Windows Zero-Day Exploited by Russia Triggered with File Drag-and-Drop, Delete

A newly discovered zero-day vulnerability in Windows, tracked as CVE-2024-43451, has been exploited by suspected Russian threat actors, particularly targeting Ukrainian entities. This medium-severity flaw affects the MSHTM engine, which is utilized by the Edge browser in Internet Explorer mode and other applications. The exploit can be triggered with minimal user interaction, such as deleting or drag-and-dropping files, or right-clicking on them. Successful exploitation allows attackers to steal NTLMv2 hashes, enabling pass-the-hash attacks to authenticate as the targeted user. ClearSky, the cybersecurity firm that identified the flaw, reported it to Microsoft in June 2024. The attackers used phishing emails from a compromised Ukrainian government server, prompting victims to download malicious ZIP files containing a PDF and a URL file designed to exploit this vulnerability. The URL file connects to an external server to download additional malicious files, including SparkRAT malware. The vulnerability is more easily exploited on Windows 10 and 11 compared to older versions. The Computer Emergency Response Team of Ukraine (CERT-UA) has linked the exploitation of this zero-day to a threat actor known as UAC-0194.

- A new Windows zero-day vulnerability (CVE-2024-43451) has been exploited by Russian threat actors.

- The exploit requires minimal user interaction, such as file deletion or right-clicking.

- Successful exploitation allows attackers to steal NTLMv2 hashes for authentication.

- The vulnerability primarily targets Ukrainian entities through phishing attacks.

- It is more easily exploited on Windows 10 and 11 than on older versions.