Windows Double Kill Attack Code Found in RIG Exploit Kit

Microsoft issued a fix for the remote code execution zero-day vulnerability in May, but research shows businesses have slowed their patching processes post-Meltdown.

Researchers are warning businesses to be prepared for potential widespread attacks using the Double Kill exploit code that was posted online three days ago and has now been discovered incorporated into the RIG Exploit Kit and ThreadKit crimeware packages.
Double Kill is the moniker given by researchers to the recently patched CVE-2018-8174, a critical flaw affecting all versions of Windows. Its the more severe of two flaws that were under
active attack
when Microsoft issued fixes on Patch Tuesday earlier this month. Double Kill is a Windows VBScript Engine Remote Code Execution Vulnerability, independently discovered both by researchers at Kaspersky Lab and Chinese security firm Qihoo360 Core and reported to Microsoft.
The vulnerability exists in the way the VBScript engine handles objects in memory. If successfully exploited, it could enable attackers to execute code with the same privileges as the current user and reallocate memory, take steps toward gaining arbitrary read/write access, hijack execution flows, and potentially achieve code execution.
Active attacks abusing CVE-2018-8174 started as spear-phishing emails with malicious RTF documents attached. The docs contained an OLE object which, when activated, downloaded and rendered an HTML page through a library that contains the engine behind Internet Explorer. VBScript on the page leverages the exploit to download a payload to the machine.
While attacks in the wild used RTF documents, Microsoft
explains
that attackers could also dupe a victim into visiting a website designed to exploit the flaw through Internet Explorer, or embed an ActiveX control marked safe for initialization in an app or Office document that hosts the IE rendering engine.
Abusing OLE to load an IE exploit in Word in a new technique, explain researchers at Barkly. They fear attacks abusing this flaw are poised to increase, especially because it works whether or not the target machine runs IE as the default browser.
CVE-2018-8174 isnt the only Windows vulnerability being used in the wild. Microsoft also confirmed attackers were also actively exploiting CVE-2018-8120, a privilege escalation vulnerability that could allow attackers to gain control over a system, view or edit data, or create new accounts with full user rights.
Microsoft did not provide more info on how widely spread CVE-2018-8120 attacks have been in the wild. The working PoC exploit code is also available on GitHub; Barkly experts
say
its only a matter of time before more attacks take advantage of this vulnerability.
RIG, ThreadKit, and Potential for Abuse
On May 24, 2018, shortly after the PoC exploit code for CVE-2018-8174 was posted online, an attacker going by the name TakeThat was
seen
taking responsibility for implementing the flaw into the RIG Exploit Kit (RIG EK). TakeThat claimed the infection rate had increased.
RIG EK is among the most popular exploit kits to distribute malicious payloads. Its packed with a variety of threats, from ransomware and credential theft to Java and Flash exploits, explains Barkly CTO Jack Danahy. Cybercriminals taking advantage of the crypto craze have also recently leveraged RIG EK to
distribute
coin miner malware and collect digital currencies like Monero and Electroneum.
The big value from the exploit kit is when people land on the system, its likely there will be one exploit among many that will be useful to corrupt and infect the machine, he explains.
With the Double Kill exploit code being built into RIG EK, Danahy says its more likely organizations that havent patched CVE-2018-8174 will be vulnerable to exploits and whatever payloads attackers decide to deliver.
Its code has also been seen in ThreadKit, an exploit builder that can be used to create weaponized Office docs. Its accessible to cybercriminals with little technical expertise and the Double Kill exploit option can be purchased for $400 online. An exploit kit lures victims to a malicious site and infects them through the browser; this one lets attackers create weaponized documents that can be distributed however they want.
Its a different kind of vector through which you can exercise the same functionality, says Danahy.
Patching Problems
Given the nature of this vulnerability, companies will want to ensure they have advanced protection. However, Barkly research discovered many have
slowed down
their patching processes after patches following Meltdown and Spectre caused problems earlier this year.
Research shows 80% of companies polled found the Meltdown and Spectre patching process to be unclear and 88% showed frustration with the process. Now, businesses are just as concerned about faulty updates as they are about Spectre. Two-thirds of respondents were worried about the lack of stable firmware updates leaving their company vulnerable to Spectre. However, they were just as concerned future patched would harm performance or stability.
Most IT pros (56%) said they had purposefully held back on applying updates and, in the future, will only do so after testing for compatibility and performance problems. Nearly one-quarter (23%) say they may not apply patches at all for fear of performance problems, and 75% say they are more likely to roll out patches more slowly in the future.
If people are scared of patching Microsoft systems because of Spectre and Meltdown, they should realize how serious and pressing these attacks are, says Danahy, who advises organizations to rethink the slower approach to patching.
The speed with which organizations are updating their systems means theres readily exploited vulnerabilities, he adds. Theres likely to be a lot of systems remaining vulnerable for a while.
Related Content:
Over 5K Gas Station Tank Gauges Sit Exposed on the Public Net
Alexa Mishap Hints at Potential Enterprise Security Risk
10 Free DevOps-Friendly Security Tools Developers Will Love
Most Expensive Data Breaches Start with Third Parties: Report

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Windows Double Kill Attack Code Found in RIG Exploit Kit