Operation Ke3chang Resurfaces With New Tide Pool Malware
Summary: Unit 42 discovered a new malware family it calls TidePool, which it links to the Operation Ke3chang actors through 11 shared registry modifications and reused code for C2 obfuscation and URL beacon creation, and which is being used in an ongoing campaign against Indian embassy personnel worldwide. The spear phishing emails spoof real people tied to Indian embassies and carry MHTML documents that exploit CVE-2015-2545, first made public in September 2015, to drop a DLL into C:\Documents and Settings\AllUsers\IEHelper\mshtml.dll and persist via an ActiveSetup key.
What's compelling: The group has kept developing custom malware since at least 2012 and went unreported from 2013 until now, while continuing to target Indian embassies across multiple years - a reminder that quiet actors are still iterating, and that a vulnerability public since September 2015 is still landing in current phishing waves.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2015-2545
- Related
- CVE-2015-2545: Microsoft Office Malformed EPS File Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022