Tracking Elirks Variants in Japan: Similarities to Previous Attacks
Unit 42 links new Elirks backdoor variants attacking Japanese organizations to 2012 Taiwan attacks, delivered via spear-phishing PDFs exploiting Adobe Flash CVE-2011-0611.
Unit 42 analyzed new Elirks backdoor variants found in an attack on a Japanese business, noting strong similarities to 2012 attacks on Taiwanese ministries. The backdoor retrieves its C2 address from attacker-created accounts on Japanese blog and SNS services. Recent deliveries used an airline e-ticket lure named "E-TKT" with a PDF exploiting Adobe Flash CVE-2011-0611. Shared infrastructure and tactics with the Scarlet Mimic campaign suggest possible ongoing cyber espionage across East Asia.
- Elirks retrieves C2 addresses from attacker-controlled accounts on Japanese blog and SNS services.
- Recent Japanese attack uses an "E-TKT" lure similar to 2012 Taiwan airline-themed phishing.
- Shares malware, delivery style, and aviation interest with the Scarlet Mimic campaign.
- Palo Alto Networks customers are protected via WildFire and PAN-DB classifications.
- CVEs
- CVE-2011-0611
- ATT&CK
- T1566.001 Spearphishing AttachmentT1203 Exploitation for Client ExecutionT1102.001 Dead Drop Resolver
- Vendors
- Palo Alto Networks
- Threat actors
- Scarlet Mimic
- Organizations
- Palo Alto Networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2011-0611 | Remote Code Execution in Adobe Flash Player via Crafted Flash Content | — | 99% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 0e317e0fee4eb6c6e81b2a41029a9573d34cebeabab6d661709115c64526bf95 | 3a0312a6c4374989cbcca48dc54ddcd3fbd54b48833afda991a6a2dfdea 0e317e0fee4eb6c6e81b2a41029a9573d34cebeabab6d661709115c64526bf95 f18ddcacfe4a98fb3dd9eaffd0feee5385ffc7f81deac100fdbbabf6423 |
| sha256 | 200a4708afe812989451f5947aed2f30b8e9b8e609a91533984ffa55d02e60a2 | 8308bbaa9fcb9c60f0b089032ed4fa1cece830a954ad574bd0c2fe1f104 200a4708afe812989451f5947aed2f30b8e9b8e609a91533984ffa55d02e60a2 |
| sha256 | 755138308bbaa9fcb9c60f0b089032ed4fa1cece830a954ad574bd0c2fe1f104 | 9eaffd0feee5385ffc7f81deac100fdbbabf64233dc68 Delivery PDF: 755138308bbaa9fcb9c60f0b089032ed4fa1cece830a954ad574bd0c2fe1f104 200a4708afe812989451f5947aed2f30b8e9b8e609a91533984ffa55d02 |
| sha256 | 8587e3a0312a6c4374989cbcca48dc54ddcd3fbd54b48833afda991a6a2dfdea | tags have been created: Elirks Indicators: Executable File: 8587e3a0312a6c4374989cbcca48dc54ddcd3fbd54b48833afda991a6a2dfdea 0e317e0fee4eb6c6e81b2a41029a9573d34cebeabab6d661709115c6452 |
| sha256 | f18ddcacfe4a98fb3dd9eaffd0feee5385ffc7f81deac100fdbbabf64233dc68 | e0fee4eb6c6e81b2a41029a9573d34cebeabab6d661709115c64526bf95 f18ddcacfe4a98fb3dd9eaffd0feee5385ffc7f81deac100fdbbabf64233dc68 Delivery PDF: 755138308bbaa9fcb9c60f0b089032ed4fa1cece830a9 |
From the original article
3 min read at unit42.paloaltonetworks.comA recent, well-publicized attack on a Japanese business involved two malware families, PlugX and Elirks, that were found during the investigation. PlugX has been used in a number of attacks since first being discovered in 2012, and we have published several articles related to its use, including an analysis of an attack campaign targeting Japanese companies .
By Kaoru Hayashi · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.