Microsoft on Thursday stated it is as soon as once more disabling the ms-appinstaller protocol handler by default following its abuse by a number of menace actors to distribute malware.
“The noticed menace actor exercise abuses the present implementation of the ms-appinstaller protocol handler as an entry vector for malware that will result in ransomware distribution,” the Microsoft Menace Intelligence workforce stated.
It additional famous that a number of cybercriminals are providing a malware equipment on the market as a service that leverages the MSIX file format and ms-appinstaller protocol handler. The modifications have gone into impact in App Installer model 1.21.3421.0 or greater.
The assaults take the type of signed malicious MSIX software packages which are distributed through Microsoft Groups or malicious commercials for respectable fashionable software program on search engines like google like Google.
From USER to ADMIN: Be taught How Hackers Acquire Full Management
Uncover the key techniques hackers use to change into admins, tips on how to detect and block it earlier than it is too late. Register for our webinar right now.
Not less than 4 completely different financially motivated hacking teams have been noticed benefiting from the App Installer service since mid-November 2023, utilizing it as an entry level for follow-on human-operated ransomware exercise –
- Storm-0569, an preliminary entry dealer which propagates BATLOADER via search engine marketing (search engine optimisation) poisoning with websites spoofing Zoom, Tableau, TeamViewer, and AnyDesk, and makes use of the malware to ship Cobalt Strike and handoff the entry to Storm-0506 for Black Basta ransomware deployment.
- Storm-1113, an preliminary entry dealer that makes use of bogus MSIX installers masquerading as Zoom to distribute EugenLoader (aka FakeBat), which acts as a conduit for quite a lot of stealer malware and distant entry trojans.
- Sangria Tempest (aka Carbon Spider and FIN7), which makes use of Storm-1113’s EugenLoader to drop Carbanak that, in flip, delivers an implant referred to as Gracewire. Alternatively, the group has relied on Google adverts to lure customers into downloading malicious MSIX software packages from rogue touchdown pages to distribute POWERTRASH, which is then used to load NetSupport RAT and Gracewire.
- Storm-1674, an preliminary entry dealer that sends harmless-looking touchdown pages masquerading as Microsoft OneDrive and SharePoint via Groups messages utilizing the TeamsPhisher device, urging recipients to open PDF recordsdata that, when clicked, prompts them to replace their Adobe Acrobat Reader to obtain a malicious MSIX installer that accommodates SectopRAT or DarkGate payloads.
Microsoft described Storm-1113 as an entity that additionally dabbles in “as-a-service,” offering malicious installers and touchdown web page frameworks mimicking well-known software program to different menace actors equivalent to Sangria Tempest and Storm-1674.
In October 2023, Elastic Safety Labs detailed one other marketing campaign wherein spurious MSIX Home windows app bundle recordsdata for Google Chrome, Microsoft Edge, Courageous, Grammarly, and Cisco Webex have been used to distribute a malware loader dubbed GHOSTPULSE.
This isn’t the primary time Microsoft has disabled the MSIX ms-appinstaller protocol handler in Home windows. In February 2022, the tech large took the identical step to stop menace actors from weaponizing it to ship Emotet, TrickBot, and Bazaloader.
“Menace actors have possible chosen the ms-appinstaller protocol handler vector as a result of it could bypass mechanisms designed to assist hold customers secure from malware, equivalent to Microsoft Defender SmartScreen and built-in browser warnings for downloads of executable file codecs,” Microsoft stated.
