RTF Exploit Installs Italian RAT: uWarrior
Summary: Unit 42 researchers documented a new RAT they call uWarrior, built by an unknown actor of Italian origin, delivered through weaponized RTF documents containing multiple OLE objects and two exploits: CVE-2012-1856, revived with a novel ROP chain to bypass ASLR, and CVE-2015-1770. The malware is a fully featured RAT using a compressed, optionally encrypted raw TCP socket and binary message protocol for command and control, with a configuration pointing to the C2 host login.collegefan.org on port 2020, and it borrows components from the for-sale ctOS RAT.
What you should know: The actor revived a 2012 vulnerability by loading MSVCR71.DLL through an OLE ProgID to get non-randomized ROP gadgets, so a decade-old patch gap is again a working delivery path. Unit 42 also notes the exploit fails on 64-bit Office, meaning the campaign's reach depends on which Office builds your fleet still runs.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2012-1856CVE-2015-1770
- Related
- CVE-2015-1770: Microsoft Office Uninitialized Memory Use Vulnerability Known Exploited Vulnerabilities · Mar 28, 2022CVE-2012-1856: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022