A recently announced and yet-to-be-patched vulnerability that affects all versions of Microsoft Internet Explorer (IE) has been exploited in targeted attacks against organizations in Taiwan since the beginning of July, according to security researchers.
Microsoft published a security advisory about the vulnerability, which is identified as CVE-2013-3893, on Sept. 17 and warned users that it is "aware of targeted attacks that attempt to exploit this vulnerability in Internet Explorer 8 and Internet Explorer 9.
The company released a Microsoft "Fix it" workaround that customers can manually download and install in order to mitigate the vulnerability. However, no patch has yet been released through Windows Update.
On Saturday, researchers from security firm FireEye reported that a known hacker group has been using the vulnerability to target organizations in Japan as part of an attack campaign dubbed "Operation DeputyDog" that started on Aug. 19.
They believe that this is the same group that managed to break into the computer network of security firm Bit9 as part of a different attack campaign in February and used one of its systems to digitally sign several pieces of malware.
More @ InfoWorld
Microsoft published a security advisory about the vulnerability, which is identified as CVE-2013-3893, on Sept. 17 and warned users that it is "aware of targeted attacks that attempt to exploit this vulnerability in Internet Explorer 8 and Internet Explorer 9.
The company released a Microsoft "Fix it" workaround that customers can manually download and install in order to mitigate the vulnerability. However, no patch has yet been released through Windows Update.
On Saturday, researchers from security firm FireEye reported that a known hacker group has been using the vulnerability to target organizations in Japan as part of an attack campaign dubbed "Operation DeputyDog" that started on Aug. 19.
They believe that this is the same group that managed to break into the computer network of security firm Bit9 as part of a different attack campaign in February and used one of its systems to digitally sign several pieces of malware.
More @ InfoWorld