Russian Hackers Exploit Windows 10/11 and Firefox Vulnerabilities in Widespread Attacks

A recent report published by Slovak cybersecurity firm ESET has revealed that the suspected Russian hacker group RomCom is actively exploiting vulnerabilities in Windows 10/11 and the Firefox browser to launch widespread attacks.

Given the initial timeline of these attacks, security researchers have cautiously classified them as zero-day exploits. Although these vulnerabilities have since been patched, the hackers had successfully exploited them before the fixes were implemented.

Previously, RomCom also targeted the Japanese electronics manufacturer Casio, deploying ransomware. When Casio refused to pay the ransom, the hacking group leaked various sensitive internal data to the internet.

Returning to the ESET security report, upon discovering the attack activities and exploited vulnerabilities, researchers responsibly notified the Mozilla Foundation. The very next day, on October 9, Firefox released a new version that addressed the vulnerabilities.

RomCom utilized these vulnerabilities to install malware on targeted computers almost entirely without user interaction, allowing the installation of malicious software without the users' awareness. This software then continuously monitors the user in the background.

The vulnerabilities in Windows 10/11 were patched in a security update released on November 12. Thus, currently, users can protect themselves from attacks by ensuring they are using the latest version of Firefox and have installed the latest security updates for Windows 10/11.

The dual approach of RomCom, engaging in both ransomware attacks and targeted attacks, is somewhat perplexing. Typically, the former is motivated by financial gain, while the latter has surveillance objectives. It is relatively rare for hacker groups to engage in both types of "business" simultaneously.

Users interested in learning more can view Microsoft's vulnerability report at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49039