Vulnerabilitycritical
PSA: Conference Invite used as a Lure by Operation Lotus Blossom Actors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | b4secure.com | nal IP address of the compromised system using the website “b4secure[.]com”. Figure 3 shows this HTTP GET request issued by Emissary |
| ipv4 | 103.249.31.49 | - 3d38 - 4c18 - 9ee9 - e440f79f3bb9 C2 Server 1 : hxxp : //103.249.31[.]49/default.aspx C2 Server 2 : C2 Server 3 : Campaign Code : |
| sha256 | 121e844022c04dbe2d152195fbfab297701c050fc6d8d08ddb8a4c27f2be138e | ata trimmed. Filename %APPDATA%\Programs\CVNX044.DAT SHA256 121e844022c04dbe2d152195fbfab297701c050fc6d8d08ddb8a4c27f2be138e Description Configuration file used by Emissary payload. We |
| sha256 | 61de3df463f94f8583934edb227b174c7e4473b89bd110a6f6ba44fad8c41943 | ceived the email themselves. The delivery document (SHA256: 61de3df463f94f8583934edb227b174c7e4473b89bd110a6f6ba44fad8c41943) attempts to exploit CVE-2012-0158 to install a payload and |
| sha256 | aefa519feab9c8741af98ae2ddc287c404117e208cecd6479ee427f682814286 | ree files: Filename %APPDATA%\Programs\Dsdcmsoon.dll SHA256 aefa519feab9c8741af98ae2ddc287c404117e208cecd6479ee427f682814286 Description Loader Trojan responsible for injecting payload |
| sha256 | c9d1daab044a4d4e21e3b1f2da0b732a9d48d82c27e723d221be499bcb7f1aa3 | er process Filename %APPDATA%\Programs\DCMOS3124.DAT SHA256 c9d1daab044a4d4e21e3b1f2da0b732a9d48d82c27e723d221be499bcb7f1aa3 (trimmed) Description Emissary Trojan that runs within Inte |
From the original article
6 min read at unit42.paloaltonetworks.com
Actors related to the Operation Lotus Blossom campaign continue their attack campaigns in the Asia Pacific region. It appears that these threat actors have begun using Palo Alto Networks upcoming Cyber Security Summit hosted on November 3, 2016 in Jakarta, Indonesia as a lure to compromise targeted individuals.
By Robert Falcone · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.