CVE-2021-22005
published 2021-09-23CVE-2021-22005: The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2021-11-17
Exploited in the wild
EPSS
100.00%
100.0th percentile
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | cloud_foundation | >= 3.0 < 5.0 | 5.0 |
| vmware | vcenter_server | — | — |
| vmware | vcenter_server | — | — |
| vmware | vcenter_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
SIDs: 58217 - 58219
- →Monitor for POST requests to vCenter Analytics service endpoints on port 443 containing invalid JSON or empty JSON objects — these match the VMware patching script's vulnerability check pattern used by scanners probing for CVE-2021-22005. ↗
- →Alert on POST requests to vCenter vulnerable endpoints containing valid, parsable, or non-empty payloads — these indicate active file upload exploitation attempts beyond mere scanning. ↗
- →Detect FaceFish backdoor activity by monitoring for creation of libs.so and modification of /etc/ld.so.preload, followed by an sshd service restart — the backdoor injects into sshd via ld.so.preload. ↗
- →Flag scanning traffic originating from Tor exit nodes targeting vCenter Server port 443, as the majority of CVE-2021-22005 vulnerability checks observed were egressing via Tor. ↗
- →CVE-2021-22005 exploitation can result in a reverse shell on the vCenter server; monitor for unexpected outbound connections from vCenter processes after file upload activity. ↗
- ·CVE-2021-22005 is exploitable regardless of vCenter Server configuration — the arbitrary file upload vulnerability in the Analytics service works irrespective of configuration settings. ↗
- ·Affected vCenter Server versions include 6.7 and 7.0 deployments exposed to the internet; prioritize patching internet-facing instances. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
VMware vCenter Server File Upload Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2021-22005 [CRITICAL] CWE-23 VMware vCenter Server File Upload Vulnerability
Vulnerability: VMware vCenter Server File Upload Vulnerability
Affected: VMware vCenter Server
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-22005
Remediation Due Date: 2021-11-17
VMware
VMware vCenter Server updates address multiple security vulnerabilities
vendor_vmware·2021-09-21·CVSS 7.8
CVE-2021-21991 [HIGH] VMware vCenter Server updates address multiple security vulnerabilities
VMSA-2021-0020: VMware vCenter Server updates address multiple security vulnerabilities
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
CVEs: CVE-2021-21991, CVE-2021-21992, CVE-2021-21993, CVE-2021-22005, CVE-2021-22006, CVE-2021-22007, CVE-2021-22008, CVE-2021-22009, CVE-2021-22010, CVE-2021-22011, CVE-2021-22012, CVE-2021-22013, CVE-2021-22014, CVE-2021-22015, CVE-2021-22016, CVE-2021-22017, CVE-2021-22018, CVE-2021-22019, CVE-2021-22020
Affected products: VMware Cloud Foundation, VMware vCenter Server, VMware vSphere
GHSA
GHSA-9w75-994h-2j26: The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service
ghsa_unreviewed·2022-05-24
CVE-2021-22005 [CRITICAL] CWE-22 GHSA-9w75-994h-2j26: The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
VulnCheck
VMware vCenter Server File Upload Vulnerability
vulncheck·2021·CVSS 9.8
CVE-2021-22005 [CRITICAL] CWE-23 VMware vCenter Server File Upload Vulnerability
VMware vCenter Server File Upload Vulnerability
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Affected: VMware vCenter Server
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://cisa.gov/news-events/alerts/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates; https://cybersecurityworks.com/howdymanage/uploads/file/RansomwareUpdate%20Report%202022%20Q1.pdf; https://www.securin.io/articles/all
Suricata
ET EXPLOIT VMware vCenter RCE Exploitation Attempt M2 (CVE-2021-22005)
suricata·2021-09-28·CVSS 9.8
CVE-2021-22005 [CRITICAL] ET EXPLOIT VMware vCenter RCE Exploitation Attempt M2 (CVE-2021-22005)
ET EXPLOIT VMware vCenter RCE Exploitation Attempt M2 (CVE-2021-22005)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMware vCenter RCE Exploitation Attempt M2 (CVE-2021-22005)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"&_i=."; content:"../../"; fast_pattern; reference:cve,2021-22005; classtype:attempted-admin; sid:2034037; rev:1; metadata:attack_target Server, created_at 2021_09_28, cve CVE_2021_22005, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2021_09_28, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Nuclei
VMware Detection
nuclei
CVE-2021-22005 VMware Detection
VMware Detection
Sends a POST request containing a SOAP payload to a vCenter server to obtain version information
Template:
id: vmware-detect
info:
name: VMware Detection
author: elouhi
severity: info
description: Sends a POST request containing a SOAP payload to a vCenter server to obtain version information
reference:
- https://www.pwndefend.com/2021/09/23/exposed-vmware-vcenter-servers-around-the-world-cve-2021-22005/
- https://svn.nmap.org/nmap/scripts/vmware-version.nse
metadata:
max-request: 1
tags: tech,vcenter,vmware,discovery
http:
- raw:
- |
POST /sdk/ HTTP/1.1
Host: {{Hostname}}
00000001-00000001
ServiceInstance
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: body
words:
- 'ha-folder-root'
- 'RetrieveServiceContentResponse'
cond
Metasploit
VMware vCenter Server Analytics (CEIP) Service File Upload
metasploit
VMware vCenter Server Analytics (CEIP) Service File Upload
VMware vCenter Server Analytics (CEIP) Service File Upload
This module exploits a file upload in VMware vCenter Server's analytics/telemetry (CEIP) service to write a system crontab and execute shell commands as the root user. Note that CEIP must be enabled for the target to be exploitable by this module. CEIP is enabled by default.
Nuclei
VMware vCenter Server - Arbitrary File Upload
nuclei·CVSS 9.8
CVE-2021-22005 [CRITICAL] VMware vCenter Server - Arbitrary File Upload
VMware vCenter Server - Arbitrary File Upload
VMware vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
Template:
id: CVE-2021-22005
info:
name: VMware vCenter Server - Arbitrary File Upload
author: PR3R00T
severity: critical
description: VMware vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
impact: |
Allows an attacker to upload and execute arbitrary files on the target system
remedia
Qualys
Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations | Qualys
blogs_qualys·2025-05-08
Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations | Qualys
#### Table of Contents
- Who is LockBit? How it Evolved and Operates
- Monero: The Coin of the Realm
- Patch or Mitigate Now: Critical CVEs Exploited by LockBit
- Beyond Traditional Endpoints: Other Compromised Systems
- Initial Access and Deployment
- Conclusion
The LockBit ransomware gang recently suffered a significant data breach. Their dark web affiliate panels were defaced with the message “Don’t do crime CRIME IS BAD xoxo from Prague,” linking to a MySQL database dump. This archive contains a SQL file from LockBit’s affiliate panel database that includes twenty tables, notably including a ‘btc_addresses’ table with 59,975 unique bitcoin addresses and a ‘chats’ table containing over 4,400 victim negotiation messages from December 2024 to the end of April 2025.
This blog post will
Qualys
Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations
blogs_qualys·2025-05-08
Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations
## Table of Contents
Who is LockBit? How it Evolved and Operates
Monero: The Coin of the Realm
Patch or Mitigate Now: Critical CVEs Exploited by LockBit
Beyond Traditional Endpoints: Other Compromised Systems
Initial Access and Deployment
Conclusion
The LockBit ransomware gang recently suffered a significant data breach. Their dark web affiliate panels were defaced with the message “Don’t do crime CRIME IS BAD xoxo from Prague,” linking to a MySQL database dump. This archive contains a SQL file from LockBit’s affiliate panel database that includes twenty tables, notably including a ‘btc_addresses’ table with 59,975 unique bitcoin addresses and a ‘chats’ table containing over 4,400 victim negotiation messages from December 2024 to the end of April 2025.
This blog post will leverage
Securelist
-=TWELVE=- is back
blogs_securelist·2024-09-20
-=TWELVE=- is back
Table of Contents
About Twelve
Unified Kill Chain: In
Reconnaissance
Resource Development
Initial Access and Delivery
Exploitation
Web shells
FaceFish backdoor
Persistence
Defense Evasion
Command and Control
Unified Kill Chain: Through
Pivoting
Discovery
Privilege Escalation
Execution
Scripts and commands
Sophos_kill_local.ps1
Using the Task Scheduler
Credential Access
Lateral Movement
Unified Kill Chain: Out
Collection
Exfiltration
Impact
Ransomware
Wipers
Objectives
Takeaways
Indicators of compromise
Authors
Kaspersky
In the spring of 2024, posts with real people’s personal data began appearing on the -=TWELVE=- Telegram channel. Soon it was blocked for falling foul of the Telegram terms of service. The group stayed off the radar for several months, but a
Securelist
Twelve: from initial compromise to ransomware and wipers
blogs_securelist·2024-09-20
Twelve: from initial compromise to ransomware and wipers
Table of Contents
- About Twelve
- Unified Kill Chain: In
- Unified Kill Chain: Through
- Unified Kill Chain: Out
- Takeaways
- Indicators of compromise
Authors
- Kaspersky
In the spring of 2024, posts with real people’s personal data began appearing on the -=TWELVE=- Telegram channel. Soon it was blocked for falling foul of the Telegram terms of service. The group stayed off the radar for several months, but as we investigated a late June 2024 attack, we found that it employed techniques identical to those of Twelve and relied on C2 servers linked to the threat actor. We are therefore confident that the group is still active and will probably soon resurface. This article uses the Unified Kill Chain methodology to analyze the attackers’ actions.
## About Twelve
The group was formed
Unit42
Network Security Trends: November 2022-January 2023
blogs_unit42·2023-05-02·CVSS 9.8
CVE-2021-22005 [CRITICAL] Network Security Trends: November 2022-January 2023
Threat Research Center
Trend Reports
Vulnerabilities
## Network Security Trends: November 2022-January 2023
Yiheng An
Published: May 2, 2023
Trend Reports
Vulnerabilities
Attack analysis
CVE-2021-22005
CVE-2021-31602
CVE-2021-33035
CVE-2021-43287
CVE-2022-1118
CVE-2022-27924
CVE-2022-30136
CVE-2022-31137
CVE-2022-44877
CVE-2022-46169
Exploit in the wild
Network security trends
## Executive Summary
Recent observations of exploits used in the wild November 2022-January 2023 reveal that attackers have been using newly published remote code execution vulnerabilities in the following three products:
Roxy-WI, a web interface for managing and monitoring RoxyDNS
CWP, a free web hosting control panel (aka Control Web Panel or CentOS Web Panel)
Cacti, an open-source netw
Unit42
Network Security Trends: November 2022-January 2023
blogs_unit42·2023-05-02
Network Security Trends: November 2022-January 2023
## Executive Summary
Recent observations of exploits used in the wild November 2022-January 2023 reveal that attackers have been using newly published remote code execution vulnerabilities in the following three products:
- Roxy-WI, a web interface for managing and monitoring RoxyDNS
- CWP, a free web hosting control panel (aka Control Web Panel or CentOS Web Panel)
- Cacti, an open-source network monitoring and graphing tool used to track the performance of various network devices, servers and applications
Additionally, attackers have also been taking advantage of a traversal and information disclosure vulnerability in ThoughtWorks GoCD to read sensitive files stored on servers.
In our observations of network security trends, Unit 42 researchers have pinpointed several attacks based o
Qualys
NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
blogs_qualys·2022-10-07·CVSS 10.0
[CRITICAL] NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
## Table of Contents
Detect & Prioritize 20 Publicly Known Vulnerabilities using VMDR 2.0
Identify Vulnerable Assets using Qualys Threat Protection
Recommendations & Mitigations
Contributors
On October 6, 2022, the United States National Security Agency (NSA) released a cybersecurity advisory on the Chinese government—officially known as the People’s Republic of China (PRC) states-sponsored cyber actors’ activity to seek national interests. These malicious cyber activities attributed to the Chinese government targeted, and persist to target, a mixture of industries and organizations in the United States. They provide the top CVEs used since 2020 by the People’s Republic of China (PRC) states-sponsored cyber actors as evaluated by the National Security Agency (NSA), Cybersecurity and I
Qualys
NSA Alert: Topmost CVEs Actively Exploited By PRC Sponsored Cyber Actors | Qualys
blogs_qualys·2022-10-07
NSA Alert: Topmost CVEs Actively Exploited By PRC Sponsored Cyber Actors | Qualys
#### Table of Contents
- Detect & Prioritize 20 Publicly Known Vulnerabilities using VMDR 2.0
- Identify Vulnerable Assets using Qualys Threat Protection
- Recommendations & Mitigations
- Contributors
On October 6, 2022, the United States National Security Agency (NSA) released a cybersecurity advisory on the Chinese government—officially known as the People’s Republic of China (PRC) states-sponsored cyber actors’ activity to seek national interests. These malicious cyber activities attributed to the Chinese government targeted, and persist to target, a mixture of industries and organizations in the United States. They provide the top CVEs used since 2020 by the People’s Republic of China (PRC) states-sponsored cyber actors as evaluated by the National Security Agency (NSA), Cybersecurit
Tenable
Top 20 CVEs Exploited by People's Republic of China State-Sponsored Actors (AA22-279A)
blogs_tenable·2022-10-07
Top 20 CVEs Exploited by People's Republic of China State-Sponsored Actors (AA22-279A)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
AA22-257A: Cybersecurity Agencies Issue Joint Advisory on Iranian Islamic Revolutionary Guard Corps-Affiliated Attacks
blogs_tenable·2022-09-15
AA22-257A: Cybersecurity Agencies Issue Joint Advisory on Iranian Islamic Revolutionary Guard Corps-Affiliated Attacks
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
CVE-2022-22948: VMware vCenter Server Sensitive Information Disclosure Vulnerability
blogs_tenable·2022-03-30·CVSS 6.5
[MEDIUM] CVE-2022-22948: VMware vCenter Server Sensitive Information Disclosure Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
ContiLeaks: Chats Reveal Over 30 Vulnerabilities Used by Conti Ransomware – How Tenable Can Help
blogs_tenable·2022-03-24
ContiLeaks: Chats Reveal Over 30 Vulnerabilities Used by Conti Ransomware – How Tenable Can Help
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Über Schwachstellen zum illegalen Monero-Mining
blogs_trendmicro·2021-12-03·CVSS 9.8
[CRITICAL] Über Schwachstellen zum illegalen Monero-Mining
## Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Trend Micro Dec 03, 2021 Read time: ( words)
Save to Folio
Originalbeitrag von Nitesh Surana, Threat Research Engineer
Anhänger der Kryptowährungen durchleben schwere Zeiten. Der Bitcoin stürzte ab und es gab aktuell einige Angriffsversuche , so berichtet vom Magazin Spiegel. Auch entdeckten wir vor ein paar Wochen kompromittierte Docker Hub-Konten , die für illegales Kryptowährungs-Mining missbraucht wurden. Nun haben wir uns auch mit entdeckten Exploit-Versuchen und dem Missbrauch der legitimen Plattformen Netlify und GitHub als Repositories für Malwa
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
blogs_trendmicro·2021-12-03·CVSS 9.8
CVE-2021-41773 [CRITICAL] Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
# Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Nitesh Surana
2021/12/03
Read time: ( words)
Save to Folio
Earlier this year, a security flaw identified as CVE-2021-41773 was disclosed to Apache HTTP Server Project, a path traversal and remote code execution (RCE) flaw in Apache HTTP Server 2.4.49. If this vulnerability is exploited, it allows attackers to map URLs to files outside the directories configured by Alias-like directives. Under certain configurations where Common Gateway Interface (CGI) scripts are enabled for aliased paths, attackers can also use it for RCE. As the initial fix was deemed
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01
## Table of Contents
Overview
Directive Scope
CISA Catalog of Known Exploited Vulnerabilities
Detect CISAs Vulnerabilities Using Qualys VMDR
Remediation
Federal Enterprises and Agencies Can Act Now
Summary
Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01 , “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to remediate
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
#### Table of Contents
- Overview
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISAs Vulnerabilities Using Qualys VMDR
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01, “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to
Talos
Threat Source newsletter (Sept. 30, 2021)
blogs_talos·2021-09-30
Threat Source newsletter (Sept. 30, 2021)
Good afternoon, Talos readers.
In the latest example of attackers trying to capitalize on current headlines, we've spotted a group using the recent fervor around the Pegasus spyware to spread malware.
We've detailed a campaign in which the attackers have copied (nearly perfectly) Amnesty International's website and is advertising a tool to sniff out the spyware and remove it. The problem is, there is no such software, and instead, it just downloads a RAT on your device.
Do you have a particular threat, IOC, malware family or actor you want us to be covering in the Threat Source newsletter? Let us know at [email protected].
## Upcoming Talos public engagements
Snort 3 and Me: The rule writers speak
Date: Oct. 5, 11 a.m. ET
Location: Virtual
Description: In the latest entry into
Talos
Threat Source newsletter (Sept. 30, 2021)
blogs_talos·2021-09-30
Threat Source newsletter (Sept. 30, 2021)
## Threat Source newsletter (Sept. 30, 2021)
Good afternoon, Talos readers.
In the latest example of attackers trying to capitalize on current headlines, we've spotted a group using the recent fervor around the Pegasus spyware to spread malware.
We've detailed a campaign in which the attackers have copied (nearly perfectly) Amnesty International's website and is advertising a tool to sniff out the spyware and remove it. The problem is, there is no such software, and instead, it just downloads a RAT on your device.
Do you have a particular threat, IOC, malware family or actor you want us to be covering in the Threat Source newsletter? Let us know at [email protected].
## Upcoming Talos public engagements
Snort 3 and Me: The rule writers speak
Date: Oct. 5, 11 a.m. ET
Location:
Checkpoint
27th September – Threat Intelligence Report
blogs_checkpoint·2021-09-26·CVSS 9.8
CVE-2021-26855 [CRITICAL] 27th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 27th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 27th September, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Conti ransomware gang has hit Covisian’s Spanish and Latin America subsidiary, Europe’s major customer service and call center providers, affecting several of their internal systems. According to the company, there were no discussions or negotiations about any ransom.
Check Point Harmony Endpoint provides protection
Tenable
CVE-2021-22005: Critical File Upload Vulnerability in VMware vCenter Server
blogs_tenable·2021-09-22·CVSS 9.8
[CRITICAL] CVE-2021-22005: Critical File Upload Vulnerability in VMware vCenter Server
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
Malicious Tag Roundup (Sep 14-30, 2021)
blogs_greynoiseio·CVSS 7.8
[HIGH] Malicious Tag Roundup (Sep 14-30, 2021)
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
Greynoiseio
Vulnerability Checks of VMWare vCenter Remote File Upload (CVE-2021-22005)
blogs_greynoiseio·CVSS 9.8
[CRITICAL] Vulnerability Checks of VMWare vCenter Remote File Upload (CVE-2021-22005)
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Crowdstrike
Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.htmlhttps://www.vmware.com/security/advisories/VMSA-2021-0020.htmlhttp://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.htmlhttps://www.vmware.com/security/advisories/VMSA-2021-0020.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005
2021-09-23
Published
2021-11-03
Added to CISA KEV
Exploited in the wild