Fortinet researchers discovered a malicious PowerPoint file which currently is used to attack diplomats, United Nations- and government organizations worldwide. This will soon filter down to mass phishing attacks.
The CVE-2017-0199 vulnerability in Office is something you want to patch NOW.
The attack uses an existing Microsoft Office vulnerability in combination with a technique to bypass User Account Control (UAC) to infect systems.
CVE-2017-0199 was patched in April this year and is a favorite cybercrime target, because despite the availability of the patch, many organizations have not patched Office for a variety or reasons.
The moment a user falls for the social engineering attack and opens the file, it triggers a remote code execution in Microsoft Office or WordPad when parsing specially crafted files. Attackers who successfully exploit this flaw in the Windows Object Linking and Embedding (OLE) interface of Microsoft Office can take control of the affected system, using the Event Viewer for privilege escalation.
Conclusion
Fortinet said: "Our analysis revealed that multiple techniques were implemented in this code in order to evade detection and remain effective. Such techniques leverage CVE-2017-0199, UAC bypass and escalation of privilege, multiple embedded encoded scripts, multiple stages of URL connection, and embedding the C&C in a jpg file. This shows how persistent criminals can be when crafting their malicious files. They have an in-depth technical analysis available.
What To Do About It
- Apply the Microsoft patches released in April that cover CVE-2017-0199
- Update your endpoint, gateway, and web filter devices
- Block outgoing malicious traffic through your firewalls
- Train your users to spot social engineering red flags.
The vast majority of these attacks start with social engineering and spear phishing attacks. KnowBe4's integrated training and phishing platform allows you to send fully simulated phishing emails so you can see which users answer the emails and/or click on links in them or open infected attachments.
See it for yourself and get a live, one-on-one demo.
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:
https://info.knowbe4.com/kmsat-request-a-demo
Grateful acknowledgement to Business Insider
