PuzzleMaker using Chrome zero-day exploit to get into your Windows PC

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

A chain of zero-day vulnerabilities is being used by a new threat actor, PuzzleMaker. PuzzleMaker uses a chrome V8 type confusion vulnerability (CVE-2021-21224), which allows the attacker to execute an arbitrary code via a crafted HTML page. This elevation of privilege (EoP) exploit is then used by the PuzzleMaker to get into windows 10 using the information disclosure vulnerability(CVE-2021-31955) and the heap buffer overflow vulnerability (CVE-2021-31956).

The Techniques used by the PuzzleMaker include:
T1543 – Create or Modify System Process
T1189 – Drive-by Compromise
T1059 – Command and Scripting Interpreter
T1055 – Process Injection
T1134 – Access Token Manipulation
T1057 – Process Discovery
T1203 – Exploitation for Client Execution
T1215 – Kernel Modules and Extensions

Vulnerability Details

Indicators of Compromise

Patch Links

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31956

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31955

https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html

References

https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/

https://otx.alienvault.com/pulse/60c088d3fd6e59ee86c1b78b