According to Google’s Project Zero team, threat actors exploited 0-day vulnerabilities to successfully carry out their attack.
The IT security researchers at Google’s Project Zero have disclosed details of a complex hacking campaign that they discovered around one year back in early 2020.
In an in-depth, six-part analysis of the campaign that targeted Windows and Android users, researchers have explained how threat actors managed to carry out a watering hole attack using 0-day and n-day exploits.
See: Google reveals unpatched 0day vulnerability in Microsoft’s API
Project Zero researchers collaborated with Google Threat Analysis Group to probe the watering hole attack and the two exploits, each of which utilized a separate exploit chain to compromise the target(s).
A ‘Sophisticated Actor’ Developed Exploit Chains
Project Zero states that the campaign is most definitely the work of a ‘highly sophisticated actor,’ operating a complex targeting infrastructure. However, they didn’t indicate who that actor may be. They did note that the discovered exploit chains were designed for flexibility and efficiency through modularity.
According to researchers, they were ‘well-engineered, complex code with a variety of novel exploitation methods, mature logging, sophisticated and calculated post-exploitation techniques, and high volumes of anti-analysis and targeting checks,” the report reads.
“We believe that teams of experts have designed and developed these exploit chains,” researchers noted.
Exploits for Four Bugs Found in Google Chrome
The research team discovered exploits for four bugs in the google reveals profile attack targeting android windows users
