Vulnerabilityhigh
Winnti-Stolen Digital Certificates Re-Used in Current Watering Hole Attacks on Tibetan and Uyghur Groups
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | footer.swf | he Tibetan Homes Foundation, i.e.: hxxp://maarip.org/uyghur/footer(.)swf So, what we have is an active watering hole campaign impl |
| md5 | 12181311e049eb9f1b909eabfdb55427 | E199C3DAB16CF8C9134E06FE12 215CEC7261D70A5913E79CD11EBC9ECC 12181311E049EB9F1B909EABFDB55427 Latest Webinars Reports Kaspersky researchers have discover |
| md5 | 215cec7261d70a5913e79cd11ebc9ecc | d publishers. Related md5: BD9FD3E199C3DAB16CF8C9134E06FE12 215CEC7261D70A5913E79CD11EBC9ECC 12181311E049EB9F1B909EABFDB55427 Latest Webinars Reports Ka |
| md5 | bd9fd3e199c3dab16cf8c9134e06fe12 | k campaigns on game developers and publishers. Related md5: BD9FD3E199C3DAB16CF8C9134E06FE12 215CEC7261D70A5913E79CD11EBC9ECC 12181311E049EB9F1B909EABFD |
| url | http://maarip.org/uyghur/footer.swf | “LadyBoyle” swf path as the Tibetan Homes Foundation, i.e.: hxxp://maarip.org/uyghur/footer(.)swf So, what we have is an active watering hole campaign impl |
From the original article
2 min read at securelist.com
A new-ish Flash exploit has been on the loose for attacks around the web. This time, the attackers have compromised a caregiver site providing support for Tibetan refugee children and are spreading backdoors signed with Winnti stolen certificates delivered with Flash exploits – the compromised web site is the NGO “Tibetan Homes Foundation”.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.