Matrix Ransomware being distributed through malvertising

CVE-2015-8651 is an integer overflow (CWE-189, a numeric error-handling flaw) in Adobe Flash Player that allows attackers to execute arbitrary code when Flash processes specially crafted content. The realistic trigger is a drive-by web attack: a user browses to a compromised or attacker-controlled page, often reached through malvertising or exploit kits, and the malicious Flash (SWF) content exploits the overflow in the user's browser or standalone player. Successful exploitation gives the attacker code execution in the context of the logged-in user, typically as a delivery mechanism for ransomware, information stealers, or miners, as seen in exploit-kit campaigns of the era (RIG, Neptune, Stegano, and others were distributing Flash exploits at the time). Anyone running an affected version of Adobe Flash Player was exposed; Flash was near-universally deployed in 2015-2016, though the product has since reached end of life (December 31, 2020) and modern browsers no longer load it. Exploitation is confirmed in the wild: CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2022-05-25, EPSS assigns it a 67.9% probability of exploitation in the next 30 days (99th percentile), and no public PoC is cataloged.

Do: Uninstall or disable Adobe Flash Player on all remaining systems, since it is end-of-life and CISA's required action is to disconnect/remove it if still in use. If legacy Flash cannot be removed immediately, apply Adobe's January 2016 security update (APSB16-01) and restrict those hosts from untrusted web browsing and ad content. Inventory for standalone Flash players, intranet applications that embed SWF content, and copies of Flash bundled inside other applications.

CVE-2016-0189 is a memory corruption flaw (out-of-bounds write, per CWE-787) in Microsoft's JScript 5.8 and VBScript 5.7/5.8 scripting engines, as used in Internet Explorer 9 through 11 and other products that embed those engines. It is triggered remotely when a user is lured into viewing a crafted website that mishandles script, corrupting memory in the browser process. A successful attacker gains arbitrary code execution in the context of the current user (or can crash the browser, causing denial of service), with no authentication required but user interaction needed. Anyone running Internet Explorer 9-11 on Windows, or other products using the affected scripting engines, was exposed. Exploitation is well established: public write-ups document its use in drive-by exploit kit attacks and subsequent 'God Mode' local privilege-escalation variants, it is listed in CISA KEV (added 2022-03-28) with known ransomware use, and EPSS assigns a 94.1% probability of exploitation within 30 days.

Do: Apply the vendor-supplied Microsoft security updates for Internet Explorer and the JScript/VBScript scripting engines per CISA's required action, prioritizing endpoints used for web browsing and email since this is delivered via drive-by website attacks and is known to be used by ransomware operators. Systems that no longer receive updates for IE 9-11 should be migrated to a supported browser or OS. Check your environment against CISA KEV to confirm remediation status.