Adobe Flash Zero-Day Spreads via Office Docs

Adobe has patched a zero-day in its Flash player after attackers leveraged the exploit in an active campaign.

An Adobe Flash zero-day was seen in the wild as part of an active campaign using the exploit in Microsoft Office documents. Adobe has since patched the vulnerability, CVE-2018-15982.
Gigamons Applied Threat Research (ATR) team identified the active campaign, which uses malicious files to deliver the exploit. CVE-2018-15982 lets a Flash object execute code on a target machine and enables an attacker to gain command line access to the victims system.
The document used in this campaign, 22.docx, was submitted by a Ukrainian IP address to VirusTotal. It appears to be an application for a Russian state healthcare clinic; the logo indicates its a fake application for Polyclinic No. 2, an adult outpatient clinic located in Moscow. Analysts compared the logo in the doc to the clinics authentic logo.
The file contains seven pages of personal questions typical of an employment application, requesting the recipients full name, birthdate, profession, company division, and level of skill.
Its indicative of a targeted spear-phishing attack, presumably things the receiver would be familiar with, says Josh Carlson, vice president of threat research at Gigamon. The way the document is crafted suggests its recipients would recognize the clinics name and logo. While this type of phishing lure appears to be highly targeted, ATR researchers point out the team has observed other similar spear-phishing attacks in which lures are unrelated to their recipients.
Its hard to tell for sure because ATR doesnt have specifics on the extent of this campaign or number of people affected. Carlson suggests this is either a highly targeted attack, in which the actor(s) has substantial knowledge of the victims environment, or the actor is testing his tools.
A Closer Look at the Attack
The way this attack unfolds is simple: The documents header contains an Active X control, which renders when the file is opened and causes an exploitation of Flash within Office. The exploitation leads to the execution of a malicious command, which attempts to extract and execute a payload, researchers explain in a
blog post
on their discovery.
In this case, the Flash exploit is self-encapsulated within the document and supports 32- and 64-bit systems. The Flash file and shellcode stubs dont make use of remote inclusion, staging, obfuscation, or any kind of anti-analysis, researchers say. Both shellcode stubs execute the same command, which is consistent with an attack packaged as a RAR archive. Testing shows that opening the document within the archive is enough to run the exploit and payload.
There isnt much thats unique about this campaign, Carlson says, but whats strange is it requires targets to take several steps to open the document and execute the command.
Its unusual in that they have a zero-day in Flash, but theyre requesting users to go through extra clicks and follow steps to leverage it, he explains.
Analysts have moderate to high confidence the payload is a variant of Scout malware, based on similarity in submission details, behavior, close time proximity, and file name matching the one expected by the exploit. The payload, a Windows executable file, is protected with VMProtect, which prevents reverse engineering and analysis. The payload collects system data, establishes persistence, and communicates with a remote server via HTTP post.
The techniques of this campaign are similar to those used by HackingTeam, an Italian offensive security company selling remote access-as-a-service and surveillance tools. When HackingTeam was breached in 2015, its internal data, including email and source code for backdoors and exploits, was publicly spread. Cyberattackers around the world began using HackingTeams tools to launch operations. This could be the case here, but attribution is difficult, ATR says.
There are similarities to HackingTeam, but in reality those tools have been reused by many copycats, Carlson says.
Flash Stays Alive…
.
For Now
The death of Flash is a common topic in cybersecurity as efforts aim to remove Flash from Web browsers. Cybercriminals, however, will continue to use it. Theyre just finding new ways. Vectors like Microsoft Office can still load and execute Flash content, and exploits against zero-days that allow for command execution using popular enterprise software will prove valuable.
As Flash is less used in browsers, the attackers are moving toward Office as an attack vector, Carlson explains. Flash is going to become less of an attack surface over time, but it still works, he says.
Related Content:
7 Common Breach Disclosure Mistakes
Bringing Compliance into the SecDevOps Process
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Backdoors Up 44%, Ransomware Up 43% from 2017

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Adobe Flash Zero-Day Spreads via Office Docs