The Russia-aligned threat actor RomCom has been linked to exploiting two zero-day vulnerabilities one in Mozilla Firefox and another in Microsoft Windows. These attacks aim to deliver the RomCom backdoor malware to victim systems.
“In a successful attack, if a victim browses a web page containing the exploit, an adversary can run arbitrary code without any user interaction required (zero click) which in this case led to the installation of RomCom's backdoor on the victim's computer,” said ESET in a report shared with The Hacker News.
Vulnerabilities Involved:
- CVE-2024-9680 (CVSS Score: 9.8) - A use-after-free vulnerability in Firefox’s Animation component. (Patched by Mozilla in October 2024)
- CVE-2024-49039 (CVSS Score: 8.8) - A privilege escalation vulnerability in Windows Task Scheduler. (Patched by Microsoft in November 2024)
RomCom, also known as Storm-0978, Tropical Scorpius, UAC-0180, UNC2596, and Void Rabisu, has been active since at least 2022, conducting both cybercrime and espionage campaigns.
Sophisticated Attack Chain:
These recent attacks use RomCom RAT, a malware capable of executing commands and downloading additional modules on infected systems. The Slovak cybersecurity firm ESET uncovered an attack chain involving a fake website (economistjournal[.]cloud) that redirects victims to a malicious server (redjournal[.]cloud).
The server hosts payloads exploiting both Firefox and Windows vulnerabilities, ultimately installing RomCom RAT. If a victim visits the malicious site using a vulnerable Firefox browser, the following occurs:
- Vulnerability Triggered: The exploit executes shellcode in a Firefox content process.
- Sandbox Escape: Shellcode retrieves a second-stage payload, which includes an embedded library ("PocLowIL") designed to escape Firefox's sandbox.
- Privilege Escalation: The Windows Task Scheduler flaw (CVE-2024-49039) is leveraged to gain elevated privileges and execute RomCom RAT.
Broader Implications:
ESET's telemetry data indicates that most victims were located in Europe and North America. The sophistication of these attacks underscores RomCom's technical capabilities and resources.
This marks the second instance of RomCom exploiting a zero-day vulnerability in the wild, following the abuse of CVE-2023-36884 via Microsoft Word in June 2023.
"Chaining together two zero-day vulnerabilities armed RomCom with an exploit that requires no user interaction," ESET noted. "This level of sophistication shows the threat actor's will and means to obtain or develop stealthy capabilities."
