Microsoft fixes two Windows zero-days exploited in malware attacks

Microsoft has fixed two actively exploited zero-day vulnerabilities during the April 2024 Patch Tuesday, although the company failed to initially tag them as such.

The first, tracked as CVE-2024-26234 and described as a proxy driver spoofing vulnerability, was issued to track a malicious driver signed using a valid Microsoft Hardware Publisher Certificate that was found by Sophos X-Ops in December 2023 and reported by team lead Christopher Budd.

This malicious file was labeled as "Catalog Authentication Client Service" by "Catalog Thales," likely an attempt to impersonate Thales Group. However, further investigation revealed that it was previously bundled with a marketing software called LaiXi Android Screen Mirroring.

While Sophos couldn't verify the authenticity of LaiXi software, Budd says they're confident the file is a malicious backdoor.

"Just as we did in 2022, we immediately reported our findings to the Microsoft Security Response Center. After validating our discovery, the team at Microsoft has added the relevant files to its revocation list (updated today as part of the usual Patch Tuesday cycle; see CVE-2024-26234)," Budd said.

Sophos' findings confirm and build upon information shared in a January report by cybersecurity company Stairwell and a tweet by reverse engineering expert Johann Aydinba.

Since its release earlier today, Redmond has updated the advisory to correct CVE-2024-26234's exploitation status, confirming it as exploited in the wild and publicly disclosed.

Sophos reported other malicious drivers signed with legitimate WHCP certificates in July 2023 and December 2022, but for those, Microsoft published security advisories instead of issuing CVE-IDs like today.

MotW bypass exploited in malware attacks

The second zero-day silently patched today by Microsoft is tracked as CVE-2024-29988 and described as a SmartScreen prompt security feature bypass vulnerability caused by a protection mechanism failure weakness.

CVE-2024-29988 is a bypass for the CVE-2024-21412 flaw and was reported by Peter Girnus of Trend Micro's Zero Day Initiative and Google's Threat Analysis Group Dmitrij Lenz and Vlad Stolyarov.

ZDI's Head of Threat Awareness Dustin Childs tagged it as actively used in attacks to deploy malware on targeted Windows systems after evading EDR/NDR detection and bypassing the Mark of the Web (MotW) feature.

"This vulnerability is related to CVE-2024-21412, which was discovered by ZDI threat researchers in the wild and first addressed in February," Childs told BleepingComputer.

"The first patch did not completely resolve the vulnerability. This update addresses the second part of the exploit chain. Microsoft did not indicate they were patching this vulnerability, so it was a (welcome) surprise when the patch went live."

The financially motivated Water Hydra hacking group that exploits CVE-2024-29988 also used CVE-2024-21412 as a zero-day on New Year’s Eve to target forex trading forums and stock trading Telegram channels in spearphishing attacks that deployed the DarkMe remote access trojan (RAT).

CVE-2024-21412 was itself a bypass for another Defender SmartScreen vulnerability tracked as CVE-2023-36025, patched during the November 2023 Patch Tuesday and exploited as a zero-day to drop Phemedrone malware.

Today, Microsoft released security updates for 150 vulnerabilities as part of April 2024's Patch Tuesday, 67 of which were remote code execution bugs.

A Microsoft spokesperson couldn't immediately provide a statement when contacted by BleepingComputer earlier today.