BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech

unit42.paloaltonetworks.com · 9 Feb 2021 · Licence: not cleared; local research copy only

CVEs this report names

2 CVEs

CVE-2014-6332Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution5 reports
94.9%Top 0.14%
89.1priority
CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Adobe · Flash PlayerKEVPublic exploitCritical · 9.8T1497Virtualization/Sandbox Evasion T1622Debugger Evasion+1 more · 3 reports
99.8%Top 0.04%
77.6priority

Addressing CVE-2014-6332 SWF Exploit

UPS: Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload

None

No passage in this report has been tied to an ATT&CK technique.