CVE-2022-23748

Vulnerability Profile Updated 2 months ago
Download STIX
Preview STIX
CVE-2022-23748 is a software vulnerability, specifically a flaw in the design or implementation of Audinate's Dante Discovery software. This vulnerability allows for malicious exploitation via DLL side-loading schemes, where the affected software, due to its flawed design, loads and executes a malicious DLL file instead of the legitimate one. The particular DLL targeted in this case is dal_keepalives.dll, which is hijacked by threat actors to exploit the vulnerability. The exploit was utilized as part of a cyber campaign that leverages spear-phishing emails to deliver archive files containing a digitally signed executable and a malicious DLL. The executable is named to match the context of the email, thereby tricking the recipient into thinking it is a legitimate attachment. Once the archive is opened, the malicious DLL exploits CVE-2022-23748 in Dante Discovery software to side-load a malware named "CurKeep" onto the victim's system. This campaign uses a sophisticated approach combining social engineering (spear-phishing) with a technical exploit (DLL side-loading via CVE-2022-23748). It highlights the importance of maintaining up-to-date software patches and educating users about the dangers of opening unsolicited email attachments. Users of Audinate's Dante Discovery software should ensure they have applied any available patches to mitigate this vulnerability and prevent potential compromise of their systems.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Curkeep
1
CurKeep is a malicious software (malware) discovered by researchers, first identified in attacks targeting entities in Vietnam, Uzbekistan, and Kazakhstan. The malware, delivered through spear-phishing emails, begins its infection chain with a ZIP file attachment containing a legitimate executable t
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Phishing
Chinese
Vulnerability
Malware
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
ToddycatUnspecified
1
ToddyCat is an advanced persistent threat (APT) actor, likely Chinese-speaking, that has been active since at least December 2020 according to Kaspersky. The group has demonstrated sophisticated capabilities in cyberattacks, primarily targeting government entities in Asia including Malaysia, Thailan
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the CVE-2022-23748 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
8 months ago
ToddyCat hackers use 'disposable' malware to target Asian telecoms
CERT-EU
8 months ago
Chinese 'Stayin' Alive' Attacks Dance Onto Targets With Dumb Malware
Checkpoint
8 months ago
Stayin’ Alive - Targeted Attacks Against Telecoms and Government Ministries in Asia - Check Point Research
InfoSecurity-magazine
8 months ago
Chinese APT ToddyCat Targets Asian Telecoms, Governments