Operation WizardOpium

Known Names 1 entries

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Description

(Kaspersky) Kaspersky Exploit Prevention is a component part of Kaspersky products that has successfully detected a number of zero-day attacks in the past. Recently, it caught a new unknown exploit for Google’s Chrome browser. We promptly reported this to the Google Chrome security team. After reviewing of the PoC we provided, Google confirmed there was a zero-day vulnerability and assigned it CVE-2019-13720. We are calling these attacks Operation WizardOpium. So far, we have been unable to establish a definitive link with any known threat actors. There are certain very weak code similarities with {{Lazarus Group, Hidden Cobra, Labyrinth Chollima}} attacks, although these could very well be a false flag. The profile of the targeted website is more in line with earlier {{DarkHotel}} attacks that have recently deployed similar false flag attacks.

Reports & References 3