{"id":49280,"date":"2024-05-09T18:56:13","date_gmt":"2024-05-09T15:56:13","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=49280"},"modified":"2026-03-28T05:45:26","modified_gmt":"2026-03-28T02:45:26","slug":"apts-most-frequently-target-vulnerable-remote-control-tools-and-winrar-in-2024-attacks","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/apts-most-frequently-target-vulnerable-remote-control-tools-and-winrar-in-2024-attacks\/","title":{"rendered":"APTs most frequently target vulnerable remote control tools and WinRAR in 2024 attacks"},"content":{"rendered":"\n

9 May 2024<\/strong><\/p>\n\n\n\n

Advanced Persistent Threat (APT) actors are targeting vulnerable remote access services and access control mechanisms like Windows Smart Screen in their attacks leveraging vulnerability exploitation, the latest research by Kaspersky has revealed.\u00a0\u00a0Analysis of available data on exploits used in APT attacks in 2023-2024 also shows that office applications like Microsoft Office and WinRAR are frequent targets.\u00a0<\/strong><\/p>\n\n\n\n

Although APT attacks rarely occur, they pose a significant threat to large corporations. Threat actors usually target specific objectives, and endeavor to remain undetected within the infrastructure for prolonged periods. <\/p>\n\n\n\n

In the first quarter of 2024, the most popular vulnerabilities used by advanced adversaries turned out to be command injection and authentication bypass in Ivanti\u2019s software for IT security and systems management \u2013 CVE-2024-21887 and CVE-2023-46805 (Common Vulnerabilities and Exposures) respectively, according to the available data on APT attacks. <\/p>\n\n\n\n

 Vulnerabilities used in APT attacks in January-March 2024 by the number of attacks<\/em><\/p>\n\n\n\n

The popularity of CVE-2024-21887 is likely due to its novelty. In targeted attacks, adversaries typically exploit vulnerabilities actively in the first weeks following registration and publication, before companies have had the chance to apply patches. The CVE-2023-46805 vulnerability may be used in conjunction with CVE-2024-21887.<\/p>\n\n\n\n

In third place is the vulnerability in WinRAR, discovered in 2023 but still actively used in targeted attacks. It misleads users regarding the nature of the archived file being opened, thereby lowering their vigilance. <\/p>\n\n\n\n

In 2023, the most exploited vulnerabilities in advanced attacks were found to be the ones in WinRAR (CVE-2023-38831), with CVE-2017-11882 and CVE-2017-0199 in the Microsoft Office suite following behind.<\/p>\n\n\n\n

Vulnerabilities used in APT attacks in 2023 by the number of attacks<\/em><\/p>\n\n\n\n

\u201cInterestingly, while exploits for the Microsoft Office suite have traditionally held first place and widely used \u2013 due to Windows\u2019 popularity that of its software in the corporate world \u2013 the latest snapshot of APT attacks reveals a different trend. Microsoft Office has ceded its leadership to WinRAR exploits,<\/em>\u201d explains Alexander Kolesnikov, a security expert at Kaspersky.<\/p>\n\n\n\n

The analysis was conducted utilizing information from available sources on APT attacks, which leveraged CVEs that have been registered.<\/p>\n\n\n\n

To mitigate the risk of advanced attacks, experts advise:<\/p>\n\n\n\n