As we speak, Microsoft revealed {that a} Mark of the Internet safety bypass vulnerability exploited by attackers as a zero-day to bypass SmartScreen safety was patched throughout the June 2024 Patch Tuesday.
SmartScreen is a safety function launched with Home windows 8 that protects customers in opposition to probably malicious software program when opening downloaded recordsdata tagged with a Mark of the Internet (MotW) label.
Whereas the vulnerability (tracked as CVE-2024-38213) may be exploited remotely by unauthenticated menace actors in low-complexity assaults, it requires consumer interplay, making profitable exploitation more durable to attain.
“An attacker who successfully exploited this vulnerability could bypass the SmartScreen user experience. An attacker must send the user a malicious file and convince them to open it,” Redmond explains in a safety advisory revealed on Tuesday.
Regardless of the elevated issue in exploiting it, Pattern Micro safety researcher Peter Girnus found that the vulnerability was being exploited within the wild in March. Girnus reported the assaults to Microsoft, who patched the flaw throughout the June 2024 Patch Tuesday. Nonetheless, the corporate forgot to incorporate the advisory with that month’s safety updates (or with July’s).
“In March 2024, Trend Micro’s Zero Day Initiative Threat Hunting team started analyzing samples connected to the activity carried out by DarkGate operators to infect users through copy-and-paste operations,” ZDI’s Head of Menace Consciousness Dustin Childs informed BleepingComputer in the present day.
“This DarkGate campaign was an update from a previous campaign in which the DarkGate operators were exploiting a zero-day vulnerability, CVE-2024-21412, which we disclosed to Microsoft earlier this year.”
Home windows SmartScreen abused in malware assaults
Within the March assaults, DarkGate malware operators exploited this Home windows SmartScreen bypass (CVE-2024-21412) to deploy malicious payloads camouflaged as installers for Apple iTunes, Notion, NVIDIA, and different official software program.
Whereas investigating the March marketing campaign, Pattern Micro’s researchers additionally seemed into SmartScreen abuse in assaults and the way recordsdata from WebDAV shares have been dealt with throughout copy-and-paste operations.
“As a result, we discovered and reported CVE-2024-38213 to Microsoft, which they patched in June. This exploit, which we’ve named copy2pwn, results in a file from a WebDAV being copied locally without Mark-of-the-Web protections,” Childs added.
CVE-2024-21412 was itself a bypass for one more Defender SmartScreen vulnerability tracked as CVE-2023-36025, exploited as a zero-day to deploy Phemedrone malware and patched throughout the November 2023 Patch Tuesday.
For the reason that begin of the 12 months, the financially motivated Water Hydra (aka DarkCasino) hacking group has additionally exploited CVE-2024-21412 to focus on inventory buying and selling Telegram channels and foreign currency trading boards with the DarkMe distant entry trojan (RAT) on New 12 months’s Eve.
Childs additionally informed BleepingComputer in April that the identical cybercrime gang exploited CVE-2024-29988Â (one other SmartScreen flaw and a CVE-2024-21412 bypass) in February malware assaults.
Moreover, as Elastic Safety Labs found, a design flaw in Home windows Sensible App Management and SmartScreen enabling attackers to launch applications with out triggering safety warnings has additionally been exploited in assaults since no less than 2018. Elastic Safety Labs reported these findings to Microsoft and was informed that this situation “may be fixed” in a future Home windows replace.
