TheNaikonAPT MsnMM1
media.kasperskycontenthub.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
3 CVEs- CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution15 reports>99.9%Top 0.02%89.2priority
- CVE-2010-3333Microsoft Office Stack-based Buffer Overflow VulnerabilityMicrosoft · OfficeKEVPublic exploitHigh · 7.8T1203Exploitation for Client ExecutionT1204.002Malicious File5 reports89.4%Top 0.22%78.4priority
- CVE-2012-1856Microsoft Office MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft · OfficeKEVHigh · 8.8T1204.002Malicious FileT1203Exploitation for Client Execution3 reports72.0%Top 0.57%71.8priority
Where it names them
CVE-2012-0158 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
produced CVE-2012-0158 spear-phish.
compromised victim systems using common spear-phishing techniques, such as cve- 2012-0158 exploit attachments, attachments altered with RTLO techniques, and a com-
generates CVE-2012-0158 exploits embedded with arbitrary backdoors for spear-
the same CVE-2012-0158 exploits, dropping iph.bat and iExplorer.exe, and running
It was used across this group and others for building CVE-2012-0158 files,
CVE-2010-3333 Original (opens in a new tab) ↗
exploiting CVE-2010-3333.
CVE-2012-1856 Original (opens in a new tab) ↗
.di Exploit.MSWord.CVE-2012-0158.dj Exploit.MSWord.CVE-2012-0158.du Exploit.MSWord.CVE-2012-0158.eb Exploit.Win32.CVE-2012-0158.* Exploit.Win32.CVE-2012-0158.a Exploit.Win32.CVE-2012-0158.aw Exploit.Win32.CVE-2012-0158.j Trojan-Dropper.MSWord.Agent.* Trojan-Dropper.MSWord.Agent.hc Exploit.OLE2.CVE-2012-1856.a
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.