Russia Linked hacker group APT28 continues to target Montenegro
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-7645 | Arbitrary Code Execution in Adobe Flash Player via Crafted SWF Files CVE-2015-7645 is a code execution vulnerability in Adobe Flash Player in which a remote attacker can execute arbitrary code by having the player process a maliciously crafted SWF (Flash) file. Triggering requires only that a user load attacker-supplied Flash content, for example by visiting a compromised or malicious website, opening a document that embeds Flash content, or receiving an SWF payload delivered through an exploit kit. Successful exploitation lets the attacker run arbitrary code in the context of the Flash process, typically enabling malware or ransomware installation and compromise of the user's account and data. Anyone running Adobe Flash Player when the flaw was disclosed in 2015 was affected, and because Flash has since reached end-of-life, any installations that remain in use are unpatched. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) with known ransomware use, and its EPSS score of 65.6% (99th percentile) indicates a high probability of exploitation. Do: Remove or disable Adobe Flash Player entirely, consistent with CISA's required action, which notes the product is end-of-life and should be disconnected if still in use; audit for legacy Flash instances in intranet applications, bundled enterprise software, and older browser configurations. If Flash cannot be removed, install the latest patched release available from Adobe for this vulnerability and ensure browsers block or sandbox SWF content. Given the confirmed ransomware use, prioritize hunting for exploitation on any systems where Flash remains installed. | — | 66% | KEV ransomware |
| mass≈1 billion+ users/devices at the time of disclosure (Flash then ran on nearly all desktops); the number of leftover unpatched installs today is unknown | |
| CVE-2016-7855 | Use-After-Free RCE in Adobe Flash Player (Windows, macOS, Linux) Adobe Flash Player for Windows, macOS/OS X, and Linux contains a use-after-free memory flaw (CWE-416) in which memory that has been freed is referenced again, corrupting memory when the player processes attacker-controlled Flash content remotely, typically via a malicious SWF delivered through a browser or another host application. A successful attack allows arbitrary code execution with the privileges of the user running Flash, commonly leading to full workstation compromise in browsing contexts. Anyone still running an affected Adobe Flash Player build is exposed, although the product has been end-of-life since early 2021 and CISA explicitly advises disconnecting or removing it rather than continuing to patch. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added March 3, 2022), confirming known in-the-wild exploitation, and EPSS assigns a 25.2% probability of exploitation within 30 days (98th percentile); no public proof-of-concept is known and ransomware use is unknown. Do: Because Flash Player is end-of-life and no longer receives security updates, follow CISA's required action: uninstall or disable Flash everywhere it remains, including browser plugins, standalone installs, and legacy applications that invoke it. If removal must be delayed, ensure the latest patched release from Adobe's security advisories is in place and block or sandbox untrusted Flash content. On systems where Flash is still active, hunt for indicators of compromise given the KEV listing and high EPSS score. | 8.8 | 25% | KEV |
| mass≈1 billion+ installs historically (Flash was near-ubiquitous; residual post-EOL installs unknown) |
Full article422 words · extracted from securityaffairs.com · click to collapse
Once again, Montenegro was targeted by the Russia-linked hacker group APT28, according to the experts it is just the beginning.
On June 5 Montenegro officially joined NATO alliance despite the strong opposition from Russian Government that threatened to retaliate.
Cybersecurity experts believe that a new wave of attacks from the cyberspace will hit the state. In February, for the second time in a few months, Montenegro suffered massive and prolonged cyberattacks against government and media websites.
Researchers at security firm FireEye who analyzed the attacks observed malware and exploits associated with the notorious Russia-linked APT group known as APT28 (aka Fancy Bear, Pawn Storm, Strontium, Sofacy, Sednit, and Tsar Team).
Another massive attack hit the country’s institutions during October elections, amid speculation that the Russian Government was involved.
In the last string of attacks, hackers targeted Montenegro with spear phishing attacks, the malicious messages used weaponized documents pertaining to a NATO secretary meeting and a visit by a European army unit to Montenegro.
The hackers delivered the GAMEFISH backdoor (aka Sednit, Seduploader, JHUHUGIT and Sofacy), a malware that was used only by the APT28 group in past attacks.
According to FireEye, the documents delivered the backdoor via a Flash exploit framework dubbed DealersChoice.
“NATO expansion is often viewed as a security threat by the Russian Federation, and Montenegro’s bid for membership was strongly contested by Russia and the pro-Russia political parties in Montenegro,” Tony Cole, vice president and chief technology officer for global government at FireEye, told journalists today.” reportedEl Reg.
“It’s likely that this activity is a part of APT28’s continued focus on targeting various NATO member states, as well as the organization itself. Russia has strongly opposed Montenegro’s NATO accession process and is likely to continue using cyber capabilities to undermine Montenegro’s smooth integration into the alliance,”
The bait documents first gather information of the target system in an effort to determine which version of Flash Player it is running on the machine, then it connects the C&C server to receive the appropriate Flash exploit. The exploits used in the attacks include the code to trigger the CVE-2015-7645 and CVE-2016-7855, are used to deliver GAMEFISH.
At the time I’m writing there is no news about the specific targets of the campaign neither is the attacks were successful.
Clearly, APT28’s and other Russian linked APT will continue to target the country such as other NATO member states.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Montenegro, APT28)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/59820/apt/apt28-targets-montenegro.html