Week of April 22, 2024

A security researcher published a proof-of-concept showing how Runtime Application Self-Protection (RASP) in Java applications can be bypassed using process injection. The technique hijacks the JVM from another process to remove RASP instrumentation probes, undermining the protection. This highlights a weakness in instrumentation-based RASP when the underlying OS environment is compromised.

CVE-2023-24880 is a zero-day vulnerability in Windows SmartScreen that allows attackers to bypass Mark of the Web (MOTW) defenses. Exploited in the wild by financially motivated actors to distribute Magniber ransomware via crafted MSI files with invalid Authenticode signatures. The flaw stems from an incomplete fix for CVE-2022-44698.

The CoralRaider threat group is conducting a campaign using malicious LNK files to evade antivirus detection and deliver infostealer malware. The attack chain leverages PowerShell, HTA files, and FoDHelper.exe to bypass UAC and add Windows Defender exclusions, ultimately deploying CryptBot, LummaC2, or Rhadamanthys payloads.

Hackers performed man-in-the-middle attacks on eScan antivirus updates delivered over HTTP, replacing genuine updates with malware tracked as GuptiMiner. The operation lasted at least five years, leveraging DLL hijacking and custom DNS for stealth. Avast researchers disclosed the issue, and eScan confirmed a fix on 2023-07-31.

SafeBreach researchers disclosed vulnerabilities in Microsoft Defender and Kaspersky EDR that allow attackers to remotely delete legitimate files by inserting malware byte signatures into them, causing false-positive detections. Microsoft issued patches (CVE-2023-24860, CVE-2023-3601) but initial fixes were bypassed, while Kaspersky acknowledged the issue as a design limitation. The flaws highlight risks in signature-based detection and the difficulty of fully mitigating such design-level weaknesses.