DarkMe Malware Targets Traders Using Microsoft SmartScreen Zero-Day Vulnerability

A freshly disclosed security flaw in the Microsoft Defender SmartScreen has been exploited as a zero-working day by an innovative persistent menace actor termed Drinking water Hydra (aka DarkCasino) targeting monetary market place traders.

Craze Micro, which started monitoring the campaign in late December 2023, stated it entails the exploitation of CVE-2024-21412, a security bypass vulnerability similar to Internet Shortcut Files (.URL).

“In this attack chain, the risk actor leveraged CVE-2024-21412 to bypass Microsoft Defender SmartScreen and infect victims with the DarkMe malware,” the cybersecurity firm said in a Tuesday report.

Microsoft, which tackled the flaw in its February Patch Tuesday update, mentioned an unauthenticated attacker could exploit the flaw by sending the targeted consumer a specially crafted file in buy to bypass displayed security checks.

Nevertheless, prosperous exploitation financial institutions on the prerequisite that the danger actor convinces the sufferer to click on on the file hyperlink to look at the attacker-controlled content material.

The an infection course of action documented by Development Micro exploits CVE-2024-21412 to fall a destructive installer file (“7z.msi”) by clicking on a booby-trapped URL (“fxbulls[.]ru”) dispersed by means of fx buying and selling community forums underneath the pretext of sharing a backlink to a stock chart picture that, in fact, is an internet shortcut file (“picture_2023-12-29.jpg.url”).

“The landing page on fxbulls[.]ru consists of a connection to a malicious WebDAV share with a filtered crafted look at,” security scientists Peter Girnus, Aliakbar Zahravi, and Simon Zuckerbraun reported.

“When people click on this backlink, the browser will question them to open the website link in Windows Explorer. This is not a security prompt, so the person may well not consider that this website link is malicious.”

The clever trick that can make this attainable is the risk actor’s abuse of the lookup: application protocol, which is made use of for calling the desktop lookup software on Windows and has been abused in the earlier to deliver malware.

The rogue internet shortcut file, for its section, details to a different internet shortcut file hosted on a remote server (“2.url”), which, in convert, details to a CMD shell script in a ZIP archive hosted on the exact server (“a2.zip/a2.cmd”).

This uncommon referencing stems from the fact that “calling a shortcut in yet another shortcut was sufficient to evade SmartScreen, which unsuccessful to adequately utilize Mark of the Web (MotW), a critical Windows ingredient that alerts customers when opening or functioning information from an untrusted source.”

The conclude aim of the campaign is to provide a Visible Primary trojan regarded as DarkMe stealthily in the history when displaying the stock graph to the target to keep up the ruse upon completion of the exploitation and an infection chain.

DarkMe comes with capabilities to down load and execute more instructions, alongside registering itself with a command-and-handle (C2) server and gathering information and facts from the compromised method.

The growth comes amid a new pattern wherever zero-days uncovered by cybercrime teams finish up having included into attack chains deployed by nation-condition hacking groups to launch advanced attacks.

“H2o Hydra possess the technological know-how and resources to find out and exploit zero-day vulnerabilities in advanced strategies, deploying very harmful malware these types of as DarkMe,” the researchers explained.

Located this write-up attention-grabbing? Adhere to us on Twitter  and LinkedIn to study extra unique articles we write-up.

Some parts of this short article are sourced from:
thehackernews.com