A newly discovered security flaw in Adobe Flash allowed an apparent state actor to implant spyware on targets involved in Middle Eastern politics, according to a new report.
Cybersecurity firm Kaspersky Lab announced Monday it had discovered the spyware campaign and reported the new Flash vulnerability to Adobe, which released a patch on the bug earlier in the morning.
Kaspersky tied the attacks to the BlackOasis group, which various security companies have tracked over the past year.
{mosads}The Adobe Flash-based attack was embedded in Microsoft Office files and used to install the latest version of FinFisher spyware. FinFisher is a commercial product sold to governments for use in espionage and law enforcement.
Throughout their campaign, targets included United Nations figures, opposition bloggers, think tanks and others within the nations of Russia, Iraq, Afghanistan, Nigeria, Libya, Jordan, Tunisia, Saudi Arabia, Iran, Netherlands, Bahrain, the United Kingdom and Angola.
The malware-laced documents used a range of topics to trick victims into opening them, including files that appeared to be news stories or accounts from immigrants.