Hacking Group Targeted Microsoft's Windows, Adobe Flash

(RTTNews) - Microsoft Corp. (MSFT) said Tuesday that a computer-hacking group, which has previously targeted government agencies, attacked its Windows software and Adobe Systems Inc.'s Flash program.

The company will release a security patch for its operating system on November 8, Windows chief Terry Myerson said Tuesday in a blog post on Microsoft's website. Users of Microsoft's Edge browser on the latest update to Windows 10 are protected from the flaw.

The security exploit, by a group Microsoft calls Strontium, was discovered by Google's Threat Analysis Group and announced on Monday. The attacks, which sought to take control of a user's computer, took advantage of so-called zero-day flaws, or security holes that are unknown to the product's vendor and therefore no patch has yet been developed.

Microsoft noted that STRONTIUM is an activity group that usually targets government agencies, diplomatic institutions, and military organizations, as well as affiliated private sector organizations such as defense contractors and public policy research institutes. Microsoft has attributed more 0-day exploits to STRONTIUM than any other tracked group in 2016.

In a blog post on Monday, Google said it reported the issue to Adobe and Microsoft on October 21, and Adobe updated Flash five days later. The internet-search giant said its policy is to disclose actively exploited security vulnerabilities after seven days.

"Responsible technology industry participation puts the customer first, and requires coordinated vulnerability disclosure," Myerson wrote in the blog. "Google's decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk."