Slower_operations_longer_load_time_excessive_buffer_errors_and_delayed_audio.

A memory flaw covered by time was exposed by hackers; the flaw enabled the group to gain control over their target's system remotely. A remote access is a feature within the "operating system". ☺Design to allow administrators access via remote. The attackers exploited a memory corruption flaw (CVE-2017- 11882), which—in "Office" 2007, 2010, 2013, and 2016—downloads malicious HTML applications (HTA) file with the final payload being a Remote Access Trojan. The buffer overflow defect lies in the Equation Editor component in " Office" when, exploited, the result is a remote arbitrary code execution.

Details about two campaigns that exploited an older flaw in Microsoft SUIT classified under CVE-2016-7262 and CVE02017- 0199 . The campaign delivered under CVE2017-0199 was a malicious Microsoft PowerPoint document, which exploited the defect in the codes. The exploitation of the security feature bypass in Powerpoint result lead to a remote code execution. These files lies in the way specially crafted files are parsed by WordPad.

A Successful exploitation requires the user to click through the security warning to enable macros after opening the malicious file, which was delivered via spear-phishing. The malicious code were delivered to a mailing list controlled by the Central Tibetan Administration. 

The threat actors attempted to hide the payload by changing the program’s icon to look like a call to action variable, the groups tactics carried out on various attacks took advantage of the flaw infecting IoT devices and installed cryptocurrency miners, backdoors, and malwares.

Since the group carried out their attack against "Office" 2007-2016; have taken their Office platform to the cloud. Secure with the IoT allowing the giant size company to enable a subscription service to the Office platform. Theflaw lied in the "NoneCmsV1.3.thinkphp/library/thin/App". php and the handling of crafted filter parameters. The malicious, device-infecting software includes variants of the Mirai botnet, the Mimikatz credential harvester, and a backdoor Trojan known as SpeakUp. 

These provide the capabilities to collect usernames, network information, and CPU details and infect the system with the XMRig cryptominer. The code contacted the attacker C2 server to download the Exile Remote Access Trojan, which is capable of exfiltrating a range of system information from the infected host, as well as uploading and downloading files and creating and terminating system processes.

Have you ever wonder why your recently purchased system is operating slower than usual. Do you know the backdoor Linux Trojan known as SpeakUp. How about the Mimikatz credential harvester or or the Mirai botnet

These carry the capabilities to collect usernames, network information, and CPU details and infect the system with the XMRig cryptominer defecting your system causing a negative user experience.

Infected system: slower operations, longer load time, excessive buffer errors, and delayed audio.