Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent
Summary: Unit 42 reports that the Patchwork group, also known as Dropping Elephant and Monsoon, has run campaigns against targets in the Indian subcontinent using malicious documents that embed EPS exploits for CVE-2015-2545 and CVE-2017-0261 to deliver an updated BADNEWS backdoor. The lures reference Pakistan Army military promotions, the Pakistan Atomic Energy Commission, and the Ministry of the Interior, and the payload is side-loaded through a signed VMware executable and a modified vmtools.dll that creates a scheduled task named BaiduUpdateTask1 to run a spoofed MSBuild.exe every minute.
Why it matters: The group abandoned the newer CVE-2017-0261 in late January 2018 in favor of the older CVE-2015-2545, and it changed how BADNEWS retrieves command-and-control data from public dead-drop resolvers and encrypts its traffic with AES-128 - a reminder that an unpatched legacy Office vulnerability is still enough to hand an attacker full control of a victim machine.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2015-2545CVE-2017-0261
- Related
- CVE-2015-2545: Microsoft Office Malformed EPS File Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022CVE-2017-0261: Microsoft Office Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022