DragonOK Updates Toolset and Targets Multiple Geographic Regions
Summary: Unit 42 reports that DragonOK has deployed new variants of its sysget malware, along with the IsSpace and TidePool families, through phishing emails and RTF documents exploiting CVE-2015-1641, a Microsoft Office memory corruption flaw patched in MS15-033. While Japan remains the most heavily targeted region, Unit 42 also observed attacks against individuals or organizations in Taiwan, Tibet, and Russia, using decoy documents themed to each locale.
Key Takeaway: The group's C2 domains carry Chinese WHOIS registrant details and resolved to China, Korea, and Taiwan within the past six months, and its toolset is being actively developed to make detection and analysis harder - so a single unpatched Office install remains the entry point for an actor now reaching across four regions.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-1641
- Related
- CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021