CVE-2015-6585

Kaspersky Lab has joined industry alliance driven by Novetta to announce Operation Blockbuster. Just like the previous Operation SMN, this alliance brings together key players in the IT security industry, working together in an effort to disrupt and neutralize multiple cyberespionage campaigns that have been active for several years. Some of the targets of these campaigns included financial institutions, media houses and manufacturing companies, among others. In the past, we published our resear...

'Macktruck' attack network sends in the 'Hangman'

FireEye researchers Genwei Jiang and Josiah Kimble say attackers from North Korea exploited a zero day vulnerability in a word processor popular with the South Korea's government. The attackers went after the vulnerability (CVE-2015-6585) in the Hangul Word Processor prior to a patch issued last Monday. Accurate attribution of North Korean actors is inherently difficult, however Jiang and Kimble say the attack payloads and infrastructure strongly point to the North. There is no suggestion of Pyo...