Fresh Baked HOMEKit-made Cookles – With a Dark Hotel Overlap
Summary: Unit 42 documented a toolkit it named HOMEKit, which generates weaponized Microsoft Word OLE documents exploiting CVE-2012-0158 and has been used by its operators since at least 2013, most recently in late June 2016. A June 2016 phishing email spoofing a United Nations Environment Programme coordination associate carried a malicious Word document that silently installed a previously undisclosed downloader Unit 42 named Cookle while displaying a decoy document about Pyongyang contacts.
Why it matters: The shellcode in the HOMEKit documents dropping Cookle is over 90 percent similar to shellcode associated with the DarkHotel group's Tapaoux Trojan, suggesting the Cookle author had access to the same shellcode and modified it, possibly as an anti-analysis technique. The decoy documents were genuine internal UNEP files whose metadata showed last modification by 'Windows User' in April 2016, indicating the actor may already hold access to data usable for further phishing against related targets.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-0158
- Related
- When combining exploits for added effect goes wrong Cyber Risks ·