Patchfirst

RATANKBA: Delving into Large-scale Watering Holes

trendmicro.com · 27 Feb 2017 · Licence: not assessed; coordinator-only cache; do not redistribute

Read the original ↗

CVEs this report names

4 CVEs
  1. CVE-2016-1019Adobe Flash Player Arbitrary Code Execution Vulnerability
    Adobe · Flash PlayerKEVRansomwareCritical · 9.8T1105Ingress Tool TransferT1486Data Encrypted for Impact4 reports
    22.3%Top 2.3%
    83.4priority
  2. CVE-2015-8651Adobe Flash Player Integer Overflow Vulnerability
    Adobe · Flash PlayerKEVHigh · 8.8T1189Drive-by CompromiseT1105Ingress Tool Transfer+1 more · 3 reports
    67.7%Top 0.69%
    81.8priority
  3. CVE-2016-4117Adobe Flash Player Arbitrary Code Execution Vulnerability
    Adobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeCritical · 9.8T1105Ingress Tool Transfer3 reports
    94.3%Top 0.15%
    72.6priority
  4. CVE-2016-0034Microsoft Silverlight Runtime Remote Code Execution Vulnerability
    Microsoft · SilverlightKEVRansomwareEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter+1 more · 3 reports
    69.4%Top 0.64%
    66.8priority

Where it names them

CVE-2016-1019
While the URL acts similarly to how eye-watch[.]in:443 delivers payloads, we also saw the URL leveraging and exploiting security flaws in Flash: CVE-2015-8651, CVE-2016-1019, and CVE-2016-4117.
Original (opens in a new tab) ↗
CVE-2015-8651
While the URL acts similarly to how eye-watch[.]in:443 delivers payloads, we also saw the URL leveraging and exploiting security flaws in Flash: CVE-2015-8651, CVE-2016-1019, and CVE-2016-4117.
Original (opens in a new tab) ↗
CVE-2016-4117
While the URL acts similarly to how eye-watch[.]in:443 delivers payloads, we also saw the URL leveraging and exploiting security flaws in Flash: CVE-2015-8651, CVE-2016-1019, and CVE-2016-4117.
Original (opens in a new tab) ↗
CVE-2016-0034
detected as SWF_EXPLOYT.YYRQ) A Silverlight (.xap) file containing several files: an App Manifest (AppManifest.xaml), and DLLs Shell_siver.dll (TROJ_CVE20130074.B), and System.Xml.Linq.dll, which when repacked form a runtime remote code execution exploit for Silverlight (CVE-2016-0034, patched last January 12,
Original (opens in a new tab) ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.

↑ ↓ chooseEnter openEsc close