CIA “DELETED” Venezuela’s Hugo Chavez?
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2012-0507 | Type Confusion RCE in Oracle Java SE Concurrency Component CVE-2012-0507 is an 'incorrect type' (type-confusion) vulnerability in the Concurrency component of Oracle's Java Runtime Environment that corrupts memory when crafted Java content is processed. It is triggered by running malicious Java content — classically via the browser Java plugin or an exploited Java application — allowing an attacker to execute arbitrary code with the privileges of the Java process. Anyone running an affected Oracle Java SE installation is exposed, which historically included the vast majority of desktops and many servers, with 2012-era campaigns hitting Mac users via Java exploits (e.g., the SabPub backdoor) and drive-by exploit kits. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) with known ransomware use, and EPSS assigns a 98.1% probability of exploitation within 30 days (100th percentile). CVSS has not been scored in the source data, but the combined KEV/EPSS signal marks this as actively and widely exploited. Do: Apply Oracle's Java SE updates per CISA's required action — Oracle shipped the fix in its February 2012 Critical Patch Update, so any current, fully patched Java release clears the flaw; verify no legacy unpatched Java builds (including Apple-delivered Java on macOS, given the 2012 OS X exploitation campaigns) remain on endpoints. Remove or disable the Java browser plugin where it is not required, and restrict execution of untrusted applets and Java Web Start content. | — | 98% | KEV ransomware |
| mass≈1 billion+ Java installations worldwide (desktop/server JRE and browser plugin deployments) |
Full article308 words · extracted from securelist.com · click to collapse
This is the topic that cybercriminals are speculating about and using as a hook to infect victims. The campaign stems from malicious emails that are sent in bulk to victims:
The links mentioned in the email re-direct users to a legitimate Russian website called “Znakvoprosa” (translation: “interrogation sign”) that has been hacked in several occasions and even reported in Zone-h as such.
When the victim clicks on one of the links in the email, he/she is first re-directed to the website Znakvoprosa.tv and from there, he/she is automatically re-directed to the website Porkafadonta.com (translation: “from spankings to Fondot”) located in Bulgaria and which uses the following ColoCrossing provider as its ASN:
The latter contains a heavy obfuscated JS that after meeting the necessary parameters of the victim’s operating system executes the corresponding exploit. Following is a section of the mentioned script:
The launched exploit takes advantage of the CVE-2012-0507 vulnerability. Its current detection in VirusTotal is 8 out of 46 antivirus. Kaspersky proactively detects the exploit with the verdict HEUR:Exploit.Java.CVE-2012-0507.gen
Said malicious campaign is apparently based on the exploit kit BlackHole v2.0 and it is still active.
Follow me on twitter: @dimitribest
Latest Webinars
Reports
Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.
Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.
Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/cia-deleted-venezuelas-hugo-chavez/67088/