Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

APT Group Uses Flash Zero-Day to Attack High-Profile Targets

The Flash Player zero-day vulnerability whose existence was brought to light on Tuesday by Adobe has been exploited by a relatively new advanced persistent threat (APT) group named by Kaspersky Lab “ScarCruft.”

The Flash Player zero-day vulnerability whose existence was brought to light on Tuesday by Adobe has been exploited by a relatively new advanced persistent threat (APT) group named by Kaspersky Lab “ScarCruft.”

According to the security firm, ScarCruft has been observed targeting Russia, Nepal, South Korea, China, Kuwait, India and Romania. Researchers said the group used two Flash Player and one Microsoft Windows vulnerabilities in its attacks.

The latest Flash zero-day (CVE-2016-4171), which Adobe plans on patching later this week, has been used by the threat actor in a campaign dubbed “Operation Daybreak.” The campaign, launched in March 2016, has focused on high-profile targets.

In a separate campaign conducted by ScarCruft, dubbed Operation Erebus, the attackers leveraged watering holes and an exploit for CVE-2016-4117, a Flash Player flaw reported to Adobe last month by researchers from FireEye. The vulnerability had been exploited by malicious actors before a patch was made available.

Kaspersky said it’s possible that ScarCruft also leveraged CVE-2016-0147, a Microsoft XML Core Services (MSXML) vulnerability that can be exploited through Internet Explorer. The flaw was patched by Microsoft in April, but it appears to have been exploited before a fix was released.

Kaspersky will publish more details on the Flash Player zero-day and ScarCruft’s attacks after Adobe releases a patch – most likely on Thursday, June 16. In the meantime, the company has confirmed that Microsoft EMET is effective at mitigating attacks.

This is not the first time Kaspersky has found a Flash Player zero-day vulnerability. In March, the security firm informed Adobe of CVE-2016-1010, which had also been exploited in targeted attacks.

Adobe informed customers on Tuesday that CVE-2016-4171 affects Flash Player 21.0.0.242 and earlier versions for Windows, Mac, Linux and Chrome OS. According to the company, successful exploitation of the flaw could lead to a crash and it could allow an attacker to take control of the vulnerable system.

Advertisement. Scroll to continue reading.

Related Reading: Hacking Team Leak Leads to Discovery of Silverlight Zero-Day

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Discover strategies for vendor selection, integration to minimize redundancies, and maximizing ROI from your cybersecurity investments. Gain actionable insights to ensure your stack is ready for tomorrow’s challenges.

Register

Dive into critical topics such as incident response, threat intelligence, and attack surface management. Learn how to align cyber resilience plans with business objectives to reduce potential impacts and secure your organization in an ever-evolving threat landscape.

Register

People on the Move

Gigamon has promoted Tony Jarjoura to CFO and Ram Bhide has been hired as Senior VP of engineering.

Cloud security firm Mitiga has appointed Charlie Thomas as Chief Executive Officer.

Cynet announced the appointment of Jason Magee as Chief Executive Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.