The CVE-2024-38213 vulnerability allows threat actors to bypass Windows mark-of-the-web protections, leading to remote code execution via malicious files copied from WebDAV shares.
The investigation of DarkGate operators' methods for infecting users using copy-and-paste operations triggered deeper research into Windows Defender SmartScreen, uncovering the CVE-2024-38213 exploit.
As threat actors increasingly use WebDAV shares to host malicious payloads, multiple zero-day vulnerabilities have emerged, including CVE-2024-21412 and CVE-2024-36025, threatening users through unpatched systems.
The discovery and reporting of CVE-2024-38213 was a direct result of analyzing ongoing malicious activities, prompting improvements in Microsoft’s security measures to protect against such exploits.
Collection
[
|
...
]