Hackers Exploit Windows File Explorer and WebDAV to Distribute Malware
Cybersecurity researchers have identified an ongoing campaign exploiting Windows File Explorer for malware distribution.
Cybersecurity researchers have identified an ongoing campaign exploiting Windows File Explorer for malware distribution.
By leveraging the deprecated WebDAV protocol, attackers distribute Remote Access Trojans (RATs) while bypassing traditional web security measures and some Endpoint Detection and Response (EDR) systems.
WebDAV (Web-based Distributed Authoring and Versioning) is a file management protocol that, despite being deprecated by Microsoft in Nov 2023, remains supported in Windows File Explorer. Attackers exploit this by sending links that open remote WebDAV servers within File Explorer, making malicious files appear as local folders.
Three primary methods are used for this attack:
Direct Linking using file:// URIs URL shortcut files ( .url ) LNK shortcut files ( .lnk )
Cybersecurity researchers have identified an ongoing campaign exploiting Windows File Explorer for malware distribution.
These methods open remote paths or execute scripts from the attacker's server. If a .url file contains a Windows UNC path, merely opening the local folder can trigger a DNS lookup.
Attackers utilize free Cloudflare Tunnel instances to host their WebDAV servers, routing victim traffic through legitimate Cloudflare infrastructure, complicating detection. The short-lived nature of these servers prevents detailed analysis post-campaign.
Since Feb 2024, the campaign's volume surged in Sep 2024. The primary payloads, delivered in 87% of the attacks, include multiple RATs such as XWorm RAT, Async RAT, and DcRAT. The attacks primarily target European corporate networks via phishing emails, often in German and English.
Security teams should monitor for unusual outbound traffic to the following Cloudflare Tunnel domains, which host malicious WebDAV servers:
tiny-fixtures-glossary-advantage[.]trycloudflare[.]com nasdaq-aged-sf-cheers[.]trycloudflare[.]com lose-croatia-acdbentity-lt[.]trycloudflare[.]com discounted-pressed-lc-vcr[.]trycloudflare[.]com skills-statute-alberta-demand[.]trycloudflare[.]com whats-menu-familiar-zshops[.]trycloudflare[.]com publicity-jenny-paintball-gilbert[.]trycloudflare[.]com
Organizations should consider disabling WebDAV client services unless required for operations. Additionally, IT teams must monitor outbound SMB or WebDAV traffic for unauthorized internet connections via File Explorer. Holistic network monitoring is essential due to potential abuse of similar protocols like FTP and CIFS.
Based on reporting by GBHackers.