CVE-2024-38213 From Crumbs to Full Compromise in a Stealthy Cyber Attack

A targeted cyber attack campaign exploiting CVE-2024-38213 was discovered targeting the GIE Annual Conference in Munich. The attack chain began with phishing emails containing malicious attachments that leveraged the vulnerability to bypass Windows security controls. The attackers deployed LummaStealer malware through a sophisticated multi-stage process using a fake conference domain and masquerading executables. This campaign represents an evolution of previously known techniques with the vulnerability being actively exploited by multiple threat actors including AsyncRAT and XWorm for remote access and data theft purposes.