One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 5065331 |
| Date de publication | 2022-06-09 17:30:25 (vue: 2022-06-10 01:06:04) |
| Titre | Qakbot Delivered Through CVE-2022-30190 (Follina) |
| Texte | FortiGuard Labs is aware of a report that CVE-2022-30190 is exploited in the wild to deliver Qakbot malware. Currently, a patch is not available for CVE-2022-30190. Also known as Qbot and Pinkslipbot, Qakbot started off as a banking malware. In recent years, Qakbot was seen as a delivery vehicle for other malware, which often results in a compromised machine being infected with ransomware.Why is this Significant?This is significant because CVE-2022-30190 is a Windows vulnerability that has no available patch and is being abused in the field. The current attack campaign delivers Qakbot to victim's machine. While final payload has not been identified nor reported, often Qakbot infection leads to ransomware deployed to the compromised machine. A publicly available report suggests Black Basta ransomware was deployed through Qakbot.What is CVE-2022-30190?CVE-20022-30190, also known as Follina, is a vulnerability in Microsoft Support Diagnostic Tool, which uccessful exploitation allows an attacker to run arbitrary code with the privileges of the calling application. FortiGuard Labs previously released Outbreal Alert and Threat Signal on CVE-2022-30190. See the Appendix for links to "MSDT Follina" and "Follina: 0-day Windows MSDT Vulnerability (CVE-2022-30190) Exploited In The Wild".How does the Current Qakbot Campaign Work?Reportedly, malicious emails arrive with an HTML attachment. Opening the HTML attachment downloads and saves a .zip file that an inner IMG file inside. The IMG file contains a DLL, a Word document, and a .LNK file. The DLL is a Qakbot variant which the link file will execute. Alternatively, the Word file will download and execute a remote HTML file, which has a script to abuse CVE-2022-30190, which then download and execute a Qakbot variant. What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against available samples associated with the current Qakbot campaign that abuses CVE-2022-30190:W32/Qbot.DM!trMSOffice/CVE_2021_40444.A!tr LNK/Agent.BD!trHTML/CVE_2022_30190.A!trRegarding IPS coverage, the following signature will detect the retrieval of remote HTML files that contain the MSDT command:MS.Office.MSHTML.Remote.Code.Execution.Known network IOCs for CVE-2022-30190 are blocked by the WebFiltering client.FortiEDR will provide protection from exploitation of this vulnerability and subsequent post-exploitation activity. See the Appendix for a link to "Technical Tip: How FortiEDR protects against CVE-2022-30190 'Follina' Microsoft Office protocol vulnerability" for more information.Th FortiGuard Content Disarm and Reconstruction (CDR) service can detect the attack in real-time and prevent it by disarming the "oleobject" data from Microsoft Office files. |
| Envoyé | Oui |
| Condensat | 20022 2021 2022 30190 30190:w32/qbot 40444 abuse abused abuses activity against alert allows also alternatively appendix application arbitrary are arrive associated attachment attack attacker available aware banking basta because been being black blocked calling campaign can cdr client code command:ms compromised contain contains content coverage current currently cve data day deliver delivered delivers delivery deployed detect diagnostic disarm disarming dll document does download downloads emails execute execution exploitation exploited field file files final follina follina: following fortiedr fortiguard from has how html identified img infected infection information inner inside iocs ips known labs leads link links lnk lnk/agent machine malicious malware microsoft more msdt mshtml network nor not off office often oleobject opening other outbreal patch payload pinkslipbot post prevent previously privileges protection protects protocol provide provides publicly qakbot qbot ransomware real recent reconstruction released remote report reported reportedly results retrieval run samples saves script see seen service signal signature significant started status subsequent suggests support technical then threat through time tip: tool trhtml/cve trmsoffice/cve trregarding uccessful variant vehicle victim vulnerability webfiltering what which why wild will windows word work years zip |
| Tags | Ransomware Vulnerability Threat Guideline |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.