CVE-2018-0824 was exploited by APT41 in a sophisticated attack chain targeting a Taiwan-based research institute, using customized malware tools for post-compromise activity.
Attacker needs to convince an end-user to open a crafted file or script, making phishing attacks or compromised websites potential vectors for leveraging the CVE-2018-0824 vulnerability.
Cisco's Talos team disclosed evidence of APT41's malicious campaign including the use of CVE-2018-0824, showing an increased risk since the vulnerability's initial disclosure by Microsoft.
[
Collection
]
[
|
...
]