Operation Powerfall.. Zero Day Chain Attack 📿📿
Share this:
An attack launched in May 2020 against a South Korean company involved an exploit that chained zero-day vulnerabilities in Windows and Internet Explorer.
The campaign, named by the company “Operation PowerFall”, a threat actor that has been known to target entities with an interest in North Korea and which some believe may be sponsored by South Korea.
The vulnerabilities exploited in the attack have now been patched, but they had a zero-day status when exploitation was first observed.
One of them is CVE-2020-1380, one of the two zero-day vulnerabilities patched by Microsoft this week with its August 2020 Patch Tuesday updates. CVE-2020-1380 affects Internet Explorer 11 and it can be exploited for remote code execution by getting the targeted user to open a specially crafted website or document, or through a malvertising attack.
Internet Explorer isolation mechanisms make this vulnerability less useful on its own, which is why the threat actor behind Operation PowerFall chained it with CVE-2020-0986, a privilege escalation flaw affecting all supported versions of Windows.
Microsoft fixed this Windows vulnerability in June, but its details were disclosed as Zero Day Initiative (ZDI) along with four other unpatched security holes affecting Windows. ZDI disclosed CVE-2020-0986, which it reported to Microsoft in December 2019, after the tech giant missed a six-month deadline and failed to release a patch in May.
The cybersecurity firm pointed out that this exploit chain targeted the latest Windows 10 builds. The company previously saw a similar exploit chain, which involved exploitation of a Chrome zero-day alongside a Windows zero-day, being used in a campaign it named Operation WizardOpium, the exploit used in the WizardOpium attacks did not work on the latest Windows 10 builds.
The hackers used the exploit chain to deliver a piece of malware, but the researchers could not analyze the final payload because its products prevented it from being downloaded.
Microsoft’s advisory for CVE-2020-0986 does not list the vulnerability as being exploited — it’s listed as “less likely” to be exploited.
The patch for the RCE exploit was still not ready, and making it public that we are aware of the attack would warn the attackers. The attackers would know that their exploit is already exposed and they would begin to use it while they can.
