Security Experts:

Connect with us

Hi, what are you looking for?


Malware & Threats

Exploit for Recent Flash Zero-Day Added to Fallout Exploit Kit

An updated version of the Fallout exploit kit recently emerged with an exploit for a recent Flash zero-day included in its arsenal, Malwarebytes Labs security researchers warn.

An updated version of the Fallout exploit kit recently emerged with an exploit for a recent Flash zero-day included in its arsenal, Malwarebytes Labs security researchers warn.

First detailed in September 2018, the toolkit was observed delivering malware families ranging from ransomware to backdoors, but also fingerprinting the browser profile to identify targets of interest.

The exploit kit (EK) remained active throughout the end of 2018, but its operators took a break in early January, apparently in order to improve their malicious kit. During Fallout’s absence, RIG EK’s activity intensified, Malwarebytes now reveals.

The Fallout EK is distributed via malvertising chains, especially via adult traffic. In attacks observed starting January 15, when the toolkit recommenced activity, GandCrab ransomware was identified as the payload.

One of the most notable additions to Fallout is an exploit for CVE-2018-15982, a vulnerability in Adobe’s Flash Player that leads to remote code execution. Adobe’s patch for the flaw arrived after a threat actor had been abusing it in attacks.

The first EK to implement an exploit for this security bug was Underminer in mid-December 2018, but it appears that Fallout wasn’t too far behind.

Due to the large number of critical vulnerabilities impacting Flash Player, Adobe is moving toward completely killing the plugin in 2020, and major Internet companies are supporting this decision. Later this year, Firefox will disable Flash by default (Chrome has been blocking Flash for two years). 

The re-launched Fallout EK was also observed to include support for encrypted communications (HTTPS) and a new landing page format, and to leverage Powershell to run the final payload. 

The use of Powershell instead of iexplorer.exe is “most likely an attempt at evasion, as traditionally we’d expect the Internet Explorer process to drop the payload,” Malwarebytes says. 

This development is yet again proof that exploit kit developers are continuously monitoring the security vulnerabilities scene to implement new exploits and techniques. 

“In 2018, several zero-days for Internet Explorer and Flash Player were found and turned into easily adaptable proof of concepts. Even though the market share for IE and Flash continues to drop, there are many countries still running older systems where the default browser is Internet Explorer,” Malwarebytes notes. 

Related: Russian Hospital Targeted With Flash Zero-Day After Kerch Incident

Related: Researchers Discover New “Fallout” Exploit Kit

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.