Special Delivery -- Phoenix Exploit Kit

Summary: Cisco Talos reported a spam campaign posing as DHL with the subject "DHL Attention 846698" that carried a zip file named "DHL-N-35385784.zip" containing an HTML file with four blocks of obfuscated code. When clicked, the code sent victims to a Phoenix exploit kit hosted on a static IP address on port 8080, which served a multi-capability PDF that exploited vulnerable PDF readers and, on a test Windows XP machine, the Windows Help and Support Center vulnerability CVE-2010-1885.
Bottom line: Talos noted that the Snort rules for the executable downloads, SID 15306 and 11192, are not on by default and must be activated manually, even though those SIDs fire regardless of which exploit kit is used.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2010-1885
Related: Increase in attacks on CVE-2010-1885 Cyber Risks ·
Quick analysis of a webpage leveraging CVE-2010-1885 (aka the help and support center vulnerability) Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026