Recently discovered to have been used to attack multiple government entities and institutions worldwide, MiniDuke is highly customized and very small in size, and was spotted being delivered to victims via malicious PDF documents rigged with exploits attacking Adobe Reader versions 9, 10, and 11, bypassing its sandbox.
But, as it turns out, this might not the only method by which it propagates.
While rifling through one of MiniDuke's C&C servers, the researchers have unearthed files that seem to have been prepared for infecting visitors using web-based vulnerabilities.
The exploit page serves either an exploit for the Java CVE-2013-0422 vulnerability or the IE8 CVE-2012-4792 flaw. Both exploits are very similar to the ones published in the Metasploit kit, and both deliver MiniDuke's main backdoor module that then fetches instructions from the same Twitter account.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.