BlackOasis__2017__BlackOasis.pdf

Kaspersky describes a targeted BlackOasis APT campaign that exploited an Adobe Flash zero-day (CVE-2017-11292) delivered via Microsoft Office documents to deploy Gamma International’s FinSpy spyware; the report includes technical exploit and shellcode analysis, infection chain (ActiveX Flash, staged shellcode, download of mo.exe), persistence via DLL search-order hijacking, C2 indicators (89.45.67.107), an MD5 for the payload, victim targeting across Middle Eastern and other countries, and mitigation recommendations.