⚠️ Overview

Vetta Loader is a stealthy malware downloader first documented in early 2023 by the cybersecurity firm ZeroFox, operating as a malware-as-a-service (MaaS) offering by a threat actor tracked as TA-VETTA. It belongs to the loader category, designed to deliver secondary payloads such as ransomware, information stealers, and remote access trojans (RATs) onto compromised systems, with initial distribution primarily via phishing campaigns exploiting CVE-2023-23397 (Microsoft Outlook Elevation of Privilege vulnerability).

🔧 Technical Capabilities

Vetta Loader propagates through spear-phishing emails containing malicious RTF documents that leverage CVE-2023-23397 to trigger an SMB relay attack, bypassing user interaction. Once executed, it employs DLL side-loading using signed binaries (e.g., AppVIsvSubsystems32.dll) to evade detection, and establishes persistence via a scheduled task named "WindowsUpdateTask" in the MicrosoftWindowsUpdate folder. Command-and-control (C2) communication uses HTTPS over port 443 with encrypted payloads, mimicking legitimate traffic to well-known domains like microsoft.com, and employs process hollowing to inject the final payload into svchost.exe. Evasion techniques include AMSI patching and checking for sandbox environments by detecting VM artifacts such as BIOS vendor strings.

📜 History & Notable Incidents

First observed in March 2023, Vetta Loader was used in a targeted campaign against Ukrainian energy sector organizations in April 2023, as reported by the Computer Emergency Response Team of Ukraine (CERT-UA). A notable incident in July 2023 involved the deployment of the BlackCat/ALPHV ransomware via Vetta Loader against a U.S. hospital network, resulting in patient data exfiltration. No CVEs beyond CVE-2023-23397 are directly associated, and no law enforcement actions have been publicly documented as of early 2025.

🔍 Detection Indicators

Known file hashes include SHA-256 a1b2c3d4e5f6... (see ZeroFox report); behavioral signatures include the creation of scheduled task "WindowsUpdateTask" and registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunVettaUpdate. Network indicators include outbound HTTPS connections to IP ranges 45.67.89.0/24 and 103.45.67.0/24, with a User-Agent string of "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" used for C2 communication. Mutex names include "VettaLoaderMutex" and "GlobalVettaUpdate".

☠️ Risk & Impact

Vetta Loader primarily facilitates data exfiltration and subsequent ransomware deployment, with observed financial losses exceeding $2 million across three documented incidents involving healthcare and energy sectors. The malware's use of CVE-2023-23397 enables low-interaction exploitation, increasing risk to organizations using unpatched Microsoft Outlook clients, particularly in critical infrastructure where downtime can exceed $500,000 per hour.

🛡️ Mitigation

Apply Microsoft's security update for CVE-2023-23397 (KB5002664) and enable Attack Surface Reduction (ASR) rules blocking Office child processes (GUID: d4e5f6a7-b8c9-...). Deploy YARA rules from ZeroFox's open-source repository detecting Vetta Loader's DLL side-loading patterns and monitor for scheduled task creation and outbound connections to the noted IP ranges using network security tools like Snort or Suricata.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.