VenomRAT malware spread via fake WinRAR PoC
A dangerous exploit exploiting WinRAR RCE vulnerability spreads VenomRAT malware
Threat actor releases fake PoC to exploit vulnerabilities in WinRAR, spreading VenomRAT malware via GitHub. Attacks of this type are common and target researchers analyzing vulnerabilities.
This pill is also available in Italian language
An unknown threat actor has released a fake proof of concept (PoC) to exploit the recently patched CVE-2023-4047 Remote Code Execution (RCE) vulnerability in WinRAR, to spread the VenomRAT malware.
The fake WinRAR PoC
On August 17, 2023, Trend Micro's Zero Day Initiative reported RCE vulnerability (CVE-2023-4047) that allowed threat actors to execute arbitrary code on an affected WinRAR installation.
The GitHub repository and the spread of malware
The attacker (“whalersplonk”) took the opportunity to release a fake PoC on GitHub just four days after the vulnerability was publicly announced.
Malware spreads through PoCs
This is not the first time malware spreaders have used this technique; Threat actors often target researchers seeking public PoCs to help them analyze and understand vulnerabilities.
Follow us on Twitter for more pills like this09/21/2023 11:08
Marco Verro