Iranian state-sponsored cyber espionage group OilRig (also tracked as APT34 or Earth Simnavaz) weaponized a high-severity elevation-of-privilege vulnerability in the Windows Kernel, tracked as CVE-2024-30088 (CVSS 7.8), in targeted campaigns across the United Arab Emirates and the broader Gulf region. The flaw stems from a Time-of-Check to Time-of-Use (TOCTOU) race condition within the kernel routine AuthzBasepCopyoutInternalSecurityAttributes. After gaining initial access via web shells on Internet-exposed web servers and tunneling traffic with ngrok, the actors triggered the race condition to escalate privileges from local web service accounts directly to NT AUTHORITY\SYSTEM.

With SYSTEM privileges secured, the adversaries registered a malicious Local Security Authority (LSA) password filter dynamic link library (psgfilter.dll) to intercept plaintext domain credentials during standard authentication cycles on domain controllers and local hosts. To maintain covert exfiltration channels, OilRig deployed a novel backdoor dubbed STEALHOOK. The implant hooks on-premises Microsoft Exchange servers, compiling harvested credentials into encrypted payloads and routing them to adversary-controlled inboxes as benign email attachments, thereby evading outbound perimeter inspection. Microsoft addressed CVE-2024-30088 in its June 2024 Patch Tuesday rollout, and CISA has listed the vulnerability in its Known Exploited Vulnerabilities catalog.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Exploiting kernel-level TOCTOU race conditions invalidates operating system privilege boundaries, enabling attackers to install unauthorized LSA password filters that silently capture credentials before hashing or encryption occurs.
• Bullet 2 — Strategic & Defender Imperative: Administrators must deploy cumulative Windows kernel security updates immediately, enforce strict DLL signature verification for LSA subauthentication and notification packages, and monitor Exchange transport services for unauthorized attachment generation.