Phishing Games
Summary: Cisco Talos reported two Olympic-themed phishing campaigns ahead of the 2012 London games: one carrying an RTF attachment that exploits CVE-2010-3333 in Microsoft Office to drop a randomly named executable from the temp folder, which then installs a file called cydll.dll as a Windows service that beacons to a command-and-control server. The second email uses plain links that lead to a Blackhole exploit kit dropping multiple binaries, with the malicious service's 'Extra-Data-Bind' and 'Extra-Data' HTTP headers and the RTF covered by specific Snort SIDs.
Why it matters: A single opened attachment turns into a persistent Windows service beaconing to an attacker's C&C, and the article notes CVE-2010-3333 had public exploits and was actively exploited in the wild since shortly after its November 2010 release - so the patch gap, not the phishing lure, is what let the payload land.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2010-3333
- Related
- CVE-2010-3333: Microsoft Office Stack-based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022