Tech brief untangling the patchwork cyberespionage group

The PowerPoint (PPT) file exploits CVE-2017-0199, an RCE vulnerability in Microsoft Office’s Windows

an .HTA file and silently exploits it by leveraging CVE-2017-0199.

Figure 7: The PPT containing the CVE-2017-0199 exploit

These are RTF files exploiting CVE-2015- 1641, a memory corruption vulnerability in Microsoft Office patched last April 2015.

Figure 11: Screenshots of RTF files that exploit CVE-2015-1641 and deliver the Badnews backdoor

It exploits CVE-2017-8570 (an RCE vulnerability in Microsoft Office

Figure 9: Screenshot of the Word document containing a PPSX file that exploits CVE-2017-8570

(PPSX) files exploit Sandworm (CVE-2014-4114), an RCE vulnerability in Windows’ Object Linking and

files that trigger an exploit for CVE-2012-1856, patched via MS12-060 last August 2012.