APT Group Wekby Leveraging Adobe Flash Exploit (CVE-2015-5119)

Summary: Volexity reported on July 8, 2015 that the APT group Wekby ran a spear phishing campaign with spoofed Adobe emails linking to a page that served a malicious SWF exploiting CVE-2015-5119, a Flash 0-day from the Hacking Team data dump that Adobe had patched that day in APSB15-16. The exploit worked on Flash versions up to 18.0.0.194, dropped an executable into the victim's Temp directory, and beaconed to the known Wekby command-and-control IP 223.25.233.248 on TCP port 80 using a modified Gh0st RAT with the packet flag "HTTP\1.1 Sycmentec".
What you should know: The exploit was already in the Angler Exploit Kit and Metasploit and used in targeted attacks the same day Adobe patched it, and the C2 address 223.25.233.248 had served Wekby for years across Poison Ivy, Gh0st and Remote RSS malware - so any host still on Flash 18.0.0.194 or earlier that touched the phishing link is a live compromise, not a hypothetical one.

Read the original at Volexity Blog ↗

Topics: Phishing & Social Engineering
Mentions: CVE-2015-5119
Related: CVE-2015-5119: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
Adobe to Patch Hacking Team’s Flash Zero-Day Cyber Risks ·
APT Group UPS Targets US Government with Hacking Team Flash Exploit Cyber Risks ·