New Windows Zero-Day Exploited in Active Attacks

The Windows vulnerability MSHTML spoofing, tracked as CVE-2024-43461, was first disclosed by Microsoft as part of the September 2024 Patch Tuesday. Initially, it wasn’t marked as exploited, but later updates confirmed that it had been actively used in attacks before it was fixed. Void Banshee, a cyber espionage group targeting North America, Europe, and Southeast Asia, utilized this flaw to deploy information-stealing malware.

Exploiting the CVE-2024-43461 Vulnerability

1. Malicious Shortcut Files (.url): The attacks began with the use of Windows Internet Shortcut (.url) files. When these files were clicked, they triggered the now-deprecated Internet Explorer (IE) instead of Microsoft Edge, forcing the system to open a malicious website controlled by the attackers.
2. HTA File Execution via Internet Explorer: Once the malicious website was opened, it prompted the download of an HTML Application (HTA) file. HTA files are executable files that run scripts on the user’s device. In this case, the HTA file contained a script to install the Atlantida info-stealer, a malware that harvests sensitive information such as:
   • Passwords
   • Authentication cookies
   • Cryptocurrency wallets

   The vulnerability allowed the attackers to hide the true nature of the file by spoofing its file extension, making it appear as something benign like a PDF file instead of a .hta executable.

3. Using Braille Whitespace Characters for Concealment: Attackers exploited a flaw in Windows MSHTML (the core component responsible for rendering web content in Internet Explorer) to spoof the file extension of the HTA file. The technique used braille whitespace characters (%E2%A0%80) to push the “.hta” extension out of the user’s view in the file name prompt.For example, a file name like this:
    

   Books_A0UJKO.pdf%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80.hta

   Would be displayed as:

   Books_A0UJKO.pdf...

   This trick made the file appear to be a PDF when in reality, it was an executable HTA file. When the user clicked the file, they unknowingly executed the Atlantida malware.

    

   Braile whitespace characters pushing HTA extension out of view
   Source: Trend Micro

    

4. Final Execution and Infection: Once the user opened the spoofed file, the HTA file was executed, running the script that installed the Atlantida info-stealer on the device. This malware was designed to silently steal credentials, financial information, and other sensitive data, sending it back to the attackers.

   

Security update now shows HTA extension
Source: Peter Girnus