Modified Zyklon and plugins from India
Summary: Cisco Talos analyzed an email campaign that used a Word document with 40 embedded ActiveX controls for heap spraying and a TIFF file named image1.jpeg to trigger CVE-2013-3906, delivering a modified Zyklon bot through a self-extractable CAB archive and an obfuscated Autoit script. The bot connects to one of three C2 servers using RSA and 256-bit AES encryption, polls for commands every 60 seconds, and in this campaign downloaded three plugins that steal credentials from browser, email, and FTP password caches.
What's compelling: The Zyklon authors modified the bot's Main function specifically to block anyone launching it outside their loader, and the campaign's C2 servers were compromised legitimate hosts - so blocking known malicious domains alone would not have caught this.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2013-3906
- Related
- CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability Known Exploited Vulnerabilities · Feb 15, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026