Yes, in fact I skipped to that section. It describes targeting, and then a vague mention of ad impressions leading to "connections" to a C2 server (but the simple fact of contacting a domain doesn't establish C2; anyone can send an AJAX request anywhere). Then they describe a "fingerprint" of servers which appears to consist of... HTTP responses with several blank fields and a claim of running on Apache. Then they say that they found a compromised DLL, which they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign.
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.
> No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
I completely and fundamentally disagree that there is such a robust attribution. I read the section thoroughly and my explanation is not at all oversimplified. Please cite the details that you believe to be relevant here.
> They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
This is not even remotely an explanation of what happened. Giving a name to a phenomenon does not explain it. This does not say how the COM hijack is effected; it does not say how any code escapes the browser sandbox at all; it does not point at a browser vulnerability. Even following through a link to their previous article, the only CVE citations they give are for local privilege escalations (which are described in a very generic way in the CVE database) which would still require a sandbox escape. And even then, it isn't necessarily relevant, as they merely claim "The functionality broadly overlaps with the functionality of the Candiru chain from our 2021 report."
Yes, in fact I skipped to that section. It describes targeting, and then a vague mention of ad impressions leading to "connections" to a C2 server (but the simple fact of contacting a domain doesn't establish C2; anyone can send an AJAX request anywhere). Then they describe a "fingerprint" of servers which appears to consist of... HTTP responses with several blank fields and a claim of running on Apache. Then they say that they found a compromised DLL, which they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign.
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.
> they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign
No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
> there is nothing explaining how the DLL becomes zero-click compromised [...]
They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
https://attack.mitre.org/techniques/T1546/015/
> No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
I completely and fundamentally disagree that there is such a robust attribution. I read the section thoroughly and my explanation is not at all oversimplified. Please cite the details that you believe to be relevant here.
> They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
This is not even remotely an explanation of what happened. Giving a name to a phenomenon does not explain it. This does not say how the COM hijack is effected; it does not say how any code escapes the browser sandbox at all; it does not point at a browser vulnerability. Even following through a link to their previous article, the only CVE citations they give are for local privilege escalations (which are described in a very generic way in the CVE database) which would still require a sandbox escape. And even then, it isn't necessarily relevant, as they merely claim "The functionality broadly overlaps with the functionality of the Candiru chain from our 2021 report."