For this article, I am pretty much only going to be talking about how a couple hackers accidentally exposed their exploit chain (exploit chain is a bunch of exploits that chain together do a bunch of malicious stuff).
A couple of hackers in the midst of fine tuning their hack wound up getting exposed when they uploaded their malicious PDF to a public virus scanner (scanners like virustotal can be used to scan programs against multiple antiviruses, and can help you determine if a program is malicious or not).
Their exploit chain was utilizing:
- CVE-2018-4990 which is used to affect Adobe Reader
- CVE-2018-8120 which affects Win32k
What their Trojan did was once a user opened up a PDF that they sent, some JavaScript code would then activate a button object which would then allow for JavaScript to affect a bunch of things which in turn would allow the attackers to run their own shell code on the system.
This was actually found at the end of March, but Windows and Apache didn't patch this until the last few days.
This was a pretty rough article and description, but just informing people to the best of my ability.
If you leave a comment/question, I will try to get to it and to answer it to the best of my ability.
If you want to read more about it, you can find it at https://www.bleepingcomputer.com/news/security/shadowy-hackers-accidentally-reveal-two-zero-days-to-security-researchers/
