Evolving exploit builder kit ThreadKit used for RAT and banking trojan campaigns

Researchers from Proofpoint last week revealed a new exploit builder kit that has been used by the sophisticated Cobalt Gang cybercriminal group, as well as other attackers who have used it to spread malware including banking trojans and remote access trojans.

Dubbed ThreadKit, the kit has evolved several times since it its activity was first identified in June 2017, according to a Proofpoint blog post detailing the various changes. The most recent iteration, seen in the wild in February and March 2018, includes exploits for the use-after-free Adobe Flash Player bug CVE-2018-4878 and the Microsoft Office remote code execution flaws CVE-2018-0802 and CVE-2017-8570. Proofpoint reports recently observing a  "large spike" in email campaigns featuring ThreadKit-generated Office attachments exploiting these two added Microsoft bugs, as well as a third, CVE-2017-11882, a memory corruption vulnerability that was added last November.

According to Proofpoint, ThreadKit bears similarities to the Microsoft Word Intruder (WMI) kit, yet is its own distinct entity. The kit offers users the ability to track infection statistics and is associated with the banking malwares Trickbot and Chthonic and the RATs FormBook and Loki Bot.