Windows 0-day is exploited to install creepy Finspy malware (again)

On Tuesday, Microsoft patched a previously unknown vulnerability that researchers say was actively exploited by an undisclosed nation to install surveillance malware on one or more vulnerable computers.

The exploit, according to a blog post published Tuesday by security firm FireEye, was embedded in a Microsoft Word document. Once opened, the document exploited a zero-day vulnerability in Microsoft's .Net framework. The exploit caused the targeted computer to install Finspy (sometimes "FinSpy"), a family of surveillance software that its controversial developer, UK-based Gamma Group, sells to governments throughout the world. Tuesday's blog post said the document might have been used to infect an unnamed "Russian speaker." The vulnerability, indexed as CVE-2017-8759, comes five months after FireEye disclosed a different zero-day being used to distribute Finspy.

"These exposures demonstrate the significant resources available to 'lawful intercept' companies and their customers," FireEye researchers wrote. "Furthermore, Finspy has been sold to multiple clients, suggesting the vulnerability was being used against other targets."

The .Net vulnerability is located in parser that's supposed to scrub malicious input from data fed to the Web Services Description Language engine. The exploit caused computers to download a maliciously formed definition from an attacker-controlled server and to compile it into a code library. The injected code then created a new process that retrieved an HTA script. The script, in turn, removed the source code and library while downloading and executing a file titled left.jpg. Despite the file extension and a content classification as a JPG image, the file was executable and installed the Finspy malware. The Finspy variant uses heavily obscured code and a built-in virtual machine to conceal its inner workings.

The exploit, which a FireEye researcher said worked against Windows 10, demonstrates the lengths attackers will go to defeat Microsoft's latest security improvements.

In a post published Tuesday, Microsoft officials said they believe the hackers who carried out the attack are members of the NEODYMIUM group, which has previously used similar zero-day exploits with spear-phishing attachments that install FinFisher spyware. Microsoft has more details about the group here and here.

The .Net flaw is one of more than 80 vulnerabilities Microsoft fixed during this month's Patch Tuesday.

Listing image by Microsoft