For a detailed advisory, download the pdf file here.A chain of zero-day vulnerabilities is being used by a new threat actor, PuzzleMaker. PuzzleMaker uses a chrome V8 type confusion vulnerability (CVE-2021-21224), which allows the attacker to execute an arbitrary code via a crafted HTML page. This elevation of privilege (EoP) exploit is then used by the PuzzleMaker to get into windows 10 using the information disclosure vulnerability(CVE-2021-31955) and the heap buffer overflow vulnerability (CVE-2021-31956).The Techniques used by the PuzzleMaker include:T1543 – Create or Modify System ProcessT1189 – Drive-by CompromiseT1059 – Command and Scripting InterpreterT1055 – Process InjectionT1134 – Access Token ManipulationT1057 – Process DiscoveryT1203 – Exploitation for Client ExecutionT1215 – Kernel Modules and Extensions
Vulnerability Details
Indicators of Compromise
Patch Links
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31956https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31955https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html
References
https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/https://otx.alienvault.com/pulse/60c088d3fd6e59ee86c1b78b
.svg)