After successfully exploiting a target host, this group will quickly dump credentials, move laterally to additional hosts, and install custom backdoors. This group is one of the more sophisticated threat groups that FireEye Threat Intelligence tracks, and they have a history of introducing new browser-based zero-day exploits (e.g., Internet Explorer, Firefox, and Adobe Flash Player). The China-based threat group FireEye tracks as APT3, aka UPS, is responsible for this exploit and the activity identified in our previous blog post, Operation Clandestine Fox. FireEye recommends that Adobe Flash Player users update to the latest version as soon as possible.įireEye MVX detects this threat as a web infection, the IPS engine reports the attack as CVE-2015-3113, and the SHOTPUT backdoor is reported as. The attackers’ emails included links to compromised web servers that served either benign content or a malicious Adobe Flash Player file that exploits CVE-2015-3113.Īdobe has already released a patch for CVE-2015-3113 with an out-of-band security bulletin ( ). In June, FireEye’s FireEye as a Service team in Singapore uncovered a phishing campaign exploiting an Adobe Flash Player zero-day vulnerability (CVE-2015-3113). Create a Free Mandiant Advantage Account.Noteholder and Preferred Shareholder Documents.

Firefox flash plugin corrupted