WinRAR 0-day That Uses Poisoned JPG and TXT Files Under Exploit Since April
upstart writes:
Vulnerability allows hackers to execute malicious code when targets open malicious ZIP files:
A newly discovered zero-day in the widely used WinRAR file-compression program has been exploited for four months by unknown attackers who are using it to install malware when targets open booby-trapped JPGs and other innocuous inside file archives.
The vulnerability, residing in the way WinRAR processes the ZIP file format, has been under active exploit since April in securities trading forums, researchers from security firm Group IB reported Wednesday. The attackers have been using the vulnerability to remotely execute code that installs malware from families, including DarkMe, GuLoader, and Remcos RAT.
From there, the criminals withdraw money from broker accounts. The total amount of financial losses and total number of victims infected is unknown, although Group-IB said it has tracked at least 130 individuals known to have been compromised. WinRAR developers fixed the vulnerability, tracked as CVE-2023-38831, earlier this month.
[...] WinRAR has more than 500 million users who rely on the program to compress large files to make them more manageable and quicker to upload and download. It's not uncommon for people to immediately decompress the resulting ZIP files without inspecting them first. Even when people attempt to examine them for malice, antivirus software often has trouble peering into the compressed data to identify malicious code.
The malicious ZIP archives Group-IB found were posted on public forums used by traders to swap information and discuss topics related to cryptocurrencies and other securities. In most cases, the malicious ZIPs were attached to forum posts. In other cases, they were distributed on the file storage site catbox[.]moe. Group-IB identified eight popular trading forums used to spread the files.
Additional details can be found at: ZDI-23-1152
Read more of this story at SoylentNews.