ROMCOM EXPLOITS 0-DAY FIREFOX AND WINDOWS FLAWS IN SOPHISTICATED CYBERATTACK

Summary from the TLDR InfoSec newsletter

Researchers are warning of a new campaign from the Russia-linked RomCom APT that exploits a use-after-free 0-day in Firefox and a privilege escalation vulnerability in Windows Task Scheduler. The attackers are using a fake website that redirects users to a secondary website which hosts the malicious payload. The payload executes shell code using the Firefox exploit which runs an embedded library to break out of the browser's sandboxed environment via the Task Scheduler exploit to install the RomCom RAT.