Exploit for Recent Flash Zero-Day Added to Fallout Exploit Kit

An updated version of the Fallout exploit kit recently emerged with an exploit for a recent Flash zero-day included in its arsenal, Malwarebytes Labs security researchers warn.

First detailed in September 2018, the toolkit was observed delivering malware families ranging from ransomware to backdoors, but also fingerprinting the browser profile to identify targets of interest.

The exploit kit (EK) remained active throughout the end of 2018, but its operators took a break in early January, apparently in order to improve their malicious kit. During Fallout’s absence, RIG EK’s activity intensified, Malwarebytes now reveals.

The Fallout EK is distributed via malvertising chains, especially via adult traffic. In attacks observed starting January 15, when the toolkit recommenced activity, GandCrab ransomware was identified as the payload.

One of the most notable additions to Fallout is an exploit for CVE-2018-15982, a vulnerability in Adobe’s Flash Player that leads to remote code execution. Adobe’s patch for the flaw arrived after a threat actor had been abusing it in attacks.

The first EK to implement an exploit for this security bug was Underminer in mid-December 2018, but it appears that Fallout wasn’t too far behind.

Due to the large number of critical vulnerabilities impacting Flash Player, Adobe is moving toward completely killing the plugin in 2020, and major Internet companies are supporting this decision. Later this year, Firefox will disable Flash by default (Chrome has been blocking Flash for two years). 

The re-launched Fallout EK was also observed to include support for encrypted communications (HTTPS) and a new landing page format, and to leverage Powershell to run the final payload. 

The use of Powershell instead of iexplorer.exe is “most likely an attempt at evasion, as traditionally we’d expect the Internet Explorer process to drop the payload,” Malwarebytes says. 

This development is yet again proof that exploit kit developers are continuously monitoring the security vulnerabilities scene to implement new exploits and techniques. 

“In 2018, several zero-days for Internet Explorer and Flash Player were found and turned into easily adaptable proof of concepts. Even though the market share for IE and Flash continues to drop, there are many countries still running older systems where the default browser is Internet Explorer,” Malwarebytes notes. 

Related: Russian Hospital Targeted With Flash Zero-Day After Kerch Incident

Related: Researchers Discover New “Fallout” Exploit Kit