A week after details about a severe Microsoft Office vulnerability came to light, at least one criminal group is now using it to infect users.
The group is not your regular spam botnet, but a top cyber-criminal operation known to security researchers as Cobalt, a hacking outfit that has targeted banks, ATM networks, and financial institutions for the past two years.
CVE-2017-11882 used by Cobalt hacking group
According to Reversing Labs, a UK-based cyber-security firm, the Cobalt group is now spreading RTF documents to high-value targets that are laced with exploits that take advantage of CVE-2017-11882.
This is a vulnerability in the Office Equation Editor component that allows an attacker to execute code on victims' computers without user interaction.
You don't need a grizzled veteran of the infosec community to tell you that a vulnerability with such results would be incredibly valuable for any cyber-criminal organization.
Besides the damage this vulnerability can do, Cobalt's quick adoption of CVE-2017-11882 was most likely aided by the availability of four proof of concept (PoC) exploits that have been published online in the past week [1, 2, 3, 4].
According to Reversing Labs, the Cobalt is currently sending emails laced with a booby-trapped RTF file that would utilize a CVE-2017-11882 exploit to download and run additional malicious files. The infection chain would go through multiple steps, but in the end, it would download and load a malicious DLL file that has yet to be analyzed in more depth.
Proofpoint Matthew Mesa also saw the same emails, but saw a slightly different exploitation chain.
hxxps://goo[.]gl/1GEcjp
— Matthew Mesa (@mesa_matt) November 22, 2017
->https://t.co/JuObz0zwRd
->
CVE-2017-11882 -> mshta -> Powershell -> DLL -> Drops msxsl.exe and runs Jscript Backdoor (more_eggs) with it.
Likely Cobalt group/gang.
Similar Jscript payload described here:https://t.co/72Mv7ucvm8@subTee
Cobalt has jumped on Microsoft bugs before
As for the Cobalt group, they have a history of jumping on Microsoft bugs as soon as they're disclosed and weaponizing them for their campaigns. The same thing happened with CVE-2017-8759, a remote code execution vulnerability that affected the .NET Framework, patched by Microsoft in the September 2017 Patch Tuesday.
Security firms first started documenting the Cobalt group in 2016, when it was spotted hitting ATMs and financial institutions across Europe. The group then spread to targets in the Americas, and later also targeted Russian banks, using the ex-Soviet space as a testing ground for new attacks, before it moved to more wealthy targets elsewhere.
The group's most well-known malware family is Cobalt Strike, named after an eponymous commercial penetration testing software because it uses some of its components.
Patch now, before vulnerability is exploited en masse
As we've seen in the past, it doesn't take too long for a vulnerability to trickle down from professional cyber-criminal groups to spam botnet herders once public PoCs are available.
Users should apply Windows updates KB2553204, KB3162047, KB4011276, and KB4011262, included in the November 2017 Patch Tuesday, to guard against CVE-2017-11882 exploitation.
Comments
Occasional - 6 years ago
"...the Cobalt group is now spreading RTF documents to high-value targets that are laced with exploits that take advantage of CVE-2017-11882."
That's interesting; as you'd think "high-value targets" would be more likely to have vulnerability awareness/update/patching discipline, less likely to be using outdated, unsupported or otherwise more easily compromised systems.
This suggests this group has information (from phishing, public documents, social media), about their targets compiled in advance - so they can take immediate advantage of the window between initial notification and remedy (which ought to narrow as target value increases).
"...trickle down from professional cyber-criminal groups to spam botnet herders..." Yes, inevitable; and probably helps cover the tracks of the high-value target sniper teams.
Occasional - 6 years ago
Another thought: high value target vulnerability is often a result of contract workers and business partners, through their access to otherwise secure networks.