Table of Contents

Cybersecurity Incidents

• Krypton Alert: DragonForce Targets New York Logistics Company
  

• Patched Vulnerability in Microsoft Outlook Used in New C2 Beacon Exploit
  
• Threat Actors Deploy New Malware Capable of Disabling EDR Security Software

Recommendations

NMFTA On The Road

Industry News

#NMFTACyber On Demand

Patched Vulnerability in Microsoft Outlook Used in New C2 Beacon Exploit

A new red team, post-exploitation framework known as “Specula” was found to be able to utilize the patched exploit of a vulnerability tracked as CVE-2017-11774 to infiltrate Microsoft Outlook, and convert it into a command-and-control (C2) beacon to execute malicious code on affected computers. The exploit CVE-2017-11774 was patched on 10 October 2017 as a security feature bypass vulnerability affecting Microsoft Outlook. The vulnerability was exposed in the file-sharing capability of Microsoft Outlook wherein an attacker could create a document file that contained malicious code, and upon a victim's interaction with the file would allow malware into the targeted system. Before it was patched, CVE-2017-11774 was used to target multiple US government agencies in attacks attributed to APT33, an Iranian-sponsored cyber espionage and hacktivist group.

While the flaw has been patched, an attacker can still exploit the vulnerability through an alternative method by creating their own Outlook home page using Windows Registry values. Specula runs in Outlook's context and can set up a custom Outlook home page via registry keys that call out to an interactive Python web server. Windows registry keys contain information and settings for the hardware and software on a computer. The non-privileged threat actor can set a URL target in Outlook’s WebView registry linked to an external website under the threat actor's control. The affected devices must be compromised to configure the Outlook registry, but once done Outlook will download and display that URL page instead of the normal mailbox element. Once the page is interacted with a threat actor is granted control of the affected device as a C2 beacon. The threat actor can then execute malicious code, establish persistence, and laterally move in an affected system.

This particular method involving exploiting already-patched vulnerabilities has not been verifiably identified in use by any threat actors. However, CVE-2017-11774 exposes that even if a vulnerability has been patched, the secondary effects or unknown aspects of the vulnerability can be identified and exploited later and demonstrates that identified vulnerabilities have long lasting effects on cyber security. Even though the vulnerability was patched seven years ago, it still has applicable uses today. CVE-2017-11774 poses a major threat to any organization that utilizes Microsoft Outlook. While the vulnerability requires a victim to interact with an unknown file, the system beyond the one affected device can be exploited once done for any manner of cyber attacks. 

Threat Actors Deploy New Malware Capable of Disabling EDR Security Software

Analysts have identified a new malware strain that the ransomware group RansomHub is developing to disable Endpoint Detection and Response (EDR) security software and execute Bring Your Own Vulnerable Driver (BYOVD) attacks. The malware, known as EDRKillShifter, infects a system after a threat actor launches the malware with a password string to decrypt, and execute an embedded resource identified as BIN. Upon decryption the payload is unpacked and executed, which drops the vulnerable driver, deactivating EDR security. To maintain persistence the malware enters a loop of continuously running and terminating processes to avoid detection. Analysts note that this malware has yet to be successfully executed in a system and is still being developed.

Threat actors utilize these kinds of attacks to bypass security by loading a vulnerable, but legitimate, driver into a system to blind security controls. Drivers run on the most privileged operating level, which grants them access to the most critical resources in a system. Through this, a threat actor can disable security controls and take control of a system. Threat actors often utilize vulnerabilities in drivers to exploit a system and avoid detection. However, a BYOVD attack loads a vulnerable driver to further an attack.

BYOVD attacks are popular with all kinds of threat actors, and have been regularly observed in use by ransomware groups. Given that RansomHub is developing the EDRKillShifter malware, it will likely be specifically developed for use in ransomware attacks. Many ransomware groups develop and utilize their own personal malwares, EDRKillShifter has been developed to execute personalized malwares as part of its payload, giving it broad applicability across threat actor groups. The EDRKillShifter malware offers a diversity of use beyond ransomware, as it can deliver various payloads depending upon the threat actor's specifications. Versions of this malware have already been observed in use by multiple different groups since May 2024, accelerating its development and diversity.

EDRKillShifter offers threat actors another versatile tool, broadening available attack surfaces in the cyber security landscape. Due to the technically difficult execution process related to the malware, it is likely to be mainly utilized by experienced threat actors. As this malware continues to be tested in attacks on vulnerable systems, focus on driver security, maintaining admin privilege separation of internal systems, and updating software regularly can create hurdles for threat actors to overcome and can hinder further EDRKillShifter development.