[BreachExchange] Adobe Flash Zero-Day Spreads via Office Docs

[Destry Winant]

https://www.darkreading.com/threat-intelligence/adobe-flash-zero-day-spreads-via-office-docs/d/d-id/1333429

An Adobe Flash zero-day was seen in the wild as part of an active
campaign using the exploit in Microsoft Office documents. Adobe has
since patched the vulnerability, CVE-2018-15982.

Gigamon's Applied Threat Research (ATR) team identified the active
campaign, which uses malicious files to deliver the exploit.
CVE-2018-15982 lets a Flash object execute code on a target machine
and enables an attacker to gain command line access to the victim's
system.

The document used in this campaign, "22.docx," was submitted by a
Ukrainian IP address to VirusTotal. It appears to be an application
for a Russian state healthcare clinic; the logo indicates it's a fake
application for "Polyclinic No. 2," an adult outpatient clinic located
in Moscow. Analysts compared the logo in the doc to the clinic's
authentic logo.

The file contains seven pages of personal questions typical of an
employment application, requesting the recipient's full name,
birthdate, profession, company division, and level of skill.

"It's indicative of a targeted spear-phishing attack, presumably
things the receiver would be familiar with," says Josh Carlson, vice
president of threat research at Gigamon. The way the document is
crafted suggests its recipients would recognize the clinic's name and
logo. While this type of phishing lure appears to be highly targeted,
ATR researchers point out the team has observed other similar
spear-phishing attacks in which lures are unrelated to their
recipients.

It's hard to tell for sure because ATR doesn't have specifics on the
extent of this campaign or number of people affected. Carlson suggests
this is either a highly targeted attack, in which the actor(s) has
substantial knowledge of the victim's environment, or the actor is
testing his tools.

A Closer Look at the Attack
The way this attack unfolds is simple: The document's header contains
an Active X control, which renders when the file is opened and causes
an exploitation of Flash within Office. The exploitation leads to the
execution of a malicious command, which attempts to extract and
execute a payload, researchers explain in a blog post on their
discovery.

In this case, the Flash exploit is self-encapsulated within the
document and supports 32- and 64-bit systems. The Flash file and
shellcode stubs don't make use of remote inclusion, staging,
obfuscation, or any kind of anti-analysis, researchers say. Both
shellcode stubs execute the same command, which is consistent with an
attack packaged as a RAR archive. Testing shows that opening the
document within the archive is enough to run the exploit and payload.

There isn't much that's unique about this campaign, Carlson says, but
what's strange is it requires targets to take several steps to open
the document and execute the command.

"It's unusual in that they have a zero-day in Flash, but they're
requesting users to go through extra clicks and follow steps to
leverage it," he explains.

Analysts have moderate to high confidence the payload is a variant of
Scout malware, based on similarity in submission details, behavior,
close time proximity, and file name matching the one expected by the
exploit. The payload, a Windows executable file, is protected with
VMProtect, which prevents reverse engineering and analysis. The
payload collects system data, establishes persistence, and
communicates with a remote server via HTTP post.

The techniques of this campaign are similar to those used by
HackingTeam, an Italian offensive security company selling remote
access-as-a-service and surveillance tools. When HackingTeam was
breached in 2015, its internal data, including email and source code
for backdoors and exploits, was publicly spread. Cyberattackers around
the world began using HackingTeam's tools to launch operations. This
could be the case here, but attribution is difficult, ATR says.

"There are similarities to HackingTeam, but in reality those tools
have been reused by many copycats," Carlson says.

Flash Stays Alive… For Now
The death of Flash is a common topic in cybersecurity as efforts aim
to remove Flash from Web browsers. Cybercriminals, however, will
continue to use it. They're just finding new ways. Vectors like
Microsoft Office can still load and execute Flash content, and
exploits against zero-days that allow for command execution using
popular enterprise software will prove valuable.

"As Flash is less used in browsers, the attackers are moving toward
Office as an attack vector," Carlson explains. Flash is going to
become less of an attack surface over time, but it still works, he
says.