Microsoft released patch for actively exploited spoofing vulnerability
Microsoft released patch for actively exploited spoofing vulnerability
THREAT LEVEL: Amber.
For a detailed advisory, download the pdf file here.
Microsoft AppX has a spoofing vulnerability that has been assigned CVE-2021-43890. Attackers are taking advantage of this critical vulnerability by deploying well-known malwares such as Emotet, Trickbot, and Bazaloader.
This vulnerability allows an attacker to create a malicious package file and modify it to look like a legitimate application and then convince the victim to open it, which will then execute code and allow to gain access to the victim’s machine.
The TTPs that might be used by an unknown attacker includes:
TA0001 – Initial Access
T1566 – Phishing
T1566.001 – Phishing: Spearphishing Attachment
T1189 – Drive-by Compromise
TA0002 – Execution
T1204 – User Execution
T1204.002 – User Execution: Malicious File
TA0005 – Defense Evasion
T1036 – Masquerading
T1036.005 – Masquerading: Match Legitimate Name or Location
T1574 – Hijack Execution Flow
TA0003 – Persistence
TA0004 – Privilege Escalation
Vulnerability Detail
Patch
https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43890
References
https://thehackernews.com/2021/12/microsoft-issues-windows-update-to.html
