APT Group UPS Targets US Government with Hacking Team Flash Exploit
Summary: On July 8, 2015, Unit 42 identified a spear-phishing attack against the US Government that used a link to a Flash exploit hosted on two subdomains of perrydale[.]com, both resolving to a Ukraine-based IP, 194.44.130.179, likely via DNS hijacking rather than a compromised site. The exploit leveraged CVE-2015-5119, one of the Flash zero-days exposed in the Hacking Team breach, and shared ActionScript classes, function names, and the 'can't cause UaF' error message with Hacking Team's exploit, while its shellcode showed 99% similarity to a prior UPS attack using CVE-2015-3113.
What's compelling: A patch for CVE-2015-5119 was released the same day the exploit was weaponized, leaving organizations almost no window to patch before UPS was already using it against government targets.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-3113CVE-2015-5119
- Related
- CVE-2015-3113: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022CVE-2015-5119: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022Adobe to Patch Hacking Team’s Flash Zero-Day Cyber Risks ·