Technical intelligence and weaponization dossier for CVE-2015-5119. Documented exploitation across 7 active malware families totaling 3,591 analyzed telemetry samples.
| Vulnerability ID | CVE-2015-5119 |
|---|---|
| Common Name / Bulletin | Adobe Flash Player ByteArray Use-After-Free (Hacking Team Leak) (APSB15-16) |
| CWE Classification | CWE-416: Use After Free in ActionScript Worker |
| Affected Software & Versions | Adobe Flash Player 18.0.0.194 and earlier |
| Technical Root Cause | Use-after-free in ValueOf operator override in ActionScript 3 ByteArray. Leaked from Hacking Team breach and integrated into exploit kits within 48 hours. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 7 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| kovter | Trojan | 2,414 | Kovter is an extraordinarily evasive, polymorphic malware strain first detected in 2013. Initially engineered as a screen-locking police-impersonation ransomwar... |
| nymaim | Downloader | 756 | Nymaim is a sophisticated dual-stage malware downloader and loader first observed in 2013. Designed with extreme resilience, Nymaim specialized in evading secur... |
| blackmoon | Banking Trojan | 228 | Trojan:Win32/Blackmoon (widely designated in cybersecurity research as KRBanker) is a destructive, regionally focused banking trojan that emerged in 2014, speci... |
| goznym | Banking Trojan | 120 | Trojan:Win32/Goznym is a devastating hybrid banking trojan created in early 2016 through the engineering merger of two notorious malware codebases: the Nymaim s... |
| vawtrak | Banking Trojan | 50 | Vawtrak (widely cataloged across international law enforcement and intelligence communities as Neverquest or Snifula) is one of the most damaging banking trojan... |
| troldesh | Ransomware | 14 | Troldesh (widely tracked across the intelligence community as Shade or Encrypter.JPHP) is a notorious Russian-speaking ransomware family first active in late 20... |
| teslacrypt | Ransomware | 9 | TeslaCrypt is a notorious ransomware family first detected in February 2015 that achieved widespread prominence by specifically targeting video gamers—encryptin... |
Threat intelligence confirms the following adversaries weaponize CVE-2015-5119 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2015-5119 in enterprise networks:
Network IDS alert for Hacking Team SWF exploit signature (ET EXPLOIT Adobe Flash Player Use-After-Free CVE-2015-5119).SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →