Keylogger Installed Using MS Office Equation Editor Vulnerability (Kimsuky)
June 13, 2024, 10:33 a.m.
Description
This technical analysis examines a campaign by the Kimsuky threat group that exploited a vulnerability (CVE-2017-11882) in the Microsoft Office Equation Editor to distribute malware. The attackers used mshta.exe to run a malicious script that downloads additional components, including a keylogger. The keylogger collects system information, keystrokes, and clipboard data, which are sent to a command-and-control server. The report highlights the importance of patching vulnerabilities and keeping software up-to-date to prevent such attacks.
Tags
Date
- Created: June 13, 2024, 10:14 a.m.
- Published: June 13, 2024, 10:14 a.m.
- Modified: June 13, 2024, 10:33 a.m.