Threat Management, Malware

Evolving exploit builder kit ThreadKit used for RAT and banking trojan campaigns


Researchers from Proofpoint last week revealed a new exploit builder kit that has been used by the sophisticated Cobalt Gang cybercriminal group, as well as other attackers who have used it to spread malware including banking trojans and remote access trojans.

Dubbed ThreadKit, the kit has evolved several times since it its activity was first identified in June 2017, according to a Proofpoint blog post detailing the various changes. The most recent iteration, seen in the wild in February and March 2018, includes exploits for the use-after-free Adobe Flash Player bug CVE-2018-4878 and the Microsoft Office remote code execution flaws CVE-2018-0802 and CVE-2017-8570. Proofpoint reports recently observing a  "large spike" in email campaigns featuring ThreadKit-generated Office attachments exploiting these two added Microsoft bugs, as well as a third, CVE-2017-11882, a memory corruption vulnerability that was added last November.

According to Proofpoint, ThreadKit bears similarities to the Microsoft Word Intruder (WMI) kit, yet is its own distinct entity. The kit offers users the ability to track infection statistics and is associated with the banking malwares Trickbot and Chthonic and the RATs FormBook and Loki Bot.

Initial clues to Threadkit's existence emerged last summer when Proofpoint researchers saw a forum advertising the toolset. At the time, the kit exploited the Windows arbitrary code execution vulnerability CVE-2017-0199 in order to download and execute an HTA file. This file introduced a decoy doc and malicious VBScript that would extract and run the embedded downloader Smoke Loader, which subsequently produced Trickbot.

Then in October, a new build of the kit added an exploit for the Microsoft .NET Framework RCE bug CVE-2017-8759. One month later, CVE-2017-11882 was added.

"Document exploit builder kits like ThreadKit enable even low-skilled threat actors to take advantage of the latest vulnerabilities to distribute malware," state blog post authors and Proofpoint researchers "Axel F" and Matthew Mesa. "Organizations and individuals can mitigate the risk from ThreadKit and other document exploit-based attacks by ensuring that clients are patched for the latest vulnerabilities in Microsoft office and other applications.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.