Vulnerabilityhigh
Red October
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2009-3129 | CVE-2009-3129: Memory Corruption RCE in Microsoft Excel via FEATHEADER Record | — | 84% | KEV | — KEV |
| CVE-2010-3333 | Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution | — | 89% | KEV | — KEV |
| CVE-2011-3544 | Remote Code Execution in Oracle Java SE JRE Applet Rhino Script Engine | — | 97% | KEV | — KEV |
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 35f1572eb7759cb7a66ca459c093e8a1 | o infiltrated victim network(s) via Java exploitation (MD5: 35f1572eb7759cb7a66ca459c093e8a1 – ‘NewsFinder.jar’ ), known as the ‘Rhino’ exploit (CVE-201 |
| md5 | c3b0d1403ba35c3aba8f4529f43fb300 | n a public sandbox at malwr.com ( http://malwr.com/analysis/c3b0d1403ba35c3aba8f4529f43fb300/ ), and only on February 14th, the very same day that they |
| url | http://www.hotinfonews.com/news/dailynews2.php?id=&t=win” | hat is concatenated with the other variables, resulting in “hXXp://www.hotinfonews.com/news/dailynews2.php?id=&t=win”. It is this content that is written to disk and executed on |
From the original article
6 min read at securelist.com
Since the publication of our report, our colleagues from Seculert have discovered and posted a blog about the usage of another delivery vector in the Red October attacks (http://blog. seculert. com/2013/01/operation-red-october-java-angle.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.