Meet Woody the New Remote Access Trojan

Description

FortiGuard Labs is aware of a report that a new Remote Access Trojan (RAT) called "Woody" has been lurking in the wild for the past year. Reported initial infection vectors include email attachments as well as Microsoft Word documents that leverage the recently patched Follina vulnerability (CVE-2022-30190).

Once a victim is infected, Woody RAT collects and sends specific information to its Command-and-Control (C2) server and performs various activities based on the remote commands it receives.

Why is this Significant?

This is significant because Woody RAT reportedly was used in real world attacks over the past year, yet the malware came to light only recently. Initial infection vectors include leveraging the infamous Follina vulnerability (CVE-2022-30190) in which a patch was released on June 2022 and has been used in various attacks.

What is Woody RAT?

Woody is a Remote Access Trojan (RAT) that performs activities according to the remote commands it receives from its C2 server.

Reported initial infection vectors include email attachments and usage of Microsoft Word that leverages the Follina vulnerability (CVE-2022-30190). In the former case, email attachments are ZIP files containing a Woody RAT executable file, which victims need to run manually to start infection process. In the latter case, victims receive weaponized Microsoft Word files which abuse the MSDT URI scheme to download and run Woody RAT.

For reference, FortiGuard Labs previously released an Outbreak Alert and Threat Signal on CVE-2022-30190. See the Appendix for links to "MSDT Follina" and "Follina: 0-day Windows MSDT Vulnerability (CVE-2022-30190) Exploited in The Wild".

Once Woody RAT compromises a victim's machine, it collects information such as OS, computer name and installed Anti-virus solutions and sends data to its C2 server. The RAT is capable of performing various activities on a compromised machine that include uploading and download files, listing up directories and capturing screenshots upon receiving remote commands.

Has the Vendor Released a Patch for the Follina vulnerability (CVE-2022-30190) Used by Woody RAT?

Yes. Microsoft released a patch as part of regular June 2022 MS Tuesday patch release.

What is the Status of Coverage?

FortiGuard Labs detects known Woody RAT and associated samples with the following AV signatures:

W32/WoodyRAT.A!tr
MSOffice/Agent.AAP!tr
W64/Agent.OS!tr
W64/Reflo.WD!tr
Malicious_Behavior.SB
PossibleThreat.PALLAS.H
W32/PossibleThreat

In relation with CVE-2022-30190, the following signature will detect the retrieval of remote HTML files that contain the MSDT command:

MS.Office.MSHTML.Remote.Code.Execution.

All network IOCs associated with this attack are blocked by the WebFiltering client.

Appendix

Woody RAT: A new feature-rich malware spotted in the wild (Malwarebytes)

MSDT Follina (Fortinet)

Follina: 0-day Windows MSDT Vulnerability (CVE-2022-30190) Exploited In The Wild (Fortinet)

CVE-2022-30190 (MITRE)