Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware

"Security experts have disclosed details of an active malware campaign that's exploiting a DLL side-loading vulnerability in a legitimate binary associated with the open-source c-ares library to bypass security controls and deliver a wide range of commodity trojans and stealers. "Attackers achieve evasion by pairing a malicious libcares-2.dll with any signed version of the legitimate ahost.exe (which they often rename) to execute their code," Trellix said in a report shared with The Hacker News. "This DLL side-loading technique allows the malware to bypass traditional signature-based security defenses.""

"The campaign has been observed distributing a wide assortment of malware, such as Agent Tesla, CryptBot, Formbook, Lumma Stealer, Vidar Stealer, Remcos RAT, Quasar RAT, DCRat, and XWorm. Targets of the malicious activity include employees in finance, procurement, supply chain, and administration roles within commercial and industrial sectors like oil and gas and import and export, with lures written in Arabic, Spanish, Portuguese, Farsi, and English, suggesting the attacks are restricted to a specific region."

"The attack hinges on placing a malicious version of the DLL in the same directory as the vulnerable binary, taking advantage of the fact that it's susceptible to search order hijacking to execute the contents of the rogue DLL instead of its legitimate counterpart, granting the threat actor code execution capabilities. The "ahost.exe" executable used in the campaign is signed by GitKraken and is typically distributed as part of GitKraken's Desktop application."

A malicious campaign exploits a DLL side-loading vulnerability in a binary linked to the open-source c-ares library by pairing a rogue libcares-2.dll with signed versions of ahost.exe to achieve code execution. The technique circumvents signature-based defenses and enables distribution of commodity malware such as Agent Tesla, CryptBot, Formbook, Lumma, Vidar, Remcos, Quasar, DCRat, and XWorm. Targets include finance, procurement, supply chain, and administration personnel in commercial and industrial sectors like oil and gas and import/export. Lures appear in Arabic, Spanish, Portuguese, Farsi, and English and samples use invoice-themed filenames to lure victims.

Read at The Hacker News