KakaoTalk

ScarCruft, a North Korean cyber group, exploited a zero-day vulnerability in Windows, identified as CVE-2024-38178, which has a CVSS score of 7.5 and is a memory corruption issue in the Scripting Engine. This vulnerability allows for remote code execution when users interact with the Edge browser in Internet Explorer Mode. Attackers entice users to click on a malicious URL to execute code. Microsoft patched this flaw in August 2024. The attack, dubbed "Operation Code on Toast," involved compromising a domestic advertising agency's server to inject exploit code into toast advertisement programs, which are pop-up notifications in South Korea. The exploitation led to a type confusion error in the JavaScript Engine of Internet Explorer, allowing the attackers to infect PCs with the vulnerable toast program. The malware associated with this attack, RokRAT, has advanced capabilities and uses legitimate cloud services for command-and-control operations. ScarCruft has a history of exploiting vulnerabilities in legacy browsers and has previously targeted other vulnerabilities in the Scripting Engine. Users are advised to keep their systems updated to mitigate risks.