Security News > 2021 > October > Geriatric Microsoft Bug Exploited by APT Using Commodity RATs

Geriatric Microsoft Bug Exploited by APT Using Commodity RATs
2021-10-20 13:28

An APT described as a "Lone wolf" is exploiting a decades-old Microsoft Office flaw to deliver a barrage of commodity RATs to organizations in India and Afghanistan, researchers have found.

Attackers use political and government-themed malicious domains as lures in the campaign, which targets mobile devices with out-of-the-box RATs such as dcRAT and QuasarRAT for Windows and AndroidRAT. They're delivering the RATs in malicious documents by exploiting CVE-2017-11882, according to a report published Tuesday by Cisco Talos.

The campaign reflects an increased trend by both cybercriminals and APTs to use commodity RATs instead of custom malware against victims for a number of reasons, researchers said.

Using commodity RATs gives attackers a range of out-of-the-box functionality, including preliminary reconnaissance capabilities, arbitrary command execution and data exfiltration, researchers noted.

Using commodity malware also saves attackers both the time and resource investment in developing custom malware, as the RATs have stock features requiring minimal configuration changes, researchers said.

Researchers observed attackers switching up tactics to deploy commodity RATs as the final payload starting in July, they said.


News URL

https://threatpost.com/apt-commodity-rats-microsoft-bug/175601/

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2017-11-15 CVE-2017-11882 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Microsoft Office
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability".
network
microsoft CWE-119
critical
9.3

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Microsoft 701 841 4687 4342 3722 13592