Hackers Exploiting ProxyLogon and ProxyShell Flaws in Spam Campaigns

Menace actors are exploiting ProxyLogon and ProxyShell exploits in unpatched Microsoft Alternate Servers as a part of an ongoing spam marketing campaign that leverages stolen e mail chains to bypass safety software program and deploy malware on susceptible methods.

The findings come from Development Micro following an investigation into numerous intrusions within the Center East that culminated within the distribution of a never-before-seen loader dubbed SQUIRRELWAFFLE. First publicly documented by Cisco Talos, the assaults are believed to have commenced in mid-September 2021 through laced Microsoft Workplace paperwork.

“It’s recognized for sending its malicious emails as replies to pre-existing e mail chains, a tactic that lowers a sufferer’s guard in opposition to malicious actions,” researchers Mohamed Fahmy, Sherif Magdy, Abdelrhman Sharshar mentioned in a report revealed final week. “To have the ability to pull this off, we imagine it concerned the usage of a series of each ProxyLogon and ProxyShell exploits.”

ProxyLogon and ProxyShell seek advice from a set of flaws in Microsoft Alternate Servers that might allow a menace actor to raise privileges and remotely execute arbitrary code, successfully granting the flexibility to take management of the susceptible machines. Whereas the ProxyLogon flaws had been addressed in March, the ProxyShell bugs had been patched in a sequence of updates launched in Could and July.

DLL an infection move

Development Micro mentioned it noticed the usage of public exploits for CVE-2021-26855 (ProxyLogon), CVE-2021-34473, and CVE-2021-34523 (ProxyShell) on three of the Alternate servers that had been compromised in several intrusions, utilizing the entry to hijack professional e mail threads and ship malicious spam messages as replies, thereby rising the chance that unsuspecting recipients will open the emails.

“Delivering the malicious spam utilizing this system to achieve all the interior area customers will lower the potential of detecting or stopping the assault, because the mail getaways will be unable to filter or quarantine any of those inside emails,” the researchers mentioned, including the attackers behind the operation didn’t perform lateral motion or set up further malware in order to remain underneath the radar and keep away from triggering any alerts.

The assault chain includes rogue e mail messages containing a hyperlink that, when clicked, drops a Microsoft Excel or Phrase file. Opening the doc, in flip, prompts the recipient to allow macros, finally resulting in the obtain and execution of the SQUIRRELWAFFLE malware loader, which acts as a medium to fetch final-stage payloads corresponding to Cobalt Strike and Qbot.

“SQUIRRELWAFFLE campaigns ought to make customers cautious of the totally different ways used to masks malicious emails and recordsdata,” the researchers concluded. “Emails that come from trusted contacts will not be sufficient of an indicator that no matter hyperlink or file included within the e mail is secure.”