sb-as logo
Story image

Attackers unleash Lokibot malware on unpatched Windows systems

13 Feb 2018

Cyber attackers are continuing to exploit a Microsoft vulnerability that already has patches available, putting those who are negligent about timely system patches at risk.

The CVE-2017-11882 Microsoft Office remote code vulnerability was patched in September 2017 however researchers from Trend Micro say attackers are continuing to exploit the vulnerability.

The latest attack method uses Windows installer and msiexec.exe– a different tactic to previous malware attacks that used a Windows executable mshta.exe and PowerShell to exploit the vulnerability.

In this instance the attackers use a malware spam campaign with an attachment to disperse the malware. When users click on the document, the action installs a malicious MSI package that exploits the CVE vulnerability.

That package itself is hidden inside another ‘hollowed out’ process, which means it is difficult to detect.

The msiexec.exe method of infecting computers is not often seen in most malware, although there are exceptions such as the Andromeda botnet.

“Malware has never really needed to install itself through an MSI package. Unlike most malware that use msiexec.exe, the malware we analysed does so without modifying the binary or its processes, and uses the available functionality of Windows Installer to install malware. In addition, MSI packages are typically abused for malicious purposes to install Potentially Unwanted Applications (PUA) and not by malware per se. This is a new direction for malware creators,” researchers state.

The original email itself takes the form of a fake payment confirmation email. Attached to the email is the ‘Payment copy.Doc’ file, which contains the malware.

“The email contains text written in Korean, which is roughly translated as “hello, please check if your PC may be infected by virus or malicious codes,” apparently to warn the recipient about possible infections,” researchers state.

They also say that the payload is well hidden, which means file scan engines may not be able to detect and identify it.

The analysed malware sample turned out to be the LokiBot Trojan, but the technique could also be used to deliver other malware payloads.

While researchers suspect the malware could focus on Korean targets due to the language used in the emails, but this could also represent a new evasion technique that security software doesn’t usually analyse.

Because phishing is the main way the malware is distributed, Trend Micro says organisations should implement best practices designed to combat email-based threats.

In addition, organisations could restrict or disable Windows installer on computers, or to allow only system administrators to install programs.

Story image
Kroll completes Redscan acquisition, expands cyber risk portfolio
With the addition of Redscan and its extended detection and response (XDR) enabled security operations centre (SOC) platform, Kroll expands its Kroll Responder capabilities to support a wider array of cloud and on-premise telemetry sources.More
Story image
Pandemic sees organisations of all sizes and industries invest in CTI
There is opportunity for organisations to better manage their cyber-threat intelligence for greater security and threat intelligence effectiveness by adopting the right tools and processes.More
Story image
Data transparency increasingly important, Kaspersky study states
“It is clear from the data that people have developed a sense of control and they are now demanding openness about how and where their data is being managed."More
Story image
NVIDIA takes AI into the heart of cybersecurity with Morpheus
The Morpheus application framework will provide security partners with AI-enhanced tools that can detect and prevent security threats.More
Link image
Webinar: Securing privileged access to stop attackers in their tracks
Thycotic's immersive webinar will demonstrate how attackers acquire passwords on endpoints and access critical cloud applications — without being detected.More
Story image
AvePoint brings Salesforce Cloud Backup to channel partners
The product adds to the AvePoint suite of trusted Cloud Backup for Microsoft 365 and Dynamics 365 to provide managed service providers with backup and restore capabilities across multiple, popular SaaS providers.More