Recent MNKit Exploit Activity Reveals Some Common Threads
Summary: Unit 42 identified a variant of MNKit-weaponized MHTML documents, built to exploit CVE-2012-0158, delivering LURK0 Gh0st, NetTraveler, and Saker payloads to targets at universities, NGOs, and political and human rights groups concerning Islam and South Asia. Reuse of sender addresses, subject lines, attachment filenames, command and control domains, XOR keys beginning at 127, and recipients links the payload families, with self-extracting PE files shifting contents across February to June 2016 while delivery methods stayed consistent.
What you should know: The attackers have been active for years, change tactics only subtly, and share a privately held exploit builder across multiple groups - so an unpatched CVE-2012-0158 exposure connects your organization to a campaign that has run since at least 2012.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2012-0158
- Related
- Bad Patch Cyber Risks ·