Russian Hackers Exploiting Microsoft Follina Vulnerability Against Ukraine

The Personal computer Unexpected emergency Response Staff of Ukraine (CERT-UA) has cautioned of a new set of spear-phishing attacks exploiting the “Follina” flaw in the Windows running system to deploy password-thieving malware.

Attributing the intrusions to a Russian nation-point out group tracked as APT28 (aka Fancy Bear or Sofacy), the agency stated the attacks commence with a lure document titled “Nuclear Terrorism A Pretty True Danger.rtf” that, when opened, exploits the not long ago disclosed vulnerability to download and execute a malware termed CredoMap.

Follina (CVE-2022-30190, CVSS score: 7.8), which problems a circumstance of distant code execution impacting the Windows Assistance Diagnostic Device (MSDT), was tackled by Microsoft on June 14, 2022, as section of its Patch Tuesday updates.

In accordance to an independent report published by Malwarebytes, CredoMap is a variant of the .NET-centered credential stealer that Google Menace Analysis Team divulged last month as possessing been deployed from users in Ukraine.

The malware’s key purpose is to siphon details, including passwords and saved cookies, from various well-known browsers these kinds of as Google Chrome, Microsoft Edge, and Mozilla Firefox.

“Even though ransacking browsers may well glimpse like petty theft, passwords are the vital to accessing sensitive details and intelligence,” Malwarebytes mentioned. “The concentrate on, and the involvement of APT28, a division of Russian armed service intelligence), implies that marketing campaign is a part of the conflict in Ukraine, or at the extremely minimum linked to the overseas plan and army aims of the Russian condition.”

It is not just APT28. CERT-UA has even more warned of similar attacks mounted by Sandworm and an actor dubbed UAC-0098 that leverage a Follina-centered an infection chain to deploy CrescentImp and Cobalt Strike Beacons on to focused hosts.

The progress arrives as Ukraine carries on to be a target for cyberattacks amidst the country’s ongoing war with Russia, with Armageddon hackers also noticed distributing the GammaLoad.PS1_v2 malware in May well 2022.

Located this write-up attention-grabbing? Stick to THN on Facebook, Twitter  and LinkedIn to study far more special written content we post.

Some pieces of this write-up are sourced from:
thehackernews.com