New Internet Explorer zeroday was used in the DoL Watering Hole campaign
May 5, 2013
In our first analysis we reported that the exploited vulnerability was CVE-2012-4792 . Further analysis showed that the vulnerability exploited wasn’t CVE-2012-4792 but a new zeroday vulnerability affecting Internet Explorer 8 (CVE-2013-1347). It was confirmed by Microsoft that released a Security Advisory on Friday and also FireEye and Invincea.
In addition we have found that the U.S Department of Labor website wasn’t the only entity affected and we can confirm that at least 9 other websites were redirecting to the malicious server at the same time. The list of affected sites includes several non-profit groups and institutes as well as a big european company that plays on the aerospace, defence and security markets.
Finally we detected several redirections to another malicious server located at www[.]sellagreement[.]com (18.104.22.168) that was serving parts of the malicious payloads found on dol[.]ns01[.]us.
We recommend you to search your logs for connections to those domains and IP addresses.