CVE-2021-34473
published 2021-07-14CVE-2021-34473: Microsoft Exchange Server Remote Code Execution Vulnerability
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2021-11-17
Exploited in the wild
EPSS
100.00%
100.0th percentile
Microsoft Exchange Server Remote Code Execution Vulnerability
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | microsoft_exchange_server_2013_cumulative_update_23 | >= 15.00.0 < 15.00.1497.015 | 15.00.1497.015 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_19 | >= 15.01.0 < 15.01.2176.012 | 15.01.2176.012 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_20 | >= 15.01.0 < 15.01.2242.008 | 15.01.2242.008 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_8 | >= 15.02.0 < 15.02.0792.013 | 15.02.0792.013 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_9 | >= 15.02.0 < 15.02.0858.010 | 15.02.0858.010 |
| msrc | microsoft_exchange_server_2013_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_19 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_20 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_8 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_9 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
sigma↗
filter event_type = STORY and actor_process_image_name = "certutil.exe" and actor_process_image_command_line contains ":8080"
sigma↗
filter event_type = FILE and (event_sub_type = ENUM.FILE_WRITE or event_sub_type = ENUM.FILE_CREATE_NEW) and action_file_extension in ("exe", "dll") and action_file_path contains "C:\Users\Public"sigma↗
filter event_type = ENUM.PROCESS and actor_process_image_name = "w3wp.exe" and (action_process_image_command_line contains "&ipconfig&echo" or action_process_image_command_line contains "&quesr&echo" or action_process_image_command_line contains "&whoami&echo" or action_process_image_command_line contains "&c:&echo" or action_process_image_command_line contains "&cd&echo" or action_process_image_command_line contains "&echo [E]" or action_process_image_command_line contains "&echo [S]")
sigma↗
filter event_type = ENUM.FILE and actor_process_image_name = "w3wp.exe" and action_file_path contains "FrontEnd\HttpProxy" and actor_process_command_line contains "MSExchange"
- →Look for ASPX webshell files dropped in the aspnet_client directory on Exchange servers, a hallmark of ProxyShell exploitation (CVE-2021-34473 chain). ↗
- →Monitor IIS (w3wp.exe) spawning PowerShell child processes on Exchange servers as a post-exploitation indicator. ↗
- →Detect web shell activity via exec_code query parameter in HTTP requests to Exchange servers. ↗
- →Hunt for China Chopper webshell command patterns spawned from w3wp.exe, including &ipconfig&echo, &whoami&echo, &echo [E], and &echo [S]. ↗
- →Alert on certutil.exe making outbound connections on port 8080 to public IP addresses, a post-exploitation indicator on Exchange servers. ↗
- →Detect EXE/DLL file writes to C:\Users\Public\ on Exchange hosts (where w3wp.exe is present) as a post-exploitation indicator. ↗
- →Monitor for suspicious file creation in Exchange FrontEnd\HttpProxy directories by w3wp.exe processes running MSExchange. ↗
- →Trace webshell file creation back to MSExchangeMailboxReplication.exe as the parent process, confirming ProxyShell exploitation. ↗
- →Detect Ngrok tunneling on ports 3389 and 443 on Exchange servers as a post-ProxyShell lateral movement indicator. ↗
- →Alert on rdpclip.exe execution followed by lsass.exe memory access as an indicator of credential dumping after ProxyShell-enabled RDP lateral movement. ↗
- ·CVE-2021-34473 is part of the ProxyShell chain and requires chaining with CVE-2021-34523 and CVE-2021-31207 for full remote code execution; exploitation of all three together enables arbitrary file write (webshell upload) on Exchange. ↗
- ·The Cobalt Strike stager used after ProxyShell exploitation mimics legitimate jQuery traffic; HTTP GET requests to /jquery-3.5.1.slim.min.js should not be assumed benign on Exchange-adjacent hosts. ↗
- ·The tampered libeay32.dll used post-ProxyShell carries a non-valid certificate spoofing Zoom (issued by GoDaddy); certificate validation alone is insufficient to detect this malicious DLL. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.1CRITICAL
cisa9.8CRITICAL
vendor_msrc9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5jv9-cff9-2j3m: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31206, CVE-2021-34473
ghsa_unreviewed·2022-05-24·CVSS 7.6
CVE-2021-31196 [HIGH] GHSA-5jv9-cff9-2j3m: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31206, CVE-2021-34473
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31206, CVE-2021-34473.
GHSA
GHSA-636v-jm8j-6hx7: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-34473
ghsa_unreviewed·2022-05-24·CVSS 7.2
CVE-2021-31206 [HIGH] GHSA-636v-jm8j-6hx7: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-34473
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-34473.
GHSA
GHSA-fgq9-p33g-xcfc: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-31206
ghsa_unreviewed·2022-05-24·CVSS 7.2
CVE-2021-34473 [HIGH] CWE-918 GHSA-fgq9-p33g-xcfc: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-31206
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-31206.
VulnCheck
Microsoft Exchange Server Remote Code Execution Vulnerability
vulncheck·2021·CVSS 9.1
CVE-2021-34473 [CRITICAL] CWE-918 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
Affected: Microsoft Exchange Server
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.cybereason.com/blog/threat-alert-microsoft-exchange-proxyshell-exploits-and-lockfile-ransomware; https://www.fireeye.com/blog/threat-research/2021/09/proxyshell-exploiting-microsoft-exchange-servers.html; https://www.securin.io/microsoft-exchange-proxyshell-and-windows-petitpotam-vulnerabilities-chained-in-new-attack/; https://threatpost.com/apt-chamelgang-targets-russian-energy-aviation/175272/; https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-ac
CISA
Microsoft Exchange Server Remote Code Execution Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2021-34473 [CRITICAL] CWE-918 Microsoft Exchange Server Remote Code Execution Vulnerability
Vulnerability: Microsoft Exchange Server Remote Code Execution Vulnerability
Affected: Microsoft Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-34473
Remediation Due Date: 2021-11-17
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2021-07-13·CVSS 9.1
CVE-2021-34473 [CRITICAL] Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server: Microsoft Exchange Server
Microsoft: Microsoft
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely;DOS:N/A
Reference: http://www.microsoft.com/download/details.aspx?familyid=f827ff3b-194c-4470-aa8f-6cedc0d95d07
Reference: https://support.microsoft.com/help/5001779
Reference: http://www.microsoft.com/download/details.aspx?familyid=5aa2aaf7-860d-4977-acd4-82096c83c5f0
Reference: http://www.microsoft.com/download/details.aspx?familyid=b13f23a9-5603-4b13-8e16-6d35b5b33524
Reference: http://www.microsoft.com/download/details.aspx?familyid=52da6d67-e0c4-4af0-a133-1e47217b630
Suricata
ET EXPLOIT Possible Microsoft Exchange Mailbox Enumeration Inbound (CVE-2021-34473)
suricata·2022-03-29·CVSS 9.1
CVE-2021-34473 [CRITICAL] ET EXPLOIT Possible Microsoft Exchange Mailbox Enumeration Inbound (CVE-2021-34473)
ET EXPLOIT Possible Microsoft Exchange Mailbox Enumeration Inbound (CVE-2021-34473)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Exchange Mailbox Enumeration Inbound (CVE-2021-34473)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ews/exchange.asmx"; nocase; fast_pattern; http.request_body; content:""; distance:0; content:""; distance:0; reference:cve,2021-34473; classtype:attempted-admin; sid:2035650; rev:2; metadata:affected_product Microsoft_Exchange, attack_target Server, created_at 2022_03_29, cve CVE_2021_34473, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2022_12_23, mitre_tactic_id TA0001, mitre_tact
Suricata
ET EXPLOIT Possible Microsoft Exchange RCE Inbound M3 (CVE-2021-34473)
suricata·2022-03-29·CVSS 9.1
CVE-2021-34473 [CRITICAL] ET EXPLOIT Possible Microsoft Exchange RCE Inbound M3 (CVE-2021-34473)
ET EXPLOIT Possible Microsoft Exchange RCE Inbound M3 (CVE-2021-34473)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Exchange RCE Inbound M3 (CVE-2021-34473)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/autodiscover.json?"; content:"/PowerShell/"; nocase; distance:0; content:"X-Rps-CAT="; distance:0; fast_pattern; http.cookie; content:"Email="; content:"autodiscover/"; within:20; reference:cve,2021-34473; classtype:attempted-admin; sid:2035649; rev:3; metadata:affected_product Microsoft_Exchange, attack_target Server, created_at 2022_03_29, cve CVE_2021_34473, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2
Suricata
ET EXPLOIT Possible Microsoft Exchange RCE Inbound M2 (CVE-2021-34473)
suricata·2021-08-12·CVSS 9.1
CVE-2021-34473 [CRITICAL] ET EXPLOIT Possible Microsoft Exchange RCE Inbound M2 (CVE-2021-34473)
ET EXPLOIT Possible Microsoft Exchange RCE Inbound M2 (CVE-2021-34473)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Exchange RCE Inbound M2 (CVE-2021-34473)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/autodiscover.json?"; content:"/PowerShell/"; nocase; distance:0; content:"X-Rps-CAT="; distance:0; fast_pattern; content:"Email="; distance:0; content:"autodiscover/"; within:20; reference:cve,2021-34473; classtype:attempted-admin; sid:2033711; rev:3; metadata:affected_product Microsoft_Exchange, attack_target Server, created_at 2021_08_12, cve CVE_2021_34473, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 20
Suricata
ET EXPLOIT Possible Microsoft Exchange RCE with Python PSRP Client UA Inbound (CVE-2021-34473)
suricata·2021-08-12·CVSS 9.1
CVE-2021-34473 [CRITICAL] ET EXPLOIT Possible Microsoft Exchange RCE with Python PSRP Client UA Inbound (CVE-2021-34473)
ET EXPLOIT Possible Microsoft Exchange RCE with Python PSRP Client UA Inbound (CVE-2021-34473)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] [443,444] (msg:"ET EXPLOIT Possible Microsoft Exchange RCE with Python PSRP Client UA Inbound (CVE-2021-34473)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/autodiscover/autodiscover.json?"; http.user_agent; content:"Python|20|PSRP|20|Client"; fast_pattern; reference:cve,2021-34473; classtype:attempted-admin; sid:2033712; rev:1; metadata:affected_product Microsoft_Exchange, attack_target Server, created_at 2021_08_12, cve CVE_2021_34473, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2022_12_23, mitre_tactic_id TA0001, mitre_tactic_
Suricata
ET EXPLOIT Possible Microsoft Exchange RCE Inbound M1 (CVE-2021-34473)
suricata·2021-08-09·CVSS 9.1
CVE-2021-34473 [CRITICAL] ET EXPLOIT Possible Microsoft Exchange RCE Inbound M1 (CVE-2021-34473)
ET EXPLOIT Possible Microsoft Exchange RCE Inbound M1 (CVE-2021-34473)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] [443,444] (msg:"ET EXPLOIT Possible Microsoft Exchange RCE Inbound M1 (CVE-2021-34473)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ews/exchange.asmx"; fast_pattern; http.request_body; content:""; distance:0; content:"Message>"; distance:0; content:"Attachments>"; distance:0; content:"Content>"; distance:0; content:"|60 c2 ac c2 aa|"; within:200; reference:cve,2021-34473; classtype:attempted-admin; sid:2033684; rev:4; metadata:affected_product Microsoft_Exchange, attack_target Server, created_at 2021_08_09, cve CVE_2021_34473, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Maj
Nuclei
Exchange Server - Remote Code Execution
nuclei·CVSS 7.2
CVE-2021-34473 [HIGH] Exchange Server - Remote Code Execution
Exchange Server - Remote Code Execution
Microsoft Exchange Server is vulnerable to a remote code execution vulnerability. This CVE ID is unique from CVE-2021-31196, CVE-2021-31206.
Template:
id: CVE-2021-34473
info:
name: Exchange Server - Remote Code Execution
author: arcc,intx0x80,dwisiswant0,r3dg33k
severity: critical
description: |
Microsoft Exchange Server is vulnerable to a remote code execution vulnerability. This CVE ID is unique from CVE-2021-31196, CVE-2021-31206.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected Exchange Server, potentially leading to a complete compromise of the system.
remediation: Apply Microsoft Exchange Server 2019 Cumulative Update 9 or upgrade to the latest version.
reference:
- h
Metasploit
Microsoft Exchange ProxyShell RCE
metasploit·CVSS 6.6
CVE-2021-31207 [MEDIUM] Microsoft Exchange ProxyShell RCE
Microsoft Exchange ProxyShell RCE
This module exploits a vulnerability on Microsoft Exchange Server that allows an attacker to bypass the authentication (CVE-2021-31207), impersonate an arbitrary user (CVE-2021-34523) and write an arbitrary file (CVE-2021-34473) to achieve the RCE (Remote Code Execution). By taking advantage of this vulnerability, you can execute arbitrary commands on the remote Microsoft Exchange Server. This vulnerability affects Exchange 2013 CU23 < 15.0.1497.15, Exchange 2016 CU19 < 15.1.2176.12, Exchange 2016 CU20 < 15.1.2242.5, Exchange 2019 CU8 < 15.2.792.13, Exchange 2019 CU9 < 15.2.858.9. All components are vulnerable by default.
Tenable
Frequently Asked Questions About Iranian Cyber Operations
blogs_tenable·2025-06-27
Frequently Asked Questions About Iranian Cyber Operations
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
ThreatLocker Patch Management: A Security-First Approach to Closing Vulnerability Windows
blogs_bleepingcomputer·2025-05-21·CVSS 9.1
[CRITICAL] ThreatLocker Patch Management: A Security-First Approach to Closing Vulnerability Windows
## ThreatLocker Patch Management: A Security-First Approach to Closing Vulnerability Windows
## ThreatLocker
Patching vulnerabilities is one of the most basic principles of cybersecurity — and one of the hardest to execute consistently and securely at scale.
In today’s threat landscape, adversaries routinely exploit vulnerabilities within hours of public disclosure. Yet, operational constraints, patch instability, and incomplete visibility into assets make it almost impossible for many organizations to patch fast enough without introducing new risks.
ThreatLocker Patch Management is built to tackle this reality head-on, providing security teams with greater control, visibility, and confidence over patching workflows — without compromising the stability of production systems.
## Why Tr
Qualys
Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations
blogs_qualys·2025-05-08
Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations
## Table of Contents
Who is LockBit? How it Evolved and Operates
Monero: The Coin of the Realm
Patch or Mitigate Now: Critical CVEs Exploited by LockBit
Beyond Traditional Endpoints: Other Compromised Systems
Initial Access and Deployment
Conclusion
The LockBit ransomware gang recently suffered a significant data breach. Their dark web affiliate panels were defaced with the message “Don’t do crime CRIME IS BAD xoxo from Prague,” linking to a MySQL database dump. This archive contains a SQL file from LockBit’s affiliate panel database that includes twenty tables, notably including a ‘btc_addresses’ table with 59,975 unique bitcoin addresses and a ‘chats’ table containing over 4,400 victim negotiation messages from December 2024 to the end of April 2025.
This blog post will leverage
Tenable
Cybersecurity Snapshot: Ghost Ransomware Group Targets Known Vulns, CISA Warns, While Report Finds Many Cyber Pros Want To Switch Jobs
blogs_tenable·2025-02-21
Cybersecurity Snapshot: Ghost Ransomware Group Targets Known Vulns, CISA Warns, While Report Finds Many Cyber Pros Want To Switch Jobs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
CISA and FBI: Ghost ransomware breached orgs in 70 countries
blogs_bleepingcomputer·2025-02-19·CVSS 6.5
[MEDIUM] CISA and FBI: Ghost ransomware breached orgs in 70 countries
## CISA and FBI: Ghost ransomware breached orgs in 70 countries
## Sergiu Gatlan
CISA and the FBI said attackers deploying Ghost ransomware have breached victims from multiple industry sectors across over 70 countries, including critical infrastructure organizations.
Other industries impacted include healthcare, government, education, technology, manufacturing, and numerous small and medium-sized businesses.
"Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware," CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) said in a joint advisory released on Wednesday.
"This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizatio
Bleepingcomputer
BadPilot network hacking campaign fuels Russian SandWorm attacks
blogs_bleepingcomputer·2025-02-12
BadPilot network hacking campaign fuels Russian SandWorm attacks
## BadPilot network hacking campaign fuels Russian SandWorm attacks
## Bill Toulas
A subgroup of the Russian state-sponsored hacking group APT44, also known as 'Seashell Blizzard' and 'Sandworm', has been targeting critical organizations and governments in a multi-year campaign dubbed 'BadPilot.'
The threat actor has been active since at least 2021 and is also responsible for breaching networks of organizations in energy, oil and gas, telecommunications, shipping, and arms manufacturing sectors.
Microsoft's Threat Intelligence team says that the actor is dedicated to achieving initial access to target systems, establishing persistence, and maintaining presence to allow other APT44 subgroups with post-compromise expertise to take over.
"We have also observed the initial access subgroup
Bleepingcomputer
CISA says BianLian ransomware now focuses only on data theft
blogs_bleepingcomputer·2024-11-21·CVSS 6.6
[MEDIUM] CISA says BianLian ransomware now focuses only on data theft
## CISA says BianLian ransomware now focuses only on data theft
## Bill Toulas
The BianLian ransomware operation has shifted its tactics, becoming primarily a data theft extortion group, according to an updated advisory from the U.S. Cybersecurity & Infrastructure Security Agency, the FBI, and the Australian Cyber Security Centre.
This new information comes in an update to a joint advisory released in May by the same agencies, which warned about BianLian's shifting tactics involving the use of stolen Remote Desktop Protocol (RDP) credentials, custom Go-based backdoors, commercial remote access tools, and targeted Windows Registry modifications.
At the time, BianLian had started a switch to data theft extortion , gradually abandoning file encryption tactics, especially after Avast relea
Securelist
Tropic Trooper spies on government entities in the Middle East
blogs_securelist·2024-09-05
Tropic Trooper spies on government entities in the Middle East
Table of Contents
Executive summary
Background
Technical details
Webshells — Umbraco modules
Backdoor implants using DLL search-order hijacking
The datast.dll library
Hunting for new loaders
Recent variants
Updated loader variant in February 2024
New samples
The victim
Attribution
Conclusion
Indicators of Compromise
Authors
Sherif Magdy
## Executive summary
Tropic Trooper (also known as KeyBoy and Pirate Panda) is an APT group active since 2011. This group has traditionally targeted sectors such as government, healthcare, transportation and high-tech industries in Taiwan, the Philippines and Hong Kong. Our recent investigation has revealed that in 2024 they conducted persistent campaigns targeting a government entity in the Middle East, starting in June 2023.
Sighting th
Securelist
New malicious web shell from the Tropic Trooper group is found in the Middle East
blogs_securelist·2024-09-05
New malicious web shell from the Tropic Trooper group is found in the Middle East
Table of Contents
- Executive summary
- Background
- Technical details
- Hunting for new loaders
- Recent variants
- The victim
- Attribution
- Conclusion
- Indicators of Compromise
Authors
- Sherif Magdy
## Executive summary
Tropic Trooper (also known as KeyBoy and Pirate Panda) is an APT group active since 2011. This group has traditionally targeted sectors such as government, healthcare, transportation and high-tech industries in Taiwan, the Philippines and Hong Kong. Our recent investigation has revealed that in 2024 they conducted persistent campaigns targeting a government entity in the Middle East, starting in June 2023.
Sighting this group’s TTPs in critical governmental entities in the Middle East, particularly those related to human rights studies, marks a new strategic mo
Bleepingcomputer
UK govt links 2021 Electoral Commission breach to Exchange server
blogs_bleepingcomputer·2024-07-30·CVSS 6.6
CVE-2021-34473 [MEDIUM] UK govt links 2021 Electoral Commission breach to Exchange server
## UK govt links 2021 Electoral Commission breach to Exchange server
## Sergiu Gatlan
The United Kingdom's Information Commissioner's Office (ICO) revealed today that the Electoral Commission was breached in August 2021 because it failed to patch its on-premise Microsoft Exchange Server against ProxyShell vulnerabilities.
In March, the U.K. National Cyber Security Centre (NCSC) attributed the UK Electoral Commission breach to a Chinese state-backed threat actor.
Tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, these security flaws were chained to hack into the commission's Exchange Server 2016 and deploy web shells, which allowed the attackers to gain persistence after installing web shells and backdoors.
While Microsoft released security updates in May 2021 that fixed t
Unit42
Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia
blogs_unit42·2024-05-23
Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia
Threat Research Center
Threat Research
Malware
## Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia
Lior Rochberger
Daniel Frank
Published: May 23, 2024
Malware
Nation-State Cyberattacks
Threat Actor Groups
Threat Research
Advanced Persistent Threat
Backdoor
China
Diplomatic Specter
Gh0st Rat
SweetSpecter
TGR-STA-0043
TunnelSpecter
## Executive Summary
A Chinese advanced persistent threat (APT) group has been conducting an ongoing campaign, which we call Operation Diplomatic Specter. This campaign has been targeting political entities in the Middle East, Africa and Asia since at least late 2022.
An analysis of this threat actor’s activity reveals long-t
Unit42
Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia
blogs_unit42·2024-05-23
Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia
## Executive Summary
A Chinese advanced persistent threat (APT) group has been conducting an ongoing campaign, which we call Operation Diplomatic Specter. This campaign has been targeting political entities in the Middle East, Africa and Asia since at least late 2022.
An analysis of this threat actor’s activity reveals long-term espionage operations against at least seven governmental entities. The threat actor performed intelligence collection efforts at a large scale, leveraging rare email exfiltration techniques against compromised servers.
This collection effort includes attempts to obtain sensitive and classified information about the following entities, focusing on current geopolitical affairs:
- Diplomatic and economic missions
- Embassies
- Military operations
- Political meeti
Tenable
Microsoft’s February 2024 Patch Tuesday Addresses 73 CVEs (CVE-2024-21351, CVE-2024-21412)
blogs_tenable·2024-02-13·CVSS 7.6
[HIGH] Microsoft’s February 2024 Patch Tuesday Addresses 73 CVEs (CVE-2024-21351, CVE-2024-21412)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Zscaler
AvosLocker | ThreatLabz
blogs_zscaler·2023-10-27·CVSS 6.6
[MEDIUM] AvosLocker | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Trendmicro
Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
blogs_trendmicro·2023-09-18
Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
Malware
## Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation.
By: Joseph C Chen 2023/09/18 Read time: ( words)
Save to Folio
In early 2021, we published a research paper discussing the operation of a China-linked threat actor we tracked as Earth Lusca . Since our initial research, the group has remained active and has even extended its operations, targeting countries around the world during the first half of 2023.
While monitoring the group, we managed to obtain an interestin
Trendmicro
Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
blogs_trendmicro·2023-09-18
Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
Malware
# Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation.
By: Joseph C Chen
2023/09/18
Read time: ( words)
Save to Folio
In early 2021, we published a research paper discussing the operation of a China-linked threat actor we tracked as Earth Lusca. Since our initial research, the group has remained active and has even extended its operations, targeting countries around the world during the first half of 2023.
While monitoring the group, we managed to obtain an interesting
Trendmicro
Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
blogs_trendmicro·2023-09-18
Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
Malware
## Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation.
By: Joseph C Chen Sep 18, 2023 Read time: ( words)
Save to Folio
In early 2021, we published a research paper discussing the operation of a China-linked threat actor we tracked as Earth Lusca . Since our initial research, the group has remained active and has even extended its operations, targeting countries around the world during the first half of 2023.
While monitoring the group, we managed to obtain an interest
Securelist
From Caribbean shores to your devices: analyzing Cuba ransomware
blogs_securelist·2023-09-11
From Caribbean shores to your devices: analyzing Cuba ransomware
Table of Contents
Introduction
Cuba ransomware gang
Victimology
Ransomware
Cuba extortion model
Arsenal
Profits
Investigation of a Cuba-related incident and analysis of the malware
Host: SRV_STORAGE
Bughatch
SRV_Service host
Veeamp
Avast Anti-Rootkit driver
Burntcigar
SRV_MAIL host (Exchange server)
SqlDbAdmin
Cobalt Strike
New malware
BYOVD (Bring Your Own Vulnerable Driver)
Conclusion
Appendix
Authors
Alexander Kirichenko
Gleb Ivanov
## Introduction
Knowledge is our best weapon in the fight against cybercrime. An understanding of how various gangs operate and what tools they use helps build competent defenses and investigate incidents. This report takes a close look at the history of the Cuba group, and their attack tactics, techniques and procedures. We hope th
Securelist
Analysis of Cuba ransomware gang activity and tooling
blogs_securelist·2023-09-11
Analysis of Cuba ransomware gang activity and tooling
Table of Contents
- Introduction
- Cuba ransomware gang
- Victimology
- Ransomware
- Cuba extortion model
- Arsenal
- Profits
- Investigation of a Cuba-related incident and analysis of the malware
- New malware
- BYOVD (Bring Your Own Vulnerable Driver)
- Conclusion
- Appendix
Authors
- Alexander Kirichenko
- Gleb Ivanov
## Introduction
Knowledge is our best weapon in the fight against cybercrime. An understanding of how various gangs operate and what tools they use helps build competent defenses and investigate incidents. This report takes a close look at the history of the Cuba group, and their attack tactics, techniques and procedures. We hope this article will help you to stay one step ahead of threats like this one.
## Cuba ransomware gang
Cuba data leak site
The group’s offe
Qualys
Top 20 Vulnerabilities Exploited by Cyber Attackers | Qualys
blogs_qualys·2023-09-04·CVSS 7.8
[HIGH] Top 20 Vulnerabilities Exploited by Cyber Attackers | Qualys
#### Table of Contents
- Stats on the Top 20 Vulnerable Vendors & By-Products
- Top Twenty Most Targeted by Attackers
- TruRisk Dashboard
- Key Insights & Takeaways
- References
- Additional Contributors
The earlier blog posts showcased an overview of the vulnerability threat landscape that is either remotely exploited or most targeted by attackers. A quick recap – We focused on high-risk vulnerabilities that can be remotely exploited with or without authentication, and with the view on the time to CISA being down to 8 days, the most vulnerabilities targeted by threat actors, malware & ransomware.
This blog post will focus on Qualys’ Top Twenty Vulnerabilities, targeted by threat actors, malware, and ransomware, with recent trending/sightings observed in the last few years and the curre
Qualys
Qualys Top 20 Most Exploited Vulnerabilities
blogs_qualys·2023-09-04·CVSS 7.8
[HIGH] Qualys Top 20 Most Exploited Vulnerabilities
## Table of Contents
Stats on the Top 20 Vulnerable Vendors & By-Products
Top Twenty Most Targeted by Attackers
TruRisk Dashboard
Key Insights & Takeaways
References
Additional Contributors
The earlier blog posts showcased an overview of the vulnerability threat landscape that is either remotely exploited or most targeted by attackers. A quick recap – We focused on high-risk vulnerabilities that can be remotely exploited with or without authentication, and with the view on the time to CISA being down to 8 days, the most vulnerabilities targeted by threat actors, malware & ransomware.
This blog post will focus on Qualys’ Top Twenty Vulnerabilities, targeted by threat actors, malware, and ransomware, with recent trending/sightings observed in the last few years and the current year.
Qualys
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities | Qualys
blogs_qualys·2023-08-24
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities | Qualys
#### Table of Contents
- References
- Additional Contributor
A unified front against malicious cyber actors is climactic in the ever-evolving cybersecurity landscape. The joint Cybersecurity Advisory (CSA), a collaboration between leading cybersecurity agencies from the United States, Canada, United Kingdom, Australia, and New Zealand, is a critical guide to strengthen global cyber resilience. The agencies involved include the U.S.’s CISA, NSA, and FBI; Canada’s CCCS; U.K.’s NCSC-UK; Australia’s ACSC; and New Zealand’s NCSC-NZ and CERT NZ.
This collaboration among key cybersecurity agencies highlights the global nature of cybersecurity threats. Such cooperative efforts signify a unified perspective and highlight the need for shared intelligence and coordinated strategies. The realizatio
Qualys
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities
blogs_qualys·2023-08-24
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities
## Table of Contents
References
Additional Contributor
A unified front against malicious cyber actors is climactic in the ever-evolving cybersecurity landscape. The joint Cybersecurity Advisory (CSA), a collaboration between leading cybersecurity agencies from the United States, Canada, United Kingdom, Australia, and New Zealand, is a critical guide to strengthen global cyber resilience. The agencies involved include the U.S.’s CISA, NSA, and FBI; Canada’s CCCS; U.K.’s NCSC-UK; Australia’s ACSC; and New Zealand’s NCSC-NZ and CERT NZ.
This collaboration among key cybersecurity agencies highlights the global nature of cybersecurity threats. Such cooperative efforts signify a unified perspective and highlight the need for shared intelligence and coordinated strategies. The realization tha
Sentinelone
Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities
blogs_sentinelone·2023-08-08·CVSS 9.1
[CRITICAL] Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities
Leveraging known bugs and unpatched exploits continue to be an unyielding strategy for threat actors. Ranging from security bypasses and credential exposure to remote code execution, software vulnerabilities remain tools of the trade for cyber attackers looking for a way into lucrative systems.
While new flaws found in Active Directory and the MOVEit file transfer application along with those used in the AlienFox toolkit or recent IceFire ransomware campaigns have wreaked havoc this year, a number of existing vulnerabilities stand out from the rest in terms of how often they are abused to this day.
In this post, we delve into CISA’s latest round-up, which lists the top 12 most routinely exploited vulnerabilities of 2022 that continue to pose significant threats to enterprise businesses.
Sentinelone
Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities
blogs_sentinelone·2023-08-08·CVSS 9.1
[CRITICAL] Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities
Leveraging known bugs and unpatched exploits continue to be an unyielding strategy for threat actors. Ranging from security bypasses and credential exposure to remote code execution, software vulnerabilities remain tools of the trade for cyber attackers looking for a way into lucrative systems.
While new flaws found in Active Directory and the MOVEit file transfer application along with those used in the AlienFox toolkit or recent IceFire ransomware campaigns have wreaked havoc this year, a number of existing vulnerabilities stand out from the rest in terms of how often they are abused to this day.
In this post, we delve into CISA’s latest round-up, which lists the top 12 most routinely exploited vulnerabilities of 2022 that continue to pose significant threats to enterprise businesses.
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
blogs_tenable·2023-08-03
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Part 2: An In-Depth Look at the Latest Vulnerability Threat Landscape (Attackers’ Edition)
blogs_qualys·2023-07-18
Part 2: An In-Depth Look at the Latest Vulnerability Threat Landscape (Attackers’ Edition)
## Table of Contents
Top Ten Vulnerabilities Exploited by Threat Actors
Top Ten Highly Active Threat Actors
Top Ten Most Exploited Vulnerabilities by Malware
Top Ten Most Active Malware
Top Ten Vulnerabilities Exploited by Ransomware
Prioritizing Exploited Vulnerabilities with TheQualys VMDR and TruRisk
Assess Your Organizations Exposure to Risk / TruRisk Dashboard
Key Insights & Takeaways
References
Additional Contributor
The previous blog from this three-part series showcased an overview of the vulnerability threat landscape. To summarize quickly, it illustrated the popular methods of exploiting vulnerabilities and the tactical techniques employed by threat actors, malware, and ransomware groups. Perhaps more crucially, we stated that commonly used solutions (CISA KEV/EPSS) of
Fortinet
Meet LockBit: The Most Prevalent Ransomware in 2022 | FortiGuard Labs
blogs_fortinet·2023-07-10
Meet LockBit: The Most Prevalent Ransomware in 2022 | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Meet LockBit: The Most Prevalent Ransomware in 2022
By Shunichi Imano and James Slaughter | July 10, 2023
Affected platforms: Microsoft Windows, Linux, ESXi, MacOS
Impacted parties: Microsoft Windows, Linux, ESXi, and MacOS Users
Impact: Encrypts and exfiltrates victims’ files and demands ransom for file decryption and not to leak stolen files
Severity level: High
On June 14th, 2023, the CISA, FBI, MS-ISAC, and multiple international cyber security organizations released a joint advisory for the LockBit ransomware. This ransomware group has been active since early 2020, targeting organizations across numerous industries, including energy and government sectors. According to the advisory, LockBit was the most active ransomware in 2022.
This blog provides
Unit42
Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
blogs_unit42·2023-06-28·CVSS 9.1
CVE-2021-26855 [CRITICAL] Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
Threat Research Center
High Profile Threats
Malware
## Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
Daniel Frank
Published: June 28, 2023
High Profile Threats
Malware
Cryptocurrency
Cryptojacking
CVE-2021-26855
CVE-2021-33766
CVE-2021-34473
CVE-2022-41040
Manic Menagerie
Microsoft Exchange Server
Persistence method
ProxyNotShell
Webshell
## Executive Summary
Unit 42 researchers discovered an active campaign that targeted several web hosting and IT providers in the United States and European Union from late 2020 to late 2022. Unit 42 tracks the activity associated with this campaign as CL-CRI-0021 and believes it stems from the same threat actor responsible for the previous campaign known as Manic Menagerie .
The threat actor deployed coin m
Unit42
Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
blogs_unit42·2023-06-28
Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
## Executive Summary
Unit 42 researchers discovered an active campaign that targeted several web hosting and IT providers in the United States and European Union from late 2020 to late 2022. Unit 42 tracks the activity associated with this campaign as CL-CRI-0021 and believes it stems from the same threat actor responsible for the previous campaign known as Manic Menagerie.
The threat actor deployed coin miners on hijacked machines to abuse the compromised servers’ resources. They have further deepened their foothold in victims’ environments by mass deployment of web shells, which granted them sustained access, as well as access to internal resources of the compromised websites.
In doing so, the attackers could potentially have turned the hijacked legitimate websites – hosted by the tar
Tenable
ProxyNotShell, OWASSRF, TabShell: Patch Your Microsoft Exchange Servers Now
blogs_tenable·2023-01-31
ProxyNotShell, OWASSRF, TabShell: Patch Your Microsoft Exchange Servers Now
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Cuba unter der Lupe
blogs_trendmicro·2023-01-18
Cuba unter der Lupe
Ransomware
## Cuba unter der Lupe
Die Cuba-Ransomware gilt mit einer umfangreichen Infrastruktur, beeindruckenden Tools und zugehöriger Malware als wichtiger Akteur und wird dies durch kontinuierliche Weiterentwicklung auch bleiben. Gute Kenntnisse dazu führen zu einem höheren Schutz davor.
By: Trend Micro Jan 18, 2023 Read time: ( words)
Save to Folio
Cuba Ransomware geriet gegen Ende 2021 mit einer Reihe hochkarätiger Angriffe, unter anderem auf europäische Regierungsbehörden, in die Schlagzeilen. Bis August 2022 kompromittierten die Akteure weltweit über 100 Einrichtungen, forderten über 145 Mio. Dollar und erhielten über 60 Mio. Dollar an Lösegeldzahlungen, wie aus einem gemeinsamen Bericht des FBI und der CISA vom Dezember 2022 hervorgeht. Wie viele moderne Ransomware-Betreiber n
Tenable
2022 Threat Landscape Report
blogs_tenable·2022-12-27
2022 Threat Landscape Report
by Josef Weiss December 27, 2022
2022 began with concerns over supply chains and Software Bills of Material (SBOM) as organizations worldwide were forced to reconsider how they respond to incidents in anticipation of the next major event. Tenable’s Security Response Team (SRT) continuously monitors the threat landscape throughout the year, always at the forefront of trending vulnerabilities and security threats. This dashboard provides a summary of Tenable data that has been compiled over the past year.
In a year marked by hacktivism, ransomware and attacks targeting critical infrastructure set against a turbulent macroeconomic environment, organizations struggled to keep pace with the demands on cybersecurity teams and resources. Attacks against critical infrastructure remained a common
Checkpoint
26th December – Threat Intelligence Report
blogs_checkpoint·2022-12-26
CVE-2022-41080 26th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 26th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 26th December, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
LastPass revealed that it has been breached for the second time this year, an event that resulted in attackers stealing customer encrypted password vaults and additional account information. The breach was achieved after attackers used information stolen from the LastPass development environment in the August incident to
Tenable
2022 Threat Landscape Report
blogs_tenable·2022-12-21
2022 Threat Landscape Report
by Josef Weiss December 21, 2022
2022 began with concerns over supply chains and Software Bills of Material (SBOM) as organizations worldwide were forced to reconsider how they respond to incidents in anticipation of the next major event. Tenable’s Security Response Team (SRT) continuously monitors the threat landscape throughout the year, always at the forefront of trending vulnerabilities and security threats. This dashboard provides a summary of Tenable data that has been compiled over the past year.
In a year marked by hacktivism, ransomware and attacks targeting critical infrastructure in a turbulent macroeconomic environment, organizations struggled to keep pace with the demands on cybersecurity teams and resources. Attacks against critical infrastructure remained a common concern.
Securelist
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
blogs_securelist·2022-12-19·CVSS 6.6
CVE-2022-41040 [MEDIUM] CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
Table of Contents
- Summary
- ProxyNotShell exploitation details
- ProxyNotShell post exploitation
- Our recommendations
- Indicators of compromise
Authors
- Vitaly Morgunov
- Dmitry Kondratyev
- Alexander Kolesnikov
- Alexey Kulaev
## Summary
At the end of September, GTSC reported an attack on critical infrastructure that took place in August. During the investigation, experts found that two 0-day vulnerabilities in Microsoft Exchange Server were used in the attack. The first one, later identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to remotely trigger the next vulnerability – CVE-2022-41082. The second vulnerability, in turn, allows remote code execution (RCE) when MS Exchange PowerShell is accessible to the
Securelist
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
blogs_securelist·2022-12-19·CVSS 6.6
[MEDIUM] CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
Table of Contents
Summary
ProxyNotShell exploitation details
ProxyNotShell post exploitation
Our recommendations
Indicators of compromise
Authors
Vitaly Morgunov
Dmitry Kondratyev
Alexander Kolesnikov
Alexey Kulaev
## Summary
At the end of September, GTSC reported an attack on critical infrastructure that took place in August. During the investigation, experts found that two 0-day vulnerabilities in Microsoft Exchange Server were used in the attack. The first one, later identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to remotely trigger the next vulnerability – CVE-2022-41082. The second vulnerability, in turn, allows remote code execution (RCE) when MS Exchange PowerShell is accessible to the attacker. A
Sentinelone
Conti
blogs_sentinelone·2022-11-30
Conti
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Sentinelone
Hive
blogs_sentinelone·2022-11-30
Hive
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Sentinelone
Moses Staff
blogs_sentinelone·2022-11-30
Moses Staff
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Sentinelone
AvosLocker
blogs_sentinelone·2022-11-30
AvosLocker
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Trendmicro
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
blogs_trendmicro·2022-11-16·CVSS 9.1
CVE-2022-41040 [CRITICAL] Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
## Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By: Zero Day Initiative Nov 16, 2022 Read time: ( words)
Save to Folio
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release.
It is a beautiful chain, with an ingenious vector for gaining remote code execution. The tricky part is that it
Trendmicro
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
blogs_trendmicro·2022-11-16·CVSS 9.1
CVE-2022-41040 [CRITICAL] Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
# Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By: Zero Day Initiative
2022/11/16
Read time: ( words)
Save to Folio
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release.
It is a beautiful chain, with an ingenious vector for gaining remote code execution. The tricky part is that it ca
Trendmicro
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
blogs_trendmicro·2022-11-16·CVSS 9.1
CVE-2022-41040 [CRITICAL] Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
## Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By: Zero Day Initiative 2022/11/16 Read time: ( words)
Save to Folio
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release.
It is a beautiful chain, with an ingenious vector for gaining remote code execution. The tricky part is that it ca
Trendmicro
LV Ransomware Exploits ProxyShell in Attack on a Jordan-based Company
blogs_trendmicro·2022-10-25
LV Ransomware Exploits ProxyShell in Attack on a Jordan-based Company
# LV Ransomware Exploits ProxyShell in Attack on a Jordan-based Company
Our blog entry provides a look at an attack involving the LV ransomware on a Jordan-based company from an intrusion analysis standpoint
By: Sherif Magdy, Ahmed Samir
2022/10/25
Read time: ( words)
Save to Folio
# Overview
The Trend Micro research team recently analyzed an infection related to the LV ransomware group, a ransomware as a service (RaaS) operation that has been active since late 2020, and is reportedly based on REvil (aka Sodinokibi). The exact nature of the relationship between the LV ransomware and REvil groups cannot be definitively established or verified — the LV ransomware’s developers do not appear to have had access to the Revil source code, and likely modified REvil binary script instead. Acc
Unit42
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
blogs_unit42·2022-10-04·CVSS 6.6
CVE-2022-41040 [MEDIUM] Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
## Executive Summary
In early August, GTSC discovered a new Microsoft Exchange zero-day remote code execution (RCE) that was very similar to ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207).
The exploit was discovered in the wild in what appeared to be a SOC investigation into suspicious activity of one of GTSC’s customers. Once they determined the scope of the vulnerabilities, GTSC reported the vulnerability to the Zero-day Initiative (ZDI) to enable further coordination with Microsoft. The vulnerabilities were assigned CVE-2022-41040 and CVE-2022-41082 and rated with severities of critical and important respectively. The first one, identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability, while the second one, identified as CVE-2022-41082, allow
Unit42
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
blogs_unit42·2022-10-04·CVSS 6.6
CVE-2022-41040 [MEDIUM] Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
Shawn Westfall
Published: October 4, 2022
High Profile Threats
Vulnerabilities
CVE-2022-41040
CVE-2022-41082
Exploit in the wild
Microsoft Exchange Server
ProxyNotShell
Threat intelligence
## Executive Summary
In early August, GTSC discovered a new Microsoft Exchange zero-day remote code execution (RCE) that was very similar to ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207).
The exploit was discovered in the wild in what appeared to be a SOC investigation into suspicious activity of one of GTSC’s customers. Once they determined the scope of the vulnerabilities, GTSC reported the vulnerability to the Zer
Checkpoint
3rd October – Threat Intelligence Report
blogs_checkpoint·2022-10-03
CVE-2022-41040 3rd October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd October, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research identified an ongoing, mobile malware campaign that has consistently targeted Uyghurs for at least the past seven years. Attributed to the actor Scarlet Mimic, the malware campaign was disguised in multiple baits such as books, pictures, and even an audio version of the Quran.
Check Point Harmony Mobil
Fortinet
Microsoft Exchange 0-Day Vulnerability Updates | FortiGuard Labs
blogs_fortinet·2022-09-30·CVSS 6.6
CVE-2022-41040 [MEDIUM] Microsoft Exchange 0-Day Vulnerability Updates | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Microsoft Exchange 0-Day Vulnerability Updates
By James Slaughter | September 30, 2022
On 28th September, 2022, the cybersecurity company GTSC released a blog detailing an exploit attempt on a system they were monitoring. After analysis, they were able to locate and submit two bugs to Microsoft via the Zero Day Initiative (ZDI-CAN-18333 (CVSS 8.8) and ZDI-CAN-18802 (CVSS 6.3)). Microsoft validated the findings and CVE-2022-41040 and CVE-2022-41082 were assigned to the vulnerabilities.
CVE-2022-41040 is a Server-Side Request Forgery (SSRF) vulnerability and CVE-2022-41082 allows for remote code execution (RCE) where PowerShell is available.
This blog describes what you need to know about these vulnerabilities.
Affected Platforms: On premises Microsoft Ex
Tenable
AA22-257A: Cybersecurity Agencies Issue Joint Advisory on Iranian Islamic Revolutionary Guard Corps-Affiliated Attacks
blogs_tenable·2022-09-15
AA22-257A: Cybersecurity Agencies Issue Joint Advisory on Iranian Islamic Revolutionary Guard Corps-Affiliated Attacks
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
What Are Initial Access Brokers? - A Comprehensive Guide 101
blogs_sentinelone·2022-08-17
What Are Initial Access Brokers? - A Comprehensive Guide 101
From ransomware operators like LockBit and BlackBasta to APTs striking for or against Russian or Chinese interests, threat actors of various stripes all need one thing to get their operations off the ground: initial access to an organization’s network .
Such access can be bought on a variety of trading forums from cyber criminals who specialize in running low-risk phishing campaigns and credential theft operations, or in scanning enterprise networks for known remote code execution (RCE) software vulnerabilities.
Because of the ease with which initial access can now be obtained thanks to poor patch management and lax controls over identity and user credentials, there exists a market where supply is outstripping demand, and vendors involved in selling initial access are lowering their pric
Sentinelone
What Are Initial Access Brokers? - A Comprehensive Guide 101
blogs_sentinelone·2022-08-17
What Are Initial Access Brokers? - A Comprehensive Guide 101
From ransomware operators like LockBit and BlackBasta to APTs striking for or against Russian or Chinese interests, threat actors of various stripes all need one thing to get their operations off the ground: initial access to an organization’s network.
Such access can be bought on a variety of trading forums from cyber criminals who specialize in running low-risk phishing campaigns and credential theft operations, or in scanning enterprise networks for known remote code execution (RCE) software vulnerabilities.
Because of the ease with which initial access can now be obtained thanks to poor patch management and lax controls over identity and user credentials, there exists a market where supply is outstripping demand, and vendors involved in selling initial access are lowering their price
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
CVE-2017-5638 [CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Threat Research Center
Trend Reports
Vulnerabilities
## Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Unit 42
Published: July 21, 2022
Trend Reports
Vulnerabilities
Apache Log4j
CVE-2017-5638
CVE-2017-9841
CVE-2018-19986
CVE-2019-02320
CVE-2019-19597
CVE-2019-9082
CVE-2020-14882
CVE-2020-14883
CVE-2020-15505
CVE-2020-15506
CVE-2020-25078
CVE-2020-5902
CVE-2021-21315
CVE-2021-22986
CVE-2021-26855
CVE-2021-31805
CVE-2021-34473
CVE-2021-35464
CVE-2021-38647
CVE-2021-40438
CVE-2021-40539
CVE-2021-41773
CVE-2021-42013
CVE-2021-44228
CVE-2021-45046
CVE-2022-22963
CVE-2022-22965
Network security trends
Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are repo
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
[CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are reported every year, but not all are used by threat actors in real-world attacks. There are many reasons for this: a proof of concept (PoC) may not be available for attackers to weaponize, it may be too difficult to exploit the vulnerability, there may be a lack of accessible vulnerable software on the internet, or attackers may simply deem a vulnerability not worth exploiting due to low impact. Real-world defenders need real-world data on which vulnerabilities attackers are choosing to exploit – and where to focus protections.
In the 2022 Unit 42 Network Threat Trends Research Report, we’ve used data captured by the Palo Alto Networks Advanced Threat Prevention security service on Next-Generation Firewall and Prisma SASE from
Checkpoint
4th July – Threat Intelligence Report
blogs_checkpoint·2022-07-04
CVE-2021-34473 4th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 4th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 4th July, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Iranian steel manufacturing plants have suffered a cyberattack which reportedly forced them to halt production. The hacker group Gonjeshke Darande, which has previously attacked the Iranian railway system, assumed responsibility for the attack. Check Point Research found and analyzed a malware sample used as part of this attack,
Unit42
LockBit 2.0: How This RaaS Operates and How to Protect Against It
blogs_unit42·2022-06-09
LockBit 2.0: How This RaaS Operates and How to Protect Against It
Threat Research Center
High Profile Threats
Ransomware
## LockBit 2.0: How This RaaS Operates and How to Protect Against It
Amer Elsad
JR Gumarin
Abigail Barr
Published: June 9, 2022
High Profile Threats
Ransomware
Threat Research
Flighty Scorpius
LockBit 2.0
RaaS
## Executive Summary
LockBit 2.0 is ransomware as a service (RaaS) that first emerged in June 2021 as an upgrade to its predecessor LockBit (aka ABCD Ransomware), which was first observed in September 2019.
Since its inception, the LockBit 2.0 RaaS attracted affiliates via recruitment campaigns in underground forums, and thus became particularly prolific during the third quarter of calendar year 2021. The LockBit 2.0 operators claimed to have the fastest encryption software of any active ransomware strain as o
Unit42
LockBit 2.0: How This RaaS Operates and How to Protect Against It
blogs_unit42·2022-06-09
LockBit 2.0: How This RaaS Operates and How to Protect Against It
## Executive Summary
LockBit 2.0 is ransomware as a service (RaaS) that first emerged in June 2021 as an upgrade to its predecessor LockBit (aka ABCD Ransomware), which was first observed in September 2019.
Since its inception, the LockBit 2.0 RaaS attracted affiliates via recruitment campaigns in underground forums, and thus became particularly prolific during the third quarter of calendar year 2021. The LockBit 2.0 operators claimed to have the fastest encryption software of any active ransomware strain as of June 2021, claiming accordingly that this added to its effectiveness and ability to disrupt the ransomware landscape.
While several top-tier RaaS affiliate programs, such as Babuk, DarkSide and REvil (aka Sodinokibi) disappeared from the underground in 2021, LockBit 2.0 continued
Elastic
Detection and response for the actively exploited ProxyShell vulnerabilities — Elastic Security Labs
blogs_elastic·2022-06-02·CVSS 6.6
[MEDIUM] Detection and response for the actively exploited ProxyShell vulnerabilities — Elastic Security Labs
2 June 2022•Daniel Stepanic•Andrew Pease
# Detection and response for the actively exploited ProxyShell vulnerabilities
In the last week, Elastic Security has observed the exploitation of Microsoft Exchange vulnerabilities associated with ProxyShell. Review the post to find newly released details about this activity.
1 min readProduct Updates
On August 21, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) released an urgent notice related to the exploitation of ProxyShell vulnerabilities (CVE-2021-31207, CVE-2021-34473, CVE-2021-34523). By chaining these vulnerabilities together, threat actors are compromising unpatched Microsoft Exchange servers and gaining footholds into enterprise networks. Security vendors and researchers are also observing these attacks tied to pos
Elastic
Detection and response for the actively exploited ProxyShell vulnerabilities — Elastic Security Labs
blogs_elastic·2022-06-02·CVSS 6.6
CVE-2021-31207 [MEDIUM] Detection and response for the actively exploited ProxyShell vulnerabilities — Elastic Security Labs
## Detection and response for the actively exploited ProxyShell vulnerabilities
In the last week, Elastic Security has observed the exploitation of Microsoft Exchange vulnerabilities associated with ProxyShell. Review the post to find newly released details about this activity.
On August 21, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) released an urgent notice related to the exploitation of ProxyShell vulnerabilities ( CVE-2021-31207 , CVE-2021-34473 , CVE-2021-34523 ). By chaining these vulnerabilities together, threat actors are compromising unpatched Microsoft Exchange servers and gaining footholds into enterprise networks. Security vendors and researchers are also observing these attacks tied to post-exploitation behavior such as deploying ransomware to victim e
Qualys
CISA Alert: Top 15 Routinely Exploited Vulnerabilities
blogs_qualys·2022-05-06·CVSS 10.0
[CRITICAL] CISA Alert: Top 15 Routinely Exploited Vulnerabilities
## Table of Contents
CISAs Top 15 Routinely Exploited Vulnerabilities of 2021
Highlights of Top Vulnerabilities Cited in CISA 2021 Report
Log4Shell Vulnerability
ProxyShell: Multiple Vulnerabilities
ProxyLogon: Multiple Vulnerabilities
How Can Qualys Help?
Getting Started
The U.S. Cybersecurity & Infrastructure Security Agency has published its report on the top exploited vulnerabilities of 2021. This blog summarizes the report’s findings and how you can use Qualys VMDR to automatically detect and remediate these risks in your enterprise environment.
The Cybersecurity & Infrastructure Security Agency (CISA) releases detailed alerts of critical vulnerabilities and threats when warranted. These alerts cover the most exploited security vulnerabilities and provide critical insights in
Qualys
CISA Alert: Top 15 Routinely Exploited Vulnerabilities | Qualys
blogs_qualys·2022-05-06
CISA Alert: Top 15 Routinely Exploited Vulnerabilities | Qualys
#### Table of Contents
- CISAs Top 15 Routinely Exploited Vulnerabilities of 2021
- Highlights of Top Vulnerabilities Cited in CISA 2021 Report
- Log4Shell Vulnerability
- ProxyShell: Multiple Vulnerabilities
- ProxyLogon: Multiple Vulnerabilities
- How Can Qualys Help?
- Getting Started
The U.S. Cybersecurity & Infrastructure Security Agency has published its report on the top exploited vulnerabilities of 2021. This blog summarizes the report’s findings and how you can use Qualys VMDR to automatically detect and remediate these risks in your enterprise environment.
The Cybersecurity & Infrastructure Security Agency (CISA) releases detailed alerts of critical vulnerabilities and threats when warranted. These alerts cover the most exploited security vulnerabilities and provide critical i
Sentinelone
Enterprise Security Essentials | Top 15 Most Routinely Exploited Vulnerabilities 2022
blogs_sentinelone·2022-04-28·CVSS 9.8
[CRITICAL] Enterprise Security Essentials | Top 15 Most Routinely Exploited Vulnerabilities 2022
From remote code execution and privilege escalation to security bypasses and path traversal, software vulnerabilities are a threat actor’s stock-in-trade for initial access and compromise. In the past 12 months, we’ve seen a number of new flaws, including Log4Shell, ProxyShell, and ProxyLogon, being exploited in attacks against enterprises. These and other known bugs, some revealed as far back as 2017, continue to be routinely abused in environments where organizations have failed to properly inventory and patch. As CISA released its latest update on the most commonly exploited vulnerabilities, we take a look at each of the top 15 most routinely exploited bugs being used against businesses today.
## 1. Log4Shell (CVE-2021-44228)
Occupying top spot is the notorious flaw in the Apache Java
Sentinelone
Enterprise Security Essentials | Top 15 Most Routinely Exploited Vulnerabilities 2022
blogs_sentinelone·2022-04-28·CVSS 9.8
[CRITICAL] Enterprise Security Essentials | Top 15 Most Routinely Exploited Vulnerabilities 2022
From remote code execution and privilege escalation to security bypasses and path traversal, software vulnerabilities are a threat actor’s stock-in-trade for initial access and compromise. In the past 12 months, we’ve seen a number of new flaws, including Log4Shell, ProxyShell, and ProxyLogon, being exploited in attacks against enterprises. These and other known bugs, some revealed as far back as 2017, continue to be routinely abused in environments where organizations have failed to properly inventory and patch. As CISA released its latest update on the most commonly exploited vulnerabilities, we take a look at each of the top 15 most routinely exploited bugs being used against businesses today .
## 1. Log4Shell (CVE-2021-44228)
Occupying top spot is the notorious flaw in the Apache Jav
Checkpoint
25th April – Threat Intelligence Report
blogs_checkpoint·2022-04-25
CVE-2021-34473 25th April – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 25th April – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 25th April, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Russian state-sponsored APT actor Gamaredon (aka Shuckworm) has targeted Ukrainian organizations using at least four different variants of the Pterodo backdoor, likely to maintain persistence on infected computers. The group has been performing cyber-espionage campaigns in Ukraine since at least 2014.
Researchers have found
Unit42
Threat Assessment: BlackByte Ransomware
blogs_unit42·2022-04-21
Threat Assessment: BlackByte Ransomware
Threat Research Center
High Profile Threats
Ransomware
## Threat Assessment: BlackByte Ransomware
Amer Elsad
Published: April 21, 2022
High Profile Threats
Malware
Ransomware
BlackByte
RaaS
## Executive Summary
BlackByte is ransomware as a service (RaaS) that first emerged in July 2021. Operators have exploited ProxyShell vulnerabilities to gain a foothold in the victim's environment. BlackByte has similarities to other ransomware variants such as Lockbit 2.0 that avoid systems that use Russian and a number of Eastern European languages, including many written with Cyrillic alphabets.
The operators behind this ransomware have been very active since it first emerged. Since November 2021, they have targeted multiple U.S. and global organizations, including a number in energy
Unit42
Threat Assessment: BlackByte Ransomware
blogs_unit42·2022-04-21
Threat Assessment: BlackByte Ransomware
## Executive Summary
BlackByte is ransomware as a service (RaaS) that first emerged in July 2021. Operators have exploited ProxyShell vulnerabilities to gain a foothold in the victim's environment. BlackByte has similarities to other ransomware variants such as Lockbit 2.0 that avoid systems that use Russian and a number of Eastern European languages, including many written with Cyrillic alphabets.
The operators behind this ransomware have been very active since it first emerged. Since November 2021, they have targeted multiple U.S. and global organizations, including a number in energy, agriculture, financial services and the public sector. They also displayed pervasiveness with a notable increase (300%) in the number of attacks associated with the RaaS in October-December 2021, compare
Trendmicro
An Investigation of the BlackCat Ransomware via Trend Micro Vision One
blogs_trendmicro·2022-04-18·CVSS 6.6
[MEDIUM] An Investigation of the BlackCat Ransomware via Trend Micro Vision One
Ransomware
# An Investigation of the BlackCat Ransomware via Trend Micro Vision One
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model.
By: Lucas Silva, Leandro Froes
Apr 18, 2022
Read time: ( words)
Save to Folio
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and ope
Trendmicro
BlackCat: Untersuchung via Trend Micro Vision One
blogs_trendmicro·2022-04-18·CVSS 6.6
[MEDIUM] BlackCat: Untersuchung via Trend Micro Vision One
Ransomware
## An Investigation of the BlackCat Ransomware via Trend Micro Vision One
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model.
By: Lucas Silva, Leandro Froes Apr 18, 2022 Read time: ( words)
Save to Folio
Originalbeitrag von Lucas Silva, Incident Response Analyst, und Leandro Froes, Threat Researcher
BlackCat (auch bekannt als AlphaVM oder AlphaV) ist eine Ransomware-Familie, die in der Programmiersprache Rust entwickelt wurde und als Ransomware-as-a-Service-Modell (RaaS) betrieben wird. W
Trendmicro
An Investigation of the BlackCat Ransomware via Trend Micro Vision One
blogs_trendmicro·2022-04-18·CVSS 6.6
[MEDIUM] An Investigation of the BlackCat Ransomware via Trend Micro Vision One
Ransomware
## An Investigation of the BlackCat Ransomware via Trend Micro Vision One
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model.
By: Lucas Silva, Leandro Froes 2022/04/18 Read time: ( words)
Save to Folio
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and opera
Trendmicro
An Investigation of the BlackCat Ransomware via Trend Micro Vision One
blogs_trendmicro·2022-04-18·CVSS 6.6
[MEDIUM] An Investigation of the BlackCat Ransomware via Trend Micro Vision One
Ransomware
# An Investigation of the BlackCat Ransomware via Trend Micro Vision One
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model.
By: Lucas Silva, Leandro Froes
2022/04/18
Read time: ( words)
Save to Folio
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and opera
Trendmicro
An Investigation of the BlackCat Ransomware via Trend Micro Vision One
blogs_trendmicro·2022-04-18·CVSS 6.6
[MEDIUM] An Investigation of the BlackCat Ransomware via Trend Micro Vision One
Ransomware
## An Investigation of the BlackCat Ransomware via Trend Micro Vision One
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model.
By: Lucas Silva, Leandro Froes Apr 18, 2022 Read time: ( words)
Save to Folio
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and ope
Dfir Report
PHOSPHORUS Automates Initial Access Using ProxyShell
blogs_dfir_report·2022-03-21
PHOSPHORUS Automates Initial Access Using ProxyShell
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Read More
- dragonforce Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Read More
Services Overview
Threat Hunting
-
Integration
CTI Program Advisory
Incident Response Playbook
About us
Contact Us
Collaboration
Careers
Analysts
Access DFIR Labs
Get in Touch
Public Reports
Products Overview
Threat intel Overview
Threat Feed
Private DFIR Reports
All Intel
Active Defense
DFIR Labs
Case Artifacts
Detection Pack
AI Training Ground
Service Overview
Threat Hunting
Integration
CTI Program Advisory
Incident Response Playbook
Company Overview
About us
Contact Us
Careers
Analyst
SQL Brute Force Leads to BlueSky Ransomware
From OneNote to RansomNote: An Ice Col
Trendmicro
Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
blogs_trendmicro·2022-03-17
Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
## Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
The digital transformations that had enabled many enterprises to stay afloat amid the Covid-19 health crisis also brought about major upheavals in cybersecurity, the impact of which was still widely felt in 2021. In our annual cybersecurity report, we look back at 2021 in terms of the most significant security issues and trends that shaped the year’s threat landscape.
By: Trend Micro Research 2022/03/17 Read time: ( words)
Save to Folio
The digital transformations that had enabled many enterprises to stay afloat amid the Covid-19 health crisis also brought about major upheavals in cybersecurity, the impact of which was still widely felt in 2021. Trend Micro detected and blocked more than 94 billion threats ove
Trendmicro
Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
blogs_trendmicro·2022-03-17
Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
# Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
The digital transformations that had enabled many enterprises to stay afloat amid the Covid-19 health crisis also brought about major upheavals in cybersecurity, the impact of which was still widely felt in 2021. In our annual cybersecurity report, we look back at 2021 in terms of the most significant security issues and trends that shaped the year’s threat landscape.
By: Trend Micro Research
2022/03/17
Read time: ( words)
Save to Folio
The digital transformations that had enabled many enterprises to stay afloat amid the Covid-19 health crisis also brought about major upheavals in cybersecurity, the impact of which was still widely felt in 2021. Trend Micro detected and blocked more than 94 billion threats ove
Trendmicro
Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
blogs_trendmicro·2022-03-17
Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
## Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
The digital transformations that had enabled many enterprises to stay afloat amid the Covid-19 health crisis also brought about major upheavals in cybersecurity, the impact of which was still widely felt in 2021. In our annual cybersecurity report, we look back at 2021 in terms of the most significant security issues and trends that shaped the year’s threat landscape.
By: Trend Micro Research Mar 17, 2022 Read time: ( words)
Save to Folio
The digital transformations that had enabled many enterprises to stay afloat amid the Covid-19 health crisis also brought about major upheavals in cybersecurity, the impact of which was still widely felt in 2021. Trend Micro detected and blocked more than 94 billion threats o
Trendmicro
Cybersecurity-Report 2021: Schwieriges Terrain
blogs_trendmicro·2022-03-17
Cybersecurity-Report 2021: Schwieriges Terrain
## Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
The digital transformations that had enabled many enterprises to stay afloat amid the Covid-19 health crisis also brought about major upheavals in cybersecurity, the impact of which was still widely felt in 2021. In our annual cybersecurity report, we look back at 2021 in terms of the most significant security issues and trends that shaped the year’s threat landscape.
By: Trend Micro Research Mar 17, 2022 Read time: ( words)
Save to Folio
Originalartikel von Trend Micro Research
Die digitale Transformation, die es vielen Unternehmen ermöglichte, sich während der Covid-19-Krise zu behaupten, brachte aber auch erhebliche Herausforderungen für die Cybersicherheit mit sich, deren Auswirkungen auch 2021 deutlich z
Trendmicro
Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
blogs_trendmicro·2022-03-17
Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
## Attacks Abound in Tricky Threat Terrain: 2021 Annual Cybersecurity Report
The digital transformations that had enabled many enterprises to stay afloat amid the Covid-19 health crisis also brought about major upheavals in cybersecurity, the impact of which was still widely felt in 2021. In our annual cybersecurity report, we look back at 2021 in terms of the most significant security issues and trends that shaped the year’s threat landscape.
By: Trend Micro Research Mar 17, 2022 Read time: ( words)
Save to Folio
The digital transformations that had enabled many enterprises to stay afloat amid the Covid-19 health crisis also brought about major upheavals in cybersecurity, the impact of which was still widely felt in 2021. Trend Micro detected and blocked more than 94 billion threats o
Qualys
AvosLocker Ransomware Behavior Examined on Windows & Linux
blogs_qualys·2022-03-07·CVSS 7.6
[HIGH] AvosLocker Ransomware Behavior Examined on Windows & Linux
## Table of Contents
Technical Analysis of AvosLocker Windows Variant
Technical Analysis of AvosLocker Linux Variant
Indicators of Compromise (IOCs):
TTP Map:
AvosLocker is a ransomware group that was identified in 2021, specifically targeting Windows machines. Now a new variant of AvosLocker malware is also targeting Linux environments. In this blog, we examine the behavior of these two AvosLocker Ransomware in detail.
AvosLocker is a relatively new ransomware-as-a-service that was first spotted in late June 2021. The attackers use spam email campaigns as initial infection vectors for the delivery of the ransomware payload. During the encryption, process files are appended with the “.avos” extension. An updated variant appends with the extension “.avos2”. Similarly, the Linux versio
Qualys
AvosLocker Ransomware Behavior Examined on Windows & Linux | Qualys
blogs_qualys·2022-03-07
AvosLocker Ransomware Behavior Examined on Windows & Linux | Qualys
#### Table of Contents
- Technical Analysis of AvosLocker Windows Variant
- Technical Analysis of AvosLocker Linux Variant
- Indicators of Compromise (IOCs):
- TTP Map:
AvosLocker is a ransomware group that was identified in 2021, specifically targeting Windows machines. Now a new variant of AvosLocker malware is also targeting Linux environments. In this blog, we examine the behavior of these two AvosLocker Ransomware in detail.
AvosLocker is a relatively new ransomware-as-a-service that was first spotted in late June 2021. The attackers use spam email campaigns as initial infection vectors for the delivery of the ransomware payload. During the encryption, process files are appended with the “.avos” extension. An updated variant appends with the extension “.avos2”. Similarly, the Linux
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Checkpoint
21st February– Threat Intelligence Report
blogs_checkpoint·2022-02-21·CVSS 9.8
CVE-2018-13379 [CRITICAL] 21st February– Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 21st February– Threat Intelligence Report
For the latest discoveries in cyber research for the week of 21st February, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research has investigated the attack against Iranian broadcasting that occurred in late January. CPR was able to discover part of the tools that were utilized in this operation, including the evidence of the usage of a destructive wiper malware.
Check Point Research has discovered a new implementation of the
Trendmicro
Defending Systems Against Attacks With Layers of Remote Control
blogs_trendmicro·2022-01-10
Defending Systems Against Attacks With Layers of Remote Control
Cyber Threats
# Uncovering and Defending Systems Against Attacks With Layers of Remote Control
The Trend Micro™ Managed XDR team addressed a stealthy multilayered attack that progressed from an exploited endpoint vulnerability to the use of legitimate remote access tools including Remote Desktop Protocol (RDP) as its final means of intrusion.
By: Abraham Camba, Gilbert Sison
2022/01/10
Read time: ( words)
Save to Folio
As organizations brace themselves for the year ahead, now is an opportune time to take stock of how they can strengthen their security posture and shore up their defenses. While organizations may have the power of leading-edge cybersecurity solutions on their side, malicious actors continue to work diligently to refine their methods and take advantage of vulnerabilitie
Trendmicro
XDR: Erkennen von mehrschichtigen Angriffen
blogs_trendmicro·2022-01-10
XDR: Erkennen von mehrschichtigen Angriffen
Cyberbedrohungen
## Uncovering and Defending Systems Against Attacks With Layers of Remote Control
The Trend Micro™ Managed XDR team addressed a stealthy multilayered attack that progressed from an exploited endpoint vulnerability to the use of legitimate remote access tools including Remote Desktop Protocol (RDP) as its final means of intrusion.
By: Abraham Camba, Gilbert Sison Jan 10, 2022 Read time: ( words)
Save to Folio
Originalbeitrag von Abraham Camba, Gilbert Sison, Ryan Maglaque, Bedrohungsanalysten
Unternehmen können zwar auf modernste Cybersicherheitslösungen zurückgreifen, aber böswillige Akteure arbeiten auch unermüdlich daran, ihre Methoden zu verfeinern und Schwachstellen bei jeder sich bietenden Gelegenheit auszunutzen. Eine proaktive Denkweise ist daher von entscheid
Unit42
Network Security Trends: August-October 2021
blogs_unit42·2021-12-21·CVSS 9.8
[CRITICAL] Network Security Trends: August-October 2021
## Executive Summary
Unit 42 researchers continually observe network attacks and search for insights that can assist defenders. Here, we summarize key trends from August-October 2021. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity distribution. We also classify vulnerabilities to provide a clear view of the prevalence of, say, cross-site scripting or denial of service.
Additionally, we provide insight into how the vulnerabilities are actively exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls. For example, we chart a timeframe showing how frequently the most commonly exploited vulnerabilities were attacked through networks and the locations from which the att
Unit42
Network Security Trends: August-October 2021
blogs_unit42·2021-12-21·CVSS 9.8
CVE-2021-24499 [CRITICAL] Network Security Trends: August-October 2021
Threat Research Center
Trend Reports
Vulnerabilities
## Network Security Trends: August-October 2021
Yue Guan
Published: December 21, 2021
Trend Reports
Vulnerabilities
Attack analysis
Buffer Overflow
Command injection
Cross-site request forgery
Cross-site scripting
CVE-2021-24499
CVE-2021-26084
CVE-2021-32789
CVE-2021-33357
CVE-2021-33766
CVE-2021-34473
CVE-2021-35395
CVE-2021-38647
CVE-2021-40438
CVE-2021-40870
CVE-2021-41773
CVE-2021-42013
Denial of service
Directory traversal
Exploit in the wild
Improper authentication
Information disclosure
Memory corruption
Network security trends
Out-of-bounds read
Privilege escalation
Remote Code Execution
Security feature bypass
SQL injection
## Executive Summary
Unit 42 researchers continually observe net
Checkpoint
6th December – Threat Intelligence Report
blogs_checkpoint·2021-12-06
CVE-2021-39237 6th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 6th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 6th December, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research has identified ongoing campaigns in Iran using socially engineered SMS messages to infect tens of thousands of citizens’ devices. The SMS, impersonating Iranian government services, lures victims into downloading malicious Android apps that steal credit card credentials, personal SMS messages and 2FA
Securelist
IT threat evolution in Q3 2021. PC statistics
blogs_securelist·2021-11-26
IT threat evolution in Q3 2021. PC statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Ransomware programs
Quarterly trends and highlights
Attack on Kaseya and the REvil story
The arrival of BlackMatter: DarkSide restored?
Q3 closures
Exploitation of vulnerabilities and new attack methods
Number of new ransomware modifications
Number of users attacked by ransomware Trojans
Geography of ransomware attacks
Top 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by cybercriminals during cyberattacks
Quarter highlights
Statistics
Attacks on macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries tha
Securelist
IT threat evolution in Q3 2021. PC statistics
blogs_securelist·2021-11-26
IT threat evolution in Q3 2021. PC statistics
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Number of users attacked by ransomware Trojans
- Geography of ransomware attacks
- Top 10 most common families of ransomware Trojans
- Miners
- Vulnerable applications used by cybercriminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution Q3 2021
- IT threat evolution in Q3 2021. PC statistics
- IT threat evolution in Q3 2021. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q3 2021:
- Kaspersky solutions blocked 1,098,968,315 attacks from online reso
Checkpoint
22nd November – Threat Intelligence Report
blogs_checkpoint·2021-11-22·CVSS 9.8
CVE-2018-13379 [CRITICAL] 22nd November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 22nd November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 22nd November, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Emotet, the most popular and notorious botnet before its takedown ten months ago, is back . Emotet is currently distributed via TrickBot and already launched a worldwide email spam campaign delivering malicious documents. Researchers believe that Conti ransomware gang is behind the botnet’s return.
Check Point Threat E
Trendmicro
Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains
blogs_trendmicro·2021-11-19·CVSS 9.1
[CRITICAL] Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains
Exploits & Vulnerabilities
# Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains
Squirrelwaffle is known for using the tactic of sending malicious spam as replies to existing email chains. We look into how by investigating its exploit of Microsoft Exchange Server vulnerabilities, ProxyLogon and ProxyShell.
By: Sherif Magdy, Abdelrhman Sharshar
2021/11/19
Read time: ( words)
Save to Folio
In September, Squirrelwaffle emerged as a new loader that is spread through spam campaigns. It is known for sending its malicious emails as replies to preexisting email chains, a tactic that lowers a victim’s guard against malicious activities. To be able to pull this off, we believe it involved the use of a chain of both ProxyLogon and ProxyShell exploits.
The Trend Micro Incid
Trendmicro
Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR
blogs_trendmicro·2021-11-17
Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR
Cyber Threats
# Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR
In this blog entry, we will take a look at the ProxyShell vulnerabilities that were being exploited in these events, and dive deeper into the notable post-exploitation routines that were used in four separate incidents involving these web shell attacks.
By: Sherif Magdy, Abdelrhman Sharshar
2021/11/17
Read time: ( words)
Save to Folio
The Trend Micro™ Managed XDR team recently observed a surge in server-side compromises — ProxyShell-related intrusions on Microsoft Exchange in particular via the Managed XDR service and other incident response engagements. These compromises, which occurred across different sectors in the Middle East, were most often observed in environments using on-premise implementatio
Dfir Report
Exchange Exploit Leads to Domain Wide Ransomware
blogs_dfir_report·2021-11-15·CVSS 6.6
[MEDIUM] Exchange Exploit Leads to Domain Wide Ransomware
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Read More
- dragonforce Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Read More
Services Overview
Threat Hunting
-
Integration
CTI Program Advisory
Incident Response Playbook
About us
Contact Us
Collaboration
Careers
Analysts
Access DFIR Labs
Get in Touch
Public Reports
Products Overview
Threat intel Overview
Threat Feed
Private DFIR Reports
All Intel
Active Defense
DFIR Labs
Case Artifacts
Detection Pack
AI Training Ground
Service Overview
Threat Hunting
Integration
CTI Program Advisory
Incident Response Playbook
Company Overview
About us
Contact Us
Careers
Analyst
SQL Brute Force Leads to BlueSky Ransomware
From OneNote to RansomNote: An Ice Col
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01
## Table of Contents
Overview
Directive Scope
CISA Catalog of Known Exploited Vulnerabilities
Detect CISAs Vulnerabilities Using Qualys VMDR
Remediation
Federal Enterprises and Agencies Can Act Now
Summary
Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01 , “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to remediate
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
#### Table of Contents
- Overview
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISAs Vulnerabilities Using Qualys VMDR
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01, “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to
Checkpoint
8th November – Threat Intelligence Report
blogs_checkpoint·2021-11-08
CVE-2021-34473 8th November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 8th November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 8th November, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research warns of scammers using Google Ads to steal crypto wallets, after seeing over $500k worth of cryptocurrency stolen from victims during one weekend. Scammers are placing ads at the top of Google Search that imitate popular wallet brands, such as Phantom and MetaMask, to trick users into giving up their
Checkpoint
6th September – Threat Intelligence Report
blogs_checkpoint·2021-09-05·CVSS 9.8
CVE-2021-34473 [CRITICAL] 6th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 6th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 6th September, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Following the SolarWinds Orion supply-chain attack, the software firm Autodesk announced they identified a compromised server and realized they were also attacked by the Russian linked group Cozy Bear as part of the espionage campaign.
The Thai airline Bangkok Airways has announced they were the target of the LockBit r
Checkpoint
30th August – Threat Intelligence Report
blogs_checkpoint·2021-08-30
CVE-2021-26855 30th August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 30th August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 30th August, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Karapatan, the Philippine human rights alliance, has suffered a massive and prolonged Distributed Denial of Service (DDoS) attack. The attack targeted the online solidarity campaign #StopTheKillingsPH and was allegedly conducted by the local government.
EskyFun, a Chinese mobile gaming company, has suffered a data breach e
Checkpoint
23rd August – Threat Intelligence Report
blogs_checkpoint·2021-08-23
CVE-2019-19781 23rd August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 23rd August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 23rd August, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
The Hive ransomware gang has encrypted computers of Memorial Health System, a chain that operates hospitals and clinics in the US, eventually forcing workers to operate with paper charts and cancel surgeries. Although Hive had previously used “double-extortion” techniques, according to MHS, patients’ data was not stolen.
Ch
Huntress
Microsoft Exchange Servers Still Vulnerable to ProxyShell Exploit | Huntress
blogs_huntress·2021-08-19
Microsoft Exchange Servers Still Vulnerable to ProxyShell Exploit | Huntress
Attackers are actively scanning for vulnerable Microsoft Exchange servers and abusing the latest line of Microsoft Exchange vulnerabilities that were patched earlier this year.
Back in March , we saw multiple zero-day exploits being used to attack on-premises Exchange servers—and it looks like we’re not out of the woods yet. Those who have not patched since April or May July are not safe and could still be exploited.
We recommend you update to the latest security patch, monitor for new indicators of compromise and stay up-to-date on new information as it is released. We will continue to update this post with new findings.
Update #9 - 08/25/2021 @ 7:10pm ET - Added intel regarding hidden webshells with modification times prior to August 2021
Update #8 - 08/23/2021 @ 6:50pm ET - Added ad
Trendmicro
From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell!
blogs_trendmicro·2021-08-18·CVSS 6.6
[MEDIUM] From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell!
## From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell!
Learn about the new attack surface on Microsoft Excahnge discussed at pwn2own 2021.
By: Zero Day Initiative 2021/08/18 Read time: ( words)
Save to Folio
In April 2021, Orange Tsai from DEVCORE Research Team demonstrated a remote code execution vulnerability in Microsoft Exchange during the Pwn2Own Vancouver 2021 contest. In doing so, he earned himself $200,000. Since then, he has disclosed several other bugs in Exchange and presented some of his findings at the recent Black Hat conference. Now that the bugs have been addressed by Microsoft, Orange has graciously provided this detailed write-up of the vulnerabilities he calls “ProxyShell”.
Hi, I am Orange Tsai from DEVCORE Research Team. In this article, I w
Trendmicro
From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell!
blogs_trendmicro·2021-08-18·CVSS 6.6
[MEDIUM] From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell!
## From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell!
Learn about the new attack surface on Microsoft Excahnge discussed at pwn2own 2021.
By: Zero Day Initiative Aug 18, 2021 Read time: ( words)
Save to Folio
In April 2021, Orange Tsai from DEVCORE Research Team demonstrated a remote code execution vulnerability in Microsoft Exchange during the Pwn2Own Vancouver 2021 contest. In doing so, he earned himself $200,000. Since then, he has disclosed several other bugs in Exchange and presented some of his findings at the recent Black Hat conference. Now that the bugs have been addressed by Microsoft, Orange has graciously provided this detailed write-up of the vulnerabilities he calls “ProxyShell”.
Hi, I am Orange Tsai from DEVCORE Research Team. In this article, I
Trendmicro
From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell!
blogs_trendmicro·2021-08-18·CVSS 6.6
[MEDIUM] From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell!
# From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange - ProxyShell!
Learn about the new attack surface on Microsoft Excahnge discussed at pwn2own 2021.
By: Zero Day Initiative
2021/08/18
Read time: ( words)
Save to Folio
In April 2021, Orange Tsai from DEVCORE Research Team demonstrated a remote code execution vulnerability in Microsoft Exchange during the Pwn2Own Vancouver 2021 contest. In doing so, he earned himself $200,000. Since then, he has disclosed several other bugs in Exchange and presented some of his findings at the recent Black Hat conference. Now that the bugs have been addressed by Microsoft, Orange has graciously provided this detailed write-up of the vulnerabilities he calls “ProxyShell”.
Hi, I am Orange Tsai from DEVCORE Research Team. In this article, I w
Checkpoint
16th August – Threat Intelligence Report
blogs_checkpoint·2021-08-16
CVE-2021-34473 16th August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 16th August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 16th August, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research has revealed that the threat actor behinds last month’s cyber-attack on Iran’s train system is “Indra”, a group that identifies itself as Iranian regime opposition. They used similar tools in an attack against companies in Syria in 2019.
Poly Network, a China-based cross-chain decentralized finance (De
Tenable
ProxyShell: Attackers Actively Scanning for Vulnerable Microsoft Exchange Servers (CVE-2021-34473)
blogs_tenable·2021-08-09·CVSS 9.1
[CRITICAL] ProxyShell: Attackers Actively Scanning for Vulnerable Microsoft Exchange Servers (CVE-2021-34473)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Microsoft Patch Tuesday for July 2021 — Snort rules and prominent vulnerabilities
blogs_talos·2021-07-13·CVSS 6.8
[MEDIUM] Microsoft Patch Tuesday for July 2021 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Jaeson Schultz.
Microsoft released its monthly security update Tuesday, disclosing 117 vulnerabilities across its suite of products, by far the most in a month this year. Today’s Patch Tuesday includes three vulnerabilities that Microsoft states are being exploited in the wild, which we will cover in more detail.
There are 13 critical vulnerabilities patched in this month, and there is one low- and moderate-severity vulnerability each. The remainder are considered “important.”
Most notably, Microsoft has released an update to patch the “PrintNightmare” vulnerability in its print spooler function that could allow an attacker to execute remote code. This vulnerability was first disclosed in April, though security researchers later discovered it coul
Trendmicro
July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
blogs_trendmicro·2021-07-13·CVSS 9.1
[CRITICAL] July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
Exploits & Vulnerabilities
# July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle.
By: Trend Micro
2021/07/13
Read time: ( words)
Save to Folio
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle. Thirteen of these were rated as Critical, 103 as Important, and one was classified as Moderate. Fifteen were submitted via the Trend Micro Zero Day Initiative.
PrintNightmare pat
Tenable
Microsoft’s July 2021 Patch Tuesday Includes 116 CVEs (CVE-2021-31979, CVE-2021-33771)
blogs_tenable·2021-07-13·CVSS 7.8
[HIGH] Microsoft’s July 2021 Patch Tuesday Includes 116 CVEs (CVE-2021-31979, CVE-2021-33771)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
blogs_trendmicro·2021-07-13·CVSS 9.1
[CRITICAL] July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
Exploits & Vulnerabilities
## July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle.
By: Trend Micro 2021/07/13 Read time: ( words)
Save to Folio
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle. Thirteen of these were rated as Critical, 103 as Important, and one was classified as Moderate. Fifteen were submitted via the Trend Micro Zero Day Initiative .
PrintNightmare pa
Trendmicro
July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
blogs_trendmicro·2021-07-13·CVSS 9.1
[CRITICAL] July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
Exploits & Vulnerabilities
## July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle.
By: Trend Micro Jul 13, 2021 Read time: ( words)
Save to Folio
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle. Thirteen of these were rated as Critical, 103 as Important, and one was classified as Moderate. Fifteen were submitted via the Trend Micro Zero Day Initiative .
PrintNightmare
Trendmicro
July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
blogs_trendmicro·2021-07-13·CVSS 9.1
[CRITICAL] July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
Exploits y vulnerabilidades
## July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle.
By: Trend Micro Jul 13, 2021 Read time: ( words)
Save to Folio
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle. Thirteen of these were rated as Critical, 103 as Important, and one was classified as Moderate. Fifteen were submitted via the Trend Micro Zero Day Initiative .
PrintNightmare
Trendmicro
July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
blogs_trendmicro·2021-07-13·CVSS 9.1
[CRITICAL] July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
Sfruttamento vulnerabilità
## July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle.
By: Trend Micro Jul 13, 2021 Read time: ( words)
Save to Folio
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle. Thirteen of these were rated as Critical, 103 as Important, and one was classified as Moderate. Fifteen were submitted via the Trend Micro Zero Day Initiative .
PrintNightmare
Trendmicro
July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
blogs_trendmicro·2021-07-13·CVSS 9.1
[CRITICAL] July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
Ausnutzung von Schwachstellen
## July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle.
By: Trend Micro Jul 13, 2021 Read time: ( words)
Save to Folio
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle. Thirteen of these were rated as Critical, 103 as Important, and one was classified as Moderate. Fifteen were submitted via the Trend Micro Zero Day Initiative .
PrintNightma
Talos
Microsoft Patch Tuesday for July 2021 — Snort rules and prominent vulnerabilities
blogs_talos·2021-07-13·CVSS 6.8
[MEDIUM] Microsoft Patch Tuesday for July 2021 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for July 2021 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Jaeson Schultz.
Microsoft released its monthly security update Tuesday, disclosing 117 vulnerabilities across its suite of products, by far the most in a month this year. Today’s Patch Tuesday includes three vulnerabilities that Microsoft states are being exploited in the wild, which we will cover in more detail.
There are 13 critical vulnerabilities patched in this month, and there is one low- and moderate-severity vulnerability each. The remainder are considered “important.”
Most notably, Microsoft has released an update to patch the “PrintNightmare” vulnerability in its print spooler function that could allow an attacker to execute remote code. This vulnerabil
Krebs
Microsoft Patch Tuesday, July 2021 Edition
blogs_krebs·2021-07-13·CVSS 7.8
[HIGH] Microsoft Patch Tuesday, July 2021 Edition
Microsoft today released updates to patch at least 116 security holes in its Windows operating systems and related software. At least four of the vulnerabilities addressed today are under active attack, according to Microsoft.
Thirteen of the security bugs quashed in this month’s release earned Microsoft’s most-dire “critical” rating, meaning they can be exploited by malware or miscreants to seize remote control over a vulnerable system without any help from users.
Another 103 of the security holes patched this month were flagged as “important,” which Microsoft assigns to vulnerabilities “whose exploitation could result in compromise of the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources.”
Among the critical bugs is o
Trendmicro
July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
blogs_trendmicro·2021-07-13·CVSS 9.1
[CRITICAL] July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
Exploits & Vulnerabilities
## July Patch Tuesday: DNS Server, Exchange Server Vulnerabilities Cause Problems
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle.
By: Trend Micro Jul 13, 2021 Read time: ( words)
Save to Folio
After two relatively quiet months, July has proven to be another busy month for Microsoft security bulletins. A total of 117 bulletins were issued for various security vulnerabilities fixed in the July Patch Tuesday cycle. Thirteen of these were rated as Critical, 103 as Important, and one was classified as Moderate. Fifteen were submitted via the Trend Micro Zero Day Initiative .
PrintNightmare
Krebs
Microsoft Patch Tuesday, July 2021 Edition
blogs_krebs·2021-07-13·CVSS 7.8
[HIGH] Microsoft Patch Tuesday, July 2021 Edition
Microsoft today released updates to patch at least 116 security holes in its Windows operating systems and related software. At least four of the vulnerabilities addressed today are under active attack, according to Microsoft.
Thirteen of the security bugs quashed in this month’s release earned Microsoft’s most-dire “critical” rating, meaning they can be exploited by malware or miscreants to seize remote control over a vulnerable system without any help from users.
Another 103 of the security holes patched this month were flagged as “important,” which Microsoft assigns to vulnerabilities “whose exploitation could result in compromise of the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources.”
Among the critical bugs is o
Recorded Future
H1 2022: Malware and Vulnerability Trends Report
blogs_recorded_future
H1 2022: Malware and Vulnerability Trends Report
# H1 2022: Malware and Vulnerability Trends Report
Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF.
This report examines trends in malware use, distribution, and development, and high-risk vulnerabilities disclosed by major hardware and software vendors between January 1 and June 30, 2022. Data was assembled from the Recorded Future® Platform, open-source intelligence (OSINT), and public reporting on NVD data. This report will assist threat hunters and security operations center (SOC) teams in strengthening their security posture by prioritizing hunting techniques and detection methods based on this research and data along with vulnerability teams looking for ways to prioritize patching and identify
Crowdstrike
Common Vulnerabilities & Exposures (CVE)
blogs_crowdstrike
Common Vulnerabilities & Exposures (CVE)
Upcoming events
Conference
CrowdTour
Find a city near you
Your Cart
Added to Cart
There's nothing in your cart
per endpoint / per year
per endpoint / per month
Login
Login
Experienced a breach?
Contact us
Businesses today are more at risk from cybersecurity attacks and data breaches than ever before. Data theft and ransomware attacks from vulnerabilities and exposures can cause millions of dollars in damages for corporations.
But what exactly are vulnerabilities and exposures? We can describe a vulnerability as a fault or weakness within a computer system or software that can grant unintended levels of access to a user . Vulnerabilities allow attackers to perform destructive actions on a computer system or network, such as installing malware or gaining unauthorized access to
Threat Intel
Magic Hound (Magic Hound, TA453, COBALT ILLUSION)
threat_intel·CVSS 9.1
[CRITICAL] Magic Hound (Magic Hound, TA453, COBALT ILLUSION)
# Threat Actor Profile: Magic Hound
ATT&CK ID: G0059
Also known as: Magic Hound, TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35, Mint Sandstorm
Suspected origin: Iran
## Overview
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Pr
Greynoiseio
GreyNoise
blogs_greynoiseio·CVSS 8.8
[HIGH] GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Sentinelone
Conti
blogs_sentinelone·CVSS 6.6
[MEDIUM] Conti
# Conti Ransomware: In-Depth Analysis, Detection, Mitigation
## What Is Conti Ransomware?
Conti has proven to be an agile and adept malware threat, capable of both autonomous and guided operation and unparalleled encryption speed. As of June 2021, Conti’s unique feature set has helped its affiliates extort several million dollars from over 400 organizations.
Conti is developed and maintained by the TrickBot gang, and it is mainly operated through a RaaS affiliation model. The Conti ransomware is derived from the codebase of Ryuk and relies on the same TrickBot infrastructure.
## History of Conti Ransomware
Conti Ransomware was first discovered in 2019 by researchers at the cybersecurity firm Check Point. Conti Ransomware is known for its high-level encryption and sophisticated tactics
Huntress
Microsoft Exchange Servers Still Vulnerable to ProxyShell Exploit | Huntress
blogs_huntress
Microsoft Exchange Servers Still Vulnerable to ProxyShell Exploit | Huntress
Attackers are actively scanning for vulnerable Microsoft Exchange servers and abusing the latest line of Microsoft Exchange vulnerabilities that were patched earlier this year.
Back in March, we saw multiple zero-day exploits being used to attack on-premises Exchange servers—and it looks like we’re not out of the woods yet. Those who have not patched since April or May July are not safe and could still be exploited.
We recommend you update to the latest security patch, monitor for new indicators of compromise and stay up-to-date on new information as it is released. We will continue to update this post with new findings.
- Update #9 - 08/25/2021 @ 7:10pm ET - Added intel regarding hidden webshells with modification times prior to August 2021
- Update #8 - 08/23/2021 @ 6:50pm ET - Added
Crowdstrike
July 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] July 2021 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Greynoiseio
Vulnerability Checks of Exchange ProxyShell (CVE-2021-34473)
blogs_greynoiseio·CVSS 9.1
[CRITICAL] Vulnerability Checks of Exchange ProxyShell (CVE-2021-34473)
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Sentinelone
Hive
blogs_sentinelone·CVSS 9.8
[CRITICAL] Hive
# Hive Ransomware: In-Depth Analysis, Detection, Mitigation
## Summary of Hive Ransomware
Hive ransomware emerged in June 2021. Hive practices double extortion, demanding payment for a decryptor as well as for the non-release of stolen data. Hive operates as a RaaS (Ransomware-as-a-Service) and their campaigns are characterized as being aggressive and rapid. The payloads are non-stealth in their execution and full drive encryption can be achieved in just a few minutes. Hive operators make significant use of COTS tools and LOLBins during all stages of attack. They are also known to frequently attack healthcare and education organizations.
## What Does Hive Ransomware Target?
Hive ransomware targets a wide range of industries including healthcare, finance, retail, energy and manufacturin
Crowdstrike
Common Vulnerabilities & Exposures (CVE)
blogs_crowdstrike
Common Vulnerabilities & Exposures (CVE)
Upcoming events
Conference
CrowdTour
Find a city near you
Login
Your Cart
Added to Cart
There's nothing in your cart
per endpoint / per year
per endpoint / per month
Login
Experienced a breach?
Contact us
Businesses today are more at risk from cybersecurity attacks and data breaches than ever before. Data theft and ransomware attacks from vulnerabilities and exposures can cause millions of dollars in damages for corporations.
But what exactly are vulnerabilities and exposures? We can describe a vulnerability as a fault or weakness within a computer system or software that can grant unintended levels of access to a user . Vulnerabilities allow attackers to perform destructive actions on a computer system or network, such as installing malware or gaining unauthorized access to
Sentinelone
AvosLocker
blogs_sentinelone
AvosLocker
# AvosLocker Ransomware: In-Depth Analysis, Detection, and Mitigation
## Summary of AvosLocker Ransomware
AvosLocker is one of the more recent ransomware families that came to fill the void left by REvil. It was first spotted in July 2021 and has since come up with several variants released over time. They also used this avenue to recruit additional team members and Initial Access Brokers (IABs). AvosLocker practices double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data. AvosLocker launched with support for Windows payloads only, however a Linux variant was later released.AvosLocker operates as a ransomware-as-a-service (RaaS) model, targeting organizations based on their ability to pay the demanded ransom. While less prominent or active than
Crowdstrike
July 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] July 2021 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
Vulnerabilidades y exposiciones comunes (CVE)
blogs_crowdstrike
Vulnerabilidades y exposiciones comunes (CVE)
Próximos eventos
Conferencia
CrowdTour
Encuentra la ciudad más cercana
Inicio de sesión
Tu cesta
Añadido a la cesta
Tu cesta está vacía
por endpoint / por año
al mes por endpoint
Inicio de sesión
¿Has sufrido una brecha de seguridad?
Contacto
En la actualidad, las empresas corren más riesgo que nunca de sufrir ataques de ciberseguridad y brechas de datos. El robo de datos y los ataques de ransomware a partir de vulnerabilidades y exposiciones pueden causar millones de dólares en daños a las corporaciones.
Pero, ¿qué son exactamente las vulnerabilidades y las exposiciones? Podemos describir una vulnerabilidad como un error o punto débil dentro de un sistema informático o software que puede conceder niveles no deseados de acceso a un usuario . Las vulnerabilidades permiten a lo
Sentinelone
Moses Staff
blogs_sentinelone·CVSS 6.6
[MEDIUM] Moses Staff
# Moses Staff Ransomware: In-Depth Analysis, Detection, and Mitigation
## What is Moses Staff Ransomware?
Moses Staff, emerging in late 2021, is a politically driven cyber threat group with roots in Iran. This ransomware stands out for its multifaceted extortion approach, use of custom-built tools, and exploitation of known vulnerabilities like ProxyShell. Notably, they actively use social media platforms like Twitter and Telegram to update and publicly shame their victims, showcasing a unique blend of technical and psychological warfare.
## What Does Moses Staff Ransomware Target?
Moses Staff has a specific focus on sectors crucial to societal functioning – government, healthcare, engineering, and finance. Indicative of geo-specific intentions, their initial onslaught in 2021 predomin
Greynoiseio
Malicious Tag Roundup (Aug 2-16, 2021)
blogs_greynoiseio·CVSS 6.6
[MEDIUM] Malicious Tag Roundup (Aug 2-16, 2021)
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473https://www.zerodayinitiative.com/advisories/ZDI-21-821/http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473https://www.zerodayinitiative.com/advisories/ZDI-21-821/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34473
2021-07-14
Published
2021-11-03
Added to CISA KEV
Exploited in the wild