Waste Wailer APT Utilizes Microsoft MHTML Vulnerability to Disseminate Atlantis Pilferer
An sophisticated and enduring menace group called Waste Wailer has been identified exploiting a recently revealed security weakness in the Microsoft MHTML web browser engine as a zero-day exploit to distribute an information thief known as Atlantis.
The cybersecurity organization Trend Micro, which noticed the operation in mid-May 2024, declared that the vulnerability – recognized as CVE-2024-38112 – was employed in a complex assault chain using specifically designed internet shortcut (URL) documents.
“Variants of the Atlantis campaign have been extremely active during the year 2024 and have transformed to utilize CVE-2024-38112 as part of Waste Wailer infection sequences,” mentioned security analysts Peter Girnus and Aliakbar Zahravi explained. “The capability of APT groups like Waste Wailer to exploit impaired services like [Internet Explorer] represents a notable danger to organizations worldwide.”
The conclusions align with former disclosures from Check Point, which informed The Hacker News of a plot leveraging the same weak point to propagate the thief. It is noteworthy that CVE-2024-38112 was rectified by Microsoft as part of the most recent Patch Tuesday updates.
CVE-2024-38112 has been characterized by the Windows creator as a falsification vulnerability in the MSHTML (aka Trident) web browser engine employed in the presently halted Internet Explorer browser. Nevertheless, the Zero Day Initiative (ZDI) has asserted that it represents a remote code execution flaw.
“What outcomes arise when the vendor claims the remedy should be a protection-in-depth upgrade instead of a complete CVE?,” raised ZDI’s Dustin Childs highlighted. “What outcomes arise when the vendor proclaims the effect as spoofing but the bug results in remote code execution?”
The assaults include the deployment of spear-phishing emails placing links to ZIP archive files stored on file-sharing platforms, which incorporate URL files that leverage CVE-2024-38112 to reroute the target to a compromised site hosting an intrusive HTML Application (HTA).
Triggering the HTA document brings about the execution of a Visual Basic Script (VBS) that, in succession, downloads and activates a PowerShell script in charge of acquiring a .NET trojan loader, which finally utilizes the Donut shellcode project to decode and run the Atlantis thief within the RegAsm.exe process memory.
Atlantis, modeled after open-source thieves like NecroStealer and PredatorTheStealer, is engineered to extract documents, screen captures, geolocation details, and confidential information from web browsers and other software, including Telegram, Steam, FileZilla, and diverse cryptocurrency wallets.
“By utilizing specially crafted URL files that enclosed the MHTML protocol handler and the x-usc! directive, Waste Wailer could obtain and operate HTML Application (HTA) files directly through the deactivated IE process,” the researchers stated.
“This approach of exploitation parallels CVE-2021-40444, another MSHTML vulnerability that was employed in unforeseen assaults.”
Limited information is accessible about Waste Wailer aside from the awareness that it has previously aimed at North American, European, and Southeast Asian territories for information theft and economic advantages.
The event coincides with Cloudflare disclosing that threat actors are swiftly incorporating evidence-of-concept (PoC) exploits into their arsenal, sometimes as swiftly as 22 minutes following their public disclosure, as evident in the situation of CVE-2024-27198.
“The speed of exploitation of disclosed CVEs is frequently quicker than the speed at which humans can craft WAF regulations or produce and deploy updates to restrict attacks,” stated the web infrastructure enterprise mentioned.
This development also follows the exposure of a fresh campaign that exploits Facebook ads promoting counterfeit Windows themes to distribute an alternative thief termed SYS01stealer that strives to seize Facebook business accounts and advance the dissemination of the malware.
“Being an info thief, SYS01 concentrates on siphoning browser data such as passwords, history, and cookies,” Trustwave expressed. “A considerable component of its payload is fixated on attaining access tokens for Facebook accounts, specifically those with Facebook business accounts, which can assist the threat actors in disseminating the malware.”
About Author
