Russia’s infamous superior persistent risk group APT28 is the most recent in a rising variety of attackers making an attempt to use the “Follina” vulnerability within the Microsoft Help Diagnostic Software (MSDT) in Home windows.
Researchers from Malwarebytes this week noticed the risk actor — aka Fancy Bear and Sofacy — sending out a malicious doc with an exploit for the now-patched flaw (CVE-2022-30190) by way of phishing emails to customers in Ukraine. The doc was titled “Nuclear Terrorism A Very Actual Risk.rtf” and appeared designed to prey on fears in regards to the warfare in Ukraine spiraling right into a nuclear holocaust.
Malwarebytes recognized the contents of the doc as a Could 10 article from the Atlantic Council on the potential for Russian President Vladimir Putin to make use of nuclear weapons in Ukraine.
Customers who opened the doc ended up having a brand new model of a beforehand recognized .Web credential stealer loaded on their programs by way of the Follina exploit, which made headlines as a zero-day earlier this month. The malware is designed to steal usernames, passwords, and URLs from Chrome and Microsoft Edge browsers. It may additionally seize all saved cookies in Chrome, Malwarebytes researchers say.
Ukraine’s Pc Emergency Response Crew (CERT-UA) individually warned of the identical risk. In an advisory, it stated it had noticed APT28 utilizing the identical malicious doc that Malwarebytes reported to attempt to distribute the CredoMap credential-stealing malware to customers in Ukraine.
Accessible telemetry means that the adversary has been utilizing the doc since not less than June 10, CERT-UA says.
“The goal, and the involvement of APT28, (a division of Russian army intelligence), means that marketing campaign is part of the battle in Ukraine, or on the very least linked to the overseas coverage and army goals of the Russian state,” states Malwarebytes in a report Tuesday on the brand new exercise.
The Follina Feeding Frenzy
The Follina bug in MSDT exists in all present variations of Home windows and might be exploited by way of malicious Microsoft Workplace paperwork. To set off it, all an attacker must do is name MSDT from an Workplace app, equivalent to Phrase, utilizing the URL protocol. Attackers can exploit the flaw to achieve distant management of weak programs and take a wide range of malicious actions on them, together with executing malicious code, putting in applications, modifying knowledge, and creating new accounts.
Microsoft disclosed the flaw in late Could amid widespread zero-day exploit exercise. The corporate lastly issued a repair for the vulnerability in its Patch Tuesday set of month-to-month safety updates for June.
Malwarebytes describes the Ukrainian marketing campaign as the primary time it had noticed APT28 exploiting Follina. However quite a few different teams, together with different state-backed actors, have been actively exploiting the vulnerability in latest weeks.
Most of the assaults have focused Ukrainian entities. Earlier this month, for example, CERT-UA warned a couple of risk actor — doubtless Russia’s Sandworm APT group — utilizing a Follina exploit in a “large cyberattack” focusing on media organizations in Ukraine.
And simply this week, CERT-UA warned a couple of risk group it’s monitoring as UAC-0098, which is focusing on crucial infrastructure
amenities in Ukraine with a tax-themed doc carrying a Follina exploit. In accordance with the CERT-UA, the attackers on this marketing campaign are exploiting Follina to drop the Cobalt Strike Beacon post-compromise assault instrument on compromised programs.
Different stories of Follina-related exercise have emerged as properly, suggesting the flaw is of excessive curiosity to attackers and must be addressed rapidly. Earlier this month, Proofpoint reported that it had blocked a possible stated-backed phishing marketing campaign involving a Follina exploit that focused a handful of its clients. The phishing electronic mail masqueraded as a doc a couple of wage improve, which if opened would have resulted in a PowerShell script being downloaded to the system.
Symantec, too, has reported observing a wide range of risk actors exploiting Follina to distribute completely different malicious payloads, together with the AsyncRAT distant entry Trojan and one other unnamed malware for stealing cookies and save login knowledge from browsers equivalent to Chrome, Edge and Firefox.
