A zero-day vulnerability in Google Chrome was used by the established spyware group Candiru to compromise users in the Middle East — specifically journalists in Lebanon.
Avast researchers said attackers compromised a website used by news agency employees in Lebanon, and injected code. That code identified specific, targeted users and routed them to an exploit server. From there, the attackers collect a set of about 50 data points, including language, device type, time zone, and much more, to verify that they have the intended target.
At the very end of the exploit chain, the attackers drop DevilsTongue spyware, the team noted.
“Based on the malware and TTPs used to carry out the attack, we can confidently attribute it to a secretive spyware vendor of many names, most commonly known as Candiru,” the Avast researchers explained.
The original vulnerability (CVE-2022-2294), discovered by the same Avast team, was the result of a memory corruption flaw in WebRTC. Google issued a patch on July 4.
“The vulnerabilities discovered here are definitely serious, particularly because of how far-reaching they are in terms of the number of products affected — most modern desktop browsers, mobile browsers, and any other products using the affected components of WebRTC,” James Sebree, senior staff research engineer with Tenable, said via email. “If successfully exploited, an attacker could potentially execute their own malicious code on a given victim’s computer and install malware, spy on the victim, steal information, or perform any other number of nefarious deeds.”
But, Sebree added, the original heap overflow flaw is complicated to exploit and won’t likely result in widespread, generalized attacks.
“It’s likely that any attacks utilizing this vulnerability are highly targeted,” Sebree explained. “While it’s unlikely that we will see generalized attacks exploiting this vulnerability, the chances are not zero, and organizations must patch accordingly.”
Candiru (aka Sourgum, Grindavik, Saito Tech, and Taveta) allegedly sells the DevilsTongue surveillance malware to governments around the world. The Israeli company was founded by engineers who left NSO Group, maker of the infamous Pegasus spyware.
The US Commerce Department added Candiru to its “Entity List” last year, effectively banning trade with the company. The list is used to restrict those deemed to pose a risk to US national security or foreign policy.