Summary:
A now-patched Microsoft Defender SmartScreen vulnerability (CVE-2024-21412) has been exploited to deliver information stealers like ACR Stealer, Lumma Stealer, and Meduza Stealer. This vulnerability allowed attackers to bypass SmartScreen warnings and deliver malicious payloads. The stealer campaign is targeting Spain, Thailand, and the US. The attack chain involves a series of intricately crafted files. Attackers first lure victims to click a booby-trapped link that downloads an LNK file. This LNK file triggers a script that retrieves a decoy PDF and a malicious executable. The executable injects shellcode using various techniques, including leveraging image files or Windows APIs, to ultimately install information stealers such as Meduza Stealer, ACR Stealer, and Lumma Stealer. These stealers target a wide range of data, including browser credentials, cryptocurrency wallets, email information, and password managers. ACR stealer hides its C2 server using a dead drop resolver (DDR) technique.

Security Officer Comments:
This incident emphasizes the importance of staying informed about patched vulnerabilities. Microsoft has addressed CVE-2024-21412, so ensuring systems are updated is paramount. However, the evolving nature of cyber threats necessitates a layered security approach. Educating users about suspicious links and file downloads is crucial. Organizations should implement robust security protocols and train employees to identify red flags. Additionally, security measures like endpoint detection and response (EDR) systems can offer real-time protection against evolving threats. By combining user awareness, up-to-date software, and layered security protocols, organizations can bolster their defenses and have a better chance against information stealer attacks.

Suggested Corrections:

• Patch Systems Promptly: Ensure all systems have the latest security patches installed, especially those addressing vulnerabilities like CVE-2024-21412.
• Educate Users: Train employees to be cautious of clicking links or downloading files from untrusted sources, especially emails or messages with suspicious attachments.
• Enable Strong Authentication: Implement multi-factor authentication (MFA) to add an extra layer of security for user logins.
• Enforce Web Filtering: Implement web filtering to block access to malicious websites or those known to be used for distributing malware.
• Maintain Backups: Regularly back up critical data to ensure a recovery option in case of a successful information stealer attack.

IOCs for this campaign are available here.

Link(s):
https://thehackernews.com/2024/07/microsoft-defender-flaw-exploited-to.html

https://www.fortinet.com/blog/threat-research/exploiting-cve-2024-21412-stealer-campaign-unleashed