Better Security, Together

The attack begins with CVE-2024-9680, a use-after-free vulnerability in Firefox’s animation timeline feature. This flaw is exploited when victims visit a malicious webpage, allowing attackers to execute arbitrary shellcode within the browser’s sandbox. Once this initial compromise occurs, the campaign pivots to CVE-2024-49039, a privilege escalation vulnerability in Windows Task Scheduler. By exploiting this, the attackers escape the browser’s sandbox and execute code with elevated privileges.

The attack chain is strategically designed and deceptively simple. Upon visiting a booby-trapped site, the Firefox exploit is triggered to bypass memory protections, injecting shellcode that downloads a secondary payload. This payload exploits the Windows Task Scheduler vulnerability to run a hidden PowerShell process. From there, the RomCom backdoor is downloaded and installed, granting attackers full control over the victim’s system. To ensure persistence, obfuscated PowerShell scripts are used alongside staging servers hosting the malware.

The RomCom backdoor deployed in this campaign is a versatile tool, enabling attackers to execute arbitrary commands, steal sensitive information, and deploy further malicious modules. The attack has been observed targeting victims across multiple sectors, including government, healthcare, and critical infrastructure in Europe and North America. This campaign demonstrates RomCom’s growing sophistication, as the group now incorporates advanced zero-day exploitation into its arsenal.

In a significant development for the UEFI threat landscape, researchers have identified the first UEFI bootkit specifically designed for Linux systems, named Bootkitty by its creators, a group known as BlackCat. While the bootkit is assessed to be a proof-of-concept (PoC) with no evidence of use in real-world attacks.

Bootkitty’s primary objective is to disable the Linux kernel’s signature verification feature and preload two as-yet-unknown ELF binaries during the system startup process. This is achieved via the Linux init process, the first process executed by the kernel upon startup. Additionally, researchers uncovered a potentially related unsigned kernel module that appears to have been developed by the same author(s). This module deploys an ELF binary that facilitates the loading of yet another unknown kernel module, indicating a possible modular architecture.

Bootkitty is signed using a self-signed certificate, which means it cannot execute on systems with UEFI Secure Boot enabled unless an attacker-controlled certificate has been pre-installed. Interestingly, the bootkit contains two unused functions. One of these functions prints special strings to the screen during execution, while the other can display a list of potential authors and individuals who may have contributed to its development. These features, while unused in this PoC, could hint at the bootkit’s future capabilities or provide clues about its creators.

Despite its PoC nature, Bootkitty represents a meaningful advancement in the UEFI threat space by targeting Linux systems. Its discovery challenges the prevailing assumption that modern UEFI bootkits are exclusively a Windows threat, broadening the scope of potential attack surfaces in the Linux ecosystem.