Threat Spotlight: Group 72, Opening the ZxShell
blogs.cisco.com · 28 Oct 2014 · Licence: not cleared; local research copy only
CVEs this report names
3 CVEs- CVE-2014-0322Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter3 reports85.1%Top 0.29%61.8priority
- CVE-2011-2462Adobe Reader and Acrobat Universal 3D Memory Corruption VulnerabilityAdobe · Reader and AcrobatKEVPublic exploitEnd of lifeCritical · 9.8T1059Command and Scripting InterpreterT1499Endpoint Denial of Service1 report88.6%Top 0.23%58.7priority
- CVE-2013-3163Microsoft Internet Explorer Memory Corruption VulnerabilityMicrosoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution1 report70.7%Top 0.61%57.9priority
Where it names them
CVE-2014-0322 Original (opens in a new tab) ↗
ZxShell has been observed to be distributed through phishing attacks, dropped by exploits that leverage vulnerabilities such as CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.
CVE-2011-2462 Original (opens in a new tab) ↗
ZxShell has been observed to be distributed through phishing attacks, dropped by exploits that leverage vulnerabilities such as CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.
CVE-2013-3163 Original (opens in a new tab) ↗
ZxShell has been observed to be distributed through phishing attacks, dropped by exploits that leverage vulnerabilities such as CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.