Microsoft Patches Zero-Day Active Since 2023

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, Microsoft and Adobe released patches, Europol pushed back against mobile encryption, Japan warned of Kimsuky attacks, the FBCS breach victim count grew, and a fraud campaign offered fake tickets to the Summer Olympics in Paris.

See Also: Supporting Malware Analysis at Scale

Microsoft’s July Patch Tuesday included security updates for 142 flaws, including two actively exploited zero-days, one of which hackers may have exploited as early as January 2023.

That flaw, tracked as CVE-2024-38112, allowed hackers to send a Windows Internet Shortcut file that would open Internet Explorer to visit a malicious website. Researchers from Check Point who discovered the flaw said attackers “could do many bad things because IE is insecure and outdated.” Microsoft long ago deprecated its former flagship browser but can’t quite seem to fully shake it off, much to the delight of hackers.

Hackers taking advantage of the flaw executed attacks in a two-step move that first directed the operating system to use IE rather than a modern browser to open the malicious file. The second trick was fooling victims into believing they opened a PDF file “while in fact, they are downloading and executing a dangerous .hta application,” Check Point said. A researcher told Dark Reading that at least two likely different threat actors have exploited the flaw to target individuals in Vietnam and Turkey. Hackers behind on campaign have been dropping an info stealer used to grab financial and credential data.

Redmond also patched CVE-2024-38080, a Hyper-V elevation of privileges vulnerability that attackers could use to gain systems privileges in the Microsoft virtual machine hypervisor.

Adobe released critical patches Tuesday addressing security defects in several enterprise products that affect Windows and macOS. The company identified seven vulnerabilities across Premiere Pro, InDesign and Adobe Bridge and urged users to install the patches immediately to prevent potential arbitrary code execution attacks.

Adobe Premiere Pro has an untrusted search path vulnerability. Adobe InDesign faces memory safety issues and Adobe Bridge is affected by integer overflow and out-of-band read vulnerabilities.

Adobe did not say whether there were any known exploits in the wild.

Europol said steps meant to ensure that Europeans don’t pay through the nose for mobile internet when crossing national borders have had the unintended side effect of making it harder to intercept criminal communications.

The police coordination agency said criminals have taken advantage of Home Routing, the policy that makes it possible for a telecom to process calls, messages and data through the customer’s domestic network rather than through the network of a foreign country.

When communications are encrypted by the telecom, police in the foreign country can’t view the traffic unless both countries have a law enforcement cooperation agreement. Police otherwise must submit a cross-border investigation order to obtain access – a process that can take up to 120 days, Europol said. Criminals have figured this out and have started using SIM cards purchased in third countries, it said.

In a position paper, Europol said that telecoms should consider routinely unencrypting Home Routing communications. Or as an alternative, it said, telecoms should make it possible for law enforcement to directly request the content of a suspect’s communications. “However, the service provider in another Member State would become aware of the person(s) of interest; operationally this might not always be desirable,” Europol said.

Japan’s Computer Emergency Response Team Coordination Center warned that North Korean Kimsuky hackers are targeting Japanese organizations. Kimsuky is an advanced persistent threat group that conducts global attacks to gather intelligence for the North Korean government.

Recent reports indicate that Kimsuky is distributing CHM malware in Korea. The malware, which is in a Microsoft proprietary format, is used for displaying HTML help pages. It executes malicious scripts to exfiltrate user information and perform keylogging. The latest malware variants employ sophisticated obfuscation to evade detection.

A breach at debt collection agency Financial Business and Consumer Solutions potentially exposed information of over 4 million individuals, according to a regulatory filing released on Monday. The Pennsylvania company initially discovered the breach in February and reported the number of affected individuals as 2 million. The breach, which occurred in February, compromised names, birthdates, Social Security numbers, driver’s license numbers and sensitive medical information.

A fraud campaign, dubbed Ticket Heist, is targeting Russian-speaking users with over 700 domains offering fake tickets for the Summer Olympics in Paris and other major events. Researchers from QuoIntelligence discovered the operation. They said some domains date back to 2022, and around 20 new domains are registered monthly.

The fake websites, which mimic legitimate ticket sellers, inflate prices to as much as 1,000 euros. The domains share the same IP address and use similar subdomains and JavaScript files. The operation also includes fake tickets for the UEFA European Championship and concerts in Russia, indicating a primary target of Russian-speaking users.

The French National Gendarmerie recently reported 338 similar scam sites.

Other Coverage From Last Week