{"id":125808,"date":"2024-11-14T17:15:13","date_gmt":"2024-11-14T10:15:13","guid":{"rendered":"https:\/\/hotvideos24.online\/?p=125808"},"modified":"2024-11-14T17:15:13","modified_gmt":"2024-11-14T10:15:13","slug":"russian-hackers-exploit-new-ntlm-flaw-to-deploy-rat-malware-via-phishing-emails","status":"publish","type":"post","link":"https:\/\/hotvideos24.online\/?p=125808","title":{"rendered":"Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails"},"content":{"rendered":"<p> <script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3711241968723425\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-layout-key=\"-fb+5w+4e-db+86\"\r\n     data-ad-client=\"ca-pub-3711241968723425\"\r\n     data-ad-slot=\"7910942971\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><br \/>\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Nov 14, 2024<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Malware \/ Vulnerability<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgaUtbznCX7hoxo_zg_8FmVf-bmHWLFv7k8xRL06GbF-nDsWc-3hW2W8DSrQ_2vuMOqIpoqRJxcMaxYQvG-G16Tt1wFVP-gcCWfmYKlxCihB14c-wJoWKKKv2hs8LK8lEQXXcvoZx0DcUFCwXmY6JNdD_w3x5ziWb-dzDnGpkUR_ytoaRJQDH4-x72JG4EE\/s728-rw-e365\/attack.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgaUtbznCX7hoxo_zg_8FmVf-bmHWLFv7k8xRL06GbF-nDsWc-3hW2W8DSrQ_2vuMOqIpoqRJxcMaxYQvG-G16Tt1wFVP-gcCWfmYKlxCihB14c-wJoWKKKv2hs8LK8lEQXXcvoZx0DcUFCwXmY6JNdD_w3x5ziWb-dzDnGpkUR_ytoaRJQDH4-x72JG4EE\/s728-rw-e365\/attack.png\" alt=\"RAT Malware\" border=\"0\" data-original-height=\"380\" data-original-width=\"728\" title=\"RAT Malware\"\/><\/a><\/div>\n<p>A newly patched security flaw impacting Windows NT LAN Manager (NTLM) was exploited as a zero-day by a suspected Russia-linked actor as part of cyber attacks targeting Ukraine.<\/p>\n<p>The vulnerability in question, CVE-2024-43451 (CVSS score: 6.5), refers to an NTLM hash disclosure spoofing vulnerability that could be exploited to steal a user&#8217;s NTLMv2 hash. It was <a href=\"https:\/\/thehackernews.com\/2024\/11\/microsoft-fixes-90-new-vulnerabilities.html\" rel=\"noopener\" target=\"_blank\">patched<\/a> by Microsoft earlier this week.<\/p>\n<p>&#8220;Minimal interaction with a malicious file by a user such as selecting (single-click), inspecting (right-click), or performing an action other than opening or executing could trigger this vulnerability,&#8221; Microsoft revealed in its advisory.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/zerotrust-inside-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhXVjKHNKDH4WdMsPjT21ztu0Bi0rTuZJGnGZU4GDPVBYLsCZA6ZSQPi9N5P31vBC5Rok2-ri9zF3Qf81Yy3Sg4HxyMA8HOhJK4NGGmbOS-rF-nTOlz_EosU1sjbmcHH_4wEgc_1n08nI_cnHBsa9yCyQFnoW3p0N7MKwuUJqaK7miyuLBi9crEBsh4BS1T\/s728-e100\/zz-inside-d.png\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>Israeli cybersecurity company ClearSky, which discovered the zero-day exploitation of the flaw in June 2024, <a href=\"https:\/\/www.clearskysec.com\/0d-vulnerability-exploited-in-the_wild\/\" rel=\"noopener\" target=\"_blank\">said<\/a> it&#8217;s been abused as part of an attack chain that delivers the open-source <a href=\"https:\/\/thehackernews.com\/2024\/07\/tag-100-new-threat-actor-uses-open.html\" rel=\"noopener\" target=\"_blank\">Spark RAT<\/a> malware.<\/p>\n<p>&#8220;The vulnerability activates URL files, leading to malicious activity,&#8221; the company said, adding the malicious files were hosted on an official Ukrainian government site that allows users to download academic certificates.<\/p>\n<p>The attack chain involves sending phishing emails from a compromised Ukrainian government server (&#8220;doc.osvita-kp.gov[.]ua&#8221;) that prompts recipients to renew their academic certificates by clicking on a booby-trapped URL embedded in the message.<\/p>\n<p>This leads to the download of a ZIP archive containing a malicious internet shortcut (.URL) file. The vulnerability is triggered when the victim interacts with the URL file by right-clicking, deleting, or dragging it to another folder.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjkieE49SD1YTM7L9RkKb3HEAZJlwZK0j-rbhwmet-E7_FuwhdWEk6I3CTnaH0GhDM7srmvPmY8_v_yrHwU0ijk9x8rEzqBuybNX211KSL_knG28660RGar-SCs6a-AkPeqg-URHXPwLY5iuYLcEK5kzUd1sz4noA65113iWlFwTnxRyc4BmmOo61n4ClZ-\/s728-rw-e365\/zero-day.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjkieE49SD1YTM7L9RkKb3HEAZJlwZK0j-rbhwmet-E7_FuwhdWEk6I3CTnaH0GhDM7srmvPmY8_v_yrHwU0ijk9x8rEzqBuybNX211KSL_knG28660RGar-SCs6a-AkPeqg-URHXPwLY5iuYLcEK5kzUd1sz4noA65113iWlFwTnxRyc4BmmOo61n4ClZ-\/s728-rw-e365\/zero-day.png\" alt=\"RAT Malware\" border=\"0\" data-original-height=\"751\" data-original-width=\"1410\" title=\"RAT Malware\"\/><\/a><\/div>\n<p>The URL file is designed to establish connections with a remote server (&#8220;92.42.96[.]30&#8221;) to download additional payloads, including Spark RAT.<\/p>\n<p>&#8220;In addition, a sandbox execution raised an alert about an attempt to pass the NTLM (NT LAN Manager) Hash through the SMB (Server Message Block) protocol,&#8221; ClearSky said. &#8220;After receiving the NTLM Hash, an attacker can carry out a Pass-the-Hash attack to identify as the user associated with the captured hash without needing the corresponding password.&#8221;<\/p>\n<p>The Computer Emergency Response Team of Ukraine (CERT-UA) has linked the activity to a likely Russian threat actor it tracks as UAC-0194.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/cis-nov\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiAxSbAOIwY5p0wWv5znF6Nj42k-fIocSD-CC_fgf7B4WQKPZbJCilURnF5BAgXpuwEEjcBU2BeRdKaag8fw81D37T0OJG7Arl683j5xIhSrEv-88wJKyGgPtRSH1A-5Sz6Oa97Zg8gS0UhfS1E-6PfJwRE2o2yqakqaiVyW8RXxs4Pgxi3c7MA2z3jASGT\/s728-e100\/cis-d.png\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>In recent weeks, the agency has also warned that phishing emails bearing tax-related lures are being used to propagate a legitimate remote desktop software named LiteManager, describing the attack campaign as financially motivated and undertaken by a threat actor named UAC-0050.<\/p>\n<p>&#8220;Accountants of enterprises whose computers work with remote banking systems are in a special risk zone,&#8221; CERT-UA <a href=\"https:\/\/cert.gov.ua\/article\/6281202\" rel=\"noopener\" target=\"_blank\">warned<\/a>. &#8220;In some cases, as evidenced by the results of computer forensic investigations, it may take no more than an hour from the moment of the initial attack to the moment of theft of funds.&#8221;<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting?  Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3711241968723425\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-layout-key=\"-fb+5w+4e-db+86\"\r\n     data-ad-client=\"ca-pub-3711241968723425\"\r\n     data-ad-slot=\"7910942971\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><br \/>\n<br \/><div data-type=\"_mgwidget\" data-widget-id=\"1660802\">\r\n<\/div>\r\n<script>(function(w,q){w[q]=w[q]||[];w[q].push([\"_mgc.load\"])})(window,\"_mgq\");\r\n<\/script>\r\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2024\/11\/russian-hackers-exploit-new-ntlm-flaw.html\">Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue802Nov 14, 2024\ue804Ravie LakshmananMalware \/ Vulnerability A newly patched security flaw impacting Windows NT LAN Manager (NTLM) was exploited as a zero-day by a suspected Russia-linked actor as part of &hellip; <a href=\"https:\/\/hotvideos24.online\/?p=125808\" class=\"more-link\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8630],"tags":[],"class_list":["post-125808","post","type-post","status-publish","format-standard","hentry","category-technology","entry"],"_links":{"self":[{"href":"https:\/\/hotvideos24.online\/index.php?rest_route=\/wp\/v2\/posts\/125808","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hotvideos24.online\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hotvideos24.online\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hotvideos24.online\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hotvideos24.online\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=125808"}],"version-history":[{"count":0,"href":"https:\/\/hotvideos24.online\/index.php?rest_route=\/wp\/v2\/posts\/125808\/revisions"}],"wp:attachment":[{"href":"https:\/\/hotvideos24.online\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=125808"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hotvideos24.online\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=125808"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hotvideos24.online\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=125808"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}