Espionage Hackers Target ‘Watering Hole’ Sites
Summary: RSA reported that espionage attackers compromised legitimate websites between June and July 2012 and silently redirected visitors to exploit pages on torontocurling.com, serving a then-unpatched Windows XML Core Services zero-day (CVE-2012-1889) and a Trojan named VPTray.exe disguised as a Symantec component. RSA said 32,160 unique hosts across 731 organizations were redirected to the exploit server, and 3,934 hosts downloaded the exploit files, a 12 percent success rate the company called very successful.
What's compelling: Nearly 4,000 hosts across 731 organizations were successfully exploited simply by visiting sites their users already trusted, and Symantec's Elderwood report warns that defense supply chain manufacturers should expect attacks routed through compromised subsidiaries and business partners.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Mentions
- CVE-2012-1723CVE-2012-1889
- Related
- CVE-2012-1889: Microsoft XML Core Services Memory Corruption Vulnerability Known Exploited Vulnerabilities · Jun 08, 2022CVE-2012-1723: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022