Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

‘Dealers Choice’ is Sofacy’s Flash Player Exploit Platform

Summary: Unit 42 documented a Sofacy (APT 28) tool it named DealersChoice, which delivers RTF documents containing an embedded OLE Word document that in turn loads an embedded Adobe Flash (.SWF) file to exploit Flash vulnerabilities rather than Word. The attacks occurred in August 2016, primarily against organizations in former Soviet republics, including a Ukrainian defense contractor and a Ministry of Foreign Affairs, both reached through phishing emails with decoy documents copied from news articles.

What you should know: DealersChoice.A embedded three SWF files to match the victim's Flash version against specific vulnerable ranges, while DealersChoice.B pulled the exploit and payload from a live C2 server, so a single phishing attachment could adapt to whatever Flash build the target was running.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related