{"id":48066,"date":"2017-10-18T06:14:50","date_gmt":"2017-10-18T06:14:50","guid":{"rendered":"https:\/\/www.biphoo.com\/bipnews\/?p=48066"},"modified":"2017-10-18T06:16:51","modified_gmt":"2017-10-18T06:16:51","slug":"blackoasis-apt-exploits-flash-zero-day-to-download-finfisher-spyware","status":"publish","type":"post","link":"https:\/\/www.biphoo.com\/bipnews\/technology\/blackoasis-apt-exploits-flash-zero-day-to-download-finfisher-spyware.html","title":{"rendered":"BlackOasis APT exploits Flash zero-day to download FinFisher spyware"},"content":{"rendered":"

BlackOasis APT exploits Flash zero-day to download FinFisher spyware<\/span><\/strong><\/span><\/h2>\n

BlackOasis APT exploits Flash zero-day to download FinFisher spyware:- AN ADVANCED PERSISTENT THREAT (APT) exploiting a new Adobe Flash zero-day exploit that downloads Gamma FinFisher surveillance software has been uncovered by security vendor Kaspersky.<\/span><\/p>\n

The threat starts with an infected RTF or other Office file, which then triggers an exploit that utilises the Flash zero-day to download FinFisher, which is used to exfiltrate data and monitor activity on the infected Windows machine.<\/span><\/p>\n

FinFisher is the product of Anglo-German firm Gamma International which sells exploits and surveillance software to nefarious regimes such as Angola, Saudi Arabia and Venezuela. The company was itself hacked in 2014, and many of its secrets were uploaded to the internet. However, the perpetrator of the latest threat seems to be a group known as BlackOasis, one of Gamma\u2019s \u2018legitimate\u2019 customers. It uses the latest version of FinFisher.<\/span><\/p>\n

BlackOasis is probably based in the Middle East, and Kaspersky says it has been tracking the group\u2019s activities since May 2016. The latest exploit uses command and control servers deployed in previous attacks that were attributed to that actor, it claims, and has a similar modus operandi.<\/span><\/p>\n

The targets of BlackOasis include senior figures in the UN, think tank members, opposition bloggers and activists and journalists, mostly in the Middle East but also in the UK, Russia, Afghanistan, Nigeria, Libya, Netherlands and Angola. Oil seems to be a common factor linking many of the targets.<\/span><\/p>\n

\u201cThe attack begins with the delivery of an Office document, presumably in this instance via e-mail,\u201d says Kaspersky. \u201cEmbedded within the document is an ActiveX object which contains the Flash exploit.\u201d<\/span><\/p>\n

The Flash object contains an ActionScript which is responsible for extracting the malware which then attacks a memory corruption vulnerability.<\/span><\/p>\n

If this exploit is successful, \u201cit will gain arbitrary read \/ write operations within memory, thus allowing it to execute a second stage shellcode,\u201d the company continues, adding that the first stage shellcode is designed \u201cto avoid detection by antivirus products looking for large NOP blocks inside Flash files\u201d.<\/span><\/p>\n

This second stage payload is the Gamma FinFisher software which is then injected into the Windows login process. Once active it communicates with three command and control servers which are used to exfiltrate information from the infected machine and to monitor activity.<\/span><\/p>\n

Adobe has released a patch for the critical exploit, which it has listed as CVE-2017-11292, for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS.<\/span><\/p>\n

Kaspersky is aware of one incident in which the APT has been used to attack a customer. It advises organisations and individuals to disable Flash where possible and to deploy a \u201cmulti-layered approach including access policies, anti-virus, network monitoring and whitelisting\u201d to protect against similar attacks.<\/span><\/p>\n

Source:-\u00a0http:\/\/gearsofbiz.com\/blackoasis-apt-exploits-flash-zero-day-to-download-finfisher-spyware\/132765<\/span><\/p>\n

\n\t\t\t
\n\t\t\t <\/div><\/div>\n\t\t