A sophisticated cyberattack campaign by the advanced persistent threat group, Stealth Falcon, which exploited a previously unknown zero-day vulnerability to target a major Turkish defense company and execute malware remotely.

The attack leveraged CVE-2025-33053, a remote code execution vulnerability that allows threat actors to manipulate the working directory of legitimate Windows tools to execute malicious files from attacker-controlled WebDAV servers.

Microsoft released a security patch for this vulnerability as part of its June Patch Tuesday updates, following a responsible disclosure by Check Point Research.

The vulnerability was exploited through a malicious .url file named “TLM.005_TELESKOPIK_MAST_HASAR_BILDIRIM_RAPORU.pdf.url” (Turkish for “TLM.005 TELESCOPIC MAST DAMAGE REPORT.pdf.url”), which was likely distributed as an archived attachment in a spear-phishing email targeting the Turkish defense contractor.

The .url file pointed to iediagcmd.exe, a legitimate Internet Explorer diagnostics utility, but manipulated the working directory to reference an attacker-controlled WebDAV server at “\summerartcamp[.]net@ssl@443/DavWWWRoot\OSYxaOjr”.

This clever technique exploited the search order used by the .NET Process.Start() method, causing the legitimate tool to execute malicious files from the remote server instead of system files.

This allowed arbitrary code execution through process hollowing, as the malicious route.exe spawned from the WebDAV server, bypassed traditional signature-based defenses.

Certificate for a Malicious file (Source: Check Point)

APT Hackers Exploited WebDAV Zero-Day

Stealth Falcon, also known as FruityArmor, is an advanced persistent threat group that has been conducting cyber espionage operations since at least 2012.

The group primarily targets high-profile entities in the Middle East and Africa, with recent operations observed against government and defense sectors in Turkey, Qatar, Egypt, and Yemen.

The attack delivered a multi-stage infection chain, culminating in the deployment of “Horus Agent,” a custom-built implant for the Mythic command and control framework, according to Check Point Research.

Named after the Egyptian falcon-headed sky god, Horus Agent represents an evolution from the group’s previously used customized Apollo implant. The malware employs advanced anti-analysis techniques, including code virtualization, string encryption, and API hashing, to evade detection.

Beyond the initial implant, researchers identified several previously undisclosed custom tools in Stealth Falcon’s arsenal, including a DC Credential Dumper that bypasses file locks by accessing virtual disk copies, a passive backdoor that listens for incoming shellcode execution requests, and a custom keylogger with RC4 encryption.

The Horus Agent focuses on essential reconnaissance functions, allowing threat actors to fingerprint victim machines and assess their value before deploying more advanced payloads. This approach helps protect the group’s sophisticated post-exploitation tools from exposure.

Stealth Falcon consistently uses repurposed legitimate domains purchased through NameCheap registrar, typically in .net or .com top-level domains. This strategy helps their infrastructure blend in with legitimate traffic, complicating attribution efforts.

The group’s continued evolution demonstrates its commitment to maintaining stealth and resilience in its operations, employing commercial code obfuscation tools and custom modifications that make its payloads difficult to reverse-engineer and track over time.

This latest campaign highlights the ongoing threat posed by sophisticated APT groups, which combine zero-day exploits with innovative attack vectors, such as WebDAV manipulation, to target critical infrastructure and defense organizations worldwide.

Automate threat response with ANY.RUN’s TI Feeds—Enrich alerts and block malicious IPs across all endpoints -> Request full access

The post APT Hackers Exploited Windows WebDAV 0-Day RCE Vulnerability in the Wild to Deploy Malware appeared first on Cyber Security News.