Week of July 10, 2023

Deep Instinct released a proof-of-concept tool called ContainYourself, presented at DEFCON 31, that abuses the Windows containers isolation framework to bypass endpoint detection and response (EDR) systems. The technique evades file-system-based malware protection, file write restrictions, and ETW-based correlations. The repository includes a static library, a PoC tool, and wiper/ransomware projects.

Microsoft identified a phishing campaign by Russian threat actor Storm-0978 targeting defense and government entities in Europe and North America. The campaign exploited CVE-2023-36884, a remote code execution vulnerability in Microsoft Word, to deliver a backdoor similar to RomCom. The actor also conducts financially motivated ransomware attacks using Underground ransomware, a rebrand of Industrial Spy.

CVE-2023-36874 is a local privilege escalation vulnerability in the Windows Error Reporting (WER) service. An attacker with low-level user access can exploit this flaw to gain SYSTEM privileges, enabling full system compromise. The vulnerability is actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities catalog.

A proof-of-concept demonstrates bypassing Themida 3.x.x's CHECK_CODE_INTEGRITY macro by hooking VirtualAlloc and inducing an access violation to skip the CRC comparison. This technique undermines the anti-tampering protection of software protected by Themida, potentially allowing reverse engineering or modification of protected applications.