Acid Box: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations
Summary: Unit 42 found a previously unknown malware family it named AcidBox, which used a VirtualBox VBoxDrv.sys driver exploit to target at least two Russian organizations in 2017, with all samples compiled on May 9, 2017. The malware abuses the unpatched second vulnerability in the VirtualBox driver - one Turla discovered after Core Security's CVE-2008-3431 was fixed in version 1.6.4 - and AcidBox extended it to work on driver versions up to 3.0.0, using SSP DLLs to inject into lsass.exe and load an encrypted main worker from the registry.
Why it matters: The attackers deliberately chose driver version 2.2.0 because it was not known to be vulnerable and therefore likely off security vendors' radar, and the malware's rarity - only a handful of samples across Unit 42, Dr.Web, Kaspersky and ESET - means signature-based defenses had almost nothing to match on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2008-3431
- Related
- CVE-2008-3431: Oracle Virtual Box Insufficient Input Validation Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026