Microsoft Addresses Two Exploited Zero-Days in April 2024 Patch Tuesday

April 9, 2024

Microsoft has remedied two zero-day vulnerabilities that were being actively leveraged in malware attacks. The vulnerabilities, initially not recognized as zero-days, were rectified during the April 2024 Patch Tuesday. The flaws are identified as CVE-2024-26234, a proxy driver spoofing vulnerability, and CVE-2024-29988, a SmartScreen prompt security feature bypass vulnerability.

The first vulnerability, CVE-2024-26234, was discovered by Sophos X-Ops in December 2023 and reported by team lead Christopher Budd. The team found a malicious driver signed with a legitimate Microsoft Hardware Publisher Certificate. The driver was disguised as 'Catalog Authentication Client Service' by 'Catalog Thales', presumably to mimic Thales Group. However, upon further investigation, it was found to have been previously bundled with a marketing software called LaiXi Android Screen Mirroring. While the authenticity of the LaiXi software could not be confirmed, the team was confident that the file was a malicious backdoor. Christopher Budd stated, 'Just as we did in 2022, we immediately reported our findings to the Microsoft Security Response Center. After validating our discovery, the team at Microsoft has added the relevant files to its revocation list (updated today as part of the usual Patch Tuesday cycle; see CVE-2024-26234).'

The second zero-day flaw silently patched by Microsoft is CVE-2024-29988, a SmartScreen prompt security feature bypass vulnerability. This flaw was reported by Peter Girnus of Trend Micro's Zero Day Initiative and Google's Threat Analysis Group's Dmitrij Lenz and Vlad Stolyarov. The flaw was being actively exploited to deploy malware on targeted Windows systems, bypassing EDR/NDR detection and the Mark of the Web (MotW) feature. Dustin Childs, Head of Threat Awareness at ZDI, revealed that the flaw was related to CVE-2024-21412, discovered by ZDI threat researchers and first addressed in February. 'The first patch did not completely resolve the vulnerability. This update addresses the second part of the exploit chain. Microsoft did not indicate they were patching this vulnerability, so it was a (welcome) surprise when the patch went live,' Childs stated.

The Water Hydra hacking group, known for its financially motivated attacks, exploited CVE-2024-29988 in combination with CVE-2024-21412 as a zero-day on New Year’s Eve to target forex trading forums and stock trading Telegram channels, deploying the DarkMe remote access trojan (RAT). CVE-2024-21412 was itself a bypass for another Defender SmartScreen vulnerability, CVE-2023-36025, patched during the November 2023 Patch Tuesday and exploited as a zero-day to deploy the Phemedrone malware.

Microsoft issued security updates for 150 vulnerabilities as part of April 2024's Patch Tuesday, 67 of which were remote code execution bugs.

Related News

Latest News

Like what you see?

Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.

Subscribe Below

By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.

Accelerate Security Teams

Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.