Multiple Chinese Groups Share the Same RTF Weaponizer

guest · Jul 3, 2019

Multiple Chinese Groups Share the Same RTF Weaponizer
July 3, 2019
https://www.securityweek.com/multiple-chinese-groups-share-same-rtf-weaponizer

During an investigation into a possibly shared RTF weaponizer by Indian and Chinese APT groups, researchers have discovered that multiple Chinese groups have updated the weaponizer to exploit the Microsoft Equation Editor (EE) vulnerability CVE-2018-0798. The same weaponizer had previously delivered exploits for EE vulnerabilities CVE-2017-11882 and CVE-2018-0802.

Weaponizers are scripts used to inject a malicious RTF object into a pre-crafted RTF phishing document.
[...] numerous Chinese actors [...] These include Goblin Panda (aka Conimes), KeyBoy (aka APT 23), Emissary Panda (aka APT27), Rancor Group, and Temp.Trident (aka Icefog).

With so many different actors using the same weaponizer with CVE-2018-0798, Anomali has found multiple exploitation techniques to drop malicious payloads. Goblin Panda has employed OLE package objects and DLL sideloading; the Rancor Group has used OLE package objects and VBScript Execution; and Emissary Panda has dropped a '.wll' file in the MS Word startup folder.
Click to expand...

Anomali: Multiple Chinese Threat Groups Exploiting CVE-2018-0798 Equation Editor Vulnerability Since Late 2018

Log in or Sign up

Multiple Chinese Groups Share the Same RTF Weaponizer

guest Guest

Log in or Sign up

Multiple Chinese Groups Share the Same RTF Weaponizer

guest Guest

Useful Searches