Advanced Persistent Tweets: Zero-Day in 140 Characters
Summary: Analysis of recent zero-day attacks, including the RSA break-in, found that the Chinese developers of the attack tools left identifying clues, with a Twitter user called "Yuange" posting exploit code snippets days before the flaws were used in the wild. The April 2011 Flash zero-day was hidden in a Word document emailed to U.S. government employees and contractors, and the Chinese IP address used to download malicious files was 123.123.123.123.
Why it matters: FireEye traced an attack file's metadata to a user named "Linxder," and analyst Scott Henderson noted the attacks keep coming because attackers send enough emails that someone eventually clicks - so the question is how many of your users would have opened "2011 Recruitment Plan."
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026