MONSOON – ANALYSIS OF AN APT CAMPAIGN
forcepoint.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
4 CVEs- CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution15 reports>99.9%Top 0.02%89.2priority
- CVE-2015-1641Microsoft Office Memory Corruption VulnerabilityMicrosoft · OfficeKEVPublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution4 reports97.2%Top 0.1%87.4priority
- CVE-2014-6352Microsoft Windows Code Injection VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1203Exploitation for Client ExecutionT1204.002Malicious File2 reports77.5%Top 0.44%74.5priority
- CVE-2016-0034Microsoft Silverlight Runtime Remote Code Execution VulnerabilityMicrosoft · SilverlightKEVRansomwareEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter+1 more · 3 reports69.4%Top 0.64%66.8priority
Where it names them
CVE-2012-0158 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2012-0158 Microsoft BizTalk Server Windows Common Controls (MSCOMCTL.OCX)
We have seen this dropped by an RTF exploiting CVE-2012-0158
CVE-2015-1641 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
vulnerability (CVE-2015-1641) and that it had filenames
Microsoft BizTalk Server Windows Common Controls (MSCOMCTL.OCX) Bug Lets Remote Users Execute Arbitrary Code CVE-2014-6352 Microsoft Windows CVE-2014-6352 OLE Package Manager Remote Code Execution Vulnerability CVE-2015-1641 Microsoft Office Memory Errors Let Remote Users Execute Arbitrary
CVE-2015-1641 has been observed as being exploited to drop BADNEWS.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1641.
CVE-2014-6352 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2014-6352 Microsoft Windows CVE-2014-6352 OLE Package Manager Remote Code
Documents exploiting CVE-2014-6352 have been observed installing the malware
The majority of the weaponised documents used in MONSOON are PPS files which exploit CVE-2014- 6352 and drop an AutoIt binary.
documents exploit CVE-2014-6352.
CVE-2016-0034 Original (opens in a new tab) ↗
could have been intended as an exploitation of something like CVE-2016-0034 which is known to have
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.