Ancient Mac Site Harbors Botnet that Exploits IE Vulnerability
Summary: Cisco Talos reported blocking an attack, first observed on November 26th, that used a hidden iframe on a compromised domain to redirect users to a malware landing page at macport.com, a lookalike of the legitimate macports.org, exploiting the Windows OLE remote code execution flaw CVE-2014-6332 patched by Microsoft in Internet Explorer. The landing page was a near-identical copy of the Metasploit module for the vulnerability, altered to use PowerShell to download and run VgaDriver.exe from C:\Windows\Temp and disable the Windows Firewall, dropping an IRC bot that connects to port 2015 and joins the channel #websites.
Bottom line: The dropped bot gives its operator keylogging and remote command execution, plus the ability to flood MS-SQL servers into denial of service, and it idles in a channel restricted to voiced users so other attackers cannot hijack it. Over half the traffic Talos observed came from non-Internet Explorer browsers, meaning the campaign was cast wide and indiscriminate rather than targeted.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2014-6332
- Related
- CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022Addressing CVE-2014-6332 SWF Exploit Cyber Risks ·