Flash zero-day exploit deployed by the ScarCruft APT Group

Kaspersky Lab documents Operation Daybreak, a targeted campaign by the ScarCruft APT that used a zero-day Adobe Flash Player vulnerability (CVE-2016-4171) delivered via spear-phishing and compromised websites to achieve remote code execution. The report details the multi-stage exploit chain (three SWFs), memory-corruption root cause, evasive techniques including RC4+Base64 delivery and an undocumented DDE-based execution path to bypass endpoint protections, final payloads (CAB with signed-but-invalid DLLs), C2 indicators, MD5s, and a small set of high-profile victims across multiple countries.