The EPS Awakens - Part 2[html]
On Wednesday, Dec. 16, 2015, FireEye published href="https://www.fireeye.com/blog/threat-research/2015/12/the_eps_awakens.html">The
EPS Awakens, detailing an exploit targeting a previously unknown
Microsoft Encapsulated Postscript (EPS) dict copy
use-after-free vulnerability that was silently patched by Microsoft on
November 10, 2015. The blog described the technical details of the
vulnerability, and the steps needed to bypass the EPS filter and
obtain full read and write access to the system memory.
In this follow-up blog, we discuss the operational details of the
spear phishing campaigns associated with the exploit. Specifically, we
detail the lures, attachments, targeting and malware, and examine the
China-based advanced persistent threat (APT) group responsible for one
of the observed attacks.
Activity Summary
Between November 26, 2015, and December 1, 2015, known and suspected
China-based APT groups launched several spear phishing attacks
targeting Japanese and Taiwanese organizations in the high-tech,
government services, media and financial services industries. Each
campaign delivered a malicious Microsoft Word document exploiting the
aforementioned EPS dict copy use-after-free vulnerability, and
the local Windows privilege escalation vulnerability CVE-2015-1701.
The successful exploitation of both vulnerabilities led to the
delivery of either a downloader that we refer to as IRONHALO, or a
backdoor that we refer to as ELMER.
Thanksgiving Day Parade
On November 26, 2015, a suspected China-based APT group sent
Japanese defense policy-themed spear phishing emails to multiple
Japanese financial and high-tech companies. As shown in Figure 1, the
emails originated from the Yahoo! email address
mts03282000@yahoo.co[.]jp, and contained the subject
“新年号巻
