While RARLabs Patched Flaw, ‘Many Users’ Don’t Appear to Have Updated the Software
Nation-state hackers are targeting a vulnerability in WinRAR, a popular Windows utility for archiving files, security experts warn, including the Russian military in attacks against Ukraine.
See Also: Challenges and Solutions in MSSP-Driven Governance, Risk, and Compliance for Growing Organizations
Google’s Threat Analysis Group, which tracks nation-state hacking campaigns, said Wednesday that “in recent weeks” it has seen “government-backed hacking groups” who hail from multiple countries, including China and Russia, targeting the bug. Vendor RARLabs issued a patch 11 weeks ago, but “many users still seem to be vulnerable.”
Nation-state groups TAG has seen exploiting the flaw include Russia’s Sandworm hacking team – a GRU military intelligence unit – that has been running a phishing campaign against the Ukrainian energy sector with a bogus PDF document that purportedly contains “a drone operator training curriculum.” Ukrainian energy infrastructure has been a main focus of Russian hackers (see: WinRAR Weaponized for Attacks on Ukrainian Public Sector).
Another phishing campaign, which TAG attributed to China, targeted Papua New Guineans with links to Dropbox that led to malware.
The vulnerability being exploited by attackers, tracked as CVE-2023-38831, centers on how the WinRAR software processes .zip files. Attackers can subvert that process so that when a user double-clicks a file to open, the user instead opens malware.
Vendor RARLabs on Aug. 2 released WinRAR version 6.23 to fix multiple vulnerabilities, including the one now being targeted by government-affiliated hackers. Also fixed was CVE-2023-40477, which allowed attackers to remotely exploit code of their choosing, provided they could trick a user into “a malicious page or open a malicious file,” according to Trend Micro’s Zero Day Initiative, which worked with ZDI researcher “goodbyeselene” to report the flaw to RARLabs.
Multiple Nation-State Campaigns
Google reports tracking at least four campaigns by advanced persistent threat groups wielding CVE-2023-38831 have been launched since news about the flaw went public, against multiple targets:
- Ukrainian energy sector: A phishing campaign attributed to Russia’s Sandworm hacking group, also known as FrozenBarents and run by the GRU military intelligence agency, used a decoy message about training drone operators that led to the payload, which was a packed version of the Rhadamanthys information-stealing malware. The off-the-shelf info stealer can steal passwords, browser credentials and more, and can be rented as a service for as little as $250 per month.
- Ukrainian government organizations: Russia’s APT28 hacking group, also known as Cozy Bear and FrozenLake, which is likely run by the GRU, launched a phishing campaign on Sept. 4 using a purported invitation to a virtual event being held by a Ukrainian public policy think tank. “The initial page redirected users to a mockbin site to perform browser checks and redirect to the next stage, which would ensure the visitor was coming from an IPv4 address in Ukraine and would prompt the user to download a file containing a CVE-2023-38831 exploit,” Google said.
- Ukrainian energy infrastructure: An APT28 attack first seen in late July, distributed via the webhook website – a free testing service – was updated in early August to also target CVE-2023-38831.
- Papua New Guinea: China-aligned APT40, which Google tracks as IslandDreams, in late August targeted victims in Papua New Guinea through phishing emails that included as attachments the exploit, a decoy PDF that was protected by a password and couldn’t be opened, plus an
.lnkfile, which was set to load the payload.dllvia a hard-coded IP address or else from a file sharing site. If successful, that led to the final stage of the attack, which aimed to install on the victim’s systems BoxRat, an in-memory backdoor for .NET that links to attackers’ botnet command-and-control network through the Dropbox API.
“The widespread exploitation of the WinRAR bug highlights that exploits for known vulnerabilities can be highly effective, despite a patch being available,” Google TAG said (see: Patching Conundrum: 5-Year-Old Flaw Again Tops Most-Hit List).
Zero-Day Attacks Targeted Traders
Hackers first began exploiting CVE-2023-38831 by April for attacks targeting financial traders, according to cybersecurity firm Group-IB. The firm said it had privately alerted RARLabs to that flaw, liaised with its developers and then waited to detail the vulnerability publicly until after the vendor had updated its software with a patch.
Given that the vulnerability was already being exploited via zero-day attacks, “we highly recommend that all users install the latest version of WinRAR,” Andrey Polovinkin, a malware analyst at Group-IB, said in an Aug. 23 blog post that first detailed the flaw. Group-IB said attackers had exploited it to gain direct access to cryptocurrency and securities traders’ accounts, leading to an unknown quantity of losses.
Multiple other attackers quickly set their sights on the flaw after Group-IB issued its warning.
“Hours after the blog post was released, proof of concepts and exploit generators were uploaded to public GitHub repositories,” Google said. “Shortly after that, TAG began to observe testing activity from both financially motivated and APT actors experimenting with CVE-2023-38831.”
Group-IB warned that in the zero-day attacks it saw, hackers were using the vulnerability to make malicious scripts appear to be legitimate file types – including .jpg and .txt files, although they could use any file format – inside compressed WinRAR folders, and the scripts installed malware such as DarkMe, GuLoader and Remcos RAT.
Warning: WinRAR Doesn’t Auto-Update
Because the WinRAR software does not include any automatic updating capability, users must manually download the software and run the installer to update it. Starting about 10 years ago, many vendors of widely used software – including operating system makers Windows and Apple, browser makers, Java and plug-in developers such as Adobe with its Flash plug-ins – began building in the ability to update such software automatically.
By 2016, experts reported that building auto-updating into many widely used pieces of software, as well as forcibly removing or blocking some older types of software, had led to a dramatic decline in the use of automated exploit kits by attackers.
“These recent campaigns exploiting the WinRAR bug underscore the importance of patching and that there is still work to be done to make it easy for users to keep their software secure and up to date,” Google TAG said.