FireEye's Singapore-based threat team has uncovered a large-scale phishing campaign by Chinese threat group APT3 (aka UPS) exploiting a zero-day vulnerability in Adobe Flash Player, dubbed Operation Clandestine Wolf. The campaign leveraged CVE-2015-3113, an unpatched flaw in how Flash Player parses Flash Video (FLV) files.
Spam-Like Lures, Sophisticated Payloads
APT3 targeted organizations across aerospace and defense, construction and engineering, high tech, telecommunications, and transportation sectors. The phishing emails were deliberately generic — mimicking Apple refurbished iMac promotions — linking victims to compromised servers hosting JavaScript profiling scripts. Once a target was fingerprinted, a malicious Flash SWF and FLV file delivered the custom SHOTPUT backdoor (also tracked as Backdoor.APT.CookieCutter), with the payload XOR-encoded and hidden inside a valid GIF image.
Advanced Exploit Techniques
The exploit employed a layered approach: an RC4-packed Flash file decrypted a second-stage exploit using loader.loadBytes. The attack used classic Vector corruption techniques to bypass ASLR, then escalated memory access to 0x3FFFFFFF bytes through a secondary Vector corruption. For DEP bypass, the attackers deployed a novel Return-Oriented Programming (ROP) technique — defining a custom ActionScript3 class with 80 function arguments to store the ROP chain directly on the stack, evading detection mechanisms designed to flag stack pointer anomalies.
FireEye described APT3 as "one of the more sophisticated threat groups," noting a history of introducing new browser-based zero-day exploits across Internet Explorer, Firefox, and Adobe Flash Player.
Rapid Post-Exploitation
After successful exploitation, APT3 operators quickly dumped credentials, moved laterally to additional hosts, and installed custom backdoors. FireEye noted that the group's C2 infrastructure is particularly difficult to track due to minimal overlap across campaigns — a hallmark of operational security discipline. Adobe released an out-of-band patch for CVE-2015-3113 following FireEye's disclosure.