CVE-2015-3043

Analyzing how tactics, techniques and procedures of the Russia-linked APT28 cyberespionage group evolve over the time. APT28 is a well known Russian cyber espionage group attributed, with a medium level of confidence, to Russian military intelligence agency GRU (by CrowdStrike). It is also known as Sofacy Group (by Kaspersky) or STRONTIUM (by Microsoft) and it’s used to target Aereospace, Defence, Governmente Agencies, International […]

Adobe’s Flash Player might be the most targeted product when criminal exploit kits are involved, but Microsoft products such as Office, Windows and Internet Explorer take center stage when Russian advanced persistent threat (APT) groups are involved.

An exploit for a Flash Player vulnerability patched by Adobe last week with the release of version 18.0.0.194 has been integrated into the Magnitude exploit kit.

Security firm FireEye released a report on June 23 about targeted attacks leveraging a Flash Player zero-day vulnerability (CVE-2015-3113) in Adobe Flash Player…

Researchers at Trend Micro say the zero-day vulnerability patched Tuesday by Adobe Systems has a similar underlying cause as an older flaw .

APT28, believed to consist of Russian hackers, has been spotted wielding two zero-day exploits in the latest targeted attack aimed at an “international government entity in an industry vertical that aligns with known APT28 targeting.”According to FireEye researchers, the group, which seems to be the same one behind the “Pawn Storm” campaigns and which has been recently found targeting NATO members and the White House, has been exploiting the Adobe Flash CVE-2015-3043 vulnerability and a … More →

FireEye recently detected a new highly targeted attack run by APT28 exploiting two zero-day flaws to compromise an “international government entity”. Security experts at FireEye have recently detected a new cyber espionage campaign, dubbed “Operation RussianDoll,” operated by the Russian APT28 group. This time the hackers run highly targeted attack by exploiting two zero-day vulnerabilities to target an “international […]

FireEye said on Saturday that it recently detected a highly targeted attack exploiting two zero-day vulnerabilities in an effort to compromise an “international government entity” in an industry vertical that aligns with known targets hit by a threat actor group which FireEye calls APT28. FireEye has described APT28 as a skilled team of developers and operators collecting intelligence on defense and geopolitical issues that would clearly benefit Russia. The security firm previously traced cyber-espionage campaigns by the group that date back to 2007. FireEye said that it first detected the attacks on April 13th, 2015, when the attackers attempted to exploit two zero-day vulnerabilities, including a recently patched flaw in Adobe Flash (CVE-2015-3043) and a brand new one in Microsoft Windows (CVE-2015-1701). Through its analysis and technical indicators and command and control infrastructure, FireEye believes that the APT28 attackers are responsible for the campaign, which it is callin…

Adobe released a new version of Flash Player (17.0.0.169) for Windows and Macintosh, and for Linux (11.2.202.457). These security updates fix a host of critical vulnerabilities – 22 in all – most of which could lead to code execution and an attacker taking control of the affected system: Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043) A type confusion vulnerability that could lead … More →

Microsoft released 11 security bulletins today to address vulnerabilities in a number of products, including a critical Office bug being exploited in the wild.

For April 2015 Patch Tuesday, Microsoft released 11 security bulletins, four of which are rated as critical, to address 26 vulnerabilities. Rated Critical All four critical security updates resolve remote code execution (RCE) vulnerabilities. MS15-033 should be your top priority, according to Qualys CTO Wolfgang Kandek, as it addresses a zero-day vulnerability in Microsoft Office, […]