BITTER: A Targeted Attack Against Pakistan | Forcepoint BITTER: a targeted attack against Pakistan
forcepoint.com · 21 Oct 2016 · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution15 reports>99.9%Top 0.02%89.2priority
Where it names them
CVE-2012-0158 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
The campaign predominantly used the older, relatively popular Microsoft Office exploit, CVE-2012-0158, in order to download and execute a RAT binary from a website.
Other attachment filenames they used that also contained the CVE-2012-0158 exploit are as follows:
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.