Void Banshee group utilizing patched zero-day to execute infostealer – Cyber Tech

Superior persistent menace (APT) group Void Banshee was noticed utilizing a just lately patched zero-day to entry and execute recordsdata by means of a disabled Web Explorer (IE) browser utilizing MHTML, a browser engine that renders net pages incessantly related to IE.

In a July 15 weblog publish, Development Micro researchers reported that the zero-day was getting used to contaminate sufferer machines with the Atlantida infostealer, which pilfers system data and delicate information resembling passwords and cookies from numerous functions.

The researchers mentioned Void Banshee lures victims utilizing a zipper archives that incorporates malicious recordsdata disguised as ebook PDFs. The PDFs have then been disseminated on cloud-sharing web sites, Discord servers, and on-line libraries in North America, Europe, and Southeast Asia.

Callie Guenther, senior supervisor of cyber menace analysis, defined that CVE-2024-38112 permits for a spoofing assault, the place an attacker can craft a malicious MHTML file that, when opened by the sufferer, might execute arbitrary code.

Guenther, an SC Media columnist, mentioned the assault begins with a malicious MHTML file, typically disguised as a respectable web shortcut file. By opening this file, the consumer inadvertently triggers the vulnerability, permitting the attacker to execute malicious scripts. Though Microsoft addressed this vulnerability in its July 2024 Patch Tuesday launch and CISA added it to the Identified Exploited Vulnerabilities catalog, Guenther mentioned the vulnerability stays important for the next three causes:

“The invention and exploitation of CVE-2024-38112 by Void Banshee underlines the essential significance of well timed safety updates and patch administration,” mentioned Guenther. “Even with a patch accessible, the danger persists as a result of gradual uptake of updates and the continued use of legacy methods.”