Invincea was the most aggressive in its claims. After noting that the infected Department of Labor website listed "nuclear-related illnesses linked to Energy facilities and toxicity levels at each location that might have sickened employees developing atomic weapons," it concluded that the real targets were Department of Energy employees or officials who worked in nuclear weapons programs for the agency.
A zero-day vulnerability in IE8 raised the stakes for all users of that browser, said Mitchell of Invincea, not only government workers who had been targeted. "With this exploit being out in the wild, the potential risk for damage is high," he wrote in the Friday blog, and recommended that users switch to an alternate browser, such as Google's Chrome or Mozilla's Firefox, until Microsoft delivers a patch.
The flaw could be used by other hackers to construct "drive-by" attacks, those triggered as soon as an unpatched browser visits a compromised website, to infect large numbers of PCs.
Meanwhile, Microsoft urged users of Vista and Windows 7 to upgrade from IE8 to IE9 and IE10, respectively. People running Windows XP -- the apparent target of the watering hole attacks -- have no such option, as neither IE9 or IE10 run on the 12-year-old operating system. The newest versions of Chrome and Firefox, however, do support Windows XP.
Customers can also deploy the Enhanced Mitigation Experience Toolkit (EMET), to lock down IE8, making exploits more difficult for hackers. EMET 3.0 or the beta of EMET 4.0 can be downloaded from Microsoft's website.
While it's possible that Microsoft will craft a patch for the vulnerability in time to include it in the scheduled May 14 updates, it's more likely the company will issue a fix outside of that schedule, as it did in January. Then, Microsoft took 16 days from issuing an advisory to patching IE. If it followed the same timetable with the newest flaw, it would ship a fix after this month's Patch Tuesday.
Microsoft credited researchers at FireEye and iSIGHT Partners, a Dallas, Texas security firm, with reporting the IE8 zero-day. iSIGHT Partners, like Invincea, supplies government agencies with security software.
Sign up for CIO Asia eNewsletters.