The Sednit group is back on the radar after alleged interference with the French elections. ESET researchers have observed another one of their phishing emails in action – this time using a recently mediatized missile strike on Syria to lure victims into opening an attachment that drops its infamous reconnaissance tool, Seduploader. Read the whole analysis on ESET’s news website. Inside the document titled Trump's_Attack_on_Syria_English.docx, Sednit uses two 0-day exploits to drop the Seduploader component. The first one, CVE-2017-0261, for a Remote Code Execution vulnerability in Microsoft Word and the second one, CVE-2017-0263, for a Local Privilege Escalation in Windows. ESET reported both vulnerabilities to Microsoft, who addressed them today in their regular monthly security updates release.“The Sednit group shows that it is far from done with its activities,” comments Alexis Dorais-Joncas, ESET Security Intelligence Team Lead, on recent findings. “While maintaining its old habits – such as the reuse of code and using known attack methods as described in our extensive whitepaper, we have noted several improvements in Seduploader over the past several months.“ The Sednit group, also known as APT28, Fancy Bear and Sofacy, is a group of attackers that has been operating since at least 2004 and whose main objective is to steal confidential information from specific, carefully selected targets. Last October, ESET published an extensive analysis of Sednit’s arsenal and tactics in the whitepaper En Route with Sednit. Read the whole analysis on the latest Sednit group attack titled ‘Sednit adds two 0-day exploits using 'Trump's attack on Syria' as a decoy’ on Welivesecurity.com.
About ESET
Since 1987, ESET® has been developing record award-winning security software that now helps over 100 million users to Enjoy Safer Technology. Its broad security product portfolio covers all popular platforms and provides businesses and consumers around the world with the perfect balance of performance and proactive protection. The company has a global sales network covering 200 countries, and regional offices in Bratislava, San Diego, Singapore and Buenos Aires. For more information visit www.eset.com or follow us on LinkedIn, Facebook and Twitter.
The Company has global headquarters in Bratislava (Slovakia), with regional distribution centers in San Diego (U.S.), Buenos Aires (Argentina), and Singapore. ESET has malware research centers in Bratislava, San Diego, Buenos Aires, Singapore, Prague, Košice (Slovakia), Krakow (Poland), Montreal (Canada), Moscow (Russia). ESET Middle East has its regional office in Dubai Internet City and manages an extensive partner network in 11 countries: United Arab Emirates, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, Yemen, Lebanon, Jordan Egypt and Libya. More information is available via www.eset.com/me