Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cyberwarfare

Russian Hospital Targeted With Flash Zero-Day After Kerch Incident

Security updates released by Adobe on Wednesday for Flash Player patch two vulnerabilities, including a critical flaw exploited by a sophisticated threat actor in attacks aimed at a healthcare organization associated with the Russian presidential administration. The attack may be related to the recent Kerch Strait incident involving Russia and Ukraine.

Security updates released by Adobe on Wednesday for Flash Player patch two vulnerabilities, including a critical flaw exploited by a sophisticated threat actor in attacks aimed at a healthcare organization associated with the Russian presidential administration. The attack may be related to the recent Kerch Strait incident involving Russia and Ukraine.

Adobe’s advisory reveals that the exploited vulnerability, CVE-2018-15982, is a use-after-free bug that allows arbitrary code execution. The issue was patched with the release of Flash Player 32.0.0.101 for Windows, macOS, Linux and Chrome OS. The company has warned users that exploits exist in the wild, but has not shared any details.

Adobe has credited three teams – one working for Gigamon and two teams from Chinese cybersecurity firm Qihoo 360 – and one independent researcher for informing it of the vulnerability.

The Qihoo 360 teams have published several blog posts, written in both English and Chinese, describing the zero-day vulnerability and the attacks involving the exploit. Gigamon has also published a blog post describing the flaw and the attack.

According to experts, the Flash zero-day exploit has been used in an operation aimed at the FSBI “Polyclinic No. 2” of the Administrative Directorate of the President of the Russian Federation. The attackers, which Qihoo 360 researchers described as an advanced persistent threat (APT), delivered the exploit inside a RAR archive containing a specially crafted document.

When opened, the document shows a questionnaire for staff of the Moscow-based hospital. However, in the background, malicious commands are executed by leveraging CVE-2018-15982, and a piece of malware is deployed on the system.

CVE-2018-15982 attack

Researchers said the malware is similar to a Trojan from Hacking Team, an Italian spyware maker whose tools were leaked in 2015 following a data breach. The malware used in this attack appears to be a variant of Hacking Team’s Scout tool, said Gigamon.

The Chinese experts noted that the Flash vulnerability is very similar to CVE-2018-4878, which was first exploited by North Korea-linked hackers earlier this year.

Advertisement. Scroll to continue reading.

Qihoo 360 researchers spotted the attacks on November 29 and reported the vulnerability to Adobe the next day. Gigamon informed Adobe of the flaw on November 29.

Qihoo 360 pointed out that the attack was launched just days after the Kerch Strait incident, which made headlines around the world. On November 25, Russian border guards opened fire on three Ukrainian vessels that had attempted to pass from the Black Sea into the Sea of Azon through the Kerch Strait on their way to the port of Mariupol. The Ukrainian vessels and their 24 crew members were captured.

The media reported that three of the captured crew members were taken to hospitals in Moscow. It is possible that “Polyclinic No. 2” is one of those hospitals and the attackers were seeking information on the captured Ukrainians.

Gigamon said the malicious document analyzed by its researchers was uploaded to VirusTotal from a Ukrainian IP address.

Related: Flash Player Update Patches Disclosed Code Execution Flaw

Related: Adobe Patches Disclosed Acrobat Vulnerability

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Cyberwarfare

WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...