WinRAR Flaw Exposes Russian and Chinese Threat Actors

Wajahat Raja

November 2, 2023 - TuxCare expert team

In recent times, security experts have detected a surge in cyber threats linked to the exploitation of a known vulnerability, CVE-2023-38831, in WinRAR, a widely used file archiver tool for Windows. These cyber-threats originate from both Russian and Chinese government-backed hacking groups, underlining the urgency of maintaining vigilant cybersecurity practices. In this blog, we will delve into the details of this WinRAR flaw and discuss how you can safeguard your systems against it.

Understanding the WinRAR Flaw

CVE-2023-38831 is a logical vulnerability in WinRAR that enables attackers to execute arbitrary code when a user attempts to open a benign file within a ZIP archive. This vulnerability came to the forefront in early 2023, initially exploited by cybercriminals who took advantage of the fact that defenders were unaware of it. RARLabs, the company behind WinRAR, promptly released an updated version of the software in August 2023, which addressed this issue. However, many users remain vulnerable as they have yet to update their software.

The flaw is rooted in the way WinRAR handles temporary file expansion when processing specially crafted archives. When a user tries to view a file within an archive, WinRAR looks for the corresponding directory and extracts both the selected file and the files inside that directory to a temporary location. During this process, WinRAR normalizes file paths, removing appended spaces. However, a quirk in the way Windows’ ShellExecute functions adds complexity to the problem.

When WinRAR calls ShellExecute, it provides a path with a trailing space to open the user-selected file. ShellExecute attempts to identify file extensions, and when it encounters a space in the extension, it uses a default search logic to identify the executable file. This is the crux of the issue. The presence of a space anywhere in the file extension can trigger the vulnerability, leading to unintended code execution.

Implications and Exploitations

The exploitation of CVE-2023-38831 has grave implications. As outlined in a blog post by Group-IB, cybercriminals were exploiting WinRAR flaws as a zero-day, long before the public was aware of it. They used it to launch campaigns targeting financial traders, distributing various commodity malware families. To make matters worse, shortly after the vulnerability was disclosed, proof-of-concept and exploit generators were made available in public repositories, making it easier for malicious actors to experiment with the vulnerability.

Campaigns By Threat Actors

Numerous campaigns have emerged, highlighting the severity of the situation:

FROZENBARENTS Targeting Energy Sector: This group, allegedly linked to the Russian Armed Forces’ Main Directorate of the General Staff, targeted the energy sector. They used an email campaign impersonating a Ukrainian drone warfare training school. The email contained a link to a malicious ZIP file exploiting CVE-2023-38831. The payload included a Rhadamanthys infostealer, which can collect sensitive information, and surprisingly, this infostealer is usually employed by cybercriminals.
FROZENLAKE and Ukrainian Government Organizations: FROZENLAKE, attributed to Russian GRU, targeted Ukrainian government organizations. They employed a free hosting provider to serve CVE-2023-38831 to their victims. This campaign used a fake event invitation as a lure to deliver malware targeting energy infrastructure.
ISLANDDREAMS Targeting Papua New Guinea: This campaign, reportedly orchestrated by Chinese government-backed groups, targeted Papua New Guinea. They used a phishing email with a Dropbox link containing the CVE-2023-38831 exploit. The payload, ISLANDSTAGER, is a .NET backdoor that leverages Dropbox’s API as a communication mechanism.

Lessons Learned

The widespread exploitation of the WinRAR security issue underscores the critical importance of staying up-to-date with software patches. Even the most sophisticated attackers will take advantage of known vulnerabilities, and it is incumbent upon users and organizations to keep their systems secure. It is not enough to merely be aware of a vulnerability; swift action to apply patches is essential.

Securing Your Systems

Protecting your systems against such threats requires a proactive approach:

Update WinRAR: The first and foremost step is to ensure that your WinRAR installation is updated to the latest version. RARLabs has released WinRAR vulnerability patches to address this vulnerability, and updating your software is the most effective way to protect yourself.
Practice Vigilant Cyber Hygiene: Be cautious when opening attachments or links in emails, especially if they are unexpected or from unknown sources. Cybercriminals often use social engineering to trick users into executing malicious files.
Leverage Security Tools: Consider using security tools like Google’s Safe Browsing and Gmail, which can help block files containing known exploits. These tools act as an additional layer of defense against threats.
Implement a Robust Patch Management Strategy: Organizations should have a well-defined patch management strategy in place. Regularly check for software updates and patches and promptly apply them to all relevant systems.
User Training: Educate your team about the importance of timely software updates and cybersecurity best practices. Users are often the first line of defense against cyber threats.
Monitoring and Incident Response: Implement robust monitoring systems and have an incident response plan in place. Being able to detect and respond to a breach is crucial in mitigating potential damage.

Conclusion

The recent exploits related to WinRAR remind us that even well-known vulnerabilities can pose a significant threat. Cybercriminals and state-sponsored actors are quick to capitalize on these weaknesses, making swift action essential. Staying up-to-date, securing WinRAR software with updates, and adopting vigilant cybersecurity practices are the keys to protecting your systems.

As these threats evolve, so must our defenses, and maintaining a proactive and informed approach to cybersecurity is paramount. In the face of these challenges, the security community remains dedicated to sharing threat intelligence, but the responsibility to secure our systems ultimately lies with users and organizations. Stay safe, stay secure.

The sources for this piece include articles in The Hacker News and Google.

Summary