New Lord Exploit Kit appears in the threat landscape
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-15982 | Use-After-Free in Adobe Flash Player Allows Arbitrary Code Execution CVE-2018-15982 is a use-after-free flaw (CWE-416) in Adobe Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier, in which Flash frees memory that is subsequently reused, corrupting process memory. It is triggered when Flash processes crafted Flash content, most notably embedded in Microsoft Office documents, requiring a user to open or view the malicious content (CVSS attack vector is local with user interaction required). Successful exploitation gives the attacker arbitrary code execution with the privileges of the user viewing the content. Affected users include anyone running the listed Flash Player versions, including the Flash Player Installer and the Adobe-supplied Flash plugin shipped with Red Hat Enterprise Linux Desktop, Server and Workstation. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15) with known ransomware use, a public exploit is available on Exploit-DB, and EPSS assigns a top-percentile 89.1% probability of exploitation within 30 days. Do: Flash Player is end-of-life: per CISA's required action, remove or disconnect Flash wherever it is still in use; if Flash must remain, update beyond the affected 31.0.0.153/31.0.0.108 builds and update the flash-plugin package on Red Hat Enterprise Linux. Mitigate the known delivery vector by blocking or disabling embedded Flash (SWF) content in Microsoft Office documents and mail clients, and hunt for suspicious documents with embedded Flash given the known in-the-wild and ransomware use. | 7.8 | 89% | KEV ransomware PoC |
| mass≈100M+ endpoints historically (Flash was preinstalled/bundled across most Windows desktops and shipped with Chrome and RHEL in 2018); only residual legacy… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | liader.com.ua | xploit Kit? I've catched only first part. popcash -> hxxp://liader[.]com[.]ua/ -> a page that look like a landing page named itself # |
| url | http://liader[ | lly a Exploit Kit? I've catched only first part. popcash -> hxxp://liader[.]com[.]ua/ -> a page that look like a landing page named it |
Full article450 words · extracted from securityaffairs.com · click to collapse
Security experts discovered a new exploit kit, dubbed Lord Exploit Kit, that is currently targeting vulnerable versions of Adobe Flash Player.
Security experts at Malwarebytes have recently discovered a new exploit kit, dubbed Lord Exploit Kit, that is targeting vulnerable versions of Adobe Flash Player
The Lord Exploit Kit was first detected by Adrian Luca, researcher at Virus Bulletin, it was involved in a malvertising campaign leveraging the the PopCash ad network.
Is this actually a Exploit Kit? I've catched only first part.
— Adrian Luca (infosec.exchange/@adrian_luca) (@adrian__luca) August 1, 2019
popcash -> hxxp://liader[.]com[.]ua/ -> a page that look like a landing page named itself #LordEK and post back my flash version/ip/location. pic.twitter.com/BVxJJ5IiiX
“The first tweet from @adrian__luca about Lord EK came out in the morning of August 1st and shows interesting elements. It is part of a malvertising chain via the PopCash ad network and uses a compromised site to redirect to a landing page.” reads the analysis published by Malwarebytes.
“We can see a very rudimentary landing page in clear text with a comment at the top left by its author that says: <!– Lord EK – Landing page –>. By the time we checked it, it had been obfuscated but remained essentially the same.”
The landing page used in the campaign involving the new EK was designed to check for the presence of Flash Player to trigger the CVE-2018-15982 flaw and gather system information.
The peculiarity of the Lord Exploit Kit is represented by the URLs it uses, they are very unusual and result from the adoption of the ngrok service to craft custom hostnames.
“This is rather unusual at least from what we have observed with exploit kits in recent history. As per ngrok’s documentation, it exposes a local server to the public internet.” continues the analysis “The free version of ngrok generates random subomains which is almost perfect (and reminds us of Domain Shadowing) for the exploit kit author,”
Once exploited the CVE-2018-15982 vulnerability, the Lord Exploit Kit launches shellcode to download and execute a payload. Experts initially observed the use of the EK to deliver the njRAT backdoor, but the operators behind this campaign rapidly switched to the ERIS ransomware.
Malwarebytes researchers also discovered that once exploited the flaw, the Lord exploit kit redirects the victim to the Google home page. This behavior was previously observed with the Spelevo exploit kit.
The Lord EK appears to be under active development, but it is difficult to predict how long it would be used by threat actors.
Malwarebytes also published Indicators of Compromise (IoCs) for the threat.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Lord Exploit Kit, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/89538/malware/lord-exploit-kit.html