Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Office 0-Day Abused in Latentbot, WingBird Attacks

A Microsoft Office 0-day vulnerability that was disclosed just days ago is already being exploited by attackers associated with malware families such as Latentbot and WingBird.

A Microsoft Office 0-day vulnerability that was disclosed just days ago is already being exploited by attackers associated with malware families such as Latentbot and WingBird.

Tracked as CVE-2017-0199, the security bug allows a malicious actor to craft a RTF (Rich Text Format) document that would download and execute a Visual Basic script containing PowerShell commands. Microsoft has already addressed the flaw, but not quick enough to prevent malware such as the Dridex banking Trojan from abusing it in attacks.

The exploit for this vulnerability was found to bypass most mitigations available before a patch was released, and could also render Protected View useless, security researchers discovered. This means that attacks leveraging the vulnerability don’t require user interaction to be successful.

The exploit leverages Office’s Object Linking and Embedding (OLE) functionality to link to an HTA (HTML Application) file hosted on a remote server. When the user opens the RTF document received via spam email, winword.exe issues a HTTP request to retrieve the malicious HTA file, which loads and executes the malicious Visual Basic script. In turn, the script downloads and executes malware.

According to FireEye, the malicious scripts used in these incidents were also observed terminating the winword.exe processes (to hide a prompt from OLE2link) and loading decoy documents.

The security researchers stumbled upon such attacks designed to distribute a newer variant of Latentbot, a highly obfuscated bot that has been active since 2013. The bot has a highly modular plugin architecture and has been also associated with the Pony infostealer.

Latentbot packs different injection mechanisms for Windows XP (x86) and Windows 7 operating systems: it uses Attrib.exe patching and Svchost code Injection on the former, but injects code into svchost.exe directly on the latter.

Another attack abusing this vulnerability consisted of two malicious stages, and distributed a variant of the dropper known as WingBird (which has similar characteristics as FinFisher). Heavily obfuscated, the malware packs several anti-analysis measures, including a custom VM to slow analysis, and was recently associated with the activities of a threat group known as NEODYMIUM.

Netskope Threat Research Labs, on the other hand, say that this Office zero-day vulnerability can also be linked to the Godzilla botnet loader. The researchers observed that the IPs related to the loader were serving payloads associated with exploits for this bug, but say that they “cannot speculate that the spam campaign and zero-day are related,” although the same attack group appears to be behind the attacks.

Office users are advised to apply the newly released patches as soon as possible, to ensure they are protected from these attacks.

Related: Dridex Attacks Exploit Recent Office 0-Day

Related: Critical Office Zero-Day Exploited in Attacks

Related: Microsoft Patches Office, IE Flaws Exploited in Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Register

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Malware & Threats

A vulnerability affecting IBM’s Aspera Faspex file transfer solution, tracked as CVE-2022-47986, has been exploited in attacks.

Cybercrime

More than 3,800 servers around the world have been compromised in recent ESXiArgs ransomware attacks, which also include an improved process.

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.