Flash 0 Day In The Wild: Group 123 At The Controls

Flash 0 Day In The Wild: Group 123 At The Controls
http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html


IOCS

Flash exploits:

fec71b8479f3a416fa58580ae76a8c731c2294c24663c601a1267e0e5c2678a0
3b1395f620e428c5f68c6497a2338da0c4f749feb64e8f12e4c5b1288cc57a1c

ROKRAT sample:

E1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd

URL:

hxxp://www[.]1588-2040[.]co[.]kr/conf/product_old.jpg
hxxp://www[.]1588-2040[.]co[.]kr/design/m/images/image/image.php
hxxp://www[.]korea-tax[.]info/main/local.php
hxxp://www[.]dylboiler[.]co[.]kr/admincenter/files/board/4/manager.php