Kaspersky report on Energetic Bear
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2011-0611 | Remote Code Execution in Adobe Flash Player via Crafted Flash Content Adobe Flash Player contains a flaw tracked as CWE-843 that allows remote attackers to execute arbitrary code or crash the application (denial of service) by inducing it to load specially crafted Flash content. Exploitation requires only that a victim's Flash runtime process a malicious SWF file — for example embedded in a document or served by a website — with no authentication involved; related reporting from this era describes waterhole attacks in which compromised websites served Flash exploits to targeted users. A successful attack yields code execution with the privileges of the user running Flash, which for browser-plugin deployments typically means the logged-in desktop user. Anyone running affected Adobe Flash Player is affected; CISA's listing does not enumerate specific vulnerable versions, and the product line is end-of-life. Exploitation is confirmed: the flaw was added to CISA's KEV catalog on 2022-03-03, EPSS assigns a 99.4% 30-day exploitation probability (100th percentile), and no public proof-of-concept is known. Do: Because Flash Player is end-of-life and receives no security updates, remove or uninstall it entirely — including browser plugins, standalone runtimes, and any embedded copies — which is also CISA's required action for impacted systems. If removal must be deferred, disconnect affected systems or block untrusted Flash content and audit logs for exploitation, given the confirmed in-the-wild status and ~99% exploitation probability; whether ransomware operators have used this flaw is unknown. | — | 99% | KEV |
| mass≈1B+ historical installs (near-universal browser plugin); current remaining installs unknown |
Full article581 words · extracted from securityaffairs.com · click to collapse
The Kaspersky Lab Team has issued a report which includes details of the investigation related to the Energetic Bear – Crouching Yeti APT campaign.
Energetic Bear, aka Crouching Yeti, is the recently discovered APT campaign that targeted energy companies, manufacturers, industrial, pharmaceutical, construction, and many IT companies.
Security experts have analyzed the Energetic Bear APT campaign, which appears to be a long-term operation which targeted companies in several countries, Kaspersky Lab Team, for example, published a report which details the attack chain and control infrastructure used by bad actors.
The Energetic Bear APT campaign is mainly focused on cyber espionage, the bad actors used malware based attacks to siphon sensitive information from targeted organizations.
The company has identified nearly 2800 victims worldwide, the attackers used a large network of hacked websites (219 domains) as command and control infrastructure, the majority of these websites were legitimate and were used to serve malware and instruct bot agents worldwide to collect information on targeted systems. Most of the 2,800 companies identified as victims of the attack are in the industrial/machinery market and researchers say the most-targeted countries are the United States, Spain, Japan and Germany. The bad actor behind Energetic Bear APT campaign used to compromise poorly configured servers to server RAT.
” They ran vulnerable content management systems or vulnerable web applications. None of the exploits used to compromise the servers were known to be zero-day. None of the client side exploits re-used from the open source metasploit framework were zero-day.” reports the report published by Kaspersky Lab.
The attackers used the following attack scheme to infect victims:
- Spearphishing using PDF documents embedded with a flash exploit (CVE-2011-0611)
- Trojanized software installers
- Waterhole attacks using a variety of re-used exploits
Experts at Kaspersky have identified 219 unique domain names for these C&C servers hosted in 21 different countries, the majority of C&C servers was located in the US (81 servers), Germany (33 servers), the Russian Federation (19 servers) and the United Kingdom (7 servers).
Bad actors behind the Energetic Bear APT campaign used several malicious codes which targeted only Windows systems, the toolset adopted has remained stable over time according to Kaspersky experts:
• Havex Trojan
• Sysmain Trojan
• The ClientX backdoor
• Karagany backdoor and related stealers
• Lateral movement and second stage tools
The experts speculated that the cyber espionage campaign began as early as 2010, despite active infections have fallen by about 50 percent since the beginning of 2014 according to the data provided by Kaspersky.
The bad actors behind the Energetic Bear APT campaign are highly determined and focused on a very specific industrial sector of vital interest, the hackers which are operating the Energetic Bear APT campaign are most active during the week, a circumstance that suggests to me that they could be state-sponsored hackers.
“Compared to our other APT research the available data is more non-specific than usual. There simply is no one piece or set of data that would lead to the conclusion that the threat actor is Bear, Kitten, Panda, Salmon, or otherwise,” states the report.
The attribution of the Energetic Bear APT campaign is very difficult, no strain of malware is definitively linked to the modus operandi of any know APT … stay tuned for more details and read the report for further data on the cyber espionage campaign.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
Security Affairs – (Energetic Bear,APT)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/27224/cyber-crime/kaspersky-report-energetic-bear.html