USCYBERCOM published an alert that hackers were exploiting the CVE-2017-11774 Microsoft Outlook Security Vulnerability to deliver malware using an HTTPS domain.
Microsoft already patched the vulnerability in 2017 and the USCYBERCOM alert refers to the ongoing campaign that exploiting CVE-2017-11774. Users are advised to ensure that they have patched the vulnerability.
USCYBERCOM shared a number of malware samples through Virustotal, and the malware delivered using the domain customermgmt[.]net.
The patched vulnerability resides in how the outlook handles the objects in memory, successful exploitation of the vulnerability allows an attacker to execute arbitrary commands on the vulnerable machine.
In December 2018 FireEye reported that Iran based hacker group APT33 exploiting the vulnerability using stolen credentials and RULER’s module. The campaign targets government agencies and financial, retail, media, and education sectors.
“The executables uploaded by CyberCom appear to be related to Shamoon2 activity, which took place around January of 2017. These executables are both downloaders that utilize PowerShell to load the PUPY RAT. Additionally, CyberCom uploaded three tools likely used for the manipulation and of exploited web servers,” said Brandon Levene, head of applied intelligence at Chronicle.
“Each tool has a slightly different purpose, but there is a clear capability on the part of the attacker to interact with servers they may have compromised. If the observation of CVE-2017-11774 holds true.”
APT33 is an Iranian based group, known for explicitly targeting corporate networks, and it compromised around 50 organizations in different countries since 2015.
Indicator of Compromise
