LightsOut EK Targets Energy Sector

A targeted watering-hole campaign in late February compromised a law firm site related to the energy sector and redirected visitors to the LightsOut exploit kit, which fingerprinted victims (browser/plugins) and attempted to deliver a malicious JAR exploiting CVE-2013-2465; research also links the attack infrastructure (e.g., IP 174.129.210.212, aptguide.3dtour.com) to HAVEX RAT C2 activity, signaling intelligence-gathering APT activity and advising monitoring of transaction logs for the attacker’s identifying user-agent patterns and redirects.