New GrimResource technique exploits a 2018-old, unpatched, Windows XSS flaw and crafted MSC files to deploy malware via the Microsoft Management Console.
Researchers detected the new exploitation technique in the wild on June 6th, 2024.
Exploiting the Microsoft Management Console could enable hackers to evade security measures and gain initial access.
Although researchers reported finding the vulnerability in October 2018, the flaw still affects the latest Windows 11 version and didn't receive a patch.
The GrimResource code execution technique explained.
The first step in this complex process is the hackers tricking their target to click on a forged MSC file.
Reportedly, researchers observed how the attackers contact their victim on Facebook and have them downloading a Word document.
The document is actually an MSC file that mimics a Word document.
The hackers forged the file's icon so that it looks like a Word, not an MSC document.
By using it along with crafted MSC files, hackers can execute arbitrary JavaScript in the context of mmc.
Further on, they use DotNetToJScript to execute a.NET loader dubbed PASTALOADER. The loader retrieves the payload from environment variables and injects it into a new dllhost.
One of the final payloads the researchers observed was Cobalt Strike.
Threat detection helps keeping safe your environment, but preventing the threat works better.
Just like many other attacks, the GrimResource also relies on online malicious communication.
Using a DNS filtering tool helps spot and block harmful connections before the hackers get to enter your system.
Heimdal's predictive DNS has a 96% accuracy rate in detecting malicious domains even if they weren't yet listed as such.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, and Youtube, for more cybersecurity news and topics.
If you liked this post, you will enjoy our newsletter.
Get cybersecurity updates you'll actually want to read directly in your inbox.
Livia Gyongyoși is a Communications and PR Officer within Heimdal®, passionate about cybersecurity.
This Cyber News was published on heimdalsecurity.com. Publication date: Wed, 26 Jun 2024 19:13:05 +0000