CVE-2015-1701

Research By: Eyal Itkin and Itay Cohen Introduction Exploits have always been an important and integral part of malicious attacks. They allow attackers to gain capabilities that are not easy to achieve otherwise. Whether attackers strive to gain higher privileges on a given computer, or laterally move inside a network, exploits often play a key […]

Research by: Itay Cohen, Eyal Itkin In the past months, our Vulnerability and Malware Research teams joined efforts to focus on the exploits inside the malware and specifically, on the exploit writers themselves. Starting from a single Incident Response case, we built a profile of one of the most active exploit developers for Windows, known […]

The developers of the Purple Fox exploit kit (EK) have added two new exploits to their arsenal, including one for a vulnerability addressed in February this year.

The authors of the Purple Fox EK have integrated two new exploits for Microsoft vulnerabilities to the Purple Fox EK. The Purple Fox EK continues to be improved by its authors that implemented two new exploits for Microsoft critical- and high-severity Microsoft vulnerabilities. The Purple Fox EK appears to have been built to replace the […]

Analyzing how tactics, techniques and procedures of the Russia-linked APT28 cyberespionage group evolve over the time. APT28 is a well known Russian cyber espionage group attributed, with a medium level of confidence, to Russian military intelligence agency GRU (by CrowdStrike). It is also known as Sofacy Group (by Kaspersky) or STRONTIUM (by Microsoft) and it’s used to target Aereospace, Defence, Governmente Agencies, International […]

Malware researchers from Trend Micro have spotted a new piece of malware dubbed SLUB that leverages GitHub and Slack for C&C communications. Malware researchers at Trend Micro have spotted a new backdoor dubbed SLUB that abuse GitHub and Slack for command and control (C&C) communications. According to the experts, the SLUB backdoor (Backdoor.Win32.SLUB.A) was only […]

Researchers from Trend Micro have come across a new piece of malware that abuses GitHub and Slack for command and control (C&C) communications.

Adobe’s Flash Player might be the most targeted product when criminal exploit kits are involved, but Microsoft products such as Office, Windows and Internet Explorer take center stage when Russian advanced persistent threat (APT) groups are involved.

SFG, the Furtim-related piece of malware that was said last week to be specifically targeting “at least one European energy company,” might have no special interest in the energy sector after all, but is instead more focused on evasion and on stealing passwords and money.

The Labs team at SentinelOne recently discovered a sophisticated malware dubbed Furtim specifically targeting at least one European energy company. In May of this year, security researcher Yotam Gottesam with enSilo, began unraveling a mystery that continues to unravel. First reported by FireF0X, a self-proclaimed “ex-malware analyst” located in the Russian Federation, the Furtim malware […]

Endpoint security firm SentinelOne has found and analyzed the dropper framework of the Furtim malware discovered in May. It describes this as the mother ship, and has named it SFG: Furtim’s Parent.

Security experts at FireEye have uncovered a spear phishing campaign managed by Chinese hackers that is targeting Taiwan Opposition and Media ahead of the vote in January. According to FireEye a group of Chinese hackers is targeting Taiwan’s opposition party and journalists, security experts and officials. The attacks are occurring weeks away from a Taiwanese presidential […]

APT28, believed to consist of Russian hackers, has been spotted wielding two zero-day exploits in the latest targeted attack aimed at an “international government entity in an industry vertical that aligns with known APT28 targeting.”According to FireEye researchers, the group, which seems to be the same one behind the “Pawn Storm” campaigns and which has been recently found targeting NATO members and the White House, has been exploiting the Adobe Flash CVE-2015-3043 vulnerability and a … More →

FireEye recently detected a new highly targeted attack run by APT28 exploiting two zero-day flaws to compromise an “international government entity”. Security experts at FireEye have recently detected a new cyber espionage campaign, dubbed “Operation RussianDoll,” operated by the Russian APT28 group. This time the hackers run highly targeted attack by exploiting two zero-day vulnerabilities to target an “international […]

FireEye said on Saturday that it recently detected a highly targeted attack exploiting two zero-day vulnerabilities in an effort to compromise an “international government entity” in an industry vertical that aligns with known targets hit by a threat actor group which FireEye calls APT28. FireEye has described APT28 as a skilled team of developers and operators collecting intelligence on defense and geopolitical issues that would clearly benefit Russia. The security firm previously traced cyber-espionage campaigns by the group that date back to 2007. FireEye said that it first detected the attacks on April 13th, 2015, when the attackers attempted to exploit two zero-day vulnerabilities, including a recently patched flaw in Adobe Flash (CVE-2015-3043) and a brand new one in Microsoft Windows (CVE-2015-1701). Through its analysis and technical indicators and command and control infrastructure, FireEye believes that the APT28 attackers are responsible for the campaign, which it is callin…