Reviewing Zero-day Vulnerabilities Exploited in Malware Campaigns in 2024
2024 was a busy year in the world of zero-day vulnerabilities, with attackers continuing to compromise endpoints by exploiting weaknesses in popular software applications and the operating system (OS). Here, we look back at examples of malware campaigns that exploited zero-day vulnerabilities to infect endpoints, describing what happened and how they worked:
- In total, the US Cybersecurity & Infrastructure Security Agency (CISA) identified 116 new vulnerabilities from 43 different vendors that were actively exploited in the wild in 2024.
- 28 of those were Microsoft Windows operating system vulnerabilities exploited in the wild.
- Using maliciously crafted Internet shortcut files (.URL), a threat actor exploited a zero-day remote code execution vulnerability in the MSHTML component in Windows (CVE-2024-38112) to spread information-stealing malware.
- In total, seven zero-day vulnerabilities in Google Chrome were actively exploited by attackers in 2024.
- Using a multiplayer online videogame as a lure, a threat actor exploited a Chrome zero-day vulnerability (CVE-2024-4947) in the browser’s JavaScript engine to infect endpoints with malware.
- A threat actor chained together two zero-day exploits in Mozilla Firefox and Windows, combining a browser exploit (CVE-2024-9680) with a sandbox escape (CVE-2024-49039), that enabled the attacker to install persistent malware on endpoints.
Introduction
The US government agency responsible for cybersecurity, CISA, maintains a list of vulnerabilities that are actively being exploited in the wild by attackers called the Known Exploited Vulnerabilities Catalog (KEV). The KEV catalog is a valuable resource for network defenders, helping them to prioritize which vulnerabilities to patch first based on attacker behavior.
In 2024, CISA added 110 new actively exploited vulnerabilities from 43 different vendors to the list. These included vulnerabilities in network appliances, server applications and endpoint software. This blog post focuses on software vulnerabilities exploited on PCs, such as those affecting OS components and common applications, like web browsers. These are attractive targets for attackers and are often exploited to mount attacks or spread malware.
A review of Microsoft Windows vulnerabilities in 2024
With over 70% share of the desktop OS market, Windows is by far the most popular endpoint OS within enterprises. Naturally, this makes the Windows ecosystem an appealing target for attackers. Many of the attacks targeting Windows endpoints rely on social engineering or exploiting software vulnerabilities. In recent years, Microsoft has worked hard to close off some common attack methods, which has pushed attackers to exploit more vulnerabilities.
In 2024, CISA flagged 28 vulnerabilities affecting Windows that they knew to be exploited by attackers in the wild – that’s an average of just over two new vulnerabilities exploited every month. These included vulnerabilities that enabled attackers to elevate their privileges, bypass security features and run arbitrary code. Attackers are keen to exploit vulnerabilities like these to remove as many barriers as possible that could jeopardize the success of an attack, such as requiring user interaction to infect a device.
CVE-2024-38112: Windows MSHTML zero-day exploited by Void Banshee
In a campaign documented by Trend Micro, a threat actor known as Void Banshee crafted malicious Internet shortcut (.URL) files that exploited a zero-day remote code execution vulnerability in the MSHTML component of Windows (CVE-2024-38112). This enabled the attackers to infect endpoints with Atlantida, a family of information-stealing malware.
The initial infection started with the download of a ZIP archive from a file sharing website. This archive contained a malicious URL file purporting to be a PDF ebook. Opening the URL file triggers the exploit of the MHTML vulnerability. Although Internet Explorer was deprecated in 2022 and the feature is disabled in Windows 10 and 11, parts of the web browser remain in the OS. The exploit enables an attacker to forcibly launch and control the defunct web browser.
In this case, Internet Explorer loads a website then downloads a malicious HTML Application (HTA) file, displaying an open dialog to the user. If the user opens the file, the endpoint is infected with Atlantida through a series of VBScript and PowerShell scripts. This information stealer collects sensitive data from various installed applications such as stored passwords, cookies or cryptocurrency wallets and exfiltrates them via a command and control channel. On 9 July 2024, Microsoft released a patch for the vulnerability through Patch Tuesday. With the first sighting of this campaign on 13 May, the vulnerability window (i.e. the time from when the flaw was identified to when it was patched) was almost two months. The campaign illustrates the often long periods of time that vulnerabilities can remain exploitable by attackers, and it shows that even disabled OS components can become an attack vector that can be exploited by attackers.
Attacks targeting web downloads and browsers
In 2024, we saw a steady increase in malware distributed via web browser downloads. Attackers used various methods to lure potential victims to malicious websites, including through links in emails, search engine optimization poisoning and malvertising. These websites spread malware by tricking the user into downloading and running malicious files, or by exploiting web browser vulnerabilities that enable the attacker to run code on the victim’s device.
CVE-2024-4947: In-the-wild exploitation of a Google Chrome zero-day
According to public reports of a campaign in early 2024, a Google Chrome zero-day vulnerability (CVE-2024-4947) was exploited by an APT threat actor, Lazarus, to infect endpoints with malware. The attackers advertised a stolen and modified version of a video game named “DeFiTankLand” on social media networks, linking to a website controlled by the threat actor. The game itself however didn’t contain malware. Instead, the infection occurred when the user visited the website.
Figure 1 – Google Chrome (CVE-2024-4947) zero-day exploitation timeline
The website loads a hidden attacker script in the background that exploits a type confusion vulnerability in Chrome’s V8 JavaScript engine. Specifically, the script exploits the just-in-time compiler, Maglev, to achieve memory corruption, which ultimately gives the malicious script access to the entire memory area of the browser process. This allows the attacker to exfiltrate sensitive information such as cookies, authentication tokens and passwords. However, by exploiting a second vulnerability, the threat actor was also able to break out of the V8 sandbox and execute code directly on the host to install malware.
As the timeline shows in Figure 1, while the V8 sandbox escape was fixed on 22 March, the vulnerability was present in Chrome for 185 days before being patched. Assuming the attacker had access to the exploit when they set up their campaign infrastructure on 5 February, the vulnerability was exploitable in the wild for 99 days to exfiltrate sensitive information before being patched. This was a long exposure window, during which simply visiting a malicious website could have led to a malware infection.
CVE-2024-9680 and CVE-2024-49039: Attackers chain Mozilla Firefox and Microsoft Windows zero-days to install RomCom malware
In 2024, attackers exploited one critical vulnerability affecting Mozilla Firefox. In October, ESET reported malware campaigns that exploited a zero-day vulnerability (CVE-2024-9680) in the web browser. The attackers combined this with a Windows sandbox escape (CVE-2024-49039) zero-day exploit, which allowed them to install persistent malware on the host system.
Figure 2 – Mozilla Firefox (CVE-2024-9680) and Windows (CVE-2024-49039) zero-day exploitation timeline
The first sign of the vulnerability being exploited in the wild was on 3 October. Five days later, ESET researchers identified the bug and reported it to Mozilla. Mozilla quickly patched it, releasing a fix one day later. Despite the quick response, there was still at least a five-day vulnerability window where attackers could exploit the flaw because a patch did not yet exist. If the attackers already had access to the exploit before its first sighting in the wild, which is plausible, the vulnerability window was even wider.
All that’s required to trigger the exploit is to browse a malicious website using a vulnerable web browser. In the campaign, the webpage first checks the version of the Firefox browser running. Next, depending on the browser version, an iFrame is added to the website containing the exploit. The code exploits a use-after-free vulnerability in Firefox’s timeline module, part of the browser’s Web Animations API. By manipulating the memory management of the browser, the attacker can execute arbitrary code. In this case, some initial shellcode runs that discovers further code in the memory, changes its protection and executes it. The second shellcode sequence loads and executes a malicious dynamic link library (DLL). This DLL uses an undocumented remote procedure call function to start a hidden PowerShell script and break out of the browser sandbox.
As seen in the zero-day campaign affecting Google Chrome, combining a browser exploit with a sandbox escape allows threat actors to install persistent malware on the host system. Since little or no user interaction is required, this makes browser exploitation a particularly dangerous attack vector.
Conclusion
As we saw in 2024, the threat to endpoints posed by zero-day exploitation continues to be strong and should continue to be a focus for a defensive strategy. Compared to 2023, the number of actively exploited vulnerabilities remains high. These exploits often require little to no user interaction, making them attractive infection methods for attackers. In the case of browser exploits, when combined with an exploit enabling escape from a browser sandbox, these can lead to persistent malware infections.
Tackling the impact of zero-day exploits requires organizations to reduce their attack surface and limit the attacker’s ability to access sensitive data and applications. Ideally, an endpoint’s software and operating system, and any sensitive data on it, should be isolated from applications like web browsers and office software that interact with high-risk content, such as links, downloads and email attachments.
HP Wolf Security’s approach to offering robust protection against such threats is based on threat containment with HP Sure Click Enterprise and HP Wolf Pro Security. These enable organizations of all sizes to enforce strong isolation between trusted and untrusted content across their endpoints. They stop zero-day exploits and malware infections by securely isolating untrusted content (whether webpages or documents) inside disposable micro-virtual machine containers. With this type of solution, if an attacker exploits a vulnerability in a browser or office application, the attack is trapped inside the secure container and therefore cannot infect the host system.
