DarkMe Malware Targets Traders Using Microsoft SmartScreen Zero-Day Vulnerability

A recently disclosed security flaw in the Microsoft Defender SmartScreen has been exploited as a zero-working day by an highly developed persistent danger actor called Drinking water Hydra (aka DarkCasino) focusing on economical marketplace traders.

Development Micro, which commenced monitoring the campaign in late December 2023, stated it entails the exploitation of CVE-2024-21412, a security bypass vulnerability similar to Internet Shortcut Documents (.URL).

“In this attack chain, the threat actor leveraged CVE-2024-21412 to bypass Microsoft Defender SmartScreen and infect victims with the DarkMe malware,” the cybersecurity organization reported in a Tuesday report.

Microsoft, which addressed the flaw in its February Patch Tuesday update, said an unauthenticated attacker could exploit the flaw by sending the targeted person a specifically crafted file in purchase to bypass exhibited security checks.

Nevertheless, prosperous exploitation banks on the prerequisite that the danger actor convinces the sufferer to click on the file url to see the attacker-controlled material.

The an infection process documented by Pattern Micro exploits CVE-2024-21412 to fall a destructive installer file (“7z.msi”) by clicking on a booby-trapped URL (“fxbulls[.]ru”) dispersed by using forex trading buying and selling boards underneath the pretext of sharing a connection to a inventory chart graphic that, in actuality, is an internet shortcut file (“image_2023-12-29.jpg.url”).

“The landing site on fxbulls[.]ru incorporates a website link to a destructive WebDAV share with a filtered crafted check out,” security scientists Peter Girnus, Aliakbar Zahravi, and Simon Zuckerbraun reported.

“When customers click on on this url, the browser will ask them to open up the link in Windows Explorer. This is not a security prompt, so the user may possibly not feel that this connection is malicious.”

The clever trick that would make this feasible is the menace actor’s abuse of the research: application protocol, which is applied for contacting the desktop search software on Windows and has been abused in the earlier to supply malware.

The rogue internet shortcut file, for its component, points to one more internet shortcut file hosted on a remote server (“2.url”), which, in change, details to a CMD shell script in a ZIP archive hosted on the identical server (“a2.zip/a2.cmd”).

This unconventional referencing stems from the truth that “contacting a shortcut within a different shortcut was enough to evade SmartScreen, which failed to effectively utilize Mark of the Web (MotW), a critical Windows ingredient that alerts users when opening or working information from an untrusted supply.”

The conclusion intention of the campaign is to produce a Visual Basic trojan recognised as DarkMe stealthily in the history when exhibiting the stock graph to the target to preserve up the ruse upon completion of the exploitation and an infection chain.

DarkMe arrives with abilities to download and execute more recommendations, alongside registering by itself with a command-and-control (C2) server and collecting information and facts from the compromised system.

The enhancement will come amid a new pattern exactly where zero-times observed by cybercrime groups conclude up acquiring included into attack chains deployed by nation-point out hacking groups to launch complex assaults.

“H2o Hydra have the technical information and applications to find and exploit zero-working day vulnerabilities in superior strategies, deploying remarkably destructive malware these types of as DarkMe,” the scientists claimed.

Located this write-up intriguing? Follow us on Twitter  and LinkedIn to go through extra unique material we submit.

Some parts of this article are sourced from:
thehackernews.com