- ESET discovers two zero-day vulnerabilities that can lead to remote code execution
- The researchers spot Russian hackers abusing the flaws to deploy backdoors
- Fixes for both flaws are already available to download
A Russian advanced persistent threat (APT) group known as RomCom has been exploiting two zero-day vulnerabilities to hit its victims with potent backdoor malware, security experts have said.
ESET said its researchers first found a use-after-free bug in the animation timeline feature in Firefox. Since the bug forces the browser to use memory that has already been freed, it can lead to all sorts of undefined behavior, including executing code in the restricted context of the browser. This bug was discovered on October 8, and was assigned CVE-2024-9680. It was fixed a day later, on October 9.
Further investigation led to the discovery of a second vulnerability, this time in Windows, tracked as CVE-2024-49039, WHICH allows previously authenticated crooks to run arbitrary code in the system. By chaining the two vulnerabilities together, the attackers were able to deploy backdoors on target devices.
Targeting Europe and North America
In practice, thIS means embedding a website with code that is capable of exploiting the vulnerabilities, redirect the victims to a server where the backdoor is hosted, and have the operating system infected. The worst part is that the attack is “zero-click” – meaning besides visiting the malicious website, the exploit requires no interaction from the victim’s side.
While ESET does not discuss how many people, or entities, fell victim to the attack, they say that the majority of victims tracked between October 10 and November 4 were located in Europe and North America.
It is also worth pointing out that patches for both flaws have been available for more than a month now, and the best way to defend against the attack is to have Firefox, Thunderbird, and the Tor Browser (which were all said to have been vulnerable) all patched, together with Windows.
Leave a comment