Let It Ride: The Sofacy Group’s Dealers Choice Attacks Continue
Summary: Unit 42 reported that the Sofacy group (APT28, Fancy Bear, STRONTIUM, Pawn Storm, Sednit) is actively using its DealersChoice exploitation platform, specifically Variant B, which generates malicious RTF documents containing embedded OLE Word documents with embedded Adobe Flash files. Researchers found two operational command and control servers, versiontask[.]com and postlkwarn[.]com, that delivered a malicious SWF exploiting CVE-2016-7855 and a loader Trojan installing a Seduploader variant, and testing showed the servers filtered requests by geolocation, refusing requests from a California VPN while responding to one in the Middle East.
What you should know: The platform delivered working exploit code for CVE-2016-7855, a Flash zero-day patched in Adobe bulletin APSB16-36 in late October 2016, and the C2 servers returned different exploit code based on the victim's reported Flash version and location - so a single phishing document can be tailored per target.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2015-7645CVE-2016-7255CVE-2016-7855
- Related
- CVE-2015-7645: Adobe Flash Player Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022CVE-2016-7855: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022CVE-2016-7255: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021