Avast ties attacks on Chrome WebRTC bug CVE-2022-2294 to Candiru

Avast Threat Labs provides some context to the recently patched CVE-2022-2294 in Google Chrome. The vulnerability is a heap buffer overflow in WebRTC and was patched on 2022-07-04. Back then the bug details were still locked and nobody had named the attackers. The team observed exploitation attempts in watering hole attacks in the Middle East, most of them in Lebanon. Based on the TTPs the campaign is associated with Candiru. The threat actor was investigated by Citizen Lab and Microsoft in July 2021. After the disclosure the group lay low and updated its toolset. Since the bug sits in WebRTC itself, Chrome is not the only target: Apple fixed the same CVE in Safari 15.6 on 2022-07-20, crediting Jan Vojtesek of Avast.