Expack Continues Exploiting Java Vulnerability

This report examines an exploit kit observed at 174.142.240.91 that exploits CVE-2012-1723 in Java to load an obfuscated applet and download malicious JARs (MD5s provided), leading to a Trojan that communicates with a C2 and retrieves a ZeroAccess-like rootkit (6.exe). The write-up includes IOCs (IP, URLs, MD5 hashes), discusses the exploitation chain and obfuscation, and advises patching or disabling browser Java to mitigate the threat.