Researcher claims two hacker gangs exploiting unpatched IE bug

Plant different malware on hijacked Windows PCs, but use the same exploit code, says Seculert's CTO, Aviv Raff

Two different hacker groups are exploiting the same still-unpatched vulnerability in Internet Explorer (IE) with almost-identical attack code, a security researcher said Tuesday.

The attacks, the first campaign unearthed last week by FireEye and a second campaign found by Websense, exploit a flaw in IE9 and IE10, two editions of Microsoft's browser. Attacks have been spotted targeting only IE10, however.

According to FireEye, the attacks it found targeted current and former U.S. military personnel who visited the Veterans of Foreign Wars (VFW) website. Meanwhile, Websense reported that the exploit it discovered had been planted on the website of a French aerospace association, GIFAS (Groupement des Industries Francaises Aeronautiques et Spatiales), whose members include defense and space contractors.

GIFAS is best known to the public as the sponsor of the Paris Air Show, where commercial and military aircraft makers strut their newest fixed-wing planes and helicopters.

Aviv Raff, chief technology officer at security firm Seculert, contended that the attacks uncovered by FireEye and Websense were the work of two gangs.

"Our analysis reveals that a totally different malware than ZXShell, the culprit as identified by FireEye, was used [in the attacks found by Websense]," Raff wrote on his company's blog Tuesday.

Raff confirmed that Seculert believed two different groups of cyber criminals were at work, both leveraging the same IE zero-day vulnerability, in an interview conducted via instant message Tuesday.

"We do see similar variations of zero-day exploits, but zero-day [vulnerabilities] that were never publicly disclosed before, that is not that common [for two groups to use simultaneously]," Raff said in that interview.

He speculated that the two hacker gangs probably obtained the attack code from the same third-party by purchasing it on the black market. "The elements of the exploits are almost identical," Raff added, explaining his reasoning.

Although Microsoft has acknowledged that both 2011's IE9 and 2012's IE10 contain the vulnerability, it has yet to issue an official security, the usual first step towards publishing a patch. Nor has the Redmond, Wash. company's security team named any temporary defensive measures, which are frequently offered in the "Fixit" format.

Instead, Microsoft has encouraged users to upgrade to IE11, which is immune to the attacks. However, Windows Vista owners running IE9 cannot migrate to IE11 as the latter does not support the little-used Vista.

Raff also said Seculert's research had found that the malware used in the GIFAS campaign had changed the hosts files of the infected machines to redirect any remote access software traffic through the hackers' servers so that they could steal log-on credentials.

"The domains that were added to the hosts file by the malware provide remote access to the employees, partners, and third-party vendors of a specific multinational aircraft and rocket engine manufacturer," said Raff on the blog.

Seculert did not identify the manufacturer by name, but an accompanying screenshot on the blog showed the logo of Safran SA, a Paris-based multinational aerospace and defense contractor whose subsidiaries produce commercial and military aircraft engines, and both liquid- and solid-fueled rocket motors.

Engines made by Safran power some of the French Air Force's Mirage 2000 jet fighters.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His email address is

> >

Read more about malware and vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags Cybercrime and HackingShellMicrosoftsecurityFireEyeSeculertMalware and Vulnerabilitieswebsense

More about AppleFireEyeMicrosoftTopicWebsense

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Gregg Keizer

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place