## securelist.com # CVE-2015-2545: overview of current threats ## by Great On May 25, 2016. 10:56 Am • 16 min read • original #### CVE-2015-2545 is a vulnerability discovered in 2015 and corrected with Microsoft’s update MS15-099. The vulnerability affects Microsoft Office versions 2007 SP3, 2010 SP2, 2013 SP1 and 2013 RT SP1. The error enables an attacker to execute arbitrary code using a specially crafted EPS image file. The exploit uses PostScript and can evade Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) protection methods. The exploit was discovered in the wild in August 2015, when it was used in a targeted attack by the Platinum group, presumably against targets in India. Over the following months, there was significant growth in the number of threat actors using the vulnerability as a primary tool for initial penetration, with both the attack groups and their targets located in South-East and Central Asia and the Far East. In this research paper, we discuss examples of attacks using the CVE 2015 2545 vulnerability undertaken by some of these groups ----- ## Platinum (also known as TwoForOne) #### The group is believe to originate from South-East Asia. Its attacks can be traced as far back as 2009. The group is notable for exploiting 0-day vulnerabilities and carrying out a small number of highly focused targeted attacks – mostly against government agencies in Malaysia, Indonesia, China and India. This group was the first to exploit the CVE-2015-2545 vulnerability. After the vulnerability was corrected with Microsoft updates in September and November 2015, no new Platinum attacks exploiting this vulnerability have been detected. Microsoft presented the activity of this group at the SAS conference in February 2016, and in its paper: PLATINUM: Targeted attacks in South and Southeast Asia. ## APT16 ----- #### Chinese origin. In November and December 2015, it used a modified exploit for CVE-2015-2545 in attacks against information and news agencies in Taiwan. These attacks were described in a FireEye research paper – The EPS Awakens – Part 2. ## EvilPost #### In December 2015, Kaspersky Lab became aware of a targeted attack against the Japanese defense sector. In order to infect victims, the attacker sent an email with an attached DOCX file exploiting the CVE 2015-2545 vulnerability in Microsoft Office using an embedded EPS (Encapsulated Postscript) object. The EPS object contained a shellcode that dropped and loaded a 32-bit or 64-bit DLL file depending on the system architecture. This, in turn exploited another vulnerability to elevate privileges to Local System (CVE-2015-1701) and download additional malware components from the C&C server. The C&C server used in the attack was located in Japan and appears to have been compromised. However, there is no indication that it has ever been used for any other malicious purpose. Monitoring of the server activity for a period of several months did not result in any new findings. We believe the attackers either lost access to the server or realized that it resulted in too much attention from security researchers, as the attack was widely discussed by the Japanese security community. According to our research partner in Japan, the original EvilPost attack in December 2015 arrived as a spear-phishing email with a Word document attached. ----- #### vulnerability in the EPS format handler in Microsoft Word. Even with an exploit component, Microsoft Word rendered the document correctly and displayed the decoy message. The document is written in good Japanese, as shown below. It has been used to decoy New Year impressions of defense-related organizations. This attack was also described in the FireEye report, mentioned above. An overview of the activity of the EvilPost group activity was provided to subscribers of the Kaspersky Lab Threat Intelligence Service in March 2016. For information about the service, please write to intelreports@kaspersky.com. ## SPIVY #### In March and April 2016, a series of emails laced with an exploit forCVE-2015-2545 were detected. The emails were sent in spear phishing attacks, presumably targeting organizations in Hong Kong. Identifying a specific group behind these attacks is difficult because ----- #### PoisonIvy (from which the name of the group, SPIVY, is derived). A description of these incidents can be found in the PaloAlto blog. ## Danti and SVCMONDR #### These two groups have not yet been publicly described. An overview of their attacks and the tools used is provided in this report. ## Danti attacks #### Danti (Kaspersky Lab’s internal name) is an APT actor that has been active at least since 2015, predominantly targeting Indian government organizations. According to our telemetry, Danti has also been actively hitting targets in Kazakhstan, Kyrgyzstan, Uzbekistan, Myanmar, Nepal and the Philippines. ----- #### using a repurposed implementation of the CVE-2015-2545 exploit with custom shellcode. In order to infect the victim, the attackers distributed spear-phishing emails with an attached DOCX file exploiting the CVE-2015-2545 vulnerability in Microsoft Office. The exploit is based on a malformed embedded EPS (Encapsulated Postscript) object. This contains the shellcode that drops a backdoor, providing full access to the attackers. Main findings: Danti, a previously unknown group, is probably related to NetTraveller and DragonOK In February-March 2016 the group was observed using CVE-2015 2545 It remains active, conducting attacks against Indian diplomatic organizations Related attacks have been observed against Central and South East Asia targets The campaign leveraging the exploit for CVE-2015-2545 took place in February 2016. As a result, several emails with attached DOCX files were uploaded to VirusTotal. The email recipients were connected to the Indian Ministry of External Affairs, as can be seen below: dsfsi@nic.in, the Foreign Service Institute, Ministry of Foreign Affairs (Under Secretary (FT/NRG), dsfsi@mea.gov.in) chumarpost@gmail.com, possibly related to the Chumar military post in India, a disputed area between India and China (the mail server is the same as the Indian Ministry of Foreign Affairs vastuXX.nic.in) chancery@indianembassy.hu, the Indian embassy in Hungary b h @ i h I di E b i D k ----- #### All these attacks took place between the 2[nd] and 29[th] of February, 2016. ----- Indian embassy in Hungary 2[nd] February Indian embassy in Denmark 2[nd] February Indian embassy in Colombia 2[nd] February DSFSI 24[th] February Chumapost 29[th] February Mission List.doc unknown (original email was forwarded) HQ List.doc mout.gmx.com ([74.208.4.200]) HQ List.doc mout.gmx.com ([74.208.4.201]) India’s 10 Top Luxury Hotels.doc India’s 10 Top Luxury Hotels.doc 191.96.111.195 via mout.gmx.com ([74.208.4.201]) 43.227.113.129 via mout.gmx.com ([74.208.4.200]) #### In the case of the Indian Embassy in Hungary, it looks like the original message was forwarded from the embassy to the Indian IT security team in the Ministry of Foreign Affairs, and uploaded later to Virus Total. ## Initial vector #### The emails that were analysed had originally been sent via “3capp mailcom-lxa06.server.lan”, perhaps using a spam-mailer program. In all known cases, the sender used the same gate at 74.208.4.200/74.208.4.201 (mout.gmx.com), a well-known open relay SMTP server. The email messages changed for different waves of the campaign. When the campaign started in February 2[nd], the emails carried the subject headers “Mission List” and “HQ List”, and forged the identity of a real sender. ----- #### Original message used in the first wave of attacks As can be seen above, the original email was supposedly forwarded from Anil Kumar Balani, Director of the Department of Information Technology at the Indian Ministry of Communications & Information Technology. ----- #### Mission List decoy document At the same time, attackers sent a slightly different document with the subject “HQ List” to other Indian embassies (for example, those in Denmark and Colombia): ----- #### Original HQ List email K.Nagaraj Naidu is Director of the Investments Technology Promotion Division in the Ministry of External Affairs, and a former Counsellor (T&C) at the Embassy of India in China. ----- #### HQ List decoy document Both files (“Mission List” and “HQ list”) have different decoy content, but both use the same CVE-2015-2545 EPS exploit (image1.eps, MD5 a90a329335fa0af64d8394b28e0f86c1). Interestingly, as can be seen in their metadata, both files were modified by the user “India” on 01.02.2016, just one day before they were sent to targets. ----- #### For the attacks at the end of February, the attackers decided to use the less relevant subject header of “10 top luxury hotels in India”, sent from an unknown sender. ----- #### Top Luxury Hotels spear-phishing email This new attachment contains the same EPS exploit, but uses a different decoy document and a new payload. ----- #### Top 10 Luxury Hotels decoy document The text of the document was copied from a Forbes article published in 2007. According to its metadata, the document was created in June 2015, so it has probably been used before in unknown attacks. However, the same mail gate (mout.gmx.com) was used as for the 2nd February attacks. Email header from February 29 ----- #### Email header from February 24 All the “doc” files are Web Archive Files and contain decoy documents and a malicious EPS. The structure of the WAF files is the same in all three cases: Web archive structure ## Exploit ----- #### exploitforCVE-2015-2545 – EPS parsing vulnerability in EPSIMP32.FLT module, reported by FireEye, and patched by Microsoft on 8 September 2015 with MS15-099. We are currently aware of about four different variants of the exploit. The original one was used in August 2015 against targets in India by the Platinum (TwoForOne) APT group. Original EPS exploit, used in August 2015 The second (which is a modified variant of the original exploit) was used in EvilPost attacks against Japan in 2015, and then reused by cybercriminals in March 2016. This variant was also used by the APT16 group (ELMER backdoor) in Taiwan in December 2015. The second variant is easily recognized by the specific strings in its EPS shellcode: The “h:\\test.txt” string could have been forgotten by the exploit developer The third variant was used in December 2015 against a Taiwanese organization, and in February 2016 against an Indian diplomatic organization. This variant uses different shellcode but is based on the original exploit from the Platinum (TwoForOne) APT: ----- #### Can be recognized by “add2