Researchers from Proofpoint last week revealed a new exploit builder kit that has been used by the sophisticated Cobalt Gang cybercriminal group, as well as other attackers who have used it to spread malware including banking trojans and remote access trojans.
Dubbed ThreadKit, the kit has evolved several times since it its activity was first identified in June 2017, according to a Proofpoint blog post detailing the various changes. The most recent iteration, seen in the wild in February and March 2018, includes exploits for the use-after-free Adobe Flash Player bug CVE-2018-4878 and the Microsoft Office remote code execution flaws CVE-2018-0802 and CVE-2017-8570. Proofpoint reports recently observing a "large spike" in email campaigns featuring ThreadKit-generated Office attachments exploiting these two added Microsoft bugs, as well as a third, CVE-2017-11882, a memory corruption vulnerability that was added last November.
According to Proofpoint, ThreadKit bears similarities to the Microsoft Word Intruder (WMI) kit, yet is its own distinct entity. The kit offers users the ability to track infection statistics and is associated with the banking malwares Trickbot and Chthonic and the RATs FormBook and Loki Bot.
Initial clues to Threadkit's existence emerged last summer when Proofpoint researchers saw a forum advertising the toolset. At the time, the kit exploited the Windows arbitrary code execution vulnerability CVE-2017-0199 in order to download and execute an HTA file. This file introduced a decoy doc and malicious VBScript that would extract and run the embedded downloader Smoke Loader, which subsequently produced Trickbot.
Then in October, a new build of the kit added an exploit for the Microsoft .NET Framework RCE bug CVE-2017-8759. One month later, CVE-2017-11882 was added.
"Document exploit builder kits like ThreadKit enable even low-skilled threat actors to take advantage of the latest vulnerabilities to distribute malware," state blog post authors and Proofpoint researchers "Axel F" and Matthew Mesa. "Organizations and individuals can mitigate the risk from ThreadKit and other document exploit-based attacks by ensuring that clients are patched for the latest vulnerabilities in Microsoft office and other applications.
