Inception Attackers Target Europe with Year-old Office Vulnerability
Summary: Unit 42 observed Inception attackers targeting European organizations in October 2018 using malicious Word remote templates that delivered exploits for CVE-2012-1856 and CVE-2017-11882, which in turn executed a new PowerShell backdoor named POWERSHOWER. The group, active since at least 2014 and previously documented by Blue Coat and Symantec, used decoy documents copied from media reports with political themes, including conference invitations and articles on Crimea, and in most cases the remote server did not return a malicious template.
What you should know: The exploit chain rests on CVE-2017-11882, patched in 2017, meaning unpatched Word installations remain a working entry point more than a year after the fix was available. POWERSHOWER is deliberately simple and used only as a foothold, so the attacker holds back more capable malware for later stages and is less likely to be detected.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2012-1856CVE-2017-11882
- Related
- Threat Source newsletter (June 24, 2021) Cyber Risks ·