In this blog post, we’ll delve into the details of CVE-2024-21412, its impact, and the tactics employed by threat actors to bypass SmartScreen.

The Basics: What Is CVE-2024-21412?

CVE-2024-21412 is a security flaw that affects Microsoft SmartScreen, a component integrated into various Microsoft products, including Windows Defender and Microsoft Edge. SmartScreen analyzes URLs and files to determine their safety and warns users if they attempt to access potentially harmful content. However, this vulnerability allows attackers to evade SmartScreen’s protective measures.

Exploitation Techniques

1. Internet Shortcuts (URL Files)

The primary vector for exploiting CVE-2024-21412 is through internet shortcuts (URL files). These files contain references to websites and are commonly used for creating desktop shortcuts or bookmarks. By crafting a malicious URL file, threat actors can trick SmartScreen into allowing access to dangerous sites or downloads.

2. Water Hydra APT Group

The Water Hydra advanced persistent threat (APT) group is at the forefront of exploiting this vulnerability. Their sophisticated techniques involve creating specially crafted URL files that appear harmless to SmartScreen. Once a victim clicks on the shortcut, the associated website delivers a payload—often the DarkMe remote access trojan (RAT).

3. Bypassing Patched Vulnerabilities

Interestingly, CVE-2024-21412 emerged as a result of bypassing a previously patched SmartScreen vulnerability (CVE-2023-36025). This highlights the cat-and-mouse game between security researchers and threat actors. Even after a patch is released, attackers continue to explore new attack vectors, rendering the patch ineffective.

Geographical Targets

The Water Hydra group’s campaign exploiting CVE-2024-21412 has primarily targeted regions such as Spain, the United States, and Australia. Their choice of targets suggests a deliberate strategy to compromise high-value systems and organizations.

Mitigation and Recommendations

1. Keep Software Updated

Ensure that your operating system and security software are up to date. Regularly check for patches and apply them promptly.

2. Exercise Caution with URL Files

Be cautious when opening internet shortcuts (URL files). Verify the source and destination before clicking on any links.

3. Educate Users

Educate users about the risks associated with SmartScreen bypass vulnerabilities. Awareness is crucial in preventing successful attacks.