Exploit / PoChigh

Attack on French Diplomat Linked to Operation Lotus Blossom

Palo Alto Unit 42by Jen Miller-OsbornNov 1, 2018 · 09:57 UTC (Nov 1, 2018)17 min read5 · 1 read

Read at unit42.paloaltonetworks.com

Analyze CVE-2014-6332 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2014-6332

Tags: cve-2014-6332 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2014-6332	Remote Code Execution via Array Bounds Flaw in Microsoft Windows OLE Automation	—	95%	KEV	— KEV Mar 25, 2022

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
domain	myfw.us	ttp://203.124.14.229/default.aspx C2 Server 3: http://dnt5b.myfw[.]us/default.aspx Campaign Code: UPG-ZHG-01 Sleep Delay: 300 A
domain	passas.us	c1c5-f71c-4a8b-b511-07aa113d9103 C2 Server 1: http://ustar5.PassAs[.]us/default.aspx C2 Server 2: http://203.124.14.229/default.a
ipv4	203.124.14.229	http://ustar5.PassAs[.]us/default.aspx C2 Server 2: http://203.124.14.229/default.aspx C2 Server 3: http://dnt5b.myfw[.]us/default.as
md5	06f1d2be5e981dee056c231d184db908	hat it injects into Internet Explorer. MD5 Path Description 06f1d2be5e981dee056c231d184db908 %APPDATA%\LocalData\ishelp.dll Loader 6278fc8c7bf1451435379
md5	6278fc8c7bf14514353797b229d562e8	81dee056c231d184db908 %APPDATA%\LocalData\ishelp.dll Loader 6278fc8c7bf14514353797b229d562e8 %APPDATA%\LocalData\A08E81B411.DAT Emissary Payload e9f51a4
md5	e9f51a4e835929e513c3f30299567abc	9d562e8 %APPDATA%\LocalData\A08E81B411.DAT Emissary Payload e9f51a4e835929e513c3f30299567abc %APPDATA%\LocalData\75BD50EC.DAT Configuration file varies

From the original article

17 min read at unit42.paloaltonetworks.com

We observed a targeted attack in November directed at an individual working for the French Ministry of Foreign Affairs. The attack involved a spear-phishing email sent to a single French diplomat based in Taipei, Taiwan and contained an invitation to a Science and Technology support group event.

Palo Alto Unit 42

By Jen Miller-Osborn · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.