Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Recent InPage Exploits Lead to Multiple Malware Families

Summary: Unit 42 found three InPage documents crafted to exploit the Urdu, Persian, Pashto and Arabic word processor, linked by near-identical shellcode that suggests one actor or a shared builder, and dropping malware including the CONFUCIUS_B family and a new Delphi backdoor named BioData. The decoy lures covered intelligence reports and political situations tied to India, the Kashmir region and terrorism, and one exploit was unsuccessful against InPage version 3.60, indicating the underlying vulnerability has likely been patched.

What's compelling: The lures were built around Kashmir and terrorism subjects, so the targets are likely politically or militarily motivated - and a shared shellcode builder means the same tooling can be repointed at new victims without new exploit work.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related