Unauthorized Coterie Exploit WPS Office Imperfection to Deploy SpyGlace Backdoor
An aligned with South Korea cyber espionage has been associated with the zero-day usage of a rectified critical remote code execution glitch in Kingsoft WPS Office to implement a custom backdoor identified as SpyGlace.
The turmoil has been connected to a menacer named APT-C-60, as per cybersecurity companies ESET and DBAPPSecurity. The strikes have been detected to afflict Chinese and East Asian users with malicious software.
The particular security imperfection is detailed as CVE-2024-7262 (CVSS score: 9.3), which originates from an absence of proper validation of user-supplied file paths. In essence, this vulnerability permits a foe to upload an arbitrary Windows library and attain remote code execution.
The flaw “allows code execution via hijacking the control flow of the WPS Office plugin component promecefpluginhost.exe,” ESET expressed, further indicating it detected another method to achieve the same outcome. The subsequent vulnerability is denoted as CVE-2024-7263 (CVSS score: 9.3).
The maneuver engineered by APT-C-60 transforms the fault into a one-click manipulation that masquerades as a deceitful spreadsheet document that was transferred to VirusTotal in February 2024.
Specifically, the document arrives embedded with a malevolent link that, upon interaction, activates a multi-stage contagion process to deploy the SpyGlace trojan, a DLL file labeled TaskControler.dll that is equipped with capabilities including file thievery, plugin loading, and command execution.
“The miscreant developers integrated an image of the spreadsheet’s rows and columns within the spreadsheet to mislead and persuade the user that the document is a standard spreadsheet,” stated security analyst Romain Dumont. “The malicious hyperlink was interlinked with the image to ensure that clicking on a cell in the image would initiate the exploitation.”
There is a belief that APT-C-60 has been functional since 2021, with the SpyGlace backdoor spotted in the wild as early as June 2022, per Beijing-based cybersecurity firm ThreatBook.
“Regardless of whether the cohort formed or procured the exploitation for CVE-2024-7262, it indeed demanded thorough exploration into the internals of the application as well as an understanding of how the Windows loading process functions,” Dumont shared.
“The manipulation is crafty in its deceptiveness to persuade any user into selecting a legitimate-looking spreadsheet while also proving immensely effective and dependable. Opting for the MHTML file format enabled the culprits to shift a code execution vulnerability into a remote one.”
The revelation arrives in tandem with the acknowledgment by the Slovak cybersecurity organization that a malevolent third-party module for the Pidgin messaging program named ScreenShareOTR (or ss-otr) enfolded code accountable for fetching subsequent-stage binary files from a command-and-control (C&C) server, ultimately culminating in the release of DarkGate malware.
“The design of the module, as presented, encompasses screen sharing employing the secure off-the-record messaging (OTR) protocol. However, besides that, the module comprises malevolent code,” ESET explained. “Particularly, certain versions of pidgin-screenshare.dll can fetch and carry out a PowerShell script from the C&C server.”
The module, which also houses keylogger and screenshot capturing functionalities, has since been eliminated from the third-party modules list. Users who have employed the module are advised to uninstall it immediately.
ESET has subsequently discovered that the same malevolent backdoor code as ScreenShareOTR has also been unearthed in an application known as Cradle (“cradle[.]im”) that claims to be an open-source derivation of the Signal messaging application. The application has been downloadable for almost a year commencing from September 2023.
The malevolent code is fetched by executing a PowerShell script, which then seizes and executes a compiled AutoIt script that ultimately installs DarkGate. The Linux variant of Cradle provides an ELF executable that fetches and executes shell commands and sends the results to a remote server.
Another shared indication is that both the module installer and the Cradle application are certified with a valid digital certificate issued to a Polish organization named “INTERREX – SP. Z O.O.,” suggesting that the perpetrators are employing diverse tactics to proliferate malware.
About Author
