Attackers Exploit Microsoft, Zoom Flaws to Target Government Agencies

Key Takeaways

• A sophisticated campaign is exploiting a critical Microsoft SharePoint Server vulnerability (CVE-2023-29357) and a Zoom flaw to target government entities.
• The attack chain leverages a privilege escalation flaw in SharePoint and tricks victims into running malicious code via manipulated Zoom event links.
• Initial access is gained through phishing emails, leading to the deployment of malware and potential data exfiltration.
• Both Microsoft and Zoom have released patches for the exploited vulnerabilities.

Government Agencies Targeted in Exploitation of Microsoft and Zoom Vulnerabilities

A new wave of cyberattacks is actively leveraging a critical vulnerability in Microsoft SharePoint Server and a flaw within the Zoom platform to compromise government agencies. Cybersecurity researchers at ANY.RUN have uncovered a campaign that exploits these weaknesses to achieve privilege escalation and deploy malicious payloads, ultimately aiming for data exfiltration. The sophisticated operation highlights attackers’ growing trend of weaponizing trusted platforms for their illicit activities.

Exploiting SharePoint for Privilege Escalation

The primary vector in this campaign is the Microsoft SharePoint Server privilege escalation vulnerability, tracked as CVE-2023-29357. This flaw, which carries a CVSS score of 9.8 (Critical), was initially addressed by Microsoft in June 2023. Attackers are exploiting this vulnerability to elevate their privileges within compromised SharePoint environments. According to ANY.RUN’s analysis, the exploit allows unauthorized access and control over SharePoint servers, creating a critical foothold for further malicious actions.

The attack typically commences with a phishing email, which delivers a malicious .ZIP archive. This archive contains a .URL shortcut file designed to initiate a multi-stage infection process. When a victim clicks this shortcut, it triggers a chain of events leading to the execution of a PowerShell script. This script then downloads an executable that exploits CVE-2023-29357. Upon successful exploitation, the attackers gain elevated privileges, enabling them to deploy additional malware.

Zoom Flaw Leveraged for Malicious Code Execution

In addition to the SharePoint exploit, the campaign also incorporates a clever abuse of Zoom’s platform. Attackers are exploiting a vulnerability (CVE-2023-36862), patched by Zoom in August 2023, which allowed for arbitrary code execution. This flaw was present in Zoom clients prior to version 5.15.5.

The attackers craft legitimate-looking Zoom event links that, when clicked, execute malicious code on the victim’s system. ANY.RUN researchers observed instances where these manipulated Zoom links were used to deliver payloads, including the DarkGate loader. “The attackers essentially turn trusted collaboration platforms into delivery mechanisms for their malware,” stated ANY.RUN researchers in their report. This tactic makes it challenging for users to distinguish between legitimate and malicious activity, increasing the likelihood of successful compromise.

Attack Chain and Malware Deployment

The full attack chain observed by ANY.RUN researchers involves several stages:

1. Initial access via a phishing email containing a malicious .ZIP archive.
2. Execution of a .URL shortcut file within the archive, initiating a PowerShell script.
3. The PowerShell script downloads an executable that exploits CVE-2023-29357 in Microsoft SharePoint Server, leading to privilege escalation.
4. Alternatively, or in conjunction, a malicious Zoom event link (exploiting CVE-2023-36862) is used to execute arbitrary code.
5. Deployment of further malware, including the DarkGate loader, which facilitates remote access and data exfiltration.

The sophistication of this campaign underscores a strategic shift by threat actors towards exploiting known vulnerabilities in widely used enterprise and collaboration tools.

What You Should Do

• Patch Microsoft SharePoint Server: Immediately apply the security update for CVE-2023-29357. Ensure all SharePoint Server instances are running the latest patched versions.
• Update Zoom Clients: Ensure all Zoom clients are updated to version 5.15.5 or later to mitigate CVE-2023-36862.
• Implement Email Security: Enhance email filtering to detect and block malicious attachments, especially .ZIP archives containing .URL shortcut files.
• User Awareness Training: Educate users about the risks of phishing emails, suspicious links, and the importance of verifying the legitimacy of Zoom event invitations.
• Endpoint Detection and Response (EDR): Utilize EDR solutions to detect and respond to suspicious PowerShell activity, unusual process execution, and the deployment of known malware loaders like DarkGate.
• Network Segmentation: Implement network segmentation to limit the lateral movement of attackers in case of a successful breach.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.