Security Experts:

Connect with us

Hi, what are you looking for?


Malware & Threats

APT Group Uses Flash Zero-Day to Attack High-Profile Targets

The Flash Player zero-day vulnerability whose existence was brought to light on Tuesday by Adobe has been exploited by a relatively new advanced persistent threat (APT) group named by Kaspersky Lab “ScarCruft.”

The Flash Player zero-day vulnerability whose existence was brought to light on Tuesday by Adobe has been exploited by a relatively new advanced persistent threat (APT) group named by Kaspersky Lab “ScarCruft.”

According to the security firm, ScarCruft has been observed targeting Russia, Nepal, South Korea, China, Kuwait, India and Romania. Researchers said the group used two Flash Player and one Microsoft Windows vulnerabilities in its attacks.

The latest Flash zero-day (CVE-2016-4171), which Adobe plans on patching later this week, has been used by the threat actor in a campaign dubbed “Operation Daybreak.” The campaign, launched in March 2016, has focused on high-profile targets.

In a separate campaign conducted by ScarCruft, dubbed Operation Erebus, the attackers leveraged watering holes and an exploit for CVE-2016-4117, a Flash Player flaw reported to Adobe last month by researchers from FireEye. The vulnerability had been exploited by malicious actors before a patch was made available.

Kaspersky said it’s possible that ScarCruft also leveraged CVE-2016-0147, a Microsoft XML Core Services (MSXML) vulnerability that can be exploited through Internet Explorer. The flaw was patched by Microsoft in April, but it appears to have been exploited before a fix was released.

Kaspersky will publish more details on the Flash Player zero-day and ScarCruft’s attacks after Adobe releases a patch – most likely on Thursday, June 16. In the meantime, the company has confirmed that Microsoft EMET is effective at mitigating attacks.

This is not the first time Kaspersky has found a Flash Player zero-day vulnerability. In March, the security firm informed Adobe of CVE-2016-1010, which had also been exploited in targeted attacks.

Adobe informed customers on Tuesday that CVE-2016-4171 affects Flash Player and earlier versions for Windows, Mac, Linux and Chrome OS. According to the company, successful exploitation of the flaw could lead to a crash and it could allow an attacker to take control of the vulnerable system.

Related Reading: Hacking Team Leak Leads to Discovery of Silverlight Zero-Day

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Malware & Threats

Norway‎-based DNV said a ransomware attack on its ship management software impacted 1,000 vessels.

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...


Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Malware & Threats

Cybercrime in 2017 was a tumultuous year "full of twists and turns", with new (but old) infection methods, a major return to social engineering,...

Malware & Threats

Fortinet warned of three malicious PyPI packages containing code that fetches the Wacatac trojan and information stealer.


The recent ransomware attack targeting Rackspace was conducted by a cybercrime group named Play using a new exploitation method, the cloud company revealed this...