Hacking Targeting Internet Explorer Vulnerability Occurs: "Please Update to the Latest Software Version"

Targeting Vulnerabilities in End-of-Support Internet Explorer
Need to Update Software to the Latest Version

Recently, there have been cases where hackers exploited public interest in various social events and incidents by mimicking titles posted on official government ministry websites and distributing MS Word (.docx) files embedded with malware through phishing emails. Analysis revealed that the hacker attacks were carried out in three stages by exploiting vulnerabilities in Internet Explorer (IE).

The Korea Internet & Security Agency (KISA) and the Ministry of Science and ICT announced a detailed analysis report on the security vulnerabilities related to these phishing email attacks on the 27th. The hacker attacks proceeded in three stages: ▲ When the malicious document (MS Word) file is opened, the user’s PC connects to the attacker’s server and downloads a malicious RTF file ▲ Through the URL embedded in the malicious RTF file, an additional malicious HTML file is downloaded from the attacker’s server ▲ MS Word uses Internet Explorer’s (IE) script engine (JScript9) to process the HTML file, and due to a vulnerability in this engine, the malware is executed.

Microsoft (MS) identified this vulnerability and released a security patch in November of last year. However, some software, including MS Office, still uses the IEHTML parsing function when executing HTML files. KISA stated, "If outdated software versions are used, they can become targets of attacks, so it is important for users to continuously update all software they use and keep them at the latest versions. KISA will continue to strengthen vulnerability analysis to discover high-risk vulnerabilities that could be exploited in cyber incidents and enhance preemptive measures to prevent damage."

Choi Kwang-hee, head of KISA’s Cyber Incident Response Division, said, “Cyber attacks continue relentlessly even during national disasters, and hackers exploit current issues to launch attacks, so we must not let our guard down in responding to cyber threats.” He added, “KISA will continue to focus on proactive responses to cyber attacks through ongoing cyber threat monitoring.”

This content was produced with the assistance of AI translation services.