Everyone always enjoys more email. I’m being sarcastic, of course. Most of us probably have that little counter that shows in the thousands for unread emails. Well, what if I told you email’s just got kinda worse? There is an RCE, or Remote Code Execution bug in Outlook. It’s being exploited out in the wild.
That, and we have North Korean hackers. Under the Kimsuky name that are currently also doing different kinds of attacks to evade detection. Let’s talk about that in today’s episode. Today we are facing an unprecedented array of data breaches, hacking attempts and surges in digital crime. Why is there such a widespread amount and how little is noticed in our everyday lives?
Malware, dark sites, brute forcing, zero day script kiddies, and nation state hackers are all on the rise. Learn more about the threats we face and gain a bit more knowledge than yesterday. Hey guys, welcome back to another episode of Exploit Brokers. I’m your host Exploit. If you can please do me a favor because it helps the channel grow, if you could hit that like, subscribe, and bell notification icon if you’re on YouTube.
And if you could give me a follow and a 5 star review on a podcast platform if that’s where you’re listening, if you think we deserve it, somewhere like Apple Podcasts or Spotify. With that said, let’s jump into it. So guys, I have two different articles for you, both from Bleeping Computer. The first one is, Critical RCE bug in Microsoft Outlook now exploited in attacks.
RCE is remote code execution, and Outlook is the email that most people use for enterprise. A remote code execution is pretty much just a really fancy way of saying that you’re executing code somewhere else that isn’t the local machine. And this is very valuable, to give context, this is very valuable because if you can execute a shell, if you can execute a loader or something else on a remote machine, you can essentially get a backdoor, or access to the machine.
So let’s actually jump into it. CISA warned U. S. federal agencies on Thursday to secure their systems against ongoing attacks targeting a critical Microsoft Outlook remote code execution vulnerability, CISA being one of the government agencies in the U. S. that helps other agencies determine, hey, this is where you need to know.
For critical cybersecurity and InfoSec related items. They help alerts, notifications. I’m subscribed to their emails. I get a bunch of their emails. Uh, you can go and subscribe. You can look up, uh, the CISA website and just subscribe to their notifications. Pretty cool. So, discovered by Checkpoint Vulnerability Researcher and tracked as CVE 2024 21413, the CVE was apparently discovered last year, but it’s still being actively Exploitd.
The flaw is caused by improper input validation when opening emails with malicious links using Vulnerable Outlook versions. So the fact that the article is saying vulnerable and the CVE is from 2024 makes me think that this was probably patched recently. And if you know, if you’ve been around the channel or if you’re new to the channel, welcome.
Then you know one of the things that I tend to kind of emphasize a lot is make sure you’re updating your stuff, right? Update your software, update your computers. Update your phones, just update everything because there will always be bugs and programming is somewhat the art of introducing bugs and cybersecurity is finding, and to an extent, patching bugs.
So let’s keep going. When it patched CV year ago, Microsoft also warned that the preview pane is an attack vector allowing successful exploitation, even when previewing maliciously crafted office documents. As Checkpoint explained, this security flaw, dubbed moniker link, lets threat actors bypass built in outlook protections for malicious links embedded in emails using the FILED protocol and by adding an exclamation mark to URLs pointing to attacker controlled servers.
So whenever you have a, an anchor, or a hyperlink, most of the time the protocol is something like HTTPS. File to the best of my knowledge is a resource way to look up a file locally, but like anything, right? A URL or just a universal resource locator doesn’t necessarily have to be locally. And what I’m seeing, um, if for those of you who are listening, and for those of you who are watching the video, it is file.
And then they’re using some backslashes after with an IP address and then test. Now this is probably taking advantage of the fact that even though you may be looking for a local file, there is network attached storage, there’s remote drives and different things that you can use on a windows machine that it doesn’t necessarily just have to be a locally found device to mount a volume on a machine.
The interesting part is just that, right? It’s you are kind of taking advantage of the way that it’s loading it, and the fact that they’re bypassing the read only protections is also interesting. So a long, long time ago, VBA and VBA still kind of common on some attacks. But Visual Basic was a scripting language that you could essentially throw into just different office documents, right?
Whether that’s word Excel, I believe. Microsoft Office PDF. There’s different ways you can inject that code, and if you don’t do read only, then when a specific application, like Microsoft Office, loads up the file, it’ll try to execute that piece of code. And if that piece of code is essentially trying to download some other kind of attack, or some other piece, some other module, then that’s where things get kind of crazy.
A lot of the times, or recently, a lot of softwares have introduced the read only mode. It’s been a while. And with read only mode, the idea is essentially, Hey, you can open it, but it’s going to be red. There’s no, there’s no writing. There’s no execution. Nothing’s going to happen. You’re just going to look at this.
Every time you download a file from the internet, you probably see that little banner like, Hey, this has been opened in read only mode only enable if you trust the source. And then you click enable and you can do whatever you need. Well, with the bypass here, you’re able to execute that anyways. And that’s kind of the power of this.
CVE 2024 21413 affects multiple Office products, including Microsoft Office LTSC 2021, Microsoft 365 Apps for Enterprise, Microsoft Outlook 2016, and Microsoft Office 2019. And successful CVE 2024 21413 attacks can result in the theft of NTLM credentials and the execution of arbitrary code via maliciously crafted office documents.
That is a very long winded way of saying that older Microsoft products, if, you know, you bought Outlook 2016 or the Office Suite 2016, 2019, and you haven’t updated, unfortunately, it seems like it’s time for you to update. The fact they’re stealing NTLM, which is the, I forget the exact thing, but it’s essentially Microsoft’s credentials.
Uh, one of the mechanisms that Microsoft uses for credentials, for authentication logging into Windows. Arbitrary code execution, what I was just talking about, right? If they can execute a reverse shell or they can execute something that downloads different modules and then exfiltrates data out of your machine, that’s all bad stuff, right?
You don’t want to be on the receiving end of someone’s random arbitrary code to run on your machine. It’s just not the way it is. And the bypass makes it even more likely because now. Just downloading and opening. That’s it. The protection of the read only that was hopefully there is gonna get bypassed and boom you’re pwned.
The article continues to say that CISA has essentially added it to its known exploitive vulnerabilities catalogs and under a binding operation directive BOD 2201. Which is just a federal directive saying that, hey, agencies must secure the networks within three weeks by February 27th. This is just the federal government.
Uh, as far as I’m aware, private and, you know, non profit and all that, the organizations that are not government entities don’t necessarily have to secure it. But, like anything, and like always, government is at least what you should be doing. Right? So, if you’re running a corporation, and you’re running a company, or you know someone’s running a company, You should be trying to secure your networks.
You should be trying to secure your machines, everything. The last thing you want is to have your client information stolen, your machines owned, your resources taken. You don’t want some random actor, threat actor, going through your bank account and draining it, stealing your credentials, logging in to a bunch of your stuff, taking over your crypto wallets, etc.
You updating your stuff you making sure things are up to date and you be paying attention to stuff like these like the known exploded vulnerabilities is one of the ways that you can take advantage of the government being active in this space and you can use that information to strengthen your organization or even yourself.
If you’re not an organization, then hey, if you’re using Microsoft Outlook 2016, just because this is most likely going through spear phishing campaigns, doesn’t mean that some other copycat can’t copy the same thing and just do a broad, sweeping campaign. Because ultimately, if this is being targeted to certain individuals or companies, someone’s most likely gonna just grab that and do it on a mass scale.
I believe the known unknown rule of spam is that 1 percent will click, right? So if you get a, a hundred people, one person will click. If you get a thousand, then 1%, which is roughly ten. Or it is 10, then 10 people will click and so on and so forth. So sometimes the numbers are just go and bypass as many protections as possible.
And the chances of someone clicking opening and getting owned just go up the wider, the net you cast essentially, but that’s kind of it for this one. So another bleeping computer, Kimsuky hackers use new custom RDP wrapper for remote access. So, if you’ve ever been in the commercial enterprise IT space, or maybe you’ve been on the receiving end, whenever on Windows, you try to remote into a machine, there’s generally the commonly used RDP, or Remote Desktop Protocol, and RDP is built in natively for most Windows, the Pro versions just support RDP RDP.
Out of the box, versus if you’re trying to do Mac, I believe there’s clients you can download that let you take advantage, but it’s not built into Mac, not like SSH or Telnet. The North Korean hacking group known as KomSuki was observed in recent attacks using a custom built RDP wrapper and proxy tools to directly access infected machines.
This is a sign of shifting tactics for Kimsuky, according to Anlab Security Intelligence Center, or ASEC, who discovered the campaign. ASEC said that the North Korean hackers now use a diverse set of customized remote access tools instead of relying solely on noisy backdoors like Pebble Dash, which is still used.
Kind of like Cali Linux, right? The quieter you are, the more you can hear. The problem with some of the tools that hackers use is certain tools can be very noisy on the network. Just some insight, right? For those of you who haven’t messed with Nmap, and if you’ve messed with Nmap, you probably know where I’m going with this, but Nmap is a network mapping tool, Nmap, and the problem with Nmap is depending on how you configure a scan, it can be very noisy.
You can essentially set it to be passive. Which means it’s kind of sniffing the network, trying to understand or doing very low rate of pings. There’s different things you can do and different things. And map does to try to map out the network. But if you do it quietly enough, then you should hopefully avoid detection by intrusion detection systems, blah, blah, blah.
Well. And map also has the opposite spectrum where you can make it go as noisy as you want. This is used more in like a think hack the box or just an environment that it doesn’t matter. You’re not trying to be stealthy. You’re just trying to solve a puzzle, map something. If it’s your control network or it’s your it network and you’re just trying to scan things or do whatever, you know, whatever you may want.
Then it’s okay if you go noisy, but these threat actors, because they’re there without authorization, because they’re trying to steal stuff, be stealthy, et cetera, they don’t want to be known. And some of the, some of the stuff they use like pebble dash tends to be very noisy. You can pick it up on wire shark or network scans and different things.
And pebble dash is. Kind of would stick out like a sore thumb, right? Versus RDP. Well, if you see RDP traffic, there’s a chance that there’s just tons of people already being into things. As a developer, I’ve had tons of opportunities to remote into servers, different kinds of servers, right? Think a SQL server, think a deployment server, Kimsuky’s latest attaching another subsection of the article, the latest infection chain starts with a spear phishing email that contains a malicious short link LNK file attachment, this guy’s as a PDF or word document.
So spear phishing, right? You have the idea of a widespread phishing campaign, which is just phishing, right? You send out to as many people as you can as much as possible Versus spear phishing is much more targeted. You’re hitting a specific individual or group or company, and you’re trying to take advantage of the fact that you hopefully did some recon, right?
So if you’re sending to just some fictional group in this case, then you can start to guess not only their naming conventions of their emails, right? It could be first letter, last name, first name, last letter. A combination of the two or something. Not only that, but now you have a bit more information.
You can bypass some of their filters and you can start to understand who their it is. Maybe you try to spoof. Something coming from the Chief Information Officer or whatever. Spear phishing campaigns are a bit more powerful than normal phishing campaigns because of the fact that you’re targeting a specific entity, group, or individual.
They should have more specific information. Continuing on, the emails contain the recipient’s name and correct company name suggesting that Kimsuky performed reconnaissance before the attack. Again, the more, you know, the more legitimate or believable that the email can be, if you go in saying, hi, this is it, download this, or open this, that’s going to be a lot less usable or a lot less likely to convert into infections.
Then if you get something like. Hey John, this is Blank from IT, we need you to download this because we’re rolling out a new thing, and the CEO, John, wants it done by tomorrow. Okay, now there’s already several little psychological triggers that say, oh well, they know too much about this, it’s most likely true.
And that’s not always the case, but, just depending on how much recon they’ve done. You can make it very believable. Now opening the LNK file triggers PowerShell or MMS HTA to retrieve additional payloads from an external server, including pebble dash unknown Kimsuky backdoor, providing initial system control, a modified version of the open source RDP wrapper tool.
Enabling persistent RDP access and security measure bypasses proxy tools for bypassing private network restrictions, allowing attackers to access a system, even when RDP connections are blocked, that’s kind of unload that for whenever you have an initial infection, a lot of the times you want to get a loader in or bad guys or threat actors try to get a loader in.
In this case, the LNK file is loading something else, right? It’s either loading the pebble dash, loading RDP, loading proxy tools. And the reason you want to load these in as an attacker is you need some kind of persistent access, or you need a specific kind of module, depending on how tactically they’re doing the campaign, right?
Maybe the idea is they never want the direct access, for example, something I’ve seen with a lot of threat actors is they will install something, the loader, and then they’ll install a stealer, an expo mechanism, et cetera. So maybe they never directly get on the machine themselves. They’re not already pain or connecting in, but they have some kind of command and control server and the, the info stealer, for example, will go through and look for cookies, sessions, crypto wallets.
Um, passwords, anything that it can possibly copy and exfil out to the command and control server, they would have never had to RDP or remote into the machine. The info Steelers already built in a way to kind of run by itself, right? Think semi autonomously versus here, pebble dash RDP wrapper, the proxy tools.
It’s a way for them to actually remote in and do some more manual manipulation of whatever they’re trying to do. Specifically, if you’re talking about RDP, when you RDP into a machine, It’s kind of like you’re virtually walking over to the machine and log in, you have kind of the same display or most of the times you have the same display as you would if you logged into a normal machine, or if you’re logging in locally, right, you have the desktop, you have the file Exploitr, etc.
If we’re talking about windows. So a loader to load in either a persistent access mechanism and info stealer or whatever. And the reason is that you generally don’t want a massive payload going into a victim bigger the payload, the bigger Better chance something will be either signature detected. Just someone’s going to raise, you know, why is this PNG, uh, you know, half a gigabyte or, you know, it’s just going to be more suspicious.
The smaller, the smaller, the vector, the smaller, the attack, the more likely it is to kind of pass unnoticed. And when you start talking about like bypassing protections, right? A lot of the times different things would be zipped up and you don’t want a massive thing trying to get zipped. You generally just want a loader to get zipped and then ran through that.
Now the custom RDP wrap. RDP wrapper is a legitimate open source tool designed to enable RDP or remote desktop protocol Functionality on a Windows version that does not natively support it like Windows Home again Windows Pro is what you need to have RDP kind of out of the box It’s a feature that gets an 8 again that gets enabled.
I believe Windows Home ships with a lot of the functionality of Pro It’s just not enabled Versus when you update it, at least what I’ve seen is it actually does try to download components and fill out whatever gaps it has. It act, now continuing, it acts as a middle layer, allowing users to enable remote desktop connections without modifying system files.
Kisuky’s version altered export functions to bypass antivirus detection and likely differentiates it be, differentiates its behavior enough to evade signature based detection. Whenever you’re trying to bypass antivirus, right? You have signature detection and heuristic detection. Signature detection just kind of looks at the file and says, Hey, this looks like X thing versus heuristic.
If a piece of program modifies a specific file, it accesses a specific end point, then it does something else. You can kind of create this trail of actions that this specific virus does, right? Ransomware will always try to modify files and encrypt them and just different things, right? Different pieces of software can be.
Given a signature both on the file contents itself and on the way they act signature base versus heuristic base Now the main advantage of using a custom RDP wrapper is detection evasion as RDP connections are often treated as legitimate Allowing him Suki to stay under the radar for longer. It is the goal of a threat actor or hacker To both not only get as much resources and as much information as possible, but the longer they can stay under the radar, the longer those kind of exfiltration of resources is possible.
Right? Um, I love the Cali saying, right? The quieter you are, the more you hear. Different threat actors can exist in compromised networks without anyone being the wiser. A big enough organization probably has several hundred RTP connections a day. Right? If you have an it person that’s logging into say 10 to 15 machines over the course of a day, And you have 10 people who are doing the same thing, right?
So 10 it people making 10 to 15 connections a day, you’re looking at a hundred to 150 RTP connections. And it’s not like it’s just a single packet, right? The entire session is tons of RTP packets going back and forth on the wire. Continuing moreover, it provides a more comfortable GUI based remote control compared to shell access via malware and can bypass firewalls or net restrictions via relays along RTP access from outside.
This is where I was kind of saying back to the difference between like RDP or something like SSH. RDP is a GUI based way, right? So you log in, you’re essentially sitting down at this remote computer and you open up, you get desktop, you get the GUI access, you get access to just all the nice visual representation of the way you would interact with a normal windows machine versus something like shell or telnet or SSH.
SSH being secure shell, you get a command line or a text based interface. Think PowerShell, terminal, depending on what operating system you’re kind of listening to this from that perspective, right? Shell is almost always text based. There is ways to get GUI to show up, um, alongside a shell or something like that from what I know, but I’ve never really Exploitd it.
Every time I log into a remote server, it’s either shell or RDP. ASEC reports that once Kimsuky secures their foothold on the network, they drop secondary payloads. Again. Once you have a loader, you bring something else in. In this case, it seems like the loader brings in their persistent access, and then they themselves bring in other modules as they see fit.
This includes a keylogger that captures keystrokes and stores them in text files and system directories, an infostealer, force copy, that’s the name of it, that extracts credentials saved on web browsers, and a PowerShell based reflective loader that enables in memory payload execution. Here’s the one that kind of caught my attention as a reflective loader.
So when you’re talking about cyber security, there’s tons of different subfields if you want to call it, right? It’s kind of like software engineering or programming or computer science. You have AI, you have software engineering, then software engineering goes into specific language. You have a C sharp developer versus like a Java developer versus a Ruby developer.
And then you have like a web developer and you can break up a web developer as like a react developer or an angular developer. Yeah, full stack, blah, blah, blah. There’s tons of kind of these arbitrary little division and a reflective loader folds into this arbitrary. I’m going to call it. It’s not really, but this arbitrary distinction of file forensics, file forensics is when you can go on to say a computer.
Grab the desk, grab the file system. You can look for artifacts from the attack, a reflective loader. If it’s being used the way that I think it’s being used, you can’t find anything to go and triage later, if it’s just in memory, if the payload, the malware, whatever, never touches the file system, then there’s nothing within the little ones and zeros of the disk to actually represent that data.
If the loader that they’re using just loads into Ram. Loads it in, execute whatever it needs to, and then dies off. Ram is volatile. You could do forensics on Ram, but not really. Uh, file forensics is kind of the most common way for just most normal people. Uh, I’ve heard about attacks where you can freeze Ram with like a CO2, and then you can pull them out and try to do some stuff.
Right. But forget about the really, really cool, sophisticated stuff. If you were to just grab a normal disc and pull it out, disconnected, connected, mounted, and do like a DD on Linux, then you can make a copy of that. And now you have a copy of this file system that you can then go and start to kind of take apart stuff.
It has to do with some of the technicality of file systems. Because when you delete something on a file system, it’s not deleted unless you tell it hey, write ones and zeros over the entire empty space. The pointer to the file is deleted, not the file data itself. So file forensics is kind of the specialization that lets you go and figure out how to pull files from a disk.
So I took this security course and I thought it was really cool. What ended up happening is the professor had this file system copy. That he had because he set up essentially a honeypot, a hacker broke in downloaded artifacts, blah, blah, blah. So he would give us this copy of this file system, and then we would have to go in.
We would look for either images or. Videos and we would have to extract them, right? So you would mount the file system. You would look through the different files. Okay. That wasn’t super helpful. Um, then you could go through all the data and look for like PNG markers because every file has like a header and you’d be able to go look through those and then DD that little section out.
Uh, maybe the file system was offset because you were trying to hide. A file system, maybe the file system is off by one bite or off by two bites or whatever. So you could find a way to mount that different thing. And then read through the file system. There’s a lot of cool stuff that you can do with file forensics.
But, I’m getting aside that topic for another day. The thing we’re seeing, and me and my buddy were talking about it recently. North Korea has some really sophisticated hackers. It was made known to me recently that not only do they bring in young talent, right? They bring in teenagers and train them up.
But they’re running like 12 hour days. So you have these individuals whose whole life is pretty much dedicated to Cyber espionage, cyber attacks, however you want to call it. And they’re trained up from a young age and they’re running 12 hour days consistently. They’re going to develop some really good skill.
At least you would hope that if you’re doing that much effort, you develop really good skill. And the fact that it’s North Korea doing it makes sense, right? They’re trying to get money to fund their programs, et cetera. The level of sophistication they’re doing on some stuff is like, I just don’t get it because If they have a very noisy thing, why even have that thing to begin with?
And specifically, I’m talking about their pebble dash. If it’s a very noisy initial access, why even bother with it? And then now they’re evolving to a modified open source RDP wrapper tool, which is easier to go underneath the radar because you’re talking about something that is a pretty prolific tool.
RDPs everywhere. The more effort they put into staying stealthy when they compromise networks, I think the longer they’ll be able to stay and the more of a threat they’re going to become. They’re already a pretty big threat. If you’ve been around the channel and if you haven’t again, welcome, then you know that I’ve brought up North Korea’s hackers more than once.
And they’re usually pretty active in the news. If they get stealthier, then we might end up eventually hearing more things, but they might go dark for a bit. If they get really good at going stealthy, I don’t know. Time would tell what I’m thinking is going to happen is that they’re going to keep ramping up and we’re going to suddenly hear, Hey, turns out they were in a system for over a year.
Hey, they’re in a system for over two years. And we just found out because they slipped up or someone audited the RDP or whatever. The RDP logs. And I think that’s the way we’re going to go on one part of it, right? There’s probably a dozen things that they’re also doing. I’m just talking about this specific infection, this specific campaign, but guys, this has been Cypress of all.
And this has been another episode of exploit brokers. I want to thank you for tuning in and I’ll catch you in the next one.
Note: This is a transcript of the episode.
📢 Connect with us:
Newsletter: https://follow.exploitbrokers.com
Twitter: @ExploitBrokers
Medium: https://medium.com/@exploitbrokers
TikTok: https://www.tiktok.com/@exploitbrokers
🔗 References & Sources
- Kimsuky hackers: https://www.bleepingcomputer.com/news/security/kimsuky-hackers-use-new-custom-rdp-wrapper-for-remote-access/
- RCE in Outlook: https://www.bleepingcomputer.com/news/security/critical-rce-bug-in-microsoft-outlook-now-exploited-in-attacks/
Leave a Reply