Operation Transparent Title
proofpoint.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution15 reports>99.9%Top 0.02%89.2priority
Where it names them
CVE-2012-0158 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
exploit: CVE-2012-0158
In this incident, the attachment was a weaponized RTF document utilizing CVE-2012-0158 to drop an embedded,
Type: Exploit,CVE-2012-0158,Embedded Payload
get additional colonels posts Link: hxxp://intribune.blogspot[.]com/2015/11/army-air-defenceengineers-and-signal-to.html Malicious Document Location: hxxp://birthdaywisheszone[.]com/pml/army-air-defenceengineers-and-signal.doc Document: 68773f362d5ab4897d4ca217a9f53975 Type: Exploit,CVE-2012-0158,Embedded
Para-Military Forces Personnel Plots Scheme 2016 Link: hxxp://intribune[.]blogspot[.]com/2015/07/awho-defence-and-para-military-forces.html Malicious Document Location: hxxp://bbmsync2727[.]com/upd/AWHO-Upcoming-Projects.doc Document: 1f82e509371c1c29b40b865ba77d091a Type: Exploit,CVE-2012-0158,Embedded
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.