Security researchers from FireEye on Tuesday said they had identified a PDF zero-day that is being used in active attacks, and that they observed successful exploitation on the latest version of Adobe PDF Reader (9.5.3, 10.1.5, and 11.0.1.).
“Upon successful exploitation, it will drop two DLLs. The first DLL shows a fake error message and opens a decoy PDF document, which is usually common in targeted attacks,” FireEye researchers Yichong Lin, Thoufique Haq, and James Bennett explained in a blog post. “The second DLL in turn drops the callback component, which talks to a remote domain.”
It’s unclear if the sample came as a result of one of FireEye’s clients being targeted, or if the researchers discovered the attacks elsewhere.
While few additional details have been provided at this time, FireEye has provided Adobe’s security team with the sample, and warns users not open any unknown or suspicious PDF files.(This should always be the case!)
Adobe did acknowledge a vulnerability report on Tuesday, assumed to be the issue reported by FireEye.
“We are currently investigating this report and assessing the risk to our customers,” David Lenoe, Adobe’s Product Security Incident Response Team group manager, noted. “We will provide an update as soon as we have more information. Please continue monitoring the Adobe PSIRT blog for the latest information.”
Last week at the Kaspersky Lab Security Analyst Summit in Puerto Rico, Lenoe outlined some of the challenges vendors face with dealing vulnerability report, especially when there is only “partial disclosure”.
SecurityWeek has contacted FireEye for additional details, and this story will be updated as new information becomes available from FireEye or Adobe.
Related: Adobe’s Hunt for Sandbox Bypass Flaw a Frustrating Exercise
For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.
More from Mike Lennon
- Watch Now: Threat Detection and Incident Response Virtual Summit
- Registration Now Open: 2023 ICS Cybersecurity Conference | Atlanta
- NetRise Adds $8 Million in Funding to Grow XIoT Security Platform
- Virtual Event Today: Zero Trust Strategies Summit
- Virtual Event Tomorrow: Zero Trust Strategies Summit
- Watch: How to Build Resilience Against Emerging Cyber Threats
- Video: How to Build Resilience Against Emerging Cyber Threats
- Webinar Today: Understanding Hidden Third-Party Identity Access Risks
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
