- Trend Micro discovers a piece of malware advertised as a PoC fork of a major Windows vulnerability
- The malware acts as an info stealer that captures vital system information
- These types of attacks are often carried out by nation states
Cybercriminals are targeting security researchers with fake proof-of-concept (PoC) solutions and trying to infect their computers with info-stealing malware, experts have warned.
Cybersecurity researchers Trend Micro, who discovered the new campaign in January 2025, noted how the crooks would publish a PoC for a popular Critical Severity vulnerability to attract the attention of the cybersecurity crowd.
The researchers would then grab the PoC for analysis and would end up installing a piece of malware instead.
Steals vital PC information
In this particular case, the crooks advertised a fork of a legitimate, existing PoC for LDAPNightmare, a vulnerability discovered earlier in January, consisting of two flaws, CVE-2024-49112 and CVE-2024-49113.
The former serves as bait here, as it is a 9.8/10 severity bug that affects the Windows Lightweight Directory Access Protocol (LDAP) and enables remote code execution (RCE).
In her overview, Trend Micro researcher Sarah Pearl Camiling said, “both vulnerabilities were considered very significant due to the widespread use of LDAP in Windows environments.” Both bugs were fixed in December 2024 through the Patch Tuesday cumulative update.
In the fake PoC, the crooks replaced some of the legitimate files with an executable named “poc.exe”. This would deploy a PowerShell script, which in turn would deploy another script that steals data from the computer.
Here’s what the info thief is after:
– PC information
– Process list
– Catalog lists (Downloads, Latest, Documents and Desktop)
– Network IPs
– Network adapters
– Installed updates
This type of attack is nothing new – criminals have been regularly observed using the same tactics in the past.
Although not hinted at in the report, these types of attacks are often carried out by nation-state actors in an attempt to gather vital intelligence about the cybersecurity practices of large tech organizations, public companies, critical infrastructure players, and more.
Via The register
