Trusted Design

DirectRev Malvertising Uses Self Sufficient Flash 0Day

概要

Malwarebytes has been observing a surge in drive-by download attacks since the recent Flash zero-day (now patched). This is due to the fact that the exploit has been integrated into several exploit kits and many end users have not yet patched their machines. Today, we noticed CVE-2015-5119 (the identifier for this vulnerability) being used in a rather unusual attack pattern. Instead of using an exploit kit, malicious actors have uploaded a rogue Flash ad which further launches another Flash file containing the zero-day exploit.

Created: 2026-02-23

Indicators

• URL - static.directrev.com/hbruse/flash0807.swf -
• URL - 155.94.67.5/upload.php -
• URL - nokerling.eu/anUyRBsRSVIWI21XNwAAGQo.swf -
• CVE - CVE-2015-5119 -

類似Pulses

• DirectRev Advert Loads Self Sufficient Flash Exploit, CryptoWall (score: 0.72)
• Killing a Zero-Day in the Egg: Adobe CVE-2016-1019 (score: 0.68)
• Spike in Malvertising Attacks Via Nuclear EK Pushes Ransomware (score: 0.67)
• Locky Ransomware Spreads via Flash and Windows Kernel Exploits (score: 0.67)
• A VAST Malvertising Attack (score: 0.64)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る