Rhadamanthys Infostealer Exploits Microsoft Management Console to Distribute Malware
Cybersecurity researchers have identified a new tactic used by the Rhadamanthys Infostealer to spread malware, leveraging Microsoft Management Console (MMC) files with the MSC extension. This latest discovery, confirmed by the AhnLab Security Intelligence Center (ASEC), highlights an evolving threat where attackers misuse legitimate administrative tools for malicious purposes.
Methods of Exploitation
The Rhadamanthys Infostealer employs two distinct techniques to distribute malware via MSC files:
1. Exploiting apds.dll Vulnerability (CVE-2024-43572)
Attackers exploit a vulnerability in the apds.dll file by utilizing a resource named “redirect.html.” Through embedded syntax:
The malware executes arbitrary code directly within the vulnerable DLL, bypassing MMC security mechanisms. However, this vulnerability has since been patched, reducing its current effectiveness.
2. Using the Console Taskpad Feature
This method leverages MMC’s built-in Console Taskpad functionality, which allows commands to be embedded within <ConsoleTaskpads> tags in an MSC file. Unlike the DLL exploitation method, this approach does not rely on software vulnerabilities but instead takes advantage of MMC’s legitimate task execution capabilities.
Attackers disguise malicious MSC files as common documents, such as Microsoft Word files. Once opened, these files trigger the execution of a PowerShell script that downloads and runs the Rhadamanthys Infostealer from an external source.
Mitigation and Prevention
While patches have addressed vulnerabilities like CVE-2024-43572, the ongoing misuse of MMC features for malware distribution underscores the need for proactive security measures. Organizations and individuals can protect themselves by:
- Avoiding MSC files from unknown or untrusted sources.
- Keeping all software and operating systems updated with the latest security patches.
- Deploying advanced antivirus solutions capable of detecting unconventional attack vectors.
- Educating users on phishing tactics and recognizing suspicious file formats.
The rise of MSC-based malware campaigns illustrates how cybercriminals continuously refine their methods to exploit overlooked system tools. Staying vigilant against such threats is crucial to maintaining robust cybersecurity defenses against evolving malware like the Rhadamanthys Infostealer.
