Search: CVE-2022-41128

CVE-2022-41128 is a high-severity remote code execution vulnerability in the Microsoft Windows JScript9 scripting language. It allows an attacker to execute arbitrary code remotely, potentially leading to full system compromise. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

APT37, a North Korean state-sponsored group, conducted a spear phishing campaign named 'Operation ToyBox Story' targeting activists focused on North Korea. The attack used emails with Dropbox links to malicious LNK files that deployed RoKRAT malware, which collected system information, screenshots, and exfiltrated data to cloud-based C2 servers. The campaign employed fileless attacks, multiple encryption layers, and used legitimate cloud services for command and control to evade detection. The threat actors impersonated academic events and used decoy documents to lure targets, highlighting the need for advanced endpoint detection and response solutions.

Campaign#cloud c2#spear phishingGermany+6