UPS: Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload
Summary: Unit 42 reports that the APT3 group, which it tracks as UPS, exploited CVE-2015-3113, an Adobe Flash zero-day patched on June 23, 2015, and that the malicious Flash file shares ActionScript code, including an unused hexToIntArray function, with the group's earlier CVE-2014-1776 exploit. Both campaigns hid an encrypted Pirpi backdoor payload inside an animated GIF using steganography, and the two Pirpi variants share C2 communication over the HTTP Cookie field and a command loop that differs in only two commands.
What's compelling: The reused, never-called hexToIntArray function indicates the actor built the 2015 exploit on top of its 2014 code and left the artifact in place, so code-level overlap like this is what lets defenders tie separate campaigns to one intrusion set. The payloads also carried data out inside HTTP Cookie fields, a channel that blends into ordinary web traffic.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-1776CVE-2014-6332CVE-2015-3113
- Related
- Addressing CVE-2014-6332 SWF Exploit Cyber Risks ·CVE-2015-3113: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022