APT Group Uses Flash Zero-Day to Attack High-Profile Targets

The Flash Player zero-day vulnerability whose existence was brought to light on Tuesday by Adobe has been exploited by a relatively new advanced persistent threat (APT) group named by Kaspersky Lab “ScarCruft.”

According to the security firm, ScarCruft has been observed targeting Russia, Nepal, South Korea, China, Kuwait, India and Romania. Researchers said the group used two Flash Player and one Microsoft Windows vulnerabilities in its attacks.

The latest Flash zero-day (CVE-2016-4171), which Adobe plans on patching later this week, has been used by the threat actor in a campaign dubbed “Operation Daybreak.” The campaign, launched in March 2016, has focused on high-profile targets.

In a separate campaign conducted by ScarCruft, dubbed Operation Erebus, the attackers leveraged watering holes and an exploit for CVE-2016-4117, a Flash Player flaw reported to Adobe last month by researchers from FireEye. The vulnerability had been exploited by malicious actors before a patch was made available.

Kaspersky said it’s possible that ScarCruft also leveraged CVE-2016-0147, a Microsoft XML Core Services (MSXML) vulnerability that can be exploited through Internet Explorer. The flaw was patched by Microsoft in April, but it appears to have been exploited before a fix was released.

Kaspersky will publish more details on the Flash Player zero-day and ScarCruft’s attacks after Adobe releases a patch – most likely on Thursday, June 16. In the meantime, the company has confirmed that Microsoft EMET is effective at mitigating attacks.

This is not the first time Kaspersky has found a Flash Player zero-day vulnerability. In March, the security firm informed Adobe of CVE-2016-1010, which had also been exploited in targeted attacks.

Adobe informed customers on Tuesday that CVE-2016-4171 affects Flash Player 21.0.0.242 and earlier versions for Windows, Mac, Linux and Chrome OS. According to the company, successful exploitation of the flaw could lead to a crash and it could allow an attacker to take control of the vulnerable system.

Related Reading: Hacking Team Leak Leads to Discovery of Silverlight Zero-Day