Watering Hole Attack on Aerospace Firm Exploits CVE-2015-5122 to Install IsSpace Backdoor
Summary: On July 16, 2015, Palo Alto Networks Unit 42 found the website of a well-known aerospace firm compromised to host a watering hole attack against the company's customers, using an Adobe Flash exploit for CVE-2015-5122, a vulnerability disclosed in the Hacking Team data breach. The exploit file movie.swf was ZWS compressed to evade anti-virus and embedded a binary identified as the IsSpace Trojan, which drops to %TEMP%\Rdws.exe, beacons to the hardcoded C2 IP 172.246.109.27, and exfiltrates victim data including the MAC address using the same four-byte XOR key seen in NFlog.
Why it matters: IsSpace shares code and behavior with NFlog, which has been attributed to DragonOK and Moafee, groups thought to operate out of Southeast Asia and, in Moafee's case, linked to attacks on the US defense industrial base. The exploit was nearly identical to the public Hacking Team proof of concept, with the variable name 'calc' left unchanged, showing how little effort adversaries needed to weaponize a leaked flaw against aerospace customers.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Data Breaches
- Mentions
- CVE-2015-5122
- Related
- CVE-2015-5122: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022Web-based Threats-2018 Q2: U.S. Remains #1 in Malicious Web Addresses, China Falls from #2 to #7 Cyber Risks ·Attacking ECMAScript Engines with Redefinition Cyber Risks ·