Week of June 19, 2023

Proofpoint disclosed CVE-2023-2818, an insecure filesystem permission vulnerability in the Insider Threat Management (ITM) Agent for Windows. Local unprivileged users can disrupt event reporting. The vulnerability affects versions prior to 7.14.3 and has been patched.

Securonix Threat Labs identified the MULTI#STORM attack campaign delivering Warzone RAT and Quasar RAT via phishing emails. The attack begins with a password-protected ZIP containing an obfuscated JavaScript file that downloads and executes a Python-based loader from OneDrive. The loader establishes persistence and drops multiple RAT payloads, targeting victims in the US and India.

Freeze is a payload toolkit that bypasses EDR detection by spawning a suspended process to obtain an unhooked copy of ntdll.dll's .text section, then overwrites the hooked .text section in its own process before executing shellcode via direct syscalls. It also patches ETW syscalls to suppress telemetry. The technique leverages the fact that ntdll.dll is loaded before EDR DLLs and that DLL base addresses are constant per boot due to ASLR behavior.