PawnStorm (APT28: Russia) using new Java zero-day
The Russian PawnStorm cybergroup have been found to be using a hitherto unknown Java exploit. &nbsp;This is the first Java zero-day to have come to light in almost two years. &nbsp;PawnStorm's origins are still debated by some, but the fact that amongst its targets it a distinct interest for Russian dissident groups suggests a certain affinity with the Kremlin.
Another zero-day vulnerability is being exploited in attacks spotted in the wild: this time, the targeted software is Java.



The flaw was spotted by Trend Micro researchers, who are closely monitoring a targeted attack campaign mounted by the economic and political cyber-espionage operation Pawn Storm.



The existence of the flaw was discovered by finding suspicious URLs that hosted the exploit.



“The said URLs hosting the new Java zero-day exploit are similar to the URLs seen in the attack launched by the threat actors behind Pawn Storm that targeted North Atlantic Treaty Organization (NATO) members and White House last April 2015,” they explained.



In the current campaign, targets – a NATO member and a US defense organization – were directed towards these URLs via links in emails.



The exploit allows attackers to execute arbitrary code on target systems with default Java settings.



The flaw affects the latest Java version 1.8.0.45, but not older versions (v1.6 and 1.7). Oracle is working on a patch, but downgrading Java to one of the older versions is not a good idea because they are vulnerable to other attacks.



Disabling Java in your preferred browser is for now is a better option. Use a secondary browser with Java enabled to view sites you absolutely must visit and which require it.