PuzzleMaker Gang Abused Google Chrome Zero-day in April
A newly identified cybercrime organization has been targeting Google Chrome with a zero-day exploit, which abuses a Remote code Execution (RCE) vulnerability. Thankfully, the exploit was patched back in April 2021, so users are not threatened if they have taken the necessary precautions to update their Google Chrome browser. When the vulnerability was first discovered, it was quite severe as it enabled the PuzzleMaker Cybercrime Gang to execute remote code through the use of a malicious piece of JavaScript. The vulnerability, found under the alias CVE-2021-21220, may have been used to initialize a multi-stage attack, which utilized several types of malware to achieve the desired results.
The PuzzleMaker Cybercrime Gang's end goal is to drop a remote shell on the compromised system, which could then be used to execute remote commands. In order to do this, however, the criminals also exploited old vulnerabilities found in unpatched Windows Systems – CVE-2021-31956 and CVE-2021-31955.
The risk of being infected by the threats that the PuzzleMaker Cybercrime Gang uses are numerous since remote code execution allows criminals to hijack the entire system, given that they have escalated privileges.
Protecting yourself from the PuzzleMaker Cybercrime Gang's attack and similar campaigns can be done by utilizing modern antivirus software, as well as by applying all patches to ensure that the operating system and software are protected from recent vulnerabilities.
