Microsoft Implements Disablement of Widely Exploited MSIX App Installer Protocol Due to Malware Attacks

On Thursday, Microsoft announced the reactivation of the ms-appinstaller protocol handler, reverting it to its default state due to widespread exploitation by various threat actors for malware dissemination. The Microsoft Threat Intelligence team reported that the misuse of the current implementation of the ms-appinstaller protocol handler has become a common method for threat actors to introduce malware, potentially leading to the distribution of ransomware.

The team highlighted the emergence of cybercriminals offering a malware kit as a service, utilizing the MSIX file format and ms-appinstaller protocol handler. These alterations are now in effect starting from App Installer version 1.21.3421.0 or newer.

The attacks are manifested through signed malicious MSIX application packages, circulated through platforms such as Microsoft Teams or deceptive advertisements appearing on popular search engines like Google. Since mid-November 2023, at least four financially motivated hacking groups have exploited the App Installer service, utilizing it as an entry point for subsequent human-operated ransomware activities.

The identified groups involved in these activities include Storm-0569, employing BATLOADER through SEO poisoning with sites mimicking Zoom, Tableau, TeamViewer, and AnyDesk, ultimately leading to Black Basta ransomware deployment. Storm-1113 serves as an initial access broker distributing EugenLoader disguised as Zoom, fac

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.