Symantec has discovered a zero-day vulnerability that is being used in targeted attacks in South Korea. The researchers found the flaw by analyzing code from an exploit kit called “BlackEnergy”. The hackers had been taking advantage of the Microsoft Internet Explorer Scripting Engine Remote Memory Corruption Vulnerability (CVE-2016-0189), which has subsequently been patched. At this stage, it is unclear what the motivation for the attacks has been and which companies have been targeted. Typically, specific attacks on South Korea entities involve acts of espionage or sabotage. Zero-day exploits are increasing, with a significant rise in this sort of attack since 2014. Symantec’s EMEA chief strategist, Sian John, commented: “Targeting website or software vulnerabilities is an appealing technique for cyber-criminals as it allows them to exploit the issue multiple times, often accessing thousands of people’s personal details before the issue is identified and publicly disclosed".
Symantec has discovered a zero-day vulnerability that is being used in targeted attacks in South Korea. The exploit was hosted on a web page, suggesting that the victims fell foul of spear-phishing emails and watering hole attacks. The hackers had been taking advantage of the Microsoft Internet Explorer Scripting Engine Remote Memory Corruption Vulnerability (CVE-2016-0189), which has subsequently been patched. At this stage, it is unclear what the motivation for the attacks has been and which companies have been targeted. Typically, specific attacks on South Korea entities involve acts of espionage or sabotage. Zero-day exploits are increasing, with a significant rise in this sort of attack since 2014. Symantec’s EMEA chief strategist, Sian John, commented: “Targeting website or software vulnerabilities is an appealing technique for cyber-criminals as it allows them to exploit the issue multiple times, often accessing thousands of people’s personal details before the issue is identified and publicly disclosed".