In recent reports, cybersecurity firm BI.ZONE disclosed that the threat actor known as Paper Werewolf has launched a series of attacks leveraging exploits delivered via email attachments. These emails masqueraded as communications from employees at the All-Russian Research Institute, with the malicious aim of installing malware to gain unauthorized access to compromised systems.
Both BI.ZONE and ESET independently identified this campaign, although there’s still uncertainty regarding any potential connections between the groups exploiting the vulnerabilities. Speculation from BI.ZONE suggests that Paper Werewolf may have obtained the vulnerabilities listed in dark web crime forums, indicating a possible sourcing of exploits from common market venues.
ESET detailed that the observed attacks adhered to three distinct execution chains, one notably targeting a specific organization with a method known as COM hijacking. This technique enabled the execution of a malicious DLL file concealed within an archive, leading to the installation of malware through applications like Microsoft Edge. In this context, the DLL decrypted embedded shellcode to retrieve the current machine’s domain and compare it against a hardcoded value; a match triggered the installation of the Mythic Agent exploitation framework.
Another execution chain employed a malicious Windows executable to deliver SnipBot, a recognized variant of RomCom malware. This malware exhibited behavior designed to thwart forensic analysis, such as terminating itself when operated within a virtual machine or sandbox environment—common setups used by cybersecurity researchers. A third execution chain utilized two other known RomCom malware samples, identified as RustyClaw and Melting Claw, further indicating a sophisticated approach to infecting targeted systems.
Historically, vulnerabilities in WinRAR have been exploited to deliver malware, including a wide-scale exploitation of a critical code-execution flaw in 2019, as well as a zero-day vulnerability detected in 2023 that was exploited for an extended period before being uncovered. The structure of WinRAR, which necessitates manual user intervention for updates, poses enhanced risks. This is compounded by the existence of unpatched vulnerabilities in Windows versions of UnRAR.dll and portable UnRAR source code, putting users at further risk. Business owners are advised to utilize only the most recent WinRAR version, specifically 7.13 or later, as it addresses known vulnerabilities.
This situation exemplifies the ongoing need for vigilance against cyber threats in a landscape where exploitation techniques continue to evolve. Utilizing the MITRE ATT&CK framework can aid in understanding the tactics involved in these attacks, including initial access, persistence, and privilege escalation—each highlighting the complexities and risks faced by organizations today. As cyber defenses become paramount, keeping software updated and employing robust cybersecurity practices remain essential for safeguarding sensitive data and systems.
