Key takeaways

Cyble Research and Intelligence Labs (CRIL) has detected a phishing site masquerading as a CapCut download page. The site aims to trick users into downloading malicious software.

Threat actors (TAs) have leveraged a reputation-hijacking technique by embedding a legitimate CapCut-signed application within the malicious downloaded package, exploiting the trustworthiness of well-known apps to bypass security systems.

This campaign utilizes a recently demonstrated proof-of-concept (PoC) that repurposes the JamPlus build utility to execute malicious scripts while evading detection.

The attack unfolds in multiple stages, employing a mix of legitimate tools, fileless methods, and reputed code repositories such as GitHub to seem legitimate and effectively circumvent traditional security measures.

This campaign’s final payload is a variant of NodeStealer, designed to capture sensitive user information and exfiltrate it through a Telegram channel.

Overview

CapCut, a video editing tool developed by Bytedance, has become increasingly popular. This popularity has extended to CapCut-themed attacks, which are on the rise among TAs. These themes have been frequently used in phishing campaigns. Cyble Research & Intelligence Labs (CRIL) previously identified several phishing websites impersonating the CapCut video editor, and we have discussed these findings in our earlier blog posts. Our latest research discovers a new CapCut-themed campaign deploying stealers such as NodeStealer.

Additionally, TAs have adopted a recently identified technique of reputation hijacking with the JamPlus build utility to deliver final payloads to victims’ systems. This new tactic highlights an evolving trend in attack strategies aimed at bypassing security controls and increasing the success rate of malicious campaigns.

The initial infection occurs when a user downloads a malicious package from a CapCut phishing site. The package contains a legitimate CapCut application, JamPlus build utility, and a malicious”.lua” script. When the user runs the legitimate CapCut application, it triggers the JamPlus build utility, which then executes a malicious “.lua” script. This process utilizes reputation hijacking to mask the execution of the malicious script. This script then downloads a batch file that subsequently fetches and executes the final payload from a remote server. The TAs aim to maintain fileless payloads wherever possible.

This multi-stage process ultimately deploys a stealer payload that resembles NodeStealer. The image below provides an overview of the infection chain.

Technical Details

In this campaign, TAs trick users into downloading a malicious package disguised as a CapCut installer from a phishing site, as shown below.

When the user clicks the “Download” button on the phishing site, it initiates the download of an archive named “CapCut_{random number}_Installer” from the URL: “hxxps://www[.]dropbox[.]com/scl/fi/6se0kgmo7sbngtdf8r11x/CapCut_7376550521366298640_installer.zip?rlkey=7fxladl3fdhpne6p7buz48kcl&st=pzxtrcqc&dl=1”.

Upon extracting the downloaded archive, the user encounters what appears to be a CapCut installer; however, it is a legitimate CapCut application rather than an installer, as shown in Figure 3. The package also includes hidden files intended for malicious activities.

After revealing the hidden files, we discovered that the package contains the JamPlus build utility and a malicious “.lua” script, as shown below.

By default, launching the CapCut shortcut from the desktop runs the CapCut application located at “C:Users<User_Name>AppDataLocalCapCutAppscapcut.exe”. This “capcut.exe” file identifies the latest CapCut application version and then executes the appropriate application from the corresponding folder, as shown below.

In this campaign, TA leveraged this technique by trying to execute a renamed JamPlus build utility instead of the actual CapCut application, as shown below.

In our tests, the JamPlus utility was not executed because the file did not have the expected name, “capcut.exe,” indicating a possible error by the TA in naming the file. However, renaming the file to “capcut.exe” successfully triggers the execution of the JamPlus Build utility.

Upon successful execution, the builder reads instructions from a “. jam” file, which is configured to identify the malicious “.lua” script, as shown below.

After identifying the malicious “.lua” script, the JamPlus build utility loads the “.lua” script file, which executes a shell command, as shown in the figure below. This command employs “curl” to silently download a batch file from a remote server and save it as “C:UsersPublicsteal.bat.” It then executes the downloaded batch file.

This approach demonstrates how TAs utilized a legitimate CapCut application with JamPlus build utility to evade Smart App Control and avoid triggering security alerts.

The batch file contains multiple PowerShell commands that perform the following actions:

1. Downloads a file named “WindowSafety.bat” from a remote URL “hxxps://raw[.]githubusercontent.com/LoneNone1807/batman/main/startup” and saves it in the startup folder, ensuring it runs automatically at the next system startup.

2. Downloads a ZIP file named “Document.zip” from another remote URL “hxxps://github[.]com/LoneNone1807/batman/raw/main/Document.zip” and saves it in the public directory (C:UsersPublicDocument.zip).

3. Extracts the contents of “Document.zip” into a folder named “Document” within the public directory (“C:UsersPublicDocument”).

4. Finally, the batch script executes a Python script named “sim.py”, located in the extracted folder.

The image below shows the contents of the Python script.

The newly launched Python script retrieves base64-encoded data from a new remote server, as highlighted in the above image, decodes it, and executes the resulting payload directly in memory without saving it to disk. This payload is a Python-based information-stealing malware identified as NodeStealer.

NodeStealer

NodeStealer is a sophisticated malware that targets a wide range of sensitive data on a victim’s machine. It steals login credentials, cookies, credit card details, and autofill data from both Chromium-based and Gecko-based web browsers. Additionally, it extracts information from Facebook Ads Manager, Facebook Business accounts, and Facebook API graph pages. NodeStealer also targets browser extensions, including crypto wallets, password managers, VPNs, and gaming applications. All the collected information is then exfiltrated to the TAs via Telegram. This attack has been attributed to a threat actor operating from Vietnam.

Broader pattern of attacks

We have also identified another campaign where TAs used similar techniques to deliver RedLine Stealer. In this campaign, they employed a legitimately signed Postman application in conjunction with the JamPlus build utility. The image below shows that the malicious package includes the Postman application.

Conclusion

The successful hijacking of reputable applications and the JamPlus build utility illustrates a sophisticated method for bypassing Smart App Control without triggering security alerts. This approach significantly elevates the complexity and effectiveness of cyberattacks, complicating detection and defense efforts. The deployment of NodeStealer, which targets sensitive information from the victim’s system, highlights the growing concerns and difficulties within the cybersecurity landscape.

Recommendations

Before accessing or downloading from any site, it is essential to diligently verify the URLs.

Consider disabling or limiting the execution of scripting languages on user workstations and servers if they are not essential for legitimate purposes.

Implement comprehensive monitoring and logging to detect unusual activities associated with reputable applications.

Employ application whitelisting to ensure that only approved applications can run on systems. This helps prevent unauthorized applications from executing.

Stay updated with the latest threat intelligence and cybersecurity trends to understand new tactics and techniques used by attackers. This knowledge helps in adapting defense strategies accordingly.

Set up network-level monitoring to detect unusual activities or data exfiltration by malware. Block suspicious activities to prevent potential breaches.

MITRE ATT&CK® Techniques

Tactic 
Technique ID 
Technique Name 

Initial Access (TA0027)
Phishing (T1660)
Malware distribution via phishing site

Execution  (TA0002) 
User Execution (T1204)
The user needs to manually execute the file downloaded from the phishing site. 

Execution (TA0002)
Python (T1059.006)  
Python stealer is used for targeting Windows users 

Defense  Evasion  (TA0005)
Masquerading (T1036.008)
Downloads file disguised as a legitimate application.

Credential Access (TA0006)
Steal Web Session Cookie (T1539) 
Steals browser cookies 

Collection (TA0009)
Archive Collected Data 
(T1560) 
Stealer compresses the stolen data with  
ZIP extension.

Exfiltration(TA0010)
Exfiltration Over Web Service (T1567)
Uses Telegram channel to exfiltrate data

Indicators of Compromise (IOCs)

Indicators   
Indicator  
Type  
Description  

8e6bbe8ac1ecdd230a4dcafa981ff00663fae06f7b85b117a87917b6f04f894f
SHA256
CapCut_7376550521366298640_installer.zip

4e213bd0a127f1bb24c4c0d971c2727097b04eed9c6e62a57110d168ccc3ba10
SHA256
JamPlus Builder – POC file

56d3ba2b661e8d8dfe38bcef275547546b476c35d18aa4ec89eea73c2e2aeb7c
SHA256
Python Stealer

hxxps://raw[.]githubusercontent[.]com/LoneNone1807/batman/main/steal[.]bat
URL
Remote server

hxxps://cap-cutdownload[.]com/
URL
Phishing site

169f7d182f7838b75737c23e1b08c4b6b303d2d6a1cb73cdb87bd9644878a027
SHA256
Copyright-infringement-images.zip

References

https://www.netskope.com/blog/new-python-nodestealer-goes-beyond-facebook-credentials-now-stealing-all-browser-cookies-and-login-credentials

https://isc.sans.edu/diary/From+Highly+Obfuscated+Batch+File+to+XWorm+and+Redline/31204

https://unit42.paloaltonetworks.com/nodestealer-2-targets-facebook-business

https://www.elastic.co/security-labs/dismantling-smart-app-control

The post Reputation Hijacking with JamPlus: A Maneuver to Bypass Smart App Control (SAC) appeared first on Cyble.

Blog – Cyble – ​Read More

As most quality thoughts go, my most recent musing on security came about because of fantasy football. 

I had to log into my Yahoo Sports account, which I admittedly only ever have to log in to, at most, three times a year for the one fantasy football draft I have on that platform each year and then the handful of other times my phone logs me out during the five months that I’m adjusting my lineups on a weekly basis.  

Admittedly, I’d never thought much about the security of my Yahoo Sports account because I don’t have any sensitive information tied to it, and if someone did want to break in, they could probably do a better job of managing my team in that league than I have the past few years. It’s the old “out of sight, out of mind” compared to something like my work email account where I’m logging in every morning, or online banking which I’m using several times a week, and the knowledge that my financial wellbeing is tied to those account credentials. 

But I have to give credit to Yahoo for how they handled my account being less secure. When I logged in, probably for the first time since January, this weekend, before it would even display my homepage or enter the fantasy draft, it took me to an account management page where it warned me that I was using a “less secure” password and still hadn’t enrolled in multi-factor authentication. It took me less than a minute to update my password to something more secure, and maybe another two minutes to enroll in passcode MFA. 

The account management page also had some helpful information, such as how long it had been since my last password change, offering the ability to manage my password through a third-party app, and multiple options to set up MFA, including using the Yahoo Sports app directly (this is always more appealing to me than having to download yet another MFA app on my phone). 

This also got me thinking about the ways in which I don’t like being asked or reminded to enroll in MFA. It never made any sense to me that sites would give users the option to click away from the screen when being asked to enroll in MFA — make it mandatory or don’t. Also, one of my biggest pet peeves in using the internet is when you confirm this is a personal device or “Remember Me” for the next time I log in and the site doesn’t, in fact, remember me, and I have to go through the same approval process multiple times in the same day. 

Our friends at Cisco Duo also have a few other great recommendations for getting people to enroll in MFA, but in my opinion, mandatory enrollment is best enrollment. If I had never displayed that screen on Yahoo’s login page, I wouldn’t have even thought twice about how secure my account was. And seeing a red “!” next to my password gave off an immediate sign that my password needed to be improved, which is something I wish other sites would start doing.  

It’s not like having my fantasy football login credentials compromised would be the end of the world, but when it comes to something more high stakes, there are a few small UI steps sites could take to help nudge us in the right direction. 

The one big thing 

Threat actors are increasingly using a traditional Red Teaming tool called MacroPack to create new malware payloads. These malicious files deliver multiple payloads, including the Havoc and Brute Ratel post-exploitation frameworks and a new variant of the PhantomCore remote access trojan (RAT). Several different actors are using this tactic based on files uploaded to VirusTotal that Talos analyzed. They are written in different languages and rely on different themes centered on different geographies, which leads us to believe these are disparate campaigns.  

Why do I care? 

The threat of VBA macros has diminished since Microsoft prevented the execution of macros in Microsoft Office documents downloaded from the internet, but not all users are using the latest up-to-date Office versions and can still be vulnerable. MacroPack can generate several types of payloads packaged into different file types, including popular Office-supported formats, scripting files and shortcuts. The code generated by the framework has the following characteristics, making it more difficult to detect using file content signatures. 

So now what? 

Talos released a new Snort rule set and several ClamAV signatures to detect and block the malicious files Talos analyzed as part of this research. Our blog post also has an in-depth breakdown of the four major themes used across these malicious documents, information that could be crucial to informing potential targets about these threats.  

Top security headlines of the week 

A new report from Google’s Threat Analysis Group found that Russia’s APT29 is exploiting some of the same vulnerabilities as two popular spyware vendors. The analysis comes from watering hole attacks that researchers saw in the wild between November 2023 and July 2024 targeting Mongolian government websites. APT29, largely thought to be connected to Russia’s government, exploited the same vulnerabilities in Apple iOS WebKit and Google Chrome that two spyware vendors, Intellexa and NSO Group, are also known to use. The actor (also known as Cozy Bear and Midnight Blizzard) compromised the government-controlled websites to embed malicious payloads in hidden iframes on web pages. These iframes pointed users to attacker-controlled websites, where the exploits were deployed to steal user data from iOS and Android devices. Intellexa, which Cisco Talos has reported on several times, was recently blacklisted by the U.S. government for its role in creating and distributing the Predator spyware. And the Israeli NSO Group is infamous for its Pegasus spyware, commonly used to target at-risk individuals like journalists, politicians and activists. (Google TAG, The Record) 

A North Korean state-sponsored actor known as Citrine Sleet is actively exploiting a zero-day vulnerability in the Google Chrome web browser to steal users’ cryptocurrency. Microsoft wrote in an advisory regarding the vulnerability, identified as CVE-2024-7971, that users had been “targeted and compromised” by the zero-day attack. Google has since released a patch for the issue. CVE-2024-7971 is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine that could allow an attacker to execute remote code on the targeted machine. Citrine Sleet is believed to be based in North Korea and primarily targets financial institutions, especially those that manage cryptocurrency accounts. Its social engineering techniques focus on the cryptocurrency industry and individuals believed to be associated with it. Exploitation of the vulnerability started by tricking a victim into visiting an attacker-controlled website. Then, because of a different vulnerability in the Windows kernel, Citrine Sleet could install a rootkit on the target’s computer, essentially giving them complete control of the machine. Cryptocurrency has long been a target for North Korean state-sponsored actors, who often use the stolen currency to fund the country’s military operations. (TechCrunch, Decipher) 

The FBI released a new warning this week that North Korean actors could soon launch a wave of cyber attacks targeting “organizations with access to large quantities of cryptocurrency-related assets or products.” A public service announcement released Tuesday said that actors had been carrying out reconnaissance-related social engineering campaigns for months targeting individuals believed to be involved in the cryptocurrency industry, or employees of financial institutions who handle virtual currency. Most of the potential targets are found by the actors by monitoring their social media activity, particularly on professional networking or employment-related platforms. These actors also are impersonating legitimate employees, looking to gain remote employment at these companies using fake names, identities and profiles. “Given the scale and persistence of this malicious activity, even those well versed in cybersecurity practices can be vulnerable to North Korea’s determination to compromise networks connected to cryptocurrency assets,” the PSA reads. (Dark Reading, FBI) 

Can’t get enough Talos? 

Vulnerabilities in Microsoft apps for macOS allow stealing permissions BlackByte ransomware group targets VMware ESXi bug Cisco: BlackByte ransomware gang only posting 20% to 30% of successful attacks Bug Leaves Microsoft Apps for MacOS Open to Silent Takeovers 

Upcoming events where you can find Talos 

LABScon (Sept. 18 – 21)  

Scottsdale, Arizona 

VB2024 (Oct. 2 – 4) 

Dublin, Ireland 

Most prevalent malware files from Talos telemetry over the past week 

SHA 256: 0e2263d4f239a5c39960ffa6b6b688faa7fc3075e130fe0d4599d5b95ef20647 
MD5: bbcf7a68f4164a9f5f5cb2d9f30d9790 
Typical Filename: bbcf7a68f4164a9f5f5cb2d9f30d9790.vir 
Claimed Product: N/A 
Detection Name: Win.Dropper.Scar::1201 

SHA 256: 5e537dee6d7478cba56ebbcc7a695cae2609010a897d766ff578a4260c2ac9cf 
MD5: 2cfc15cb15acc1ff2b2da65c790d7551 
Typical Filename: rcx4d83.tmp 
Claimed Product: N/A   
Detection Name: Win.Dropper.Pykspa::tpd 

SHA 256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91  
MD5: 7bdbd180c081fa63ca94f9c22c457376 
Typical Filename: c0dwjdi6a.dll 
Claimed Product: N/A  
Detection Name: Trojan.GenericKD.33515991 

SHA 256: c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0  
MD5: 8c69830a50fb85d8a794fa46643493b2  
Typical Filename: AAct.exe  
Claimed Product: N/A   
Detection Name: PUA.Win.Dropper.Generic::1201 

SHA 256: 161937ed1502c491748d055287898dd37af96405aeff48c2500b834f6739e72d 
MD5: fd743b55d530e0468805de0e83758fe9 
Typical Filename: KMSAuto Net.exe 
Claimed Product: KMSAuto Net 
Detection Name: W32.File.MalParent 

Cisco Talos Blog – ​Read More

Key takeaways 

The Head Mare hacktivist group targets Russian and Belarusian organizations, linking their cyberattacks to geopolitical tensions with Ukraine. 

Head Mare’s attacks on Russia and Belarus are strategic, aiming to influence political and economic stability in these countries and support its own objectives. 

The group uses sophisticated phishing and ransomware attacks, exploiting vulnerabilities like CVE-2023-38831 in WinRAR and ransomware strains like LockBit and Babuk. 

Head Mare’s cyber operations align with the Russo-Ukrainian conflict, applying pressure on Russia and Belarus to distract from Ukraine’s military actions. 

The group employs advanced techniques for persistence and evasion, disguising malware and using sophisticated tools to control compromised systems. 

Head Mare uses the Sliver framework to manage compromised systems, ensuring their command-and-control infrastructure is resilient. 

Tools like Mimikatz are used to extract credentials, enhancing their control over targeted networks. 

Overview 

The Head Mare hacktivist group has emerged as a formidable digital adversary in today’s geopolitical conflicts. First reported in 2023 on X (previously Twitter), Head Mare has targeted Russian and Belarusian organizations. The group’s actions are not merely technical intrusions but are deeply entwined with the broader political tensions between these countries and their neighbors, particularly in the context of the ongoing Russo-Ukrainian conflict. 

Head Mare’s focus on Russian and Belarusian entities is a strategic choice rather than a coincidence. By targeting organizations within these nations, Head Mare aligns its cyber operations with the geopolitical friction between Russia, Belarus, and Ukraine. This approach reflects a deliberate attempt to influence the political and economic stability of these countries through cyber means, thus amplifying the existing geopolitical tensions. 

The group’s operations include deploying sophisticated phishing campaigns and ransomware attacks. By exploiting vulnerabilities like CVE-2023-38831 in WinRAR and utilizing ransomware strains such as LockBit and Babuk, Head Mare aims to destabilize key organizations within Russia and Belarus.  

The Geopolitical Angle of Head Mare’s Activities 

The geopolitical implications of Head Mare’s activities are evident in their choice of targets and methods. By focusing on Russian and Belarusian organizations, Head Mare is engaging in a form of cyber warfare that complements the broader Russo-Ukrainian conflict. The group’s attacks are likely intended to support Ukraine’s strategic objectives by applying additional pressure on Russia and Belarus. 

The Russian military’s struggles, especially following Ukraine’s recent offensive into Kursk, have heightened the need for strategic distractions. President Vladimir Putin has used Belarus to create a diversion, hoping that the buildup of Belarusian troops near the Ukrainian border would draw Ukrainian forces away from their offensive operations. Head Mare’s attacks fit into this geopolitical maneuvering by amplifying the pressure on Russia and Belarus. 

The situation on the ground further illustrates the intertwining of cyber operations and geopolitical strategy. In August, Belarusian President Alyaksandr Lukashenka announced the deployment of a significant portion of Belarus’s army to the Ukrainian border, citing concerns over a potential Ukrainian offensive. Lukashenka claimed this move was a response to a perceived build-up of Ukrainian troops, which he attributed to a misunderstanding of Belarus’s preparations for Independence Day celebrations. 

Despite the official narrative, Lukashenka’s actions are likely influenced by Moscow’s broader strategy. The Belarusian leader’s military deployment aligns with Putin’s attempt to create a strategic diversion. However, Belarus’s involvement in the conflict remains complex.  

Lukashenka’s regime is heavily dependent on Russian support, yet Belarusian society shows limited enthusiasm for direct involvement in the war against Ukraine. This lack of domestic support, combined with Lukashenka’s precarious political position, suggests that a full-scale Belarusian invasion of Ukraine remains unlikely. 

Technical Sophistication and Strategic Intent 

Head Mare’s cyber tactics reflect both technical sophistication and strategic intent. The group employs advanced phishing techniques to exploit vulnerabilities in widely used software, such as WinRAR. By deploying multiple malware types, Head Mare establishes a foothold in targeted systems, enabling further attacks and data collection. 

Persistence techniques are another hallmark of Head Mare’s operations. By adding malware samples to the Windows Run registry key or creating scheduled tasks, the group ensures that their malware remains active and continues to transmit data to their command-and-control servers. These methods not only enhance the group’s operational longevity but also contribute to the ongoing disruption. 

Detection evasion is a critical component of Head Mare’s strategy. The group disguises its malware as legitimate software, using deceptive filenames to bypass traditional security measures. This approach allows them to maintain a low profile while exerting a significant influence over compromised systems. 

Command and Control Infrastructure and Credential Theft 

Head Mare utilizes the Sliver framework for managing compromised systems, demonstrating a high level of sophistication in its cyber operations. Sliver enables the group to execute commands, manage connections, and navigate network restrictions effectively. By disguising its Sliver implants and using VPS/VDS servers, Head Mare ensures that its command-and-control infrastructure remains resilient and challenging to dismantle. 

Credential theft is another crucial aspect of Head Mare’s strategy. Tools like Mimikatz and XenArmor All-In-One Password Recovery Pro3 facilitate the extraction of credentials from compromised systems. This capability allows Head Mare to escalate their access and maintain control over targeted networks, amplifying their disruptive impact. 

Head Mare’s use of ransomware, including LockBit and Babuk, highlights their intent to cause maximum disruption. LockBit targets Windows systems, while Babuk is designed for ESXi servers. The encryption of files and the demand for ransoms serve both financial and operational purposes. By employing multiple ransomware variants and encrypting files twice, Head Mare increases the complexity of recovery and intensifies the pressure on victims to comply with their demands. 

Conclusion 

Head Mare’s cyber operations illustrate the evolving nature of cyber threats and their intersection with geopolitics. By targeting organizations in Russia and Belarus with sophisticated phishing and ransomware attacks, the group leverages its technical capabilities to influence political outcomes and create disruption.  

Head Mare’s operations are a reflection of the broader geopolitical dynamics at play, with their cyber tactics serving as a means to exert political pressure and shape public perceptions. As the conflict between Russia and Ukraine continues to unfold, the role of cyber actors like Head Mare will likely remain an influential factor in international relations and security. 

Recommendations and Mitigation 

To counteract the threats posed by Head Mare and similar actors, organizations should implement the following best practices: 

Continuously scan for vulnerabilities and apply patches promptly to mitigate the risk of exploitation. 

Maintain encrypted backups in isolated locations to safeguard against ransomware attacks. 

Use EDR solutions to detect and respond to malicious activities in real time. 

Educate employees on recognizing and avoiding phishing attempts and other cyber threats. 

Keep systems and software up to date with the latest security patches to reduce vulnerabilities. 

Indicators of Compromise (IOCs) 

Indicator  
Type of Indicator  
Comments  

201F8DD57BCE6FD70A0E1242B07A17F489C5F873278475AF2EAF82A751C24FA8  
SHA-256  
NA  

9F5B780C3BD739920716397547A8C0E152F51976229836E7442CF7F83ACFDC69  
SHA-256  
NA  

08DC76D561BA2F707DA534C455495A13B52F65427636C771D445DE9B10293470  
SHA-256  
NA  

6A889F52AF3D94E3F340AFE63615AF4176AB9B0B248490274B10F96BA4EDB263  
SHA-256  
NA  

33786D781D9C492E17C56DC5FAE5350B94E9722830D697C3CBD74098EA891E5A  
SHA-256  
NA  

5D924A9AB2774120C4D45A386272287997FD7E6708BE47FB93A4CAD271F32A03  
SHA-256  
NA  

9B005340E716C6812A12396BCD4624B8CFB06835F88479FA6CFDE6861015C9E0  
SHA-256  
NA  

5A3C5C165D0070304FE2D2A5371F5F6FDD1B5C964EA4F9D41A672382991499C9  
SHA-256  
NA  

DC3E4A549E3B95614DEE580F73A63D75272D0FBA8CA1AD6E93D99E44B9F95CAA  
SHA-256  
NA  

053BA35452EE2EA5DCA9DF9E337A3F307374462077A731E53E6CC62EB82517BD  
SHA-256  
NA  

2F9B3C29ABD674ED8C3411268C35E96B4F5A30FABE1AE2E8765A82291DB8F921  
SHA-256  
NA  

015A6855E016E07EE1525BFB6510050443AD5482039143F4986C0E2AB8638343  
SHA-256  
NA  

9D056138CFB8FF80B0AA53F187D5A576705BD7954D36066EBBBF34A44326C546  
SHA-256  
NA  

22898920DF011F48F81E27546FECE06A4D84BCE9CDE9F8099AA6A067513191F3  
SHA-256  
NA  

2F1EE997A75F17303ACC1D5A796C26F939EB63871271F0AD9761CDBD592E7569  
SHA-256  
NA  

AF5A650BF2B3A211C39DCDCAB5F6A5E0F3AF72E25252E6C0A66595F4B4377F0F  
SHA-256  
NA  

9E9FABBA5790D4843D2E5B027BA7AF148B9F6E7FCDE3FB6BDDC661DBA9CCB836  
SHA-256  
NA  

B8447EF3F429DAE0AC69C38C18E8BDBFD82170E396200579B6B0EFF4C8B9A984  
SHA-256  
NA  

92804FAAAB2175DC501D73E814663058C78C0A042675A8937266357BCFB96C50  
SHA-256  
NA  

664B68F2D9F553CC1ACFB370BCFA2CCF5DE78A11697365CF8646704646E89A38  
SHA-256  
NA  

311EDF744C2E90D7BFC550C893478F43D1D7977694D5DCECF219795F3EB99B86  
SHA-256  
NA  

4C218953296131D0A8E67D70AEEA8FA5AE04FD52F43F8F917145F2EE19F30271  
SHA-256  
NA  

2D3DB0FF10EDD28EE75B7CF39FCF42E9DD51A6867EB5962E8DC1A51D6A5BAC50  
SHA-256  
NA  

DC47D49D63737D12D92FBC74907CD3277739C6C4F00AAA7C7EB561E7342ED65E  
SHA-256  
NA  

EDA18761F3F6822C13CD7BEAE5AF2ED77A9B4F1DC7A71DF6AB715E7949B8C78B  
SHA-256  
NA  

188.127.237[.]46  
IP  
NA  

45.87.246[.]169  
IP  
NA  

45.87.245[.]30  
IP  
NA  

185.80.91[.]107  
IP  
NA  

188.127.227[.]201  
IP  
NA  

5.252.176[.]47  
IP  
NA  

45.11.27[.]232  
IP  
NA  

188.127.237[.]46/winlog.exe  
URL  
NA  

188.127.237[.]46/servicedll.exe  
URL  
NA  

194.87.210[.]134/gringo/splhost.exe  
URL  
NA  

194.87.210[.]134/gringo/srvhost.exe  
URL  
NA  

94.131.113[.]79/splhost.exe  
URL  
NA  

94.131.113[.]79/resolver.exe  
URL  
NA  

45.156.21[.]178/dlldriver.exe  
URL  
NA  

5.252.176[.]77/ngrok.exe  
URL  
NA  

5.252.176[.]77/sherlock.ps1  
URL  
NA  

5.252.176[.]77/sysm.elf  
URL  
NA  

5.252.176[.]77/servicedll.rar  
URL  
NA  

5.252.176[.]77/reverse.exe  
URL  
NA  

5.252.176[.]77/soft_knitting.exe  
URL  
NA  

5.252.176[.]77/legislative_cousin.exe  
URL  
NA  

5.252.176[.]77/2000×2000.php  
URL  
NA  

Sources:  

https://jamestown.org/program/developments-on-belarus-ukraine-border-prompt-roller-coaster-of-reactions-in-minsk/ 

https://kyivindependent.com/belarus-moved-third-of-its-army-to-ukraine-border-due-to-independence-day-celebration-mixup-lukashenko-claims/ 

https://www.atlanticcouncil.org/blogs/ukrainealert/putin-hopes-belarus-border-bluff-can-disrupt-ukraines-invasion-of-russia/ 

https://www.aljazeera.com/news/2024/8/18/belarus-says-ukraine-amassing-troops-at-border-amid-incursion-into-russia 

The post The Rise of Head Mare: A Geopolitical and Cybersecurity Analysis  appeared first on Cyble.

Blog – Cyble – ​Read More

Certain versions of WeChat, a popular messaging app created by tech giant Tencent, contain a type confusion vulnerability that could allow an adversary to execute remote code. While this issue, CVE-2023-3420, was disclosed and patched in the V8 engine in June 2023, the WeChat Webview component was not updated, and still remained vulnerable when Talos reported to the vendor in April 2024.  Cisco Talos researchers have confirmed that WeChat versions up to 8.0.42 (the latest version on the Google Play store for Android devices before June 14, 2024) were vulnerable to this issue. However, due to the dynamic WebView loading mechanism, Talos cannot confirm if it’s patched on all versions. Talos reported the vulnerability to Tencent WeChat on April 30, 2024, and continued our investigation in the following weeks and months. 

Vulnerability overview 

WeChat is an instant messenger application with a large user base in China. It also offers users the ability to pay for certain products through the app and includes several functionalities similar to other social media platforms like Facebook and X. 

During Cisco Talos’ research of WeChat, we uncovered that it employs a custom WebView component instead of relying on the built-in Android WebView. This component is a custom version of XWalk, maintained by Tencent, which consists of an embedded Chromium browser with V8 version 8.6.365.13 released on Oct. 12, 2020, supporting the rendering of HTML and the execution of JavaScript. 

The custom WebView component is dynamically downloaded onto the phone after the user logs into the app for the first time, allowing Tencent to deploy dynamic updates. When downloaded, XWalk webview is located at the path `/data/data/com.tencent.mm/app_xwalk_4433/apk/base.apk`. The library at /data/data/com.tencent.mm/app_xwalk_4433/extracted_xwalkcore/libxwebcore.so contains an embedded browser environment with an outdated version of V8.  

GitHub Security Labs published detailed analysis of this vulnerability, CVE-2023-3420, for V8 version 11.4.183.19 in June 2023.      

How can the exploit be triggered? 

The exploit, which we have seen in the wild,  is triggered when the victim clicks a URL in a malicious WeChat message. Clicking a URL in WeChat causes the webpage with embedded JavaScript to be loaded inside XWalk, which triggers exploitation. A so called one-click exploit. 

What is the impact of this vulnerability? 

The exploit allows the threat actor to gain control of the victim’s device and execute arbitrary code. 

CVSSv3 Score: 8.8 – CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H  

How do I know if I’m impacted? 

Talos has confirmed the WeChat version 8.0.42 (the latest version available on the Play Store before June 14) is impacted. For WeChat using the impacted custom browser (MMWEBID/2247), the user agent of request includes the version information of the custom browser. For example: 

Mozilla/5.0 (Linux; Android 14; Pixel 6 Build/UQ1A.240105.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/86.0.4240.99 XWEB/4433 MMWEBSDK/20230805 Mobile Safari/537.36 MMWEBID/2247 MicroMessenger/8.0.42.2428(0x28002A48) WeChat/arm64 Weixin GPVersion/1 NetType/4G Language/en ABI/arm64  

What do I do if I’m impacted? 

Update to the latest version of WeChat and confirm XWalk is updated as well (in our testing, the app does not get updated to the latest version automatically right after the update is released). Alternatively, do not click on any links sent over WeChat if using the impacted versions. If you must read links, copy the link from the WeChat chat and open them on an updated web browser outside the application. We recommend WeChat users be aware of the URL links sent in WeChat. Before clicking the URL links, verify it’s from a trusted source.  

Bug report Timeline 

April 30, 2024: Disclosed to vendor while research was ongoing. May 31, 2024: Tencent acknowledges report and confirms they know about the vulnerability and are working on patching it. June 14, 2024: New version of WeChat 8.0.48 released on Play Store. However, the app on our testing device did not get automatically updated.  June 27, 2024: Notified Vendor of our intention to publish. 

Credit 

Chi En Shen (Ashley Shen), Vitor Ventura, Michael Gentile and Aleksandar Nikolic of Cisco Talos.  

Cisco Talos Blog – ​Read More