Patchfirst
Patchfirst

The Overlooked North Korean Actor

services.google.com · Undated · Licence: not cleared; local research copy only

Read the original ↗

CVEs this report names

15 CVEs
  1. CVE-2017-0199Microsoft Office and WordPad Remote Code Execution Vulnerability
    Microsoft · Office and WordPadKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution12 reports
    99.5%Top 0.06%
    88.4priority
  2. CVE-2018-0802Microsoft Office Memory Corruption Vulnerability
    Microsoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution8 reports
    93.3%Top 0.16%
    88.4priority
  3. CVE-2016-1019Adobe Flash Player Arbitrary Code Execution Vulnerability
    Adobe · Flash PlayerKEVRansomwareCritical · 9.8T1105Ingress Tool TransferT1486Data Encrypted for Impact4 reports
    22.3%Top 2.3%
    83.4priority
  4. CVE-2014-8439Adobe Flash Player Dereferenced Pointer Vulnerability
    Adobe · Flash PlayerKEVHigh · 8.8T1189Drive-by Compromise2 reports
    20.4%Top 2.5%
    79.8priority
  5. CVE-2015-3105Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before…
    Public exploitT1189Drive-by CompromiseT1203Exploitation for Client Execution+1 more · 2 reports
    90.1%Top 0.2%
    77.9priority
  6. CVE-2015-5119Adobe Flash Player Use-After-Free Vulnerability
    Adobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reports
    98.6%Top 0.08%
    74.8priority
  7. CVE-2015-2545Microsoft Office Malformed EPS File Vulnerability
    Microsoft · OfficeKEVPublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution2 reports
    85.9%Top 0.27%
    74.5priority
  8. CVE-2016-4117Adobe Flash Player Arbitrary Code Execution Vulnerability
    Adobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeCritical · 9.8T1105Ingress Tool Transfer3 reports
    94.3%Top 0.15%
    72.6priority
  9. CVE-2015-7645Adobe Flash Player Arbitrary Code Execution Vulnerability
    Adobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeHigh · 7.8T1204.002Malicious File2 reports
    65.3%Top 0.74%
    69.4priority
  10. CVE-2015-2387Microsoft ATM Font Driver Privilege Escalation Vulnerability
    Microsoft · ATM Font DriverKEVHigh · 7.8T1068Exploitation for Privilege Escalation2 reports
    34.9%Top 1.6%
    69.3priority
  11. CVE-2015-5122Adobe Flash Player Use-After-Free Vulnerability
    Adobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1059Command and Scripting InterpreterT1499.004Application or System Exploitation1 report
    87.0%Top 0.25%
    68.7priority
  12. CVE-2015-2419Microsoft Internet Explorer Memory Corruption Vulnerability
    Microsoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1059.007JavaScript1 report
    53.0%Top 1%
    67.8priority
  13. CVE-2018-4878Adobe Flash Player Use-After-Free Vulnerability
    Adobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1219Remote Access Tools+1 more · 1 report
    90.3%Top 0.2%
    67.3priority
  14. CVE-2015-3043Adobe Flash Player Memory Corruption Vulnerability
    Adobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1499.004Application or System Exploitation2 reports
    73.9%Top 0.52%
    60.9priority
  15. CVE-2013-4979Buffer overflow in the gldll32.dll module in EPS Viewer 3.2 and earlier allows remote attackers to execute arbitrary…
    1 report
    5.1%Top 7.6%
    58.0priority

Where it names them

CVE-2017-0199
containing exploit code for CVE-2017- 0199, a vulnerability in Microsoft Office
Original (opens in a new tab) ↗
CVE-2017-0199
Original (opens in a new tab) ↗
exploiting RTF vulnerability CVE-2017-0199.
Original (opens in a new tab) ↗
CVE-2018-0802
vulnerabilities (CVE-2018-0802) and has the
Original (opens in a new tab) ↗
CVE-2016-1019
CVE-2016-4117, CVE- 2016-1019 and CVE-2015-3043 were all exploited
Original (opens in a new tab) ↗
9] FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2013-4979 CVE-2013-4979 CVE-2015-5122 CVE-2016-4117 CVE-2014-8439 CVE-2016-1019
Original (opens in a new tab) ↗
CVE-2014-8439
CVE-2014-8439
Original (opens in a new tab) ↗
CVE-2015-3105
APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2013-4979 CVE-2013-4979 CVE-2015-5122 CVE-2016-4117 CVE-2014-8439 CVE-2016-1019 CVE-2015-5119 CVE-2015-2419 CVE-2015-3105
Original (opens in a new tab) ↗
CVE-2015-5119
C NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2013-4979 CVE-2013-4979 CVE-2015-5122 CVE-2016-4117 CVE-2014-8439 CVE-2016-1019 CVE-2015-5119
Original (opens in a new tab) ↗
CVE-2015-2545
[PAGE 8] FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2018-4878 (Zero-day vulnerability) CVE-2017-0199 CVE-2015-2387 CVE-2015-2545
Original (opens in a new tab) ↗
CVE-2016-4117
SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2018-4878 (Zero-day vulnerability) CVE-2017-0199 CVE-2015-2387 CVE-2015-2545 CVE-2015-7645 CVE-2016-4117
Original (opens in a new tab) ↗
CVE-2016-4117, CVE-
Original (opens in a new tab) ↗
CVE-2016-4117
Original (opens in a new tab) ↗
CVE-2015-7645
AN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2018-4878 (Zero-day vulnerability) CVE-2017-0199 CVE-2015-2387 CVE-2015-2545 CVE-2015-7645
Original (opens in a new tab) ↗
CVE-2015-2387
CVE-2015-2387
Original (opens in a new tab) ↗
CVE-2015-5122
CVE-2015-5122
Original (opens in a new tab) ↗
CVE-2015-2419
UG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2013-4979 CVE-2013-4979 CVE-2015-5122 CVE-2016-4117 CVE-2014-8439 CVE-2016-1019 CVE-2015-5119 CVE-2015-2419
Original (opens in a new tab) ↗
CVE-2018-4878
vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group
Original (opens in a new tab) ↗
CVE-2018-4878 (Zero-day vulnerability)
Original (opens in a new tab) ↗
CVE-2018-4878, to distribute DOGCALL malware to
Original (opens in a new tab) ↗
CVE-2015-3043
2016-1019 and CVE-2015-3043 were all exploited
Original (opens in a new tab) ↗
CVE-2013-4979
CVE-2013-4979
Original (opens in a new tab) ↗
CVE-2013-4979
Original (opens in a new tab) ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.

↑ ↓ chooseEnter openEsc close