Skip to main content

Evolving exploit builder kit ThreadKit used for RAT and banking trojan campaigns

posted onApril 4, 2018
by l33tdawg

Researchers from Proofpoint last week revealed a new exploit builder kit that has been used by the sophisticated Cobalt Gang cybercriminal group, as well as other attackers who have used it to spread malware including banking trojans and remote access trojans.

Dubbed ThreadKit, the kit has evolved several times since it its activity was first identified in June 2017, according to a Proofpoint blog post detailing the various changes. The most recent iteration, seen in the wild in February and March 2018, includes exploits for the use-after-free Adobe Flash Player bug CVE-2018-4878 and the Microsoft Office remote code execution flaws CVE-2018-0802 and CVE-2017-8570. Proofpoint reports recently observing a  "large spike" in email campaigns featuring ThreadKit-generated Office attachments exploiting these two added Microsoft bugs, as well as a third, CVE-2017-11882, a memory corruption vulnerability that was added last November.

According to Proofpoint, ThreadKit bears similarities to the Microsoft Word Intruder (WMI) kit, yet is its own distinct entity. The kit offers users the ability to track infection statistics and is associated with the banking malwares Trickbot and Chthonic and the RATs FormBook and Loki Bot.

Source

Tags

Security

You May Also Like

Recent News

Tuesday, November 19th

Friday, November 8th

Friday, November 1st

Tuesday, July 9th

Wednesday, July 3rd

Friday, June 28th

Thursday, June 27th

Thursday, June 13th

Wednesday, June 12th

Tuesday, June 11th