Cobalt Malware: Fortiguard Lab's Kadena Threat Intelligence System (KTIS) discovered a spam campaign that exploited the CVE-2017-11882 vulnerability, which has been known for about 2 decades but was patched by Microsoft in November 2017.
Threat actors, as they are called, exploited this gap and using the penetration tool Cobalt Strike were able to spread the Cobalt malware. Threat actors check for vulnerabilities - mainly old ones - which are not very critical or have been "forgotten" in order to start a malware campaign. In all of this, of course, there is also the user's responsibility as many are those who do not upgrade their operating system and applications to versions that fix any vulnerabilities.
The propagation process is as follows:
An email arrives to users with the subject line “Visa card security policy change” or something similar. The attached file is compressed and password-protected as this blocks automated malware scanning systems from decompressing the file and deleting it.
The Powershell script found in the file starts running on the user's computer without being noticed since it has mechanisms that evade antiviruses, the so-called anti-detection beacons, and gives attackers complete control of the system.
It is worth noting that attackers can load Cobalt Strike and its DLL files (x64 or x86 depending on the system architecture) directly into memory without requiring it to be written to disk, giving it the advantage of avoiding any antimalware programs.
Fortinet recommends that users download the latest updates for their Windows systems as Microsoft appears to have fixed the problem.
