Windows MSHTML 0-Day Exploited to Deploy Cobalt Strike Beacon in Targeted Attacks

Microsoft on Wednesday disclosed details of a targeting phishing
campaign that leveraged a now-patched zero-day flaw in its MSHTML
platform using specially-crafted Office documents to deploy Cobalt
Strike Beacon on compromised Windows systems.

“These attacks used the vulnerability, tracked as CVE-2021-40444^[1], as part of an initial
access campaign that distributed custom Cobalt Strike Beacon
loaders,” Microsoft Threat Intelligence Center said^[2]
in a technical write-up. “These loaders communicated with an
infrastructure that Microsoft associates with multiple
cybercriminal campaigns, including human-operated ransomware.”

Details about CVE-2021-40444 (CVSS score: 8.8) first emerged^[3]
on September 7 after researchers from EXPMON alerted the Windows
maker about a “highly sophisticated zero-day attack” aimed at
Microsoft Office users by taking advantage of a remote code
execution vulnerability in MSHTML (aka Trident), a proprietary
browser engine for the now-discontinued Internet Explorer and which
is used in Office to render web content inside Word, Excel, and
PowerPoint documents.

“The observed attack vector relies on a malicious ActiveX
control that could be loaded by the browser rendering engine using
a malicious Office document,” the researchers noted. Microsoft has
since rolled out a fix^[4]
for the vulnerability as part of its Patch Tuesday updates a week
later on September 14.

The company attributed the activities to related cybercriminal
clusters it tracks as DEV-0413 and DEV-0365, the latter of which is
the company’s moniker for the emerging threat group associated with
creating and managing the Cobalt Strike infrastructure used in the
attacks. The earliest exploitation attempt by DEV-0413 dates back
to August 18.

The exploit delivery mechanism originates from emails
impersonating contracts and legal agreements hosted on file-sharing
sites. Opening the malware-laced document leads to the download of
a Cabinet archive file containing a DLL bearing an INF file
extension that, when decompressed, leads to the execution of a
function within that DLL. The DLL, in turn, retrieves remotely
hosted shellcode — a custom Cobalt Strike Beacon loader — and loads
it into the Microsoft address import tool.

Additionally, Microsoft said some of the infrastructures that
was used by DEV-0413 to host the malicious artifacts were also
involved in the delivery of BazaLoader and Trickbot payloads, a
separate set of activities the company monitors under the codename
DEV-0193 (and by Mandiant as UNC1878).

“At least one organization that was successfully compromised by
DEV-0413 in their August campaign was previously compromised by a
wave of similarly-themed malware that interacted with DEV-0365
infrastructure almost two months before the CVE-2021-40444 attack,”
the researchers said. “It is currently not known whether the
retargeting of this organization was intentional, but it reinforces
the connection between DEV-0413 and DEV-0365 beyond sharing of
infrastructure.”