CISA has ordered U.S. federal companies to safe their techniques towards a just lately patched Home windows MSHTML spoofing zero-day bug exploited by the Void Banshee APT hacking group.
The vulnerability (CVE-2024-43461) was disclosed throughout this month’s Patch Tuesday, and Microsoft initially labeled it as not exploited in assaults. Nevertheless, Microsoft up to date the advisory on Friday to verify that it had been exploited in assaults earlier than being mounted.
Microsoft revealed that attackers exploited CVE-2024-43461 earlier than July 2024 as part of an exploit chain with CVE-2024-38112, one other MSHTML spoofing bug.
“We launched a repair for CVE-2024-38112 in our July 2024 safety updates which broke this assault chain,” it stated. “Clients ought to each the July 2024 and September 2024 safety replace to completely defend themselves.”
Peter Girnus, the Development Micro Zero Day Initiative (ZDI) menace researcher who reported the safety flaw, advised BleepingComputer that Void Banshee hackers exploited it in zero-day assaults to put in information-stealing malware.
The vulnerability allows distant attackers to execute arbitrary code on unpatched Home windows techniques by tricking the targets into visiting a maliciously crafted webpage or opening a malicious file.
“The particular flaw exists inside the way in which Web Explorer prompts the person after a file is downloaded,” the ZDI advisory explains. “A crafted file title may cause the true file extension to be hidden, deceptive the person into believing that the file kind is innocent. An attacker can leverage this vulnerability to execute code within the context of the present person.”
They used CVE-2024-43461 exploits to ship malicious HTA recordsdata camouflaged as PDF paperwork. To cover the .hta extension, they used 26 encoded braille whitespace characters (%E2percentA0percent80).
As revealed in July by Test Level Analysis and Development Micro, the Atlantida information-stealing malware deployed in these assaults might help steal passwords, authentication cookies, and cryptocurrency wallets from contaminated units.
Void Banshee is an APT hacking group first recognized by Development Micro and identified for focusing on organizations throughout North America, Europe, and Southeast Asia for monetary acquire and to steal information.
Federal companies given three weeks to patch
As we speak, CISA has added the MSHTML spoofing vulnerability to its Identified Exploited Vulnerabilities catalog, tagging it as actively exploited and ordering federal companies to safe weak techniques inside three weeks by October 7, as mandated by Binding Operational Directive (BOD) 22-01.
“These kind of vulnerabilities are frequent assault vectors for malicious cyber actors and pose important dangers to the federal enterprise,” the cybersecurity company stated.
Though CISA’s KEV catalog primarily focuses on alerting federal companies about safety flaws they need to patch as quickly as doable, personal organizations worldwide are additionally suggested to prioritize mitigating this vulnerability to dam ongoing assaults.
Microsoft has patched three different actively exploited zero-days within the September 2024 Patch Tuesday. This contains CVE-2024-38217, a vulnerability exploited in LNK stomping assaults since no less than 2018 to bypass the Good App Management and the Mark of the Net (MotW) safety characteristic.