Targeted operation against Ukraine exploited 7-year-old MS Office bug

A hacking campaign targeted Ukraine exploiting a seven-year-old vulnerability in Microsoft Office to deliver Cobalt Strike.

Security experts at Deep Instinct Threat Lab have uncovered a targeted campaign against Ukraine, exploiting a Microsoft Office vulnerability dating back almost seven years to deploy Cobalt Strike on compromised systems.

The researchers found a malicious PPSX (PowerPoint Slideshow signal-2023-12-20-160512.ppsx) file uploaded from Ukraine to VirusTotal at the end of 2023.

The file, although labeled as shared through the Signal app, might not have been originally sent via the application. It’s a PPSX file, seemingly an outdated US Army manual for tank mine clearing blades (MCB).

The PPSX file contains a remote link to an external OLE object. The researchers pointed out that the use of the “script:” prefix demonstrates the exploitation of the vulnerability CVE-2017-8570, a bypass for CVE-2017-0199. The remote script, named “widget_iframe.617766616773726468746672726a6834.html,” was hosted on “weavesilk[.]space,” protected by CloudFlare. Despite this, the true hosting behind the domain was identified as a Russian VPS provider. The scriptlet contents are heavily obfuscated.

The second stage dropper is an HTML file containing JavaScript code executed via Windows cscript.exe. The script sets up persistence, decode, and save the embedded payload to disk disguised as Cisco AnyConnect VPN file.

The payload includes a dynamic-link library (vpn.sessings) that injects the post-exploitation tool Cobalt Strike Beacon into memory and awaits commands from the C2 server. Threat actors used a cracked version of Cobalt Strike.

The DLL also implements features to evade detection and avoid analysis by security experts.

The Deep Instinct Threat Lab could not attribute the attacks to a known threat actor. Evidence collected by the experts demonstrates the sample originated from Ukraine, a Russian VPS provider hosted the second stage, and the Cobalt beacon C&C was registered in Warsaw, Poland.

“The lure contained military-related content, suggesting it was targeting military personnel. But the domain names weavesilk[.]space and petapixel[.]fun are disguised as an obscure generative art site (http://weavesilk.com) and a popular photography site (https://petapixel.com). These are unrelated, and it’s a bit puzzling why an attacker would use these specifically to fool military personnel.” concludes the report. “As of the day of discovery, the loader was undetectable by most engines, while Deep Instinct prevented it on day 0.”

The report includes Indicators of Compromise (IoCs).

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Ukraine)