A recently patched Windows vulnerability, tracked as
, has been actively exploited as a zero-day by a suspected Russia-linked threat group, UAC-0194, in cyberattacks targeting Ukrainian entities. Discovered by ClearSky in June 2024, the vulnerability is an NTLM hash disclosure spoofing flaw that allows attackers to steal NTLMv2 hashes with minimal user interaction, such as right-clicking or deleting a malicious URL file. The attack chain begins with phishing emails originating from compromised Ukrainian government servers, directing victims to download ZIP files containing a URL file. Interaction with the file triggers the exploit, connecting to an attacker-controlled command-and-control (C2) server to download additional malware, including the open-source SparkRAT, enabling remote system control. The stolen NTLMv2 hashes can facilitate pass-the-hash attacks or be cracked to reveal plaintext passwords. Microsoft patched the vulnerability in November 2024, confirming its impact on all supported Windows versions. CERT-UA and the U.S. Cybersecurity and Infrastructure Security (CISA) agencey have also issued warnings, emphasizing the critical risk posed by this flaw. The flaw has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies secure their systems by no later than December 3, 2024. CTIX analysts
- Security Week:
CVE-2024-43451
- The Hacker News:
CVE-2024-43451
- Bleeping Computer:
CVE-2024-43451