分类0day下的文章

heliosteam 发布于 05月09, 2018

APT-C-06组织在全球范围内首例使用“双杀”0day漏洞(CVE-2018-8174)发起的APT攻击分析及溯源

第一章 概述

日前,360核心安全事业部高级威胁应对团队在全球范围内率先监控到了一例使用0day漏洞的APT攻击,捕获到了全球首例利用浏览器0day漏洞的新型Office文档攻击,我们将该漏洞命名为“双杀”漏洞。该漏洞影响最新版本的IE浏览器及使用了IE内核的应用程序。用户在浏览网页或打开Office文档时都可能中招,最终被黑客植入后门木马完全控制电脑。对此,我们及时向微软分享了该0day漏洞的相关细节,并第一时间对该APT攻击进行了分析和追踪溯源,确认其与APT-C-06组织存在关联。 2018年4月18日,在监控发现该攻击活动后,360核心安全事业部高级威胁应对团队在当天就与微软积极沟通,将相关细节信息提交到微软。微软在4月20日早上确认此漏洞,并于5月8号发布了官方安全补丁,对该0day漏洞进行了修复,并将其命名为CVE-2018-8174。在漏洞得到妥善解决后,我们于5月9日发布本篇报告,对攻击活动和0day漏洞进一步的技术披露。

阅读全文 »

heliosteam 发布于 05月09, 2018

Analysis of CVE-2018-8174 VBScript 0day and APT actor related to Office targeted attack

I Overview

Recently, the Advanced Threat Response Team of 360 Core Security Division detected an APT attack exploiting a 0-day vulnerability and captured the world’s first Office malicious sample that uses a browser 0-day vulnerability. We code named the vulnerability as "double kill” exploit. This vulnerability affects the latest version of Internet Explorer and applications that use the IE kernel. When users browse the web or open Office documents, they are likely to be potential targets. Eventually the hackers will implant backdoor Trojan to completely control the computer. In response, we shared with Microsoft the relevant details of the 0day vulnerability in a timely manner. This APT attack was analyzed and attributed upon the detection and we now confirmed its association with the APT-C-06 Group. On April 18, 2018, as soon as 360 Core Security detected the malicious activity, we contacted Microsoft without any delay and submitted relevant details to Microsoft. Microsoft confirmed this vulnerability on the morning of April 20th and released an official security patch on May 8th. Microsoft has fixed the vulnerability and named it CVE-2018-8174. After the vulnerability was properly resolved, we published this report on May 9th, along with further technical disclosure of the attack and the 0day.

阅读全文 »