Attack on French Diplomat Linked to Operation Lotus Blossom
Summary: In November 2015, threat actors sent a spear-phishing email to a single French diplomat based in Taipei, Taiwan, inviting them to a Science and Technology conference in Hsinchu held three days later, with two malicious Word attachments. The attachments exploited CVE-2014-6332 using modified proof-of-concept code to install the Emissary Trojan, version 5.3, which is related to the Elise backdoor from the Operation Lotus Blossom campaign.
Bottom line: The Emissary command handler supports six commands giving attackers backdoor access to run the system's command shell, exfiltrate data, and download and execute additional tools - and the actors set a secondary C2 domain to resolve to 127.0.0.1 until they need it operational, a technique built to evade network detection.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2014-6332
- Related
- CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022