Hackers Exploited MSHTML Flaw to Spy on Government and Defense Targets

[silversurfer]

Content source

https://thehackernews.com/2022/01/hackers-exploited-mshtml-flaw-to-spy-on.html

Cybersecurity researchers on Tuesday took the wraps off a multi-stage espionage campaign targeting high-ranking government officials overseeing national security policy and individuals in the defense industry in Western Asia.

The attack is unique as it leverages Microsoft OneDrive as a command-and-control (C2) server and is split into as many as six stages to stay as hidden as possible, Trellix — a new company created following the merger of security firms McAfee Enterprise and FireEye — said in a report shared with The Hacker News.

"This type of communication allows the malware to go unnoticed in the victims' systems since it will only connect to legitimate Microsoft domains and won't show any suspicious network traffic," Trellix explained.

"We are supremely confident that we are dealing with a very skilled actor based on how infrastructure, malware coding and operation were set up," Trellix security researcher Marc Elias said.

The infection chain begins with the execution of a Microsoft Excel file containing an exploit for the MSHTML remote code execution vulnerability (CVE-2021-40444), which is used to run a malicious binary that acts as the downloader for a third-stage malware dubbed Graphite.

Hackers Exploited MSHTML Flaw to Spy on Government and Defense Targets

Researchers uncover a new espionage campaign targeting high-ranking government officials and individuals in the defense industry in Western Asia.

thehackernews.com