Cybersecurity Alert: Paper Werewolf Exploits WinRAR Vulnerabilities

Overview

A new cybersecurity threat, dubbed "Paper Werewolf," has emerged, exploiting vulnerabilities in the widely used WinRAR software to deliver harmful malware. This issue was uncovered by cybersecurity companies ESET and BI.ZONE, highlighting significant implications for users who have not updated their software.

Method of Attack

According to BI.ZONE, the Paper Werewolf group delivered these exploits via email attachments that impersonated employees of the All-Russian Research Institute during July and August. The ultimate aim was to install malware that would provide unauthorized access to affected systems.

While the findings from ESET and BI.ZONE were independent, the potential link between the groups involved in the attacks remains unclear. BI.ZONE hypothesizes that Paper Werewolf may have acquired these vulnerabilities from underground crime forums, suggesting organized activity behind the attacks.

Execution Chains

ESET observed that the cyber attacks followed three specific execution chains. One involved a malicious DLL file hidden in an archive, utilizing a technique called COM hijacking. This technique allows the malicious file to execute through trusted applications, including Microsoft Edge.

The malware worked by decrypting embedded shellcode, which then compared the domain name of the affected machine with a hardcoded value. If the values matched, the shellcode proceeded to install a custom instance of the Mythic Agent exploitation framework.

A second execution chain involved a malicious Windows executable delivering SnipBot, a recognized piece of RomCom malware that blocks forensic analysis by terminating if opened in a virtual machine or sandbox. Lastly, a third chain utilized two additional forms of RomCom malware known as RustyClaw and Melting Claw.

Historical Vulnerabilities

Exploits in WinRAR are not a new phenomenon. Notably, a code-execution vulnerability identified in 2019 was rapidly exploited following patch release. Furthermore, in 2023, a zero-day vulnerability went undetected for four months, underlining the persistent risks associated with the software.

WinRAR’s extensive user base makes it an attractive target for cybercriminals. Compounding the issue is the lack of an automated update mechanism, requiring users to manually download and install security patches. ESET has advised users to avoid all WinRAR versions prior to 7.13, which at the time of this report was the most recent version with fixes for known vulnerabilities.

Security Recommendations

Given the severity of these vulnerabilities and the risks of infection, users of WinRAR are strongly encouraged to:

• Update to the latest version (7.13 or higher).
• Remain vigilant against suspicious email attachments, especially those purporting to be from legitimate sources.
• Regularly implement cybersecurity hygiene practices, including the use of comprehensive antivirus software.

Conclusion

The emergence of the Paper Werewolf group is a stark reminder of the continuous and evolving threats in the cybersecurity landscape. As cybercriminals exploit vulnerabilities in widely used software like WinRAR, the onus remains on users to take proactive measures to safeguard their systems. With no assurance that new vulnerabilities won’t surface, the potential for future breaches looms large, emphasizing the criticality of timely updates and user awareness in the prevention of cyber threats.