CVE-2017-8759
published 2017-09-13CVE-2017-8759: Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application…
PriorityP185high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
88.70%
99.8th percentile
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft_corporation | microsoft_net_framework | — | — |
| msrc | microsoft_net_framework_2.0_service_pack_2 | — | — |
| msrc | microsoft_net_framework_3.5 | — | — |
| msrc | microsoft_net_framework_3.5.1 | — | — |
| msrc | microsoft_net_framework_4.5.2 | — | — |
| msrc | microsoft_net_framework_4.6 | — | — |
| msrc | microsoft_net_framework_4.6.1 | — | — |
| msrc | microsoft_net_framework_4.6.2_4.7 | — | — |
| msrc | microsoft_net_framework_4.6_4.6.1_4.6.2_4.7 | — | — |
| msrc | microsoft_net_framework_4.7 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2017-8759 exploitation involves embedding a SOAP moniker in an RTF file that retrieves a malicious SOAP WSDL definition (XML file) from a remote server; the XML content is parsed and compiled by .NET Framework, which Microsoft Office then loads as a library. ↗
- →ANEL malware (delivered via CVE-2017-8759) uses DLL side-loading: legitimate accevent.exe loads a malicious event.dll from the same directory, which then decrypts and loads ssssss.ddd (lena_http.bin). Monitor for accevent.exe loading non-standard DLLs. ↗
- →ANEL C2 communications use blowfish, XOR, and Base64 encryption; network traffic analysis should look for Base64-encoded blobs in HTTP POST requests to C2 servers associated with ANEL. ↗
- →Cobalt Group's macro-based infection chain uses odbcconf.exe to execute a dropped DLL and regsvr32.exe to execute SCT/JScript files; monitor for these LOLBin invocations with unusual arguments. ↗
- →Fortinet IPS signature 'MS.DotNET.Framework.SOAP.Remote.Code.Execution' directly covers CVE-2017-8759 exploitation attempts. ↗
- ·The MD5 hash for the CVE-2017-8759 RTF attachment (eb4325ef1cbfba85b35eec3204e7f79) appears truncated (31 hex chars instead of 32); verify against authoritative sources before using for detection. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft .NET Framework Remote Code Execution Vulnerability
cisa·2021-11-03·CVSS 7.8
CVE-2017-8759 [HIGH] CWE-20 Microsoft .NET Framework Remote Code Execution Vulnerability
Vulnerability: Microsoft .NET Framework Remote Code Execution Vulnerability
Affected: Microsoft .NET Framework
Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-8759
Remediation Due Date: 2022-05-03
Microsoft
.NET Framework Remote Code Execution Vulnerability
vendor_msrc·2017-09-12·CVSS 7.8
CVE-2017-8759 [HIGH] .NET Framework Remote Code Execution Vulnerability
.NET Framework Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input. An attacker who successfully exploited this vulnerability in software using the .NET framework could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
To exploit the vulnerability, an attacker would first need to convince the user to open a malicious document or application.
The security update addresses the vulnerability by correcting how .NET validates untrusted input.
GHSA
GHSA-rc4w-p9f6-7c7q: Microsoft
ghsa_unreviewed·2022-05-14
CVE-2017-8759 [HIGH] CWE-20 GHSA-rc4w-p9f6-7c7q: Microsoft
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."
VulnCheck
Microsoft .NET Framework Remote Code Execution Vulnerability
vulncheck·2017·CVSS 7.8
CVE-2017-8759 [HIGH] CWE-20 Microsoft .NET Framework Remote Code Execution Vulnerability
Microsoft .NET Framework Remote Code Execution Vulnerability
Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.
Affected: Microsoft .NET Framework
Required Action: Apply updates per vendor instructions.
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2017-Sep; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html; https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/; https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defens
Suricata
ET EXPLOIT Possible CVE-2017-8759 Soap File DL Over FTP
suricata·2017-09-20·CVSS 7.8
CVE-2017-8759 [HIGH] ET EXPLOIT Possible CVE-2017-8759 Soap File DL Over FTP
ET EXPLOIT Possible CVE-2017-8759 Soap File DL Over FTP
Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2017-8759 Soap File DL Over FTP"; flow:established,to_client; content:"process.start"; nocase; fast_pattern; content:").)+?]+location=\s*[\x22\x27](?:(?!).)+?]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start/Rsi"; classtype:attempted-admin; sid:2024729; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_09_20, cve CVE_2017_8759, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Critical, tag CISA_KEV, updated_at 2024_03_07;)
Suricata
ET EXPLOIT Possible CVE-2017-8759 Soap File DL
suricata·2017-09-13·CVSS 7.8
CVE-2017-8759 [HIGH] ET EXPLOIT Possible CVE-2017-8759 Soap File DL
ET EXPLOIT Possible CVE-2017-8759 Soap File DL
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2017-8759 Soap File DL"; flow:established,to_client; file.data; content:"process.start"; nocase; fast_pattern; content:").)+?]+location=\s*[\x22\x27](?:(?!).)+?]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start/Rsi"; classtype:attempted-admin; sid:2024702; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2017_09_13, cve CVE_2017_8759, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_03_14;)
YARA
CVE_2017_8759_SOAP_txt
yara·CVSS 7.8
CVE-2017-8759 [HIGH] CVE_2017_8759_SOAP_txt
rule CVE_2017_8759_SOAP_txt {
meta:
description = "Detects malicious file in releation with CVE-2017-8759 - file exploit.txt"
author = "Florian Roth"
reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
date = "2017-09-14"
hash1 = "840ad14e29144be06722aff4cc04b377364eeed0a82b49cc30712823838e2444"
strings:
$s1 = /<soap:address location="http[s]?:\/\/[^"]{8,140}.hta"/ ascii wide
$s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide
condition:
( filesize < 200KB and 1 of them )
}
YARA
CVE_2017_8759_Mal_Doc
yara·CVSS 7.8
CVE-2017-8759 [HIGH] CVE_2017_8759_Mal_Doc
rule CVE_2017_8759_Mal_Doc {
meta:
description = "Detects malicious files related to CVE-2017-8759 - file Doc1.doc"
author = "Florian Roth"
reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
date = "2017-09-14"
hash1 = "6314c5696af4c4b24c3a92b0e92a064aaf04fd56673e830f4d339b8805cc9635"
strings:
$s1 = "soap:wsdl=http://" ascii wide nocase
$s2 = "soap:wsdl=https://" ascii wide nocase
$c1 = "Project.ThisDocument.AutoOpen" fullword wide
condition:
( uint16(0) == 0xcfd0 and filesize < 500KB and 2 of them )
}
YARA
CVE_2017_8759_SOAP_Excel
yara·CVSS 7.8
CVE-2017-8759 [HIGH] CVE_2017_8759_SOAP_Excel
rule CVE_2017_8759_SOAP_Excel {
meta:
description = "Detects malicious files related to CVE-2017-8759"
author = "Florian Roth"
reference = "https://twitter.com/buffaloverflow/status/908455053345869825"
date = "2017-09-15"
strings:
$s1 = "|'soap:wsdl=" ascii wide nocase
condition:
( filesize < 300KB and 1 of them )
}
YARA
CVE_2017_8759_WSDL_in_RTF
yara·CVSS 7.8
CVE-2017-8759 [HIGH] CVE_2017_8759_WSDL_in_RTF
rule CVE_2017_8759_WSDL_in_RTF {
meta:
description = "Detects malicious RTF file related CVE-2017-8759"
author = "Security Doggo @xdxdxdxdoa"
reference = "https://twitter.com/xdxdxdxdoa/status/908665278199996416"
date = "2017-09-15"
strings:
$doc = "d0cf11e0a1b11ae1"
$obj = "\\objupdate"
$wsdl = "7700730064006c003d00" nocase
$http1 = "68007400740070003a002f002f00" nocase
$http2 = "680074007400700073003a002f002f00" nocase
$http3 = "6600740070003a002f002f00" nocase
condition:
RTFFILE and $obj and $doc and $wsdl and 1 of ($http*)
}
YARA
CVE_2017_8759_Mal_HTA
yara·CVSS 7.8
CVE-2017-8759 [HIGH] CVE_2017_8759_Mal_HTA
rule CVE_2017_8759_Mal_HTA {
meta:
description = "Detects malicious files related to CVE-2017-8759 - file cmd.hta"
author = "Florian Roth"
reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
date = "2017-09-14"
hash1 = "fee2ab286eb542c08fdfef29fabf7796a0a91083a0ee29ebae219168528294b5"
strings:
$x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii
condition:
( uint16(0) == 0x683c and filesize < 1KB and all of them )
}
YARA
CVE_2017_8759_SOAP_via_JS
yara
CVE_2017_8759_SOAP_via_JS
rule CVE_2017_8759_SOAP_via_JS {
meta:
description = "Detects SOAP WDSL Download via JavaScript"
author = "Florian Roth"
reference = "https://twitter.com/buffaloverflow/status/907728364278087680"
date = "2017-09-14"
score = 60
strings:
$s1 = "GetObject(\"soap:wsdl=https://" ascii wide nocase
$s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase
condition:
( filesize < 3KB and 1 of them )
}
Tenable
Cybersecurity Snapshot: 6 Things That Matter Right Now
blogs_tenable·2022-08-19
Cybersecurity Snapshot: 6 Things That Matter Right Now
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Analyzing the Vulnerabilities Associated with the Top Malware Strains of 2021
blogs_tenable·2022-08-04
Analyzing the Vulnerabilities Associated with the Top Malware Strains of 2021
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Tenable
Daisy Chaining: How Vulnerabilities Can Be Greater Than the Sum of Their Parts
blogs_tenable·2021-01-21
Daisy Chaining: How Vulnerabilities Can Be Greater Than the Sum of Their Parts
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Securelist
IT threat evolution Q2 2020. PC statistics
blogs_securelist·2020-09-03
IT threat evolution Q2 2020. PC statistics
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by cybercriminals during cyberattacks
- Attacks on Apple macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- Victor Chebyshev
- Evgeny Lopatin
- Fedor Sinitsyn
- Denis Parinov
- Oleg Kupreev
- Alexey Kulaev
- Alexander Kolesnikov
IT threat evolution Q2 2020. Review
IT threat evolution Q2 2020. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q2:
- Kaspersky solutions blocked 899,744,810 attacks launched from online resources in 191 countries across the globe.
- As many as 286,
Securelist
IT threat evolution Q2 2020. PC statistics
blogs_securelist·2020-09-03
IT threat evolution Q2 2020. PC statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Ransomware programs
Quarterly trend highlights
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacks
Top 10 most common families of ransomware Trojans
Miners
Number of new modifications
Number of users attacked by miners
Geography of attacks
Vulnerable applications used by cybercriminals during cyberattacks
Attacks on Apple macOS
Threat geography
IoT attacks
IoT threat statistics
Threats loaded into traps
Attacks via web resources
Countries that are sources of web-based attacks: TOP 10
Countries where users faced the greatest risk of online infection
Local threats
Countries where users faced the highest risk of local infection
Authors
Victor
Unit42
The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
blogs_unit42·2020-08-26
The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
Threat Research Center
Threat Research
Vulnerabilities
## The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
Jay Chen
Published: August 26, 2020
Threat Research
Vulnerabilities
Exploit
## Executive Summary
With the ever-increasing number of new vulnerabilities, vulnerability management becomes one of the most critical processes in ensuring continuous business operation. While it is clear that timely patching is essential, it’s also important to know quantitatively how a delay could increase risk. What is the chance that attackers breach my organization using a CVE just disclosed or using an unknown (zero-day) vulnerability? To understand the state of vulnerability disclosure and exploit development, Unit 42 researchers analyzed 45,450 publicly availabl
Unit42
The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
blogs_unit42·2020-08-26
The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
## Executive Summary
With the ever-increasing number of new vulnerabilities, vulnerability management becomes one of the most critical processes in ensuring continuous business operation. While it is clear that timely patching is essential, it’s also important to know quantitatively how a delay could increase risk. What is the chance that attackers breach my organization using a CVE just disclosed or using an unknown (zero-day) vulnerability? To understand the state of vulnerability disclosure and exploit development, Unit 42 researchers analyzed 45,450 publicly available exploits in Exploit Database at the time of this writing. The research correlated the exploit data with vulnerability and patch information to study exploit development in multiple facets.
The research reveals that:
-
Qualys
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
blogs_qualys·2019-12-27·CVSS 8.8
[HIGH] Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
A recent report identified 19+ vulnerabilities that should be mitigated by end of year 2019. These are a range of top vulnerabilities attacked and leveraged by Advance Persistent Threat (APT) actors from all parts of the world.
The list below shows those top 19 vulnerabilities, and it should be no surprise that you can easily track and remediate them via a dashboard within Qualys. Import the dashboard into your subscription for easy insight into what assets and vulnerabilities in your organization are at risk.
No.
CVE
Products Affected by CVE
CVSS Score (NVD)
Examples of Threat Actors
1
CVE-2017-11882
Microsoft Office
7.8
APT32 (Vietnam), APT34 (Iran), APT40 (China), APT-C-35 (India), Cobalt Group (Spain, Ukraine), Silent Group (Russia), Lotus Blossom (China), FIN7 (Russia)
2
Qualys
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking | Qualys
blogs_qualys·2019-12-27·CVSS 8.8
[HIGH] Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking | Qualys
A recent report identified 19+ vulnerabilities that should be mitigated by end of year 2019. These are a range of top vulnerabilities attacked and leveraged by Advance Persistent Threat (APT) actors from all parts of the world.
The list below shows those top 19 vulnerabilities, and it should be no surprise that you can easily track and remediate them via a dashboard within Qualys. Import the dashboard into your subscription for easy insight into what assets and vulnerabilities in your organization are at risk.
No.
CVE
Products Affected by CVE
CVSS Score (NVD)
Examples of Threat Actors
1
CVE-2017-11882
Microsoft Office
7.8
APT32 (Vietnam), APT34 (Iran), APT40 (China), APT-C-35 (India), Cobalt Group (Spain, Ukraine), Silent Group (Russia), Lotus Blossom (China), FIN7 (Russia)
2
CVE-2018-
Securelist
IT threat evolution Q2 2019. Statistics
blogs_securelist·2019-08-19
IT threat evolution Q2 2019. Statistics
Table of Contents
- Quarterly figures
- Mobile threats
- Attacks on Apple macOS
- IoT attacks
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by cybercriminals during cyber attacks
Authors
- Victor Chebyshev
- Fedor Sinitsyn
- Denis Parinov
- Boris Larin
- Oleg Kupreev
- Evgeny Lopatin
These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
## Quarterly figures
According to Kaspersky Security Network,
- Kaspersky solutions blocked 717,057,912 attacks launched from online resources in 203 countries across the globe.
- 217,843,293 unique URLs triggered Web Anti-Virus components.
- Attempted infections by malware designed to steal money via online access to bank accounts were
Talos
SWEED: Exposing years of Agent Tesla campaigns
blogs_talos·2019-07-15
SWEED: Exposing years of Agent Tesla campaigns
By Edmund Brumaghin and other Cisco Talos researchers.
## Executive summary
Cisco Talos recently identified a large number of ongoing malware distribution campaigns linked to a threat actor we're calling "SWEED," including such notable malware as Formbook, Lokibot and Agent Tesla. Based on our research, SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans.
SWEED remains consistent across most of their campaigns in their use of spear-phishing emails with malicious attachments. While these campaigns have featured a myriad of different types of malicious documents, the actor primarily tries to infect its victims with a packed version of Agent Tesla — an information stealer that's been around since at least 2014. The
Talos
SWEED: Exposing years of Agent Tesla campaigns
blogs_talos·2019-07-15
SWEED: Exposing years of Agent Tesla campaigns
## SWEED: Exposing years of Agent Tesla campaigns
By Edmund Brumaghin and other Cisco Talos researchers.
## Executive summary
Cisco Talos recently identified a large number of ongoing malware distribution campaigns linked to a threat actor we're calling "SWEED," including such notable malware as Formbook, Lokibot and Agent Tesla. Based on our research, SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans. SWEED remains consistent across most of their campaigns in their use of spear-phishing emails with malicious attachments. While these campaigns have featured a myriad of different types of malicious documents, the actor primarily tries to infect its victims with a packed version of Agent Tesla — an information st
Securelist
IT threat evolution Q1 2019. Statistics
blogs_securelist·2019-05-23
IT threat evolution Q1 2019. Statistics
Table of Contents
- Quarterly figures
- Mobile threats
- Attacks on Apple macOS
- IoT attacks
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by cybercriminals
- Attacks via web resources
- Local threats
Authors
- Victor Chebyshev
- Fedor Sinitsyn
- Denis Parinov
- Boris Larin
- Oleg Kupreev
- Evgeny Lopatin
These statistics are based on detection verdicts of Kaspersky Lab products received from users who consented to provide statistical data.
## Quarterly figures
According to Kaspersky Security Network,
- Kaspersky Lab solutions blocked 843,096,461 attacks launched from online resources in 203 countries across the globe.
- 113,640,221 unique URLs were recognized as malicious by Web Anti-Virus components.
- Attempted infections by malware designed t
Securelist
IT threat evolution Q1 2018. Statistics
blogs_securelist·2018-05-14
IT threat evolution Q1 2018. Statistics
Table of Contents
Q1 figures
Mobile threats
Q1 events
Mobile threat statistics
Distribution of detected mobile apps by type
TOP 20 mobile malware
Geography of mobile threats
Mobile banking Trojans
Mobile ransomware Trojans
Vulnerable apps used by cybercriminals
Malicious programs online (attacks via web resources)
Online threats in the financial sector
Q1 events
Financial threat statistics
Geography of attacks
TOP 10 banking malware families
Cryptoware programs
Q1 events
Number of new modifications
Number of users attacked by Trojan cryptors
Geography of attacks
Countries that are sources of web-based attacks: TOP 10
Countries where users faced the greatest risk of online infection
Local threats
Authors
Victor Chebyshev
Fedor Sinitsyn
Denis Parinov
Alexander Li
Securelist
IT threat evolution Q1 2018. Statistics
blogs_securelist·2018-05-14
IT threat evolution Q1 2018. Statistics
Table of Contents
- Q1 figures
- Mobile threats
- Vulnerable apps used by cybercriminals
- Malicious programs online (attacks via web resources)
- Local threats
Authors
- Victor Chebyshev
- Fedor Sinitsyn
- Denis Parinov
- Alexander Liskin
- Oleg Kupreev
## Q1 figures
According to KSN:
- Kaspersky Lab solutions blocked 796,806,112 attacks launched from online resources located in 194 countries across the globe.
- 282,807,433 unique URLs were recognized as malicious by Web Anti-Virus components.
- Attempted infections by malware designed to steal money via online access to bank accounts were logged on the computers of 204,448 users.
- Ransomware attacks were registered on the computers of 179,934 unique users.
- Our File Anti-Virus logged 187,597,494 unique malicious and potentially
Securelist
The King is dead. Long live the King!
blogs_securelist·2018-05-09·CVSS 7.5
CVE-2018-8174 [HIGH] The King is dead. Long live the King!
Authors
- Vladislav Stolyarov
- Boris Larin
- Anton Ivanov
## Root cause analysis of the latest Internet Explorer zero day – CVE-2018-8174
In late April 2018, a new zero-day vulnerability for Internet Explorer (IE) was found using our sandbox; more than two years since the last in the wild example (CVE-2016-0189). This particular vulnerability and subsequent exploit are interesting for many reasons. The following article will examine the core reasons behind the latest vulnerability, CVE-2018-8174.
### Searching for the zero day
Our story begins on VirusTotal (VT), where someone uploaded an interesting exploit on April 18, 2018. This exploit was detected by several AV vendors including Kaspersky, specifically by our generic heuristic logic for some older Microsoft Word exploits.
After
Securelist
The King is dead. Long live the King!
blogs_securelist·2018-05-09·CVSS 7.5
CVE-2018-8174 [HIGH] The King is dead. Long live the King!
Authors
Vladislav Stolyarov
Boris Larin
Anton Ivanov
## Root cause analysis of the latest Internet Explorer zero day – CVE-2018-8174
In late April 2018, a new zero-day vulnerability for Internet Explorer (IE) was found using our sandbox; more than two years since the last in the wild example (CVE-2016-0189). This particular vulnerability and subsequent exploit are interesting for many reasons. The following article will examine the core reasons behind the latest vulnerability, CVE-2018-8174.
## Searching for the zero day
Our story begins on VirusTotal (VT), where someone uploaded an interesting exploit on April 18, 2018. This exploit was detected by several AV vendors including Kaspersky, specifically by our generic heuristic logic for some older Microsoft Word exploits.
After the
Trendmicro
ChessMaster Adds Updated Tools to Its Arsenal
blogs_trendmicro·2018-03-29·CVSS 7.8
[HIGH] ChessMaster Adds Updated Tools to Its Arsenal
APT und gezielte Angriffe
## ChessMaster Adds Updated Tools to Its Arsenal
In this blog post, we analyze ChessMaster's current status, including the updated tools in its arsenal — with a particular focus on the evolution of ANEL and how it is used in the campaign.
By: Tamada Kiyotaka, MingYen Hsieh Mar 29, 2018 Read time: ( words)
Save to Folio
Trend Micro discovered the ChessMaster campaign back in July 2017 as part of our monitoring efforts to protect our customers. At the time, we found ChessMaster targeting different sectors from the academe to media and government agencies in Japan. The threat group used a variety of attack tools and techniques to spy on their target organizations.
Back then, we noted that ChessMaster's sophisticated nature implied that the campaign could evolve
Trendmicro
ChessMaster Adds Updated Tools to Its Arsenal
blogs_trendmicro·2018-03-29·CVSS 7.8
[HIGH] ChessMaster Adds Updated Tools to Its Arsenal
APT & Targeted Attacks
## ChessMaster Adds Updated Tools to Its Arsenal
In this blog post, we analyze ChessMaster's current status, including the updated tools in its arsenal — with a particular focus on the evolution of ANEL and how it is used in the campaign.
By: Tamada Kiyotaka, MingYen Hsieh 2018/03/29 Read time: ( words)
Save to Folio
Trend Micro discovered the ChessMaster campaign back in July 2017 as part of our monitoring efforts to protect our customers. At the time, we found ChessMaster targeting different sectors from the academe to media and government agencies in Japan. The threat group used a variety of attack tools and techniques to spy on their target organizations.
Back then, we noted that ChessMaster's sophisticated nature implied that the campaign could evolve, bef
Trendmicro
ChessMaster Adds Updated Tools to Its Arsenal
blogs_trendmicro·2018-03-29·CVSS 7.8
[HIGH] ChessMaster Adds Updated Tools to Its Arsenal
APT & Targeted Attacks
# ChessMaster Adds Updated Tools to Its Arsenal
In this blog post, we analyze ChessMaster's current status, including the updated tools in its arsenal — with a particular focus on the evolution of ANEL and how it is used in the campaign.
By: Tamada Kiyotaka, MingYen Hsieh
2018/03/29
Read time: ( words)
Save to Folio
Trend Micro discovered the ChessMaster campaign back in July 2017 as part of our monitoring efforts to protect our customers. At the time, we found ChessMaster targeting different sectors from the academe to media and government agencies in Japan. The threat group used a variety of attack tools and techniques to spy on their target organizations.
Back then, we noted that ChessMaster's sophisticated nature implied that the campaign could evolve, bef
Trendmicro
ChessMaster Adds Updated Tools to Its Arsenal
blogs_trendmicro·2018-03-29·CVSS 7.8
[HIGH] ChessMaster Adds Updated Tools to Its Arsenal
APT y ataques dirigidos
## ChessMaster Adds Updated Tools to Its Arsenal
In this blog post, we analyze ChessMaster's current status, including the updated tools in its arsenal — with a particular focus on the evolution of ANEL and how it is used in the campaign.
By: Tamada Kiyotaka, MingYen Hsieh Mar 29, 2018 Read time: ( words)
Save to Folio
Trend Micro discovered the ChessMaster campaign back in July 2017 as part of our monitoring efforts to protect our customers. At the time, we found ChessMaster targeting different sectors from the academe to media and government agencies in Japan. The threat group used a variety of attack tools and techniques to spy on their target organizations.
Back then, we noted that ChessMaster's sophisticated nature implied that the campaign could evolve,
Trendmicro
ChessMaster Adds Updated Tools to Its Arsenal
blogs_trendmicro·2018-03-29·CVSS 7.8
[HIGH] ChessMaster Adds Updated Tools to Its Arsenal
APT & Targeted Attacks
## ChessMaster Adds Updated Tools to Its Arsenal
In this blog post, we analyze ChessMaster's current status, including the updated tools in its arsenal — with a particular focus on the evolution of ANEL and how it is used in the campaign.
By: Tamada Kiyotaka, MingYen Hsieh Mar 29, 2018 Read time: ( words)
Save to Folio
Trend Micro discovered the ChessMaster campaign back in July 2017 as part of our monitoring efforts to protect our customers. At the time, we found ChessMaster targeting different sectors from the academe to media and government agencies in Japan. The threat group used a variety of attack tools and techniques to spy on their target organizations.
Back then, we noted that ChessMaster's sophisticated nature implied that the campaign could evolve, b
Securelist
Threat Landscape for Industrial Automation Systems in H2 2017
blogs_securelist·2018-03-26
Threat Landscape for Industrial Automation Systems in H2 2017
Table of Contents
Overview of ICS vulnerabilities identified in 2017
Vulnerabilities in various ICS components
Number of vulnerabilities identified
Analysis by Industry
Severity levels of the vulnerabilities identified
Types of vulnerabilities identified
Vulnerable ICS components
Vulnerabilities in industrial protocols
Impact of vulnerabilities in ‘traditional’ technologies on industrial systems
IoT device vulnerabilities
Vulnerabilities identified by Kaspersky Lab ICS CERT
Number of vulnerabilities identified
Number of CVE entries published
Capabilities provided by the vulnerabilities identified
Vulnerabilities in ICS components
Severity ratings of the vulnerabilities identified
Vulnerabilities in OPC UA implementations
Vulnerabilities in third-party hardware-based and s
Securelist
Threat Landscape for Industrial Automation Systems in H2 2017
blogs_securelist·2018-03-26
Threat Landscape for Industrial Automation Systems in H2 2017
Table of Contents
- Overview of ICS vulnerabilities identified in 2017
- Vulnerabilities identified by Kaspersky Lab ICS CERT
- Malware in industrial automation systems
- Threat statistics
- Our recommendations
Authors
- Kaspersky ICS CERT
For many years, Kaspersky Lab experts have been uncovering and researching cyberthreats that target a variety of information systems – those of commercial and government organizations, banks, telecoms operators, industrial enterprises, and individual users. In this report, Kaspersky Lab Industrial Control Systems Cyber Emergency Response Team (Kaspersky Lab ICS CERT) publishes the findings of its research on the threat landscape for industrial automation systems conducted during the second half of 2017.
The main objective of these publications is t
Talos
Threat Round Up for December 29 - January 5
blogs_talos·2018-01-05·CVSS 7.8
[HIGH] Threat Round Up for December 29 - January 5
## Threat Round Up for December 29 - January 5
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between December 29 and January 05. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.
Talos
Threat Round Up for December 29 - January 5
blogs_talos·2018-01-05·CVSS 7.8
[HIGH] Threat Round Up for December 29 - January 5
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between December 29 and January 05. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
The most prevalent threats
Trendmicro
Cobalt Strikes Again, Spam Runs Target Russian Banks
blogs_trendmicro·2017-11-20·CVSS 7.8
[HIGH] Cobalt Strikes Again, Spam Runs Target Russian Banks
Spam
## Cobalt Strikes Again, Spam Runs Target Russian Banks
Backdoor-laden spam mail we saw targeting Russian-speaking businesses were apparently part of bigger campaigns. The culprit appears to be the Cobalt group. In recent campaigns, Cobalt used social engineering hooks designed to target bank employees.
By: Ronnie Giagone, Lenart Bermejo, Fyodor Yarochkin Nov 20, 2017 Read time: ( words)
Save to Folio
The waves of backdoor-laden spam emails we observed during June and July that targeted Russian-speaking businesses were part of bigger campaigns. The culprit appears to be the Cobalt hacking group, based on the techniques used. In their recent campaigns, Cobalt used two different infection chains, with social engineering hooks that were designed to invoke a sense of urgency in its r
Trendmicro
Cobalt Strikes Again, Spam Runs Target Russian Banks
blogs_trendmicro·2017-11-20·CVSS 7.8
CVE-2017-8759 [HIGH] Cobalt Strikes Again, Spam Runs Target Russian Banks
Spam
# Cobalt Strikes Again, Spam Runs Target Russian Banks
Backdoor-laden spam mail we saw targeting Russian-speaking businesses were apparently part of bigger campaigns. The culprit appears to be the Cobalt group. In recent campaigns, Cobalt used social engineering hooks designed to target bank employees.
By: Ronnie Giagone, Lenart Bermejo, Fyodor Yarochkin
2017/11/20
Read time: ( words)
Save to Folio
The waves of backdoor-laden spam emails we observed during June and July that targeted Russian-speaking businesses were part of bigger campaigns. The culprit appears to be the Cobalt hacking group, based on the techniques used. In their recent campaigns, Cobalt used two different infection chains, with social engineering hooks that were designed to invoke a sense of urgency in its rec
Trendmicro
Cobalt Strikes Again, Spam Runs Target Russian Banks
blogs_trendmicro·2017-11-20·CVSS 7.8
[HIGH] Cobalt Strikes Again, Spam Runs Target Russian Banks
Spam
## Cobalt Strikes Again, Spam Runs Target Russian Banks
Backdoor-laden spam mail we saw targeting Russian-speaking businesses were apparently part of bigger campaigns. The culprit appears to be the Cobalt group. In recent campaigns, Cobalt used social engineering hooks designed to target bank employees.
By: Ronnie Giagone, Lenart Bermejo, Fyodor Yarochkin 2017/11/20 Read time: ( words)
Save to Folio
The waves of backdoor-laden spam emails we observed during June and July that targeted Russian-speaking businesses were part of bigger campaigns. The culprit appears to be the Cobalt hacking group, based on the techniques used. In their recent campaigns, Cobalt used two different infection chains, with social engineering hooks that were designed to invoke a sense of urgency in its rec
Fortinet
Cybercriminals Exploiting Microsoft’s Vulnerable Dynamic Data Exchange Protocol
blogs_fortinet·2017-11-17·CVSS 8.8
[HIGH] Cybercriminals Exploiting Microsoft’s Vulnerable Dynamic Data Exchange Protocol
FORTIGUARD LABS THREAT RESEARCH
Cybercriminals Exploiting Microsoft’s Vulnerable Dynamic Data Exchange Protocol
By FortiGuard SE Team | November 17, 2017
Visa Payment Systems Intelligence recently announced that cybercriminals are threatening the payments ecosystem by leveraging a vulnerable Microsoft Dynamic Data Exchange protocol in phishing campaigns. This phishing attack relies on the Dynamic Data Exchange (DDE) protocol for infection instead of the usual malicious macros or an exploit kit.
This exploit is related to the Microsoft Security Advisory 4053440 issued on November 8, 2017. It provides guidance on securing Microsoft applications when processing Dynamic Data Exchange (DDE) fields. The DDE protocol enables messages to be sent between Microsoft applications and uses shared da
Securelist
IT threat evolution Q3 2017. Statistics
blogs_securelist·2017-11-10
IT threat evolution Q3 2017. Statistics
Table of Contents
Q3 figures
Mobile threats
Q3 events
The spread of the Asacub banker
New capabilities of mobile banking Trojans
The growth of WAP billing subscriptions
Mobile threat statistics
Distribution of mobile malware by type
TOP 20 mobile malware programs
The geography of mobile threats
Mobile banking Trojans
Mobile ransomware
Vulnerable apps exploited by cybercriminals
Online threats (Web-based attacks)
Online threats in the banking sector
Geography of attacks
TOP 10 banking malware families
Cryptoware programs
Q3 highlights
Crysis rises from the dead
Surge in Cryrar attacks
Master key to original versions of Petya/Mischa/GoldenEye published
The number of new modifications
The number of users attacked by ransomware
The geography of attacks
Top 10 countrie
Securelist
IT threat evolution Q3 2017. Statistics
blogs_securelist·2017-11-10
IT threat evolution Q3 2017. Statistics
Table of Contents
- Q3 figures
- Mobile threats
- Vulnerable apps exploited by cybercriminals
- Online threats (Web-based attacks)
- Local threats
Authors
- Roman Unuchek
- Fedor Sinitsyn
- Denis Parinov
- Alexander Liskin
## Q3 figures
According to KSN data, Kaspersky Lab solutions detected and repelled 277,646,376 malicious attacks from online resources located in 185 countries all over the world.
72,012,219 unique URLs were recognized as malicious by web antivirus components.
Attempted infections by malware that aims to steal money via online access to bank accounts were registered on 204,388 user computers.
Crypto ransomware attacks were blocked on 186283 computers of unique users.
Kaspersky Lab’s file antivirus detected a total of 198,228,428 unique malicious and potentially
Securelist
BlackOasis APT and new targeted attacks leveraging zero-day exploit
blogs_securelist·2017-10-16·CVSS 9.8
CVE-2017-11292 [CRITICAL] BlackOasis APT and new targeted attacks leveraging zero-day exploit
Table of Contents
- Introduction
- BlackOasis Background
- Attacks Leveraging CVE-2017-11292
- Targeting and Victims
- Conclusions
- Acknowledgements
- References
- Indicators of compromise
Authors
- GReAT
More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service. Contact: [email protected]
## Introduction
Kaspersky Lab has always worked closely with vendors to protect users. As soon as we find new vulnerabilities we immediately inform the vendor in a responsible manner and provide all the details required for a fix.
On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers. The exploit was delivered through a Microsoft Offic
Securelist
BlackOasis APT and new targeted attacks leveraging zero-day exploit
blogs_securelist·2017-10-16·CVSS 9.8
CVE-2017-11292 [CRITICAL] BlackOasis APT and new targeted attacks leveraging zero-day exploit
Table of Contents
Introduction
BlackOasis Background
Attacks Leveraging CVE-2017-11292
Payload – mo.exe
Targeting and Victims
Conclusions
Acknowledgements
References
Indicators of compromise
Authors
GReAT
More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service. Contact: [email protected]
## Introduction
Kaspersky Lab has always worked closely with vendors to protect users. As soon as we find new vulnerabilities we immediately inform the vendor in a responsible manner and provide all the details required for a fix.
On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers. The exploit was delivered through a Microsoft
Trendmicro
September Patch Tuesday Fixes MS Office Zero-Day
blogs_trendmicro·2017-09-13·CVSS 6.8
[MEDIUM] September Patch Tuesday Fixes MS Office Zero-Day
## September Patch Tuesday Fixes MS Office Zero-Day
Microsoft has released their monthly security bulletin for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word to potentially allow attackers to execute code on the target system remotely.
By: Ronaldo Mangahas Sep 13, 2017 Read time: ( words)
Save to Folio
Microsoft has released their monthly security bulletin—colloquially known as Patch Tuesday—for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word . CVE-2017-8759 is a .NET Framework Remote Code Execution Vulnerability that allows attackers to execute code on the target system remotely when exploited. The vulnerability is exploited via the use of a spam email tha
Trendmicro
September Patch Tuesday Fixes MS Office Zero-Day
blogs_trendmicro·2017-09-13·CVSS 6.8
[MEDIUM] September Patch Tuesday Fixes MS Office Zero-Day
## September Patch Tuesday Fixes MS Office Zero-Day
Microsoft has released their monthly security bulletin for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word to potentially allow attackers to execute code on the target system remotely.
By: Ronaldo Mangahas 2017/09/13 Read time: ( words)
Save to Folio
Microsoft has released their monthly security bulletin—colloquially known as Patch Tuesday—for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word . CVE-2017-8759 is a .NET Framework Remote Code Execution Vulnerability that allows attackers to execute code on the target system remotely when exploited. The vulnerability is exploited via the use of a spam email that
Trendmicro
September Patch Tuesday Fixes MS Office Zero-Day
blogs_trendmicro·2017-09-13·CVSS 6.8
[MEDIUM] September Patch Tuesday Fixes MS Office Zero-Day
# September Patch Tuesday Fixes MS Office Zero-Day
Microsoft has released their monthly security bulletin for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word to potentially allow attackers to execute code on the target system remotely.
By: Ronaldo Mangahas
2017/09/13
Read time: ( words)
Save to Folio
Microsoft has released their monthly security bulletin—colloquially known as Patch Tuesday—for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word. CVE-2017-8759 is a .NET Framework Remote Code Execution Vulnerability that allows attackers to execute code on the target system remotely when exploited. The vulnerability is exploited via the use of a spam email that p
Trendmicro
September Patch Tuesday Fixes MS Office Zero-Day
blogs_trendmicro·2017-09-13·CVSS 6.8
[MEDIUM] September Patch Tuesday Fixes MS Office Zero-Day
## September Patch Tuesday Fixes MS Office Zero-Day
Microsoft has released their monthly security bulletin for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word to potentially allow attackers to execute code on the target system remotely.
By: Ronaldo Mangahas Sep 13, 2017 Read time: ( words)
Save to Folio
Microsoft has released their monthly security bulletin—colloquially known as Patch Tuesday—for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word . CVE-2017-8759 is a .NET Framework Remote Code Execution Vulnerability that allows attackers to execute code on the target system remotely when exploited. The vulnerability is exploited via the use of a spam email tha
Krebs
Adobe, Microsoft Plug Critical Security Holes
blogs_krebs·2017-09-13·CVSS 6.8
[MEDIUM] Adobe, Microsoft Plug Critical Security Holes
Adobe and Microsoft both on Tuesday released patches to plug critical security vulnerabilities in their products. Microsoft’s patch bundles fix close to 80 separate security problems in various versions of its Windows operating system and related software — including two vulnerabilities that already are being exploited in active attacks. Adobe’s new version of its Flash Player software tackles two flaws that malware or attackers could use to seize remote control over vulnerable computers with no help from users.
Of the two zero-day flaws being fixed this week, the one in Microsoft’s ubiquitous .NET Framework (CVE-2017-8759) is perhaps the most concerning. Despite this flaw being actively exploited, it is somehow labeled by Microsoft as “important” rather than “critical” — the latter being
Trendmicro
September Patch Tuesday Fixes MS Office Zero-Day
blogs_trendmicro·2017-09-13·CVSS 6.8
[MEDIUM] September Patch Tuesday Fixes MS Office Zero-Day
Exploits & Vulnerabilities
## September Patch Tuesday Fixes MS Office Zero-Day
Microsoft has released their monthly security bulletin for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word to potentially allow attackers to execute code on the target system remotely.
By: Ronaldo Mangahas Sep 13, 2017 Read time: ( words)
Save to Folio
Microsoft has released their monthly security bulletin—colloquially known as Patch Tuesday—for September. The most important update is one that addresses a zero-day vulnerability that exploits Microsoft Word . CVE-2017-8759 is a .NET Framework Remote Code Execution Vulnerability that allows attackers to execute code on the target system remotely when exploited. The vulnerability is exploited via
Qualys
September Patch Tuesday: 27 Critical Vulnerabilities from Microsoft, plus Critical Adobe Patches
blogs_qualys·2017-09-12·CVSS 8.1
[HIGH] September Patch Tuesday: 27 Critical Vulnerabilities from Microsoft, plus Critical Adobe Patches
Today Microsoft released a fairly large batch of patches covering 81 vulnerabilities as part of September’s Patch Tuesday update, with 38 of them impacting Windows. Patches covering 27 of these vulnerabilities are labeled as Critical, and 39 can result in Remote Code Execution (RCE). According to Microsoft, one critical vulnerability impacting HoloLens has a public exploit, and there are active malware campaigns exploiting a .NET vulnerability. Microsoft has also patched the BlueBorne vulnerability that could allow an attacker to perform a man-in-the-middle attack against a Windows system.
Top priority for patching should go to CVE-2017-0161 , an RCE vulnerability in NetBIOS that impacts both servers and workstations. For users of Microsoft’s DHCP server, priority should also be given to
Talos
Microsoft Patch Tuesday - September 2017
blogs_talos·2017-09-12·CVSS 8.1
[HIGH] Microsoft Patch Tuesday - September 2017
Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 81 new vulnerabilities with 27 of them rated critical, 52 rated important, and 2 rated moderate. These vulnerabilities impact Edge, Hyper-V, Internet Explorer, Office, Remote Desktop Protocol, Sharepoint, Windows Graphic Display Interface, Windows Kernel Mode Drivers, and more. In addition, Microsoft is also releasing an update for Adobe Flash Player embedded in Edge and Internet Explorer.
Note that the Bluetooth vulnerabilities known as "BlueBorne" that affected Windows have been patched in this latest release. For more information, please refer to CVE-2017-8628.
## Vulnerabilities Rated CriticalThe followi
Qualys
September Patch Tuesday: 27 Critical Vulnerabilities from Microsoft, plus Critical Adobe Patches | Qualys
blogs_qualys·2017-09-12·CVSS 8.1
[HIGH] September Patch Tuesday: 27 Critical Vulnerabilities from Microsoft, plus Critical Adobe Patches | Qualys
Today Microsoft released a fairly large batch of patches covering 81 vulnerabilities as part of September’s Patch Tuesday update, with 38 of them impacting Windows. Patches covering 27 of these vulnerabilities are labeled as Critical, and 39 can result in Remote Code Execution (RCE). According to Microsoft, one critical vulnerability impacting HoloLens has a public exploit, and there are active malware campaigns exploiting a .NET vulnerability. Microsoft has also patched the BlueBorne vulnerability that could allow an attacker to perform a man-in-the-middle attack against a Windows system.
Top priority for patching should go to CVE-2017-0161, an RCE vulnerability in NetBIOS that impacts both servers and workstations. For users of Microsoft’s DHCP server, priority should also be given to C
Krebs
Adobe, Microsoft Plug Critical Security Holes – Krebs on Security
blogs_krebs·2017-09-01·CVSS 6.8
[MEDIUM] Adobe, Microsoft Plug Critical Security Holes – Krebs on Security
Adobe and Microsoft both on Tuesday released patches to plug critical security vulnerabilities in their products. Microsoft’s patch bundles fix close to 80 separate security problems in various versions of its Windows operating system and related software — including two vulnerabilities that already are being exploited in active attacks. Adobe’s new version of its Flash Player software tackles two flaws that malware or attackers could use to seize remote control over vulnerable computers with no help from users.
Of the two zero-day flaws being fixed this week, the one in Microsoft’s ubiquitous .NET Framework ( CVE-2017-8759 ) is perhaps the most concerning. Despite this flaw being actively exploited, it is somehow labeled by Microsoft as “important” rather than “critical” — the latter bei
Threat Intel
Cobalt Group (Cobalt Group, GOLD KINGSWOOD, Cobalt Gang)
threat_intel
Cobalt Group (Cobalt Group, GOLD KINGSWOOD, Cobalt Gang)
# Threat Actor Profile: Cobalt Group
ATT&CK ID: G0080
Also known as: Cobalt Group, GOLD KINGSWOOD, Cobalt Gang, Cobalt Spider
## Overview
Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Group Aug 2017)(Citation
Threat Intel
Leviathan (Leviathan, MUDCARP, Kryptonite Panda)
threat_intel
Leviathan (Leviathan, MUDCARP, Kryptonite Panda)
# Threat Actor Profile: Leviathan
ATT&CK ID: G0065
Also known as: Leviathan, MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, APT40, TEMP.Periscope, Gingham Typhoon
Suspected origin: China
## Overview
Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proo
Zscaler
Zscaler found Multiple Security Vulnerabilities | 09-12-2017
blogs_zscaler·CVSS 7.5
[HIGH] Zscaler found Multiple Security Vulnerabilities | 09-12-2017
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
arXiv
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
arxiv_fulltext·2025-02-12
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
Almuthanna Alageel
and
Sergio Maffeis
Department of Computing
Imperial College London
London, United Kingdom
plain
plain
## Abstract
The scarcity of data and the high complexity of Advanced Persistent Threats (APTs) attacks have created challenges in comprehending their behavior and hindered the exploration of effective detection techniques.
To create an effective APT detection strategy, it is important to examine the Tactics, Techniques, and Procedures (TTPs) that have been reported by the industry. These TTPs can be difficult to classify as either malicious or legitimate. When developing an approach for the next generation of network intrusion detection systems (NIDS), it is necessary to
arXiv
Analysis and Correlation of Visual Evidence in Campaigns of Malicious Office Documents
arxiv_fulltext·2021-03-30
Analysis and Correlation of Visual Evidence in Campaigns of Malicious Office Documents
Analysis and Correlation of Visual Evidence in Campaigns of Malicious Office Documents
[1,2]Fran Casino
[3]Nikolaos Totosis
[1]Theodoros Apostolopoulos
[1]Department of Informatics, University Piraeus, 80 Karaoli & Dimitriou str, 18534 Piraeus, Greece
[1]Nikolaos Lykousas
[1,2]Constantinos Patsakis
[2]Information Management Systems Institute of Athena Research Center, Greece
[3]Hatching, Netherlands
## Abstract
Many malware campaigns use Microsoft (MS) Office documents as droppers to download and execute their malicious payload. Such campaigns often use these documents because MS Office is installed in billions of devices and that these files allow the execution of arbitrary VBA code. Recent versions of MS Office prevent the automatic execution of VBA macros, so malware authors try to co
arXiv
Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting
arxiv_fulltext·2021-02-10·CVSS 8.8
CVE-2017-11882 [HIGH] Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting
Top 10 Most Exploited Vulnerabilities 2016-2019
(https://us-cert.cisa.gov/ncas/alerts/aa20-133a)
.83fcdec8a329824466f140a2e6cdfeec473a9ee2 .0
longtable[]@lllllll@
& CVSS Score & Number of Tactics & Number of Techniques &
Number of CAPECs & Number of CWEs & Number of CPEs
CVE-2017-11882 & 8.55 & 0 & 0 & 12 & 1 & 4
CVE-2017-0199 & 8.55 & 0 & 0 & 0 & 0 & 9
CVE-2017-5638 & 10.0 & 1 & 3 & 51 & 1 & 53
CVE-2012-0158 & 9.3 & 0 & 0 & 3 & 1 & 29
CVE-2019-0604 & 8.65 & 1 & 3 & 51 & 1 & 4
CVE-2017-0143 & 0.0 (not listed in BRON but NVD says high severity)
& 0 & 0 & 0 & 0 & 0
CVE-2018-4878 & 8.65 & 0 & 0 & 0 & 1 & 3
CVE-2017-8759 & 8.55 & 1 & 3 & 51 & 1 & 8
CVE-2015-1641 & 9.3 & 0 & 0 & 0 & 1 & 11
CVE-2018-7600 & 8.65 & 1 & 3 & 51 & 1 & 4
longtable
4 out of Top 10 Vulnerabilities share the follow
arXiv
An Analysis of Malware Trends in Enterprise Networks
arxiv_fulltext·2019-10-01
An Analysis of Malware Trends in Enterprise Networks
An Analysis of Malware Trends in Enterprise Networks
An Analysis of Malware Trends in Enterprise Networks
Abbas Acar1,
Long Lu 2,
A. Selcuk Uluagac 1,
Engin Kirda 2
A. Acar et al.
Florida International University
\aacar001,suluagac\@fiu.edu
Northeastern University
[email protected],[email protected]
## Abstract
We present an empirical and large-scale analysis of malware
samples captured from two different enterprises from 2017 to early 2018. Particularly, we perform threat vector, social-engineering, vulnerability and
time-series analysis on our dataset. Unlike existing malware studies, our
analysis is specifically focused on the recent enterprise malware samples. First
of all, based on our analysis on the combined datasets of two enterprises, our
results confirm the general consensu
Bugzilla
CVE-2017-17740 openldap: contrib/slapd-modules/nops/nops.c attempts to free stack buffer allowing remote attackers to cause a denial of service
bugzilla·2017-12-18·CVSS 7.5
CVE-2017-17740 [HIGH] CVE-2017-17740 openldap: contrib/slapd-modules/nops/nops.c attempts to free stack buffer allowing remote attackers to cause a denial of service
CVE-2017-17740 openldap: contrib/slapd-modules/nops/nops.c attempts to free stack buffer allowing remote attackers to cause a denial of service
contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.
Bug report:
https://www.openldap.org/its/index.cgi/Incoming?id=8759
Discussion:
Created openldap tracking bugs for this issue:
Affects: fedora-all [bug 1527078]
---
JBoss EAP 5 is EOL so won't be receiving updates for moderate security issues.
---
JBoss Core Services and Web Server do not provide slapd and don't use the affected module.
http://www.securityfocus.com/bid/100742http://www.securitytracker.com/id/1039324https://github.com/GitHubAssessments/CVE_Assessments_01_2020https://github.com/bhdresh/CVE-2017-8759https://github.com/nccgroup/CVE-2017-8759https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759https://www.exploit-db.com/exploits/42711/http://www.securityfocus.com/bid/100742http://www.securitytracker.com/id/1039324https://github.com/GitHubAssessments/CVE_Assessments_01_2020https://github.com/bhdresh/CVE-2017-8759https://github.com/nccgroup/CVE-2017-8759https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759https://www.exploit-db.com/exploits/42711/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8759
2017-09-13
Published
2021-11-03
Added to CISA KEV
Exploited in the wild