Vulnerabilityhigh
The Cobalt group is exploiting the CVE-2017-11882 Microsoft Office flaw in targeted attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2017-8759 | Remote Code Execution in Microsoft .NET Framework via Malicious Documents (CWE-94) | 7.8 | 89% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | bc4d2d914f7f0044f085b086ffda0cf2eb01287d0c0653665ceb1ddbc2fd3326 | starting point of our analysis was an RTF seen in the wild: bc4d2d914f7f0044f085b086ffda0cf2eb01287d0c0653665ceb1ddbc2fd3326 Using MS Equation CVE-2017-11882, it contacted hxxp: //104. |
| sha256 | d8e1403446ac131ac3b62ce10a3ee93e385481968f21658779e084545042840f | or second 64-bit DLL, depending on the system architecture: d8e1403446ac131ac3b62ce10a3ee93e385481968f21658779e084545042840f (32-bit) fb97a028760cf5cee976f9ba516891cbe784d89c07a6f110a4 |
| sha256 | fb97a028760cf5cee976f9ba516891cbe784d89c07a6f110a4552fc7dbfce5f4 | 1ac3b62ce10a3ee93e385481968f21658779e084545042840f (32-bit) fb97a028760cf5cee976f9ba516891cbe784d89c07a6f110a4552fc7dbfce5f4 (64-bit) The analysis published by the security firm includ |
From the original article
2 min read at securityaffairs.com
A few days after details about the CVE-2017-11882 Microsoft Office flaw were publicly disclosed, the firm Reversing Lab observed Cobalt group using it. A few days after details about the CVE-2017-11882 Microsoft Office vulnerability were publicly disclosed, security experts from firm Reversing Lab observed criminal gang using it in the wild.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.