Vulnerabilityhigh
The Spring Dragon APT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-2883 | Stack-Based Buffer Overflow in Adobe Acrobat and Reader Allows RCE | — | 81% | KEV | — KEV |
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
| CVE-2014-6332 | Remote Code Execution via Array Bounds Flaw in Microsoft Windows OLE Automation | — | 95% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 96.47.234.246 | t/support/flashplayer/downloads.html → redirected to hxxp://96.47.234.246/support/flashplayer/install_flashplayer.exe (Trojan-Dropper |
| md5 | a42c966e26f3577534d03248551232f3 | veral backdoor components, including an Elise “wincex.dll” (a42c966e26f3577534d03248551232f3, detected as Backdoor.Win32.Agent.delp). It beacons out wit |
| url | http://96.47.234.246/support/flashplayer/install_flashplayer.exe | 2010.net/support/flashplayer/downloads.html → redirected to hxxp://96.47.234.246/support/flashplayer/install_flashplayer.exe (Trojan-Dropper.Win32.Agent.ilbq) While this particular act |
| url | http://www.bkav2010.net/support/flashplayer/downloads.html | and its usual “GET /14111121/page_321111234.html HTTP/1.0”. hxxp://www.bkav2010.net/support/flashplayer/downloads.html → redirected to hxxp://96.47.234.246/support/flashplayer/in |
From the original article
3 min read at securelist.com
Let’s examine a couple of interesting delivery techniques from an APT active for the past several years, the Spring Dragon APT. A paper released today by our colleagues at Palo Alto Networks presented a portion of data on this crew under the label “ the Lotus Blossom Operation “, likely named for the debug string present in much of the “Elise” codebase since at least 2012: “d:\lstudio\projects\lotus\…”
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.