The EPS Awakens - Part 2 « Threat Research | FireEye Inc

FireEye observed Nov–Dec 2015 spear-phishing campaigns targeting Japanese and Taiwanese organizations that exploited a Microsoft EPS use-after-free vulnerability and CVE-2015-1701 to install IRONHALO (downloader) and ELMER (HTTP backdoor). Campaigns used localized lures (Japanese and traditional Chinese), delivered weaponized Word documents, and included observable IoCs (MD5s, C2 IPs and domains, HTTP beacon strings). FireEye attributes one December campaign to China-based APT16 and highlights targeting of high-tech, government, media and financial sectors in the context of regional political events.