Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists
unit42.paloaltonetworks.com · 24 Jan 2016 · Licence: not assessed; coordinator-only cache; do not redistribute
CVEs this report names
6 CVEs- CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution15 reports>99.9%Top 0.02%89.2priority
- CVE-2010-3333Microsoft Office Stack-based Buffer Overflow VulnerabilityMicrosoft · OfficeKEVPublic exploitHigh · 7.8T1203Exploitation for Client ExecutionT1204.002Malicious File5 reports89.4%Top 0.22%78.4priority
- CVE-2009-3129Microsoft Excel Featheader Record Memory Corruption VulnerabilityMicrosoft · ExcelKEVPublic exploitHigh · 7.8T1059Command and Scripting InterpreterT1204.002Malicious File1 report84.0%Top 0.31%72.3priority
- CVE-2010-2572Microsoft PowerPoint Buffer Overflow VulnerabilityMicrosoft · PowerPointKEVHigh · 7.8T1204.002Malicious FileT1059Command and Scripting Interpreter1 report58.6%Top 0.9%67.1priority
- CVE-2012-4969Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 8.11 report80.3%Top 0.38%57.5priority
- CVE-2010-2883Adobe Acrobat and Reader Stack-Based Buffer Overflow VulnerabilityAdobe · Acrobat and ReaderKEVPublic exploitEnd of lifeHigh · 7.3T1204.002Malicious FileT1059Command and Scripting Interpreter+1 more · 1 report81.4%Top 0.36%56.9priority
Where it names them
CVE-2012-0158 Original (opens in a new tab) ↗
CVE-2012-0158
CVE-2010-3333 Original (opens in a new tab) ↗
CVE-2010-3333
CVE-2009-3129 Original (opens in a new tab) ↗
CVE-2009-3129
CVE-2010-2572 Original (opens in a new tab) ↗
CVE-2010-2572
CVE-2012-4969 Original (opens in a new tab) ↗
According to a blog by Websense, threat actors compromised the Tibetan Alliance of Chicago’s website to host malicious code that exploited a vulnerability in Internet Explorer (CVE-2012-4969.)
CVE-2010-2883 Original (opens in a new tab) ↗
CVE-2010-2883
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.