Cybersecurity News

Microsoft patches spoofing vulnerability exploited by Emotet (CVE-2021-43890)

It’s the final Patch Tuesday of 2021 and Microsoft has delivered fixes for 67 vulnerabilities, including a spoofing vulnerability actively exploited to deliver Emotet/Trickbot/Bazaloader malware family.

Of the 67 CVE-numbered flaws, CVE-2021-43890 – a Windows AppX Installer spoofing vulnerability – will, understandably, be a patching priority.

“CVE-2021-43890 allows an attacker to create a malicious package file and then modify it to look like a legitimate application, and has been used to deliver Emotet malware, which made a comeback this year. The patch should mean that packages can no longer be spoofed to appear as valid, but it will not stop attackers from sending links or attachments to these files,” noted Kevin Breen, Director of Cyber Threat Research, Immersive Labs.

He also considers CVE-2021-43905, an unauthenticated RCE vulnerability in the Microsoft Office app, important to patch quickly, as it has a high CVSS score of 9.6 and Microsoft considers its exploitation to be “More likely”.

Then we have CVE-2021-43883, an elevation of privilege vulnerability in Windows Installer.

“CVE-2021-43883 affects both server and desktop versions of Windows and allows a local user to escalate their privileges, and this kind of vulnerability is highly sought after by attackers looking to move laterally across a network. After gaining the initial foothold, achieving administrator-level access can allow attackers to disable security tools and deploy additional malware or tools like Mimikatz. Almost all ransomware attacks in the last year employed some form of privilege escalation as a key component of the attack prior to launching ransomware,” Breen added.

Stay on Top of Cyber Threats!
Subscribe to our monthly bulletin to stay updated on major cybersecurity risks.

Recent Cybersecurity News

Tell us about your needs.
Get an answer the same business day.

Tell us about your needs.
Get an answer the same business day.

Got an urgent request? Call us at 1-877-805-7475 or Book a meeting.

What happens next:

  • We reach out to learn about your objectives
  • We work together to define your project's scope
  • You get an all-inclusive, no engagement proposal

No engagement. We answer within 24h.
Scroll to Top

BOOK A MEETING WITH AN EXPERT

Enter Your Corporate Email