Exclusive – APT group exploited still unpatched zero-day in IE dubbed ‘double play’

Pierluigi Paganini April 20, 2018

Security researchers at the 360 Core Security observed an APT group exploiting a zero-day vulnerability in IE, dubbed ‘double play’. The flaw is still unfixed.

Security researchers at the 360 Core Security uncovered a zero-day vulnerability in IE, dubbed ‘double play’,  that was triggered by weaponized MS Office documents. The experts have been observing an APT group targeting a limited number of users exploiting the zero-day flaw.

At the time of writing the expert did not reveal the name of the APT because of ongoing investigation, most of the victims are located in ASIA.

According to the experts at 360 Core Security, users may get hacked by simply opening a malicious document. Hackers can use the ‘double play’ flaw to implant a backdoor Trojan and take full control over the vulnerable machine. 

Through source analysis, 360 Security experts were able to discover the attack chain and reported it to Microsoft.

The APT group was delivering an Office document with a malicious web page embedded, once the user opens the document, the exploit code and malicious payloads are downloaded and executed from a remote server. The later phase of this attack leverages a public UAC bypass technique and uses file steganography and memory reflection loading to avoid traffic monitoring and achieve loading with no files.

This ‘double play’ vulnerability may affect the latest versions of Internet Explorer and applications that are with IE kernel.

Experts at 360 Core Security are urgently promoting the release of the patch.

“At present, 360 is urgently promoting the release of the patch.” states 360 Core Security.

“We would like to remind users not to open any unfamiliar Office documents and use security software to protect against possible attacks.” states 360 Core Security.

double play zero day

 Below the timeline of the zero-day:

April 18. 360 Core Security detected the attack;
April 19. Experts reported the flaw to Microsoft.
April 20. Microsoft confirmed the existence of the zero-day. Microsoft hasn’t yet released t patch.
Update April 22, 2018

Official Updates

Now, several equihash based mining pools have published their updates toresponse to this attack.  Z-comp has changed the dependency of Equihashverify to an official authorized equihashverify (https://github.com/zencashofficial/equihashverify.git). Zencash released an official update last week:  https://blog.zencash.com/update-for-the-equihash-mining-application-z-nomp/. Bitcoin Gold updated to a new equihashjs-verify. Other major crypytocurrencies and mining pools like Zclassic, BTG and Zcash also took actions to resolve the vulnerability. However, since there are many kinds of digital currencies and forked codes, smaller crypocurrencies and mining pools haven’t updated their dependencies yet. Attacks are happening at wild, 360 strongly suggest the members in the community implement the fix in time.


Implement Zencash official solutions:


About the author 360 Core Security

Reference http://blogs.360.cn/blog/attackers-fake-computational-power-to-steal-cryptocurrencies-from-mining-pools/

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – double play zero-day, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

you might also like

leave a comment