THE DUKES 7 YEARS OF RUSSIAN CYBERESPIONAGE

blog-assets.f-secure.com · Undated · Licence: not cleared; local research copy only

CVEs this report names

4 CVEs

CVE-2010-0232Microsoft Windows Kernel Exception Handler Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation1 report
28.7%Top 1.9%
72.0priority
CVE-2010-4398Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 7.8T1078Valid Accounts T1068Exploitation for Privilege Escalation+1 more · 1 report
8.7%Top 4.9%
71.4priority
CVE-2013-0640Adobe Reader and Acrobat Memory Corruption Vulnerability
Adobe · Reader and AcrobatKEVPublic exploitEnd of lifeHigh · 7.8T1566.001Spearphishing Attachment1 report
86.9%Top 0.25%
57.3priority
CVE-2013-0641Adobe Reader Buffer Overflow Vulnerability
Adobe · ReaderKEVEnd of lifeHigh · 7.8T1204.002Malicious File T1105Ingress Tool Transfer+1 more · 1 report
32.3%Top 1.7%
52.0priority

(CVE-2010-0232) affecting Microsoft Windows.

exploit either of the publicly known CVE-2010-0232 or CVE-2010- 4398 privilege escalation

In the case of CVE-2010-0232, the exploit appears to be based directly on the

many of these loader samples embed CosmicDuke variants that exploit the CVE-2010- 0232

exploit either of the publicly known CVE-2010-0232 or CVE-2010- 4398 privilege escalation

We believe that the exploit for CVE- 2010-4398 was also based on a publicly

Exploit Database; CVE: 2010-4398; published 24 November 2014; [Online].

of new Adobe Reader 0-day vulnerabilities, CVE-2013-0640 and CVE-2013-0641, that were being

are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke

of new Adobe Reader 0-day vulnerabilities, CVE-2013-0640 and CVE-2013-0641, that were being

None

No passage in this report has been tied to an ATT&CK technique.