Metasploit Module Released For IE Zero-Day Flaw Used In Labor Attack

Other U.S. energy agencies, organizations targeted in apparent nuclear technology cyberspying campaign that employed a zero-day bug in Internet Explorer 8

A targeted attack discovered last week serving up malware from the U.S. Department of Labors (DOL) website employed a previously unknown vulnerability in Internet Explorer 8 that Microsoft says it will fix either with an emergency patch or via its monthly patch process.
And as is tradition, Metasploit also has quickly added
an exploit pack
for the new flaw, a use-after-free bug that has been assigned as CVE-2013-1347. Microsoft is investigating public reports of a vulnerability in Internet Explorer 8. Microsoft is aware of attacks that attempt to exploit this vulnerability, a
security advisory issued by Microsoft
late on Friday said. Internet Explorer 6, Internet Explorer 7, Internet Explorer 9, and Internet Explorer 10 are not affected by the vulnerability.
Security researchers at AlienVault Labs and Invincea initially attributed the exploit to a patched bug in IE 8, CVE-2012-4792, but further investigation into the attacks found it was a new flaw.
FireEye
is credited with reporting the find to Microsoft.
At least nine additional websites in addition to the DOL were hit with
the attack
simultaneously, according to Jaime Blasco, director of AlienVault research labs. Blasco said in a blog post over the weekend that nonprofit organizations and a large European aerospace, defense, and security company were among the websites hit in the waterhole campaign.
[Broader spearphishing campaigns and watering-hole attacks look to compromise and gather intelligence on broader classes of targets. See
Expect Less Targeting From This Years Targeted Attacks
.]
It appears the attackers were using the DOL attack to turn around and target the U.S. Department of Energy. According to Invincea, the web pages that were compromised on the DoL site are intended for Dept of Energy employees (and their DoL representatives) in dealing with nuclear-related illnesses linked to Dept of Energy facilities and the toxicity levels at each location, and the campaign is now widely believed to be a watering hole attack that involves compromising one Federal Dept (DoL) to target another (DoE).
Matt Dahl, senior threat researcher for CrowdStrike, says the likely ultimate targets visiting the uranium-focused DOL site would be U.S. government agencies involved in energy, energy companies, and possibly companies in the extractive sector, he said in
a blog post
.
Of the visitor traffic to the infected DOL site, 71 percent were IP addresses out of the U.S., 11 percent were out of Southeast Asia, and 10 percent were out of Europe. But its unclear whether the malware actually was exploited on all of those machines.
Dahl stopped short of confirming that the infamous Chinese cyberespionage group DeepPanda is behind the attacks, noting that it was unable to confirm this because the command-and-control server is offline. AlienVaults Blasco last week discovered that the command-and-control protocol used in the attack matches a backdoor used by DeepPanda, which is known for stealing information from defense, energy, and chemical entities.
The DOLs website was infiltrated with malicious code planted on its website, which then sent victim machines to a malicious server that was spreading the PoisonIvy remote access Trojan. A JavaScript tag on the website leads via an iFrame to the browser exploit.
IE 8 running on XP, Vista, Windows 7, Server 2003, and Server 2008 are all affected by the new zero-day.
Security experts recommend moving to IE 9 or 10, and for XP users to run Chrome or Firefox until Microsoft has issued a fix for the bug.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Metasploit Module Released For IE Zero-Day Flaw Used In Labor Attack