CISA has ordered U.S. federal companies to safe their techniques in opposition to a not too long ago patched Home windows MSHTML spoofing zero-day bug exploited by the Void Banshee APT hacking group.
The vulnerability (CVE-2024-43461) was disclosed throughout this month’s Patch Tuesday, and Microsoft initially labeled it as not exploited in assaults. Nevertheless, Microsoft up to date the advisory on Friday to substantiate that it had been exploited in assaults earlier than being mounted.
Microsoft revealed that attackers exploited CVE-2024-43461 earlier than July 2024 as part of an exploit chain with CVE-2024-38112, one other MSHTML spoofing bug.
“We released a fix for CVE-2024-38112 in our July 2024 security updates which broke this attack chain,” it mentioned. “Customers should both the July 2024 and September 2024 security update to fully protect themselves.”
Peter Girnus, the Pattern Micro Zero Day Initiative (ZDI) risk researcher who reported the safety flaw, instructed BleepingComputer that Void Banshee hackers exploited it in zero-day assaults to put in information-stealing malware.
The vulnerability allows distant attackers to execute arbitrary code on unpatched Home windows techniques by tricking the targets into visiting a maliciously crafted webpage or opening a malicious file.
“The specific flaw exists within the way Internet Explorer prompts the user after a file is downloaded,” the ZDI advisory explains. “A crafted file name can cause the true file extension to be hidden, misleading the user into believing that the file type is harmless. An attacker can leverage this vulnerability to execute code in the context of the current user.”
They used CVE-2024-43461 exploits to ship malicious HTA recordsdata camouflaged as PDF paperwork. To cover the .hta extension, they used 26 encoded braille whitespace characters (%E2percentA0percent80).
As revealed in July by Verify Level Analysis and Pattern Micro, the Atlantida information-stealing malware deployed in these assaults may also help steal passwords, authentication cookies, and cryptocurrency wallets from contaminated gadgets.
Void Banshee is an APT hacking group first recognized by Pattern Micro and identified for focusing on organizations throughout North America, Europe, and Southeast Asia for monetary acquire and to steal information.
Federal companies given three weeks to patch
Right now, CISA has added the MSHTML spoofing vulnerability to its Recognized Exploited Vulnerabilities catalog, tagging it as actively exploited and ordering federal companies to safe susceptible techniques inside three weeks by October 7, as mandated by Binding Operational Directive (BOD) 22-01.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” the cybersecurity company mentioned.
Though CISA’s KEV catalog primarily focuses on alerting federal companies about safety flaws they need to patch as quickly as potential, non-public organizations worldwide are additionally suggested to prioritize mitigating this vulnerability to dam ongoing assaults.
Microsoft has patched three different actively exploited zero-days within the September 2024 Patch Tuesday. This contains CVE-2024-38217, a vulnerability exploited in LNK stomping assaults since not less than 2018 to bypass the Good App Management and the Mark of the Internet (MotW) safety characteristic.
