An Internet Explorer zero-day vulnerability has been discovered used in recent North Korean attacks against security and vulnerability researchers.
Last month, Google disclosed that the North Korean state-sponsored hacking group known as Lazarus was conducting social engineering attacks against security researchers.
To perform their attacks, the threat actors created elaborate online ‘security researcher’ personas that would then use social media to contact well-known security researchers to collaborate on vulnerability and exploit development.
As part of this collaboration, the attackers sent malicious Visual Studio Projects and links to websites hosting exploit kits that would install backdoors on the researcher’s computers.
Internet Explorer zero-day used in attacks
Today, South Korean cybersecurity firm ENKI reported that Lazarus targeted security researchers on their team with MHTML files in this social engineering campaign.
While they state that the attacks failed, they analyzed the payloads downloaded by the MHT file and discovered it contained an exploit for an Internet Explorer zero-day vulnerability.
An MHT/MHTML file, otherwise known as MIME HTML, is a special file format used by Internet Explorer to store a web page and its resources in a single archive file.
The MHT file sent to ENKI researchers contained what was allegedly a Chrome 85 RCE exploit and was named ‘Chrome_85_RCE_Full_Exploit_Code.mht.’
This exploit abuses a double-free bug in IE 11, allowing the attackers to upload a list of the running process, screen captures, and network information to their command and control server. It would then download and execute additional malicious code from the C2 server to be executed.
ENKI told BleepingComputer that they have reported the bug to Microsoft and were later contacted by a Microsoft employee requesting more information.
Acros CEO and 0patch co-founder Mitja Kolsek told BleepingComputer that he was able to reproduce the Internet Explorer zero-day PoC reported by ENKI.
Based on tweets from other security researchers, ENKI told BleepingComputer that they believe other researchers know of this IE 11 zero-day.
— b0ring (@dnpushme) February 4, 2021
Microsoft told BleepingComputer that they investigate every report and will provide an update in the future.
“Microsoft has a customer commitment to investigate reported security issues and we will provide updates for impacted devices as soon as possible.”- a Microsoft spokesperson.
Is your business effected by Cyber Crime?
If a cyber crime or cyber attack happens to you, you need to respond quickly. Cyber crime in its several formats such as online identity theft, financial fraud, stalking, bullying, hacking, e-mail fraud, email spoofing, invoice fraud, email scams, banking scam, CEO fraud. Cyber fraud can lead to major disruption and financial disasters. Contact Digitpol’s hotlines or respond to us online.
Digitpol’s Cyber Crime Investigation Unit provides investigative support to victims of cyber crimes. Digitpol is available 24/7. https://digitpol.com/cybercrime-investigation/
UK +44 20 8089 9944