Operation Dust Storm
s7d2.scene7.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
6 CVEs- CVE-2011-0611Adobe Flash Player Remote Code Execution VulnerabilityAdobe · Flash PlayerKEVPublic exploitHigh · 8.8T1204.002Malicious FileT1105Ingress Tool Transfer3 reports99.4%Top 0.06%76.9priority
- CVE-2012-1889Microsoft XML Core Services Memory Corruption VulnerabilityMicrosoft · XML Core ServicesKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter+1 more · 3 reports83.5%Top 0.32%76.8priority
- CVE-2010-1885The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows…Public exploit1 report71.1%Top 0.59%65.5priority
- CVE-2011-1255The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8…Public exploit1 report42.1%Top 1.3%65.4priority
- CVE-2014-0322Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter3 reports85.1%Top 0.29%61.8priority
- CVE-2013-5990Unspecified vulnerability in JustSystems Ichitaro 2006 through 2011; Ichitaro Government 6, 7, and 2006 through 2010…1 report4.6%Top 8.4%58.3priority
Where it names them
CVE-2011-0611 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
embedded with a zero-day Flash exploit (CVE-2011-0611).
in June 2012 that leveraged both CVE-2011-0611, a
CVE-2012-1889 Original (opens in a new tab) ↗
Flash exploit the group had used previously, and CVE- 2012-1889, an Internet Explorer zero-day.
CVE-2010-1885 Original (opens in a new tab) ↗
malicious Windows Help (.hlp) file, which exploited CVE- 2010-1885.
CVE-2011-1255 Original (opens in a new tab) ↗
8 vulnerability, CVE-2011-1255, to gain a foothold into
CVE-2014-0322 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
zero-day, CVE-2014-0322, to a number of unsuspecting
executable common to other CVE-2014-0322 attacks,
CVE-2013-5990 Original (opens in a new tab) ↗
Dust Storm leveraged an Ichitaro zero-day “CVE-2013- 5990” to target Japanese victims.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.