Olivier Le Moal - stock.adobe.co

News Stay informed about the latest enterprise technology news and product updates.

U.S. Cybercom warns Outlook vulnerability under attack

U.S. Cybercom issued an alert about active exploitation of a 2-year-old Microsoft Outlook flaw, and experts say an Iranian threat group is behind the attacks.

U.S. Cyber Command issued an alert urging users to patch a 2-year-old Outlook vulnerability due to active attacks in the wild. But security researchers said U.S. Cybercom is a little late to the game. 

The official U.S. Cybercom Twitter account for malware alerts wrote on Tuesday afternoon that Cybercom "has discovered active malicious use of CVE-2017-11774 and recommends immediate patching." This is the first time the U.S. Cybercom Twitter account was used to warn of active attacks. Previously, the account only tweeted when Cybercom added malware to VirusTotal.

That Outlook vulnerability was patched by Microsoft in October 2017, and it was described at the time as a security feature bypass vulnerability affecting Outlook 2010, 2013 and 2016. Since the flaw was patched, both FireEye Mandiant and Chronicle security researchers connected attacks using that vulnerability to the malware actors behind the Shamoon wiper malware. Shamoon had been used in attacks aimed at disrupting operations in the energy sector.

Nick Carr, senior manager of the advanced practices team at FireEye, based in Milpitas, Calif., noted on Twitter that FireEye had reported attacks using this Outlook vulnerability in December, and "the malware families, Yara rules, [and] hunting methods shared still apply to this attacker's current campaign (mid-June to present)."

FireEye and Chronicle researchers said attacks on this vulnerability were linked to APT33, a threat group believed to be based in Iran, and specifically related to attacks using the Shamoon wiper malware. Researchers originally speculated that APT33 used spear phishing attacks on targets in the engineering industry.

Brandon Levene, head of applied intelligence at Chronicle, based in Mountain View, Calif., said this U.S. Cybercom alert could shed "some light on how the Shamoon attackers were able to compromise their targets."

Although U.S. Cybercom did not mention Iran or the Shamoon wiper malware as part of this alert on Outlook attacks, Christopher Krebs, director of the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency,  issued a warning on June 22, saying, "Iranian regime actors and proxies are increasingly using destructive 'wiper' attacks, looking to do much more than just steal data and money."

Dig Deeper on Emerging cyberattacks and threats

Join the conversation

4 comments

Send me notifications when other members comment.

Please create a username to comment.

What is your organization's patch remediation process?
Cancel
Given the propensity of U.S. agencies to lie and the demonstrated inability of any U.S. Government to honor commitments one would have to be beyond gullible to believe that the Outlook attacks were of Iranian origin. As always no proof, no independent verification. Likelihood of falsity: 9.9 repeating.
Cancel
Given the propensity of U.S. agencies to lie and the demonstrated inability of any U.S. Government to honor commitments one would have to be beyond gullible to believe that the Outlook attacks were of Iranian origin. As always no proof, no independent verification. Likelihood of falsity: 9.9 repeating.
Cancel
I am SME for appsec but would like to know about patch remediation process 
Cancel

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly.com

Close