Proofpoint discovered a new document exploit builder, ThreadKit

According to cybersecurity firm Proofpoint, their security researchers have discovered a new Microsoft Office document exploit kit that has been used by many cybercriminals (such as Cobalt Gang) to spread the payload of various malware. Includes bank Trojans (such as Trickbot and Chthonic) and backdoor programs (such as FormBook and Loki Bot).

The exploit kit named “ThreadKit” was first discovered in October 2017, but Proofpoint researchers stated that its distribution could start as early as June 2017.

Although the documentation generated by the toolkit is somewhat similar to the documentation generated by Microsoft Word Intruder (MWI), the most influential Microsoft Office malware toolkit, the researchers determined that these documents were generated from a new toolkit. , which is ThreadKit.

In June 2017, ThreadKit was posted on a hacker forum. According to its developer’s description, it can create documents with embedded executables and embedded decoy files.

Researchers stated that ThreadKit does have this capability and has been used in many practical attacks. The document uses the INCLUDEPICTURE field to perform an initial registration of the Command and Control (C&C) server, which is one of the strategies used by the MWI.

These documents used the CVE-2017-0199 vulnerability to download and execute the HTA file, and then download the decoy document and the malicious VB script that can extract and run the embedded executable. This infection chain led to the installation of the malware, the Load Loader, and the Trickbot Trojan, which is the final payload, will be downloaded by the Smoke Loader.

In October 2017, ThreadKit’s developers released a new version that increased the use of CVE 2017-8759 vulnerabilities but continued to use the original C&C registry and HTA files to execute embedded executables. The difference is that the new version has changed the way the exploit files are run, and the final payload of the transfer has been switched to the Chthonic Trojan Trojan.

At the end of 2017, ThreadKit promises to integrate the latest Microsoft Office exploits into ThreadKit in the shortest possible time. In the new version released on November 21, 2017, the CVE 2017-11882 vulnerability has been exploited.

In February and March of this year, ThreadKit was added in a very short time to exploit multiple vulnerabilities, including Adobe Flash Zero-day Vulnerability (CVE-2018-4878) and two Microsoft Office vulnerabilities (CVE-2018). -0802 and CVE-2017-8570).

In addition, this version of ThreadKit also contains significant modifications to embedded bait and malware extraction and execution, and the final payload of the switch was switched to Neutrino Bot for building botnets.

Proofpoint stated that ThreadKit is a relatively new and very popular document exploit kit. Since at least June 2017, it has been used by many cybercrime groups to carry out various attacks. And it’s extremely easy to use, even if only a low-skilled malicious attacker can use it to take advantage of the latest Microsoft Office vulnerabilities.

ThreadKit can be used to distribute a variety of malicious software, which brings widespread and uncertain potential threats to a wide range of computer users. Therefore, Proofpoint recommends that individuals or organizations ensure that the latest released security patches for Microsoft Office or other applications are installed in a timely manner. This mitigates the risk of cyber attacks caused by ThreadKit or other exploit tools.

Source: Proofpoint