Matryoshka Doll Reconnaissance Framework
Summary: Cisco Talos analyzed an RTF document that nests an OLE object containing a first Adobe Flash object, which uses ActionScript to extract a second Flash object encoded with XOR and zlib compression. That final payload contacts a command-and-control server at the URI /nato, sends system details gathered through the flash.system.Capabilities.serverString API, and then makes two further HTTP requests before calling functions named expLoaded() and payLoaded().
What you should know: The campaign's DNS traffic shows a tightly targeted window from December 29, 2016 through January 12, 2017, with the surge in requests after January 16 coming from security researchers rather than victims. The payload also checks the victim's OS and Flash version and can abandon the request if the system looks like a sandbox or virtual machine, so a decoy environment may never see the next stage.
Read the original at Cisco Talos ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026