ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

OpenCV

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

New Malware 'Rover' Targets Indian Ambassador to Afghanistan

Unit 42 reports a spearphishing attack delivering the custom Rover Trojan to India's Ambassador to Afghanistan, exploiting CVE-2010-3333 in Word.

On December 24, 2015, Unit 42 identified a targeted spearphishing email spoofing Indian Defence Minister Manohar Parrikar, sent to India's Ambassador to Afghanistan. The RTF attachment exploited CVE-2010-3333 in Microsoft Word to download a downloader from newsumbrella.net, which retrieved the Rover Trojan and DLL plugins from 46.166.165.254. Rover uses OpenCV for webcam capture, OpenAL for audio recording and libsndfile for audio files, with data exfiltration over its C2 channel; separate payload versions target Windows XP and later systems.

Palo Alto Unit 42 · 29d agoThreat actor in the wildCVE-2010-3333

Related CVEs

  • CVE-2010-3333—89%
    Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution
    CVE-2010-3333 is a stack-based buffer overflow in the way Microsoft Office parses RTF (Rich Text Format) data. An attacker triggers it by convincing a user to open a specially crafted RTF file, including an RTF email that is handed to Office for rendering, with no authentication required beyond the user's action. Successful exploitation allows remote code execution in the context of the logged-on user, giving the attacker a foothold on the workstation. Any Microsoft Office installation within the affected range identified in the December 2012 Microsoft security bulletin is exposed; the source data does not enumerate specific version numbers. The flaw is actively exploited: it is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03, ransomware association unknown) and was used in targeted espionage, notably Kaspersky's 'Red October' campaign, with EPSS estimating an 89.5% probability of exploitation within 30 days (100th percentile).
    · Microsoft Office KEVmass

Appears with

threat actor Rover operators 1malware Rover 1organization Unit 42 1product Microsoft Word 1product OpenAL 1vendor Microsoft 1vendor Palo Alto Networks 1victim Indian Ambassador to Afghanistan 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.