A New Exploit can Bypass Recently Patched MSHTML Flaw

What has happened?

• The most recent campaign spotted by Sophos Labs bypasses the protection of the patch through a new Office exploit.
• Attackers are weaponizing it to deliver the Formbook malware.
• Researchers believe that this new attack is possible because the patch was too narrowly focused, it did not address the initial issue entirely.

Modus Operandi

• The modified exploit (CAB-less 40444) existed for 36 hours between October 24 and 25, during which spam emails laden with malformed RAR archive files were sent to the victims.
• The RAR file is loaded with a script that is written in Windows Script Host along with a Word Document. 
• When opened, it communicates with a remote server hosting malicious JavaScript code.
• The JavaScript code uses Word Document to launch WSH script and runs PowerShell command in the RAR file to obtain Formbook malware payload from an attacker's website.

Recent attacks

• In the same month, Microsoft discovered a targeted phishing campaign abusing the vulnerability to deploy Cobalt Strike Beacons on targeted Windows systems using Office documents.
• In November, SafeBreach Labs provided details on Iranian threat actor operation aimed at Farsi-speaking victims. It was using a new PowerShell-based information stealer collecting information.

Conclusion