Chinese ToddyCat abuses ESET antivirus bug for malicious activities – Source: www.csoonline.com

China-backed APT group ToddyCat has been found exploiting a medium-severity vulnerability in ESET antivirus software to sneak malicious code onto vulnerable systems.

Tracked as CVE-2024-11859, the flaw is a dynamic link library (DLL) search order hijacking vulnerability discovered and reported by Kaspersky last year, with a fix issued by ESET in January.

“On systems with an affected ESET product installed, an attacker could plant a malicious dynamic-link library to a specific folder and execute its content by running ESET Command Line Scanner, which would load the planted library instead of the intended system library,” ESET said in an advisory.

The company is urging customers using its consumer, business, and server security products to upgrade to a fixed build of the antivirus.

Tricking malicious DLL execution

CVE-2024-11859 is a CVSS 6.8/10 flaw stemming from the way one of ESET’s antivirus tools (command line scanner) loads a requested DLL. Instead of looking for the DLL in a trusted system directory, the tool starts by looking in the current directory, a fact being abused to plant DLL with malicious codes for execution.

To exploit the flaw, however, the attacker needs to have administrative-level privileges on the targeted system.

ToddyCat was found exploiting this flaw in its campaigns since early 2024, using it to plant a 64-bit DLL containing the “TCESB” malware written in C++, Kaspersky said in a blog post.

“While investigating ToddyCat-related incidents, we detected a suspicious file named version.dll in the temp directory on multiple devices,” Kaspersky said. “Previously unseen in ToddyCat attacks, it is designed to stealthily execute payloads in circumvention of protection and monitoring tools installed on the device.”

Once executed, TCESB reads the running kernel version and disables notification routines, installs a vulnerable driver for defense evasion, and launches the final payload that Kaspersky was unable to obtain samples of.

A range of affected products

The flaw affects all of ESET offerings with the command line scanner which includes an array of products used by power users, IT admins, and enterprise environments.

According to the advisory, the affected antivirus versions include ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security Premium, and ESET Security Ultimate 18.0.12.0 and earlier. Affected Windows offerings include Endpoint Antivirus for Windows and Endpoint Security for Windows 12.0.2038.0 and earlier.

Affected Enterprise offerings include ESET Small Business Security and ESET Safe Server 18.0.12 and earlier. All affected versions have been fixed in the respective latest upgrades. Kaspersky has shared indicators of compromise (IoC) to help detect traces of ToddyCat activities. “To detect the activity of such tools, it’s recommended to monitor systems for installation events involving drivers with known vulnerabilities.” Using operating system tools to check all loaded system library files for the presence of malicious files, like version.dll, was also recommended.