Flash 0-day Exploited by Angler Exploit Kit

Summary: Cisco Talos reported that the Angler Exploit Kit was serving a new Flash 0-day, CVE-2015-0311, before Adobe released a fix, with a traffic spike beginning January 20, 2015 that Cloud Web Security blocked. Adobe's advisory said the flaw was actively exploited via drive-by-download attacks against Internet Explorer and Firefox on Windows 8 and below, and Talos telemetry showed the 0-day served only to specific User Agents while Chrome-based or non-standard agents received other exploits.
Key Takeaway: The attackers registered domains one day and used most for only 24 hours, rotating rapidly while keeping the attacks on just two IP addresses (46.105.251.7 and 94.23.247.180), so domain blocklists alone would lag the campaign.

Read the original at Cisco Talos ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2014-8439 CVE-2015-0310 CVE-2015-0311
Related: CVE-2014-8439: Adobe Flash Player Dereferenced Pointer Vulnerability Known Exploited Vulnerabilities · May 25, 2022
CVE-2015-0310: Adobe Flash Player ASLR Bypass Vulnerability Known Exploited Vulnerabilities · May 25, 2022
CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022