The Trail of BlackTech’s Cyber Espionage Campaigns
trendmicro.com · 22 Jun 2017 · Licence: not cleared; local research copy only
CVEs this report names
5 CVEs- CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution15 reports>99.9%Top 0.02%89.2priority
- CVE-2017-0199Microsoft Office and WordPad Remote Code Execution VulnerabilityMicrosoft · Office and WordPadKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution12 reports99.5%Top 0.06%88.4priority
- CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reports98.6%Top 0.08%74.8priority
- CVE-2014-6352Microsoft Windows Code Injection VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1203Exploitation for Client ExecutionT1204.002Malicious File2 reports77.5%Top 0.44%74.5priority
- CVE-2017-7269Microsoft Windows Server Buffer Overflow VulnerabilityMicrosoft · Internet Information Services (IIS)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report99.8%Top 0.04%73.7priority
Where it names them
CVE-2012-0158 Original (opens in a new tab) ↗
CVE-2012-0158, patched by Microsoft last April, 2012
CVE-2017-0199 Original (opens in a new tab) ↗
CVE-2017-0199, patched by Microsoft last April, 2017
CVE-2015-5119 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2015-5119, patched by Adobe last July, 2015
PLEAD also dabbled with a short-lived, fileless version of their malware when it obtained an exploit for a Flash vulnerability (CVE-2015-5119) that was leaked during the Hacking Team breach.
CVE-2014-6352 Original (opens in a new tab) ↗
CVE-2014-6352, patched by Microsoft last October, 2014
CVE-2017-7269 Original (opens in a new tab) ↗
PLEAD also uses CVE-2017-7269, a buffer overflow vulnerability Microsoft Internet Information Services (IIS) 6.0 to compromise the victim’s server.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.