VERY IMPORTANT

Found to be exploited in two APT attacks earlier in December, a critical zero-day vulnerability in Adobe Flash Player (CVE-2018-15982) is still being used by attackers. The vulnerability is used to drop a payload embedded in Microsoft Word documents, to avoid anti-virus detection. The Word document with the zero-day Flash vulnerability payload compressed into a ZIP file with a JPG picture is sent to the victim. Once the word document is opened, the vulnerability is extracted and a shellcode from the JPG picture is executed.