Flash 0-Day In The Wild: Group 123 At The Controls
Summary: Cisco Talos reports that a malicious document carrying an ActiveX Flash object exploits the CVE-2018-4878 use-after-free vulnerability to download shellcode from compromised South Korean websites and execute it in memory, dropping the ROKRAT remote administration tool. Talos attributes the activity to Group 123, which it previously profiled in its January 2018 'Korea In The Crosshair' write-up, and notes one ROKRAT sample used a naming reference to Hancom Secure AnySign, a legitimate PKI and authentication application widely used in South Korea.
Key Takeaway: The payload is ROKRAT, a tool Talos says is used with cloud platforms to exfiltrate documents and manage infected systems, and the lure impersonates AnySign, an authentication product broadly deployed in South Korea - so the same tooling that steals documents is being aimed through software users already trust.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2018-4878
- Related
- CVE-2018-4878: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Attackers Exploiting Unpatched Flaw in Flash Cyber Risks ·Traps Prevents Adobe Flash Player Zero-Day Cyber Risks ·