Connect with us

Hi, what are you looking for?


Malware & Threats

Recent IE Zero-Day Used in Widespread Attacks: Symantec

Earlier this month, security researchers from FireEye discovered a new IE 10 Zero-Day exploit (CVE-2014-0322) that was being used in a watering hole attack on the US Veterans of Foreign Wars’ website.

Earlier this month, security researchers from FireEye discovered a new IE 10 Zero-Day exploit (CVE-2014-0322) that was being used in a watering hole attack on the US Veterans of Foreign Wars’ website.

Dubbed “Operation SnowMan” by FireEye, the attack targets certain versions of Internet Explorer with Adobe Flash and originally was used in more targeted attacks against a limited audience.

Now, according to Symantec, the attacks are much more widespread and no longer being used in only targeted attacks.

“We’ve observed trends suggesting that attacks targeting this vulnerability are no longer confined to advanced persistent threats (APT) — the zero-day attacks are expanding to attack average Internet users as well,” Symantec wrote in a blog post Tuesday.

“This is not a surprising result, as the vulnerability’s exploit code received a lot of exposure, allowing anyone to acquire the code and re-use it for their own purposes.”

Symantec witnessed a large uptick in attempted zero-day attacks in many parts of the world on Feb. 22, including both targeted and drive-by download attacks. Users visiting Japanese sites have particularly been targeted after multiple sites were compromised to host the drive-by download, Symantec said.

Researchers at Websense said the vulnerability was being used as early as Jan. 20, including an attack that targeted organizations associated with the French aerospace association GIFAS. 

Advertisement. Scroll to continue reading.

Map of CVE-2014-0322 Attacks

Attacks targeting CVE-2014-0322 around the world (Credit: Symantec)

Based on the file components used in the attacks, Symantec believes the same attacker(s) are behind the majority of the attacks.

If the attack is successful, the exploit drops a banking Trojan (Infostealer.Bankeiya) that captures login details from certain banks.

Microsoft has not yet issued a patch to fix the vulnerability, but did issue a fix-it tool on Feb. 20 to help users address the issue.  

According to Microsoft, the vulnerability exists in the way IE accesses an object in memory that has either been deleted or not properly allocated. The vulnerability can corrupt memory in a way that allows an attacker to execute arbitrary code, Microsoft explained in an advisory.

Written By

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.