CVE-2021-40444
published 2021-09-15CVE-2021-40444: Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks…
PriorityP191high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2021-11-17
Exploited in the wild
EPSS
97.24%
99.9th percentile
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.
An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”.
Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.
Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability.
UPDATE September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.
Affected
59 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.19060 | 10.0.10240.19060 |
| microsoft | windows_10_1607 | < 10.0.14393.4651 | 10.0.14393.4651 |
| microsoft | windows_10_1809 | < 10.0.17763.2183 | 10.0.17763.2183 |
| microsoft | windows_10_1909 | < 10.0.18363.1801 | 10.0.18363.1801 |
| microsoft | windows_10_2004 | < 10.0.19041.1237 | 10.0.19041.1237 |
| microsoft | windows_10_20h2 | < 10.0.19042.1237 | 10.0.19042.1237 |
| microsoft | windows_10_21h1 | < 10.0.19043.1237 | 10.0.19043.1237 |
| microsoft | windows_10_version_1507 | >= 10.0.0 < 10.0.10240.19060 | 10.0.10240.19060 |
| microsoft | windows_10_version_1607 | >= 10.0.0 < 10.0.14393.4651 | 10.0.14393.4651 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.2183 | 10.0.17763.2183 |
| microsoft | windows_10_version_1909 | >= 10.0.0 < 10.0.18363.1801 | 10.0.18363.1801 |
| microsoft | windows_10_version_2004 | >= 10.0.0 < 10.0.19041.1237 | 10.0.19041.1237 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.1237 | 10.0.19042.1237 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.1237 | 10.0.19043.1237 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.25712 | 6.1.7601.25712 |
| microsoft | windows_7 | >= 6.1.0 < 1.001 | 1.001 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.26221 | 6.1.7601.26221 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.25712 | 6.1.7601.25712 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 1.001 | 1.001 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.26221 | 6.1.7601.26221 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20120 | 6.3.9600.20120 |
| microsoft | windows_8.1 | >= 6.3.0 < 1.001 | 1.001 |
| microsoft | windows_server_2004 | < 10.0.19041.1237 | 10.0.19041.1237 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.0.0 < 6.1.7601.25712 | 6.1.7601.25712 |
Detection & IOCsextracted from sources · hover to see the quote
urlhxxp://www.code-nana.com/pjje/?t8LP2P=Mf6ydddwV/QU6mZ4nnZxMBdzDcAr2xsvfTgD82WAzYYrxOcjLRrG5mXLygKxYmvGqlzJAQ==&kPq8=K4Nh-6↗
urlhxxp://www.rajuherbalandspicegarden.com/pjje/?t8LP2P=DltNRLklEPawWuNnsQXifEZmZKsLvkDXv3cKYhiC/0Bh3Q72JrrG/8woD25qq/vxSOxjNQ==&kPq8=K4Nh-6↗
urlhxxp://www.swaplenders.com/pjje/?t8LP2P=TQtLDRoafbQM4/pEtdovke1/MPx0w24gCyByZx68z3lV5KTK6L4nUj2UtH2v2BgU+KkBhg==&kPq8=K4Nh-6↗
urlhxxp://www.thechiropractor.vegas/pjje/?t8LP2P=rpNmzTsgN3WrlTJLsfA2BlL5A0hwTnOMjBBWuUAz4iRkWF3ty9m96ejMesY0+5JvVxns9g==&kPq8=K4Nh-6↗
- →Exploit delivers a DLL disguised with a non-DLL extension (e.g. .inf) inside a CAB archive; hunt for DLL files with .inf or other mismatched extensions dropped from Office processes ↗
- →Exploit chain uses CPL file execution to load the dropped DLL; monitor for control panel (rundll32/control.exe) loading unexpected DLLs spawned from Office processes ↗
- →FormBook campaign stages second PowerShell payload hosted on Discord CDN (cdn.discordapp.com/attachments/); alert on Office or PowerShell processes fetching content from Discord attachment URLs ↗
- →Exploit JavaScript uses CLSID edbc374c-5730-432a-b5b8-de94f0b57217 to check/load the CAB-delivered ActiveX control; presence of this CLSID in Office-spawned browser engine activity is a strong indicator of CVE-2021-40444 exploitation ↗
- →Kaspersky detects CVE-2021-40444 exploitation attempts with verdict HEUR:Exploit.MSOffice.CVE-2021-40444.a; use this signature name for cross-vendor threat hunting ↗
- →FortiGuard IPS signature MS.Office.MSHTML.Remote.Code.Execution covers network-level detection of CVE-2021-40444 exploitation traffic ↗
- →Sender address [email protected] was associated with the CVE-2021-40444 testing-phase phishing email delivering Request Details.docx; use as an email IOC ↗
- ·Microsoft Defender Antivirus detection build 1.349.22.0 or newer is required for CVE-2021-40444 coverage; earlier builds will not detect the known exploitation samples ↗
- ·FortiGuard AV definitions version 88.00961 (or 88.00798 for W64/Agent.ASO!tr) are required for the listed AV signatures to fire; older definition sets will not cover these samples ↗
- ·Disabling ActiveX controls in Internet Explorer via registry edits is an effective mitigation but must be performed carefully; incorrect registry edits can cause severe OS issues ↗
- ·FortiGuard CDR protection requires the 'Enable/disable stripping of linked objects in Microsoft Office documents' option to be explicitly enabled; it is not on by default ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck8.8HIGH
cisa7.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Project0
2022 0-day In-the-Wild Exploitation…so far - Project Zero
project_zero·2022-06-01·CVSS 8.8
CVE-2016-5128 [HIGH] 2022 0-day In-the-Wild Exploitation…so far - Project Zero
Posted by Maddie Stone, Google Project Zero
This blog post is an overview of a talk, “ 0-day In-the-Wild Exploitation in 2022…so far”, that I gave at the FIRST conference in June 2022. The slides are available here.
For the last three years, we’ve published annual year-in-review reports of 0-days found exploited in the wild. The most recent of these reports is the 2021 Year in Review report, which we published just a few months ago in April. While we plan to stick with that annual cadence, we’re publishing a little bonus report today looking at the in-the-wild 0-days detected and disclosed in the first half of 2022.
As of June 15, 2022, there have been 18 0-days detected and disclosed as exploited in-the-wild in 2022. When we analyzed those 0-days, we found that at least nin
GHSA
GHSA-2h32-fhf6-xhh5: Microsoft MSHTML Remote Code Execution Vulnerability
ghsa_unreviewed·2022-05-24
CVE-2021-40444 [HIGH] CWE-22 GHSA-2h32-fhf6-xhh5: Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft MSHTML Remote Code Execution Vulnerability
Project0
The More You Know, The More You Know You Don’t Know - Project Zero
project_zero·2022-04-01
CVE-2016-4654 The More You Know, The More You Know You Don’t Know - Project Zero
A Year in Review of 0-days Used In-the-Wild in 2021
Posted by Maddie Stone, Google Project Zero
This is our third annual year in review of 0-days exploited in-the-wild [2020, 2019]. Each year we’ve looked back at all of the detected and disclosed in-the-wild 0-days as a group and synthesized what we think the trends and takeaways are. The goal of this report is not to detail each individual exploit, but instead to analyze the exploits from the year as a group, looking for trends, gaps, lessons learned, successes, etc. If you’re interested in the analysis of individual exploits, please check out our root cause analysis repository.
We perform and share this analysis in order to make 0-day hard. We want it to be more costly, more resource intensive, and overall more difficult for
VulnCheck
Microsoft MSHTML Remote Code Execution Vulnerability
vulncheck·2021·CVSS 8.8
CVE-2021-40444 [HIGH] CWE-22 Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.
Affected: Microsoft MSHTML
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2021-Sep; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.microsoft.com/en-us/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/; https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/; https://www.riskiq.com/blog/external-threat-management/wizard-spider-windows-0day-exploit/; https://www.
CISA
Microsoft MSHTML Remote Code Execution Vulnerability
cisa·2021-11-03·CVSS 7.8
CVE-2021-40444 [HIGH] CWE-22 Microsoft MSHTML Remote Code Execution Vulnerability
Vulnerability: Microsoft MSHTML Remote Code Execution Vulnerability
Affected: Microsoft MSHTML
Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-40444
Remediation Due Date: 2021-11-17
Microsoft
Microsoft MSHTML Remote Code Execution Vulnerability
vendor_msrc·2021-09-14·CVSS 8.8
CVE-2021-40444 [HIGH] Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft MSHTML Remote Code Execution Vulnerability
Description: Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.
An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections fo
No detection rules found.
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Securelist
Exploits and vulnerabilities in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Exploits and vulnerabilities in Q3 2024
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most prevalent exploits
Vulnerability exploitation in APT attacks
Interesting vulnerabilities
CVE-2024-47177 (CUPS filters)
CVE-2024-38112 (MSHTML Spoofing)
CVE-2024-6387 (regreSSHion)
CVE-2024-3183 (Free IPA)
CVE-2024-45519 (Zimbra)
CVE-2024-5290 (Ubuntu wpa_supplicant)
Conclusion and advice
Authors
Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Co
Securelist
Analyzing the vulnerability landscape in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Analyzing the vulnerability landscape in Q3 2024
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- Interesting vulnerabilities
- CVE-2024-47177 (CUPS filters)
- CVE-2024-38112 (MSHTML Spoofing)
- CVE-2024-6387 (regreSSHion)
- CVE-2024-3183 (Free IPA)
- CVE-2024-45519 (Zimbra)
- CVE-2024-5290 (Ubuntu wpa_supplicant)
- Conclusion and advice
Authors
- Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Common Log Filing System (CLFS) in Windows, so the number
Securelist
Exploits and vulnerabilities in Q2 2024
blogs_securelist·2024-08-21·CVSS 7.8
CVE-2024-26169 [HIGH] Exploits and vulnerabilities in Q2 2024
Table of Contents
Statistics on registered vulnerabilities
Vulnerability exploitation statistics
Windows and Linux vulnerability exploitation
Most common exploits
Vulnerability exploitation in APT attacks
Exploiting vulnerable drivers to attack operating systems
BYOVD attack tools
Interesting vulnerabilities
CVE-2024-26169 (WerKernel.sys)
CVE-2024-26229 (csc.sys)
CVE-2024-4577 (PHP CGI)
Takeaways and recommendations
Authors
Vitaly Morgunov
Alexander Kolesnikov
Q2 2024 was eventful in terms of new interesting vulnerabilities and exploitation techniques for applications and operating systems. Attacks through vulnerable drivers have become prevalent as a general means of privilege escalation in the operating system. Such attacks are notable in that the vulnerability does not h
Securelist
Analyzing the vulnerability landscape in Q2 2024
blogs_securelist·2024-08-21·CVSS 7.8
CVE-2024-26169 [HIGH] Analyzing the vulnerability landscape in Q2 2024
Table of Contents
- Statistics on registered vulnerabilities
- Vulnerability exploitation statistics
- Vulnerability exploitation in APT attacks
- Exploiting vulnerable drivers to attack operating systems
- Interesting vulnerabilities
- CVE-2024-26169 (WerKernel.sys)
- CVE-2024-26229 (csc.sys)
- CVE-2024-4577 (PHP CGI)
- Takeaways and recommendations
Authors
- Vitaly Morgunov
- Alexander Kolesnikov
Q2 2024 was eventful in terms of new interesting vulnerabilities and exploitation techniques for applications and operating systems. Attacks through vulnerable drivers have become prevalent as a general means of privilege escalation in the operating system. Such attacks are notable in that the vulnerability does not have to be fresh, since attackers themselves deliver unpatched drivers to t
Trendmicro
CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
blogs_trendmicro·2024-07-15·CVSS 7.5
CVE-2024-38112 [HIGH] CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Exploits & Vulnerabilities
## CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Our threat hunters discovered CVE-2024-38112, which was used as a zero-day by APT group Void Banshee, to access and execute files through the disabled Internet Explorer using MSHTML. We promptly identified and reported this zero-day vulnerability to Microsoft, and it has been patched.
By: Peter Girnus, Aliakbar Zahravi 2024/07/15 Read time: ( words)
Save to Folio
Report Highlights:
In May, ZDI threat hunters under Trend Micro’s Zero Day Initiative discovered a vulnerability that the APT group Void Banshee had been exploiting in an updated Atlantida Stealer campaign. We promptly identified and reported this as a zero-day vulnerability to Microsoft.
The
Trendmicro
CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
blogs_trendmicro·2024-07-15·CVSS 7.5
CVE-2024-38112 [HIGH] CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Exploits y vulnerabilidades
## CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Our threat hunters discovered CVE-2024-38112, which was used as a zero-day by APT group Void Banshee, to access and execute files through the disabled Internet Explorer using MSHTML. We promptly identified and reported this zero-day vulnerability to Microsoft, and it has been patched.
By: Peter Girnus, Aliakbar Zahravi Jul 15, 2024 Read time: ( words)
Save to Folio
Report Highlights:
In May, ZDI threat hunters under Trend Micro’s Zero Day Initiative discovered a vulnerability that the APT group Void Banshee had been exploiting in an updated Atlantida Stealer campaign. We promptly identified and reported this as a zero-day vulnerability to Microsoft.
Trendmicro
CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
blogs_trendmicro·2024-07-15·CVSS 7.5
CVE-2024-38112 [HIGH] CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Ausnutzung von Schwachstellen
## CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Our threat hunters discovered CVE-2024-38112, which was used as a zero-day by APT group Void Banshee, to access and execute files through the disabled Internet Explorer using MSHTML. We promptly identified and reported this zero-day vulnerability to Microsoft, and it has been patched.
By: Peter Girnus, Aliakbar Zahravi Jul 15, 2024 Read time: ( words)
Save to Folio
Report Highlights:
In May, ZDI threat hunters under Trend Micro’s Zero Day Initiative discovered a vulnerability that the APT group Void Banshee had been exploiting in an updated Atlantida Stealer campaign. We promptly identified and reported this as a zero-day vulnerability to Microsoft.
Trendmicro
CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
blogs_trendmicro·2024-07-15·CVSS 7.5
CVE-2024-38112 [HIGH] CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Exploits & Vulnerabilities
## CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Our threat hunters discovered CVE-2024-38112, which was used as a zero-day by APT group Void Banshee, to access and execute files through the disabled Internet Explorer using MSHTML. We promptly identified and reported this zero-day vulnerability to Microsoft, and it has been patched.
By: Peter Girnus, Aliakbar Zahravi Jul 15, 2024 Read time: ( words)
Save to Folio
Report Highlights:
In May, ZDI threat hunters under Trend Micro’s Zero Day Initiative discovered a vulnerability that the APT group Void Banshee had been exploiting in an updated Atlantida Stealer campaign. We promptly identified and reported this as a zero-day vulnerability to Microsoft.
T
Trendmicro
CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
blogs_trendmicro·2024-07-15·CVSS 7.5
CVE-2024-38112 [HIGH] CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Exploits & Vulnerabilities
# CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Our threat hunters discovered CVE-2024-38112, which was used as a zero-day by APT group Void Banshee, to access and execute files through the disabled Internet Explorer using MSHTML. We promptly identified and reported this zero-day vulnerability to Microsoft, and it has been patched.
By: Peter Girnus, Aliakbar Zahravi
2024/07/15
Read time: ( words)
Save to Folio
Report Highlights:
- In May, ZDI threat hunters under Trend Micro’s Zero Day Initiative discovered a vulnerability that the APT group Void Banshee had been exploiting in an updated Atlantida Stealer campaign. We promptly identified and reported this as a zero-day vulnerability to Microsoft.
-
Checkpoint
Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112)
blogs_checkpoint·2024-07-09·CVSS 8.8
CVE-2024-38112 [HIGH] Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112)
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112)
by Haifei Li
## Introduction and Background
Check Point R
Fortinet
MerkSpy: Exploiting CVE-2021-40444 to Infiltrate Systems | FortiGuard Labs
blogs_fortinet·2024-06-27·CVSS 8.8
CVE-2021-40444 [HIGH] MerkSpy: Exploiting CVE-2021-40444 to Infiltrate Systems | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
MerkSpy: Exploiting CVE-2021-40444 to Infiltrate Systems
CVE-2021-40444 Exploitation
ShellCode Preparation
ShellCode
MerkSpy
Conclusion
Fortinet Protections
IOCs
IP Addresses
Files
By Cara Lin | June 27, 2024
Affected Platforms: Microsoft Windows
Impacted Users: Microsoft Windows
Impact: The stolen information can be used for future attack
Severity Level: High
Spyware is malicious software engineered to covertly monitor and gather information from a user’s computer without their awareness or consent. It can record activities like keystrokes, browsing behavior, and personal information, often transmitting this data to a third party for espionage or theft.
FortiGuard Labs recently detected an attack exploiting the CVE-2021-40444 vulnerability in Microsoft
Unit42
In-Depth Analysis of July 2023 Exploit Chain Featuring CVE-2023-36884 and CVE-2023-36584
blogs_unit42·2023-11-13·CVSS 5.4
CVE-2023-36584 [MEDIUM] In-Depth Analysis of July 2023 Exploit Chain Featuring CVE-2023-36884 and CVE-2023-36584
## Executive Summary
During our analysis of a July 2023 campaign targeting groups supporting Ukraine's admission into NATO, we discovered a new vulnerability for bypassing Microsoft's Mark-of-the-Web (MotW) security feature. This activity has been attributed by the community to the pro-Russian APT group known as Storm-0978 (also known as the RomCom Group, in reference to their use of the RomCom backdoor). This group used a highly complex and well-developed exploit chain leveraging a remote code execution (RCE) vulnerability in Microsoft Office designated CVE-2023-36884 to infect its targets with malware.
Our investigation revealed a new exploit method related to CVE-2023-36884 that can bypass MotW. Microsoft awarded our team a bug bounty and assigned CVE-2023-36584 (CVSS score 5) to this
Unit42
In-Depth Analysis of July 2023 Exploit Chain Featuring CVE-2023-36884 and CVE-2023-36584
blogs_unit42·2023-11-13·CVSS 5.4
CVE-2023-36884 [MEDIUM] In-Depth Analysis of July 2023 Exploit Chain Featuring CVE-2023-36884 and CVE-2023-36584
Threat Research Center
Threat Research
Vulnerabilities
## In-Depth Analysis of July 2023 Exploit Chain Featuring CVE-2023-36884 and CVE-2023-36584
Eli Birkan
Dan Yashnik
Oriel Cochavi
Bar Lahav
Mike Harbison
Published: November 13, 2023
Malware
Threat Research
Vulnerabilities
CVE-2023-36584
CVE-2023-36884
Exploit
Microsoft Office
Microsoft Vulnerability
Remote Code Execution
RomCom
Storm-0978
Ukraine
## Executive Summary
During our analysis of a July 2023 campaign targeting groups supporting Ukraine's admission into NATO, we discovered a new vulnerability for bypassing Microsoft's Mark-of-the-Web (MotW) security feature. This activity has been attributed by the community to the pro-Russian APT group known as Storm-0978 (also known as the RomCom Group, in referenc
Fortinet
LokiBot Campaign Targets Microsoft Office Document Using Vulnerabilities and Macros | FortiGuard Labs
blogs_fortinet·2023-07-12·CVSS 8.8
CVE-2021-40444 [HIGH] LokiBot Campaign Targets Microsoft Office Document Using Vulnerabilities and Macros | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
LokiBot Campaign Targets Microsoft Office Document Using Vulnerabilities and Macros
By Cara Lin | July 12, 2023
Affected platforms: Microsoft Windows
Impacted parties: Windows users
Impact: Control and collect sensitive information from a victim’s device
Severity level: Critical
In a recent FortiGuard Labs investigation, we came across several malicious Microsoft Office documents designed to exploit known vulnerabilities. Specifically, CVE-2021-40444 and CVE-2022-30190 are remote code execution vulnerabilities. Exploiting these vulnerabilities allowed the attackers to embed malicious macros within Microsoft documents that, when executed, dropped the LokiBot malware onto the victim's system. LokiBot, also known as Loki PWS, has been a well-known informati
Tenable
Microsoft’s July 2023 Patch Tuesday Addresses 130 CVEs (CVE-2023-36884)
blogs_tenable·2023-07-11·CVSS 7.5
[HIGH] Microsoft’s July 2023 Patch Tuesday Addresses 130 CVEs (CVE-2023-36884)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
Black Basta
blogs_sentinelone·2022-11-30
Black Basta
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Securelist
IT threat evolution in Q3 2022. Non-mobile statistics
blogs_securelist·2022-11-18
IT threat evolution in Q3 2022. Non-mobile statistics
Table of Contents
Quarterly figures
Financial threats
Number of users attacked by banking malware
TOP 10 banking malware families
Geography of financial malware attacks
Ransomware programs
Quarterly trends and highlights
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
TOP 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by criminals during cyberattacks
Quarterly highlights
Vulnerability statistics
Attacks on macOS
TOP 20 threats for macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries and territories that serve as sources of web-ba
Securelist
PC malware statistics, Q3 2022
blogs_securelist·2022-11-18
PC malware statistics, Q3 2022
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by criminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q3 2022
- IT threat evolution in Q3 2022. Non-mobile statistics
- IT threat evolution in Q3 2022. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q3 2022:
- Kaspersky solutions blocked 956,074,958 attacks from online resources across the globe.
- Web Anti-Virus recognized 251,288,987 unique URLs as malicious.
- Attempts to run malware fo
Tenable
Cybersecurity Snapshot: 6 Things That Matter Right Now
blogs_tenable·2022-08-19
Cybersecurity Snapshot: 6 Things That Matter Right Now
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Analyzing the Vulnerabilities Associated with the Top Malware Strains of 2021
blogs_tenable·2022-08-04
Analyzing the Vulnerabilities Associated with the Top Malware Strains of 2021
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Elastic
FORMBOOK Adopts CAB-less Approach — Elastic Security Labs
blogs_elastic·2022-06-07·CVSS 8.8
CVE-2021-40444 [HIGH] FORMBOOK Adopts CAB-less Approach — Elastic Security Labs
7 June 2022•Derek Ditch•Daniel Stepanic•Seth Goodwin•Andrew Pease
# FORMBOOK Adopts CAB-less Approach
Campaign research and analysis of an observed FORMBOOK intrusion attempt.
13 min readThreat Intelligence
The Elastic Intelligence & Analytics team is tracking a new FORMBOOK information-stealing campaign leveraging the MSHTML remote code exploit (CVE-2021-40444). This campaign has been observed sharing infrastructure between the Weaponization phases of both the testing and production releases.
We have observed, and will discuss, three phases of this campaign relevant to defenders:
- Testing phase using CVE-2021-40444
- Production phase using CVE-2021-40444
- Generic phase without CVE-2021-40444
As of November 8, 2021, Elastic observed network infrastructure actively being used to de
Elastic
FORMBOOK Adopts CAB-less Approach — Elastic Security Labs
blogs_elastic·2022-06-07·CVSS 8.8
CVE-2021-40444 [HIGH] FORMBOOK Adopts CAB-less Approach — Elastic Security Labs
## FORMBOOK Adopts CAB-less Approach
Campaign research and analysis of an observed FORMBOOK intrusion attempt.
The Elastic Intelligence & Analytics team is tracking a new FORMBOOK information-stealing campaign leveraging the MSHTML remote code exploit ( CVE-2021-40444 ). This campaign has been observed sharing infrastructure between the Weaponization phases of both the testing and production releases.
We have observed, and will discuss, three phases of this campaign relevant to defenders:
Testing phase using CVE-2021-40444
Production phase using CVE-2021-40444
Generic phase without CVE-2021-40444
As of November 8, 2021, Elastic observed network infrastructure actively being used to deploy the FORMBOOK information stealer and acting as a command and control endpoint serving archives,
Securelist
CVE-2022-30190 (Follina) vulnerability in MSDT: description and counteraction
blogs_securelist·2022-06-06·CVSS 7.8
CVE-2022-30190 [HIGH] CVE-2022-30190 (Follina) vulnerability in MSDT: description and counteraction
Table of Contents
CVE-2022-30190 technical details
Protecting against Follina
Authors
AMR
At the end of May, researchers from the nao_sec team reported a new zero-day vulnerability in Microsoft Support Diagnostic Tool (MSDT) that can be exploited using Microsoft Office documents. It allowed attackers to remotely execute code on Windows systems, while the victim could not even open the document containing the exploit, or open it in Protected Mode. The vulnerability, which the researchers dubbed Follina, later received the identifier CVE-2022-30190 .
## CVE-2022-30190 technical details
Briefly, the exploitation of the CVE-2022-30190 vulnerability can be described as follows. The attacker creates an MS Office document with a link to an external malicious OLE object ( word/_rels/documen
Securelist
CVE-2022-30190 (Follina) vulnerability in MSDT: description and counteraction
blogs_securelist·2022-06-06·CVSS 7.8
CVE-2022-30190 [HIGH] CVE-2022-30190 (Follina) vulnerability in MSDT: description and counteraction
Table of Contents
- CVE-2022-30190 technical details
- Protecting against Follina
Authors
- AMR
At the end of May, researchers from the nao_sec team reported a new zero-day vulnerability in Microsoft Support Diagnostic Tool (MSDT) that can be exploited using Microsoft Office documents. It allowed attackers to remotely execute code on Windows systems, while the victim could not even open the document containing the exploit, or open it in Protected Mode. The vulnerability, which the researchers dubbed Follina, later received the identifier CVE-2022-30190.
## CVE-2022-30190 technical details
Briefly, the exploitation of the CVE-2022-30190 vulnerability can be described as follows. The attacker creates an MS Office document with a link to an external malicious OLE object (word/_rels/doc
Tenable
CVE-2022-30190: Zero Click Zero Day in Microsoft Support Diagnostic Tool Exploited in the Wild
blogs_tenable·2022-05-31·CVSS 7.8
[HIGH] CVE-2022-30190: Zero Click Zero Day in Microsoft Support Diagnostic Tool Exploited in the Wild
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Huntress
Rapid Response: Microsoft Office RCE - “Follina” MSDT Attack | Huntress
blogs_huntress·2022-05-30·CVSS 7.8
[HIGH] Rapid Response: Microsoft Office RCE - “Follina” MSDT Attack | Huntress
This post, as is the norm for emerging threats, is a developing article and may be subject to change as the Huntress team learns more about this attack vector and new information is available.
UPDATE 4:51pm ET June 14, 2022:
Microsoft announced an available patch for the Follina exploit. Our team has been working to validate the patch, and we have tested and verified that the patch is effective both for Windows 10 and Windows 11:
Just to note, your KB# may vary based on your operating system—check out Microsoft's update for the full list.
Below, the code fails to execute on Windows 10:
In the below image, the raw command fails on Windows 10:
UPDATE 11:16pm ET May 30, 2022:
Microsoft has now revealed the CVE identifier for this vulnerability is CVE-2022-30190 , including a Security U
Securelist
IT threat evolution in Q1 2022. Non-mobile statistics
blogs_securelist·2022-05-27
IT threat evolution in Q1 2022. Non-mobile statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Geography of financial malware attacks
TOP 10 banking malware families
Ransomware programs
Quarterly trends and highlights
Law enforcement successes
HermeticWiper, HermeticRansom and RUransom, etc.
Conti source-code leak
Attacks on NAS devices
Maze Decryptor
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
TOP 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by criminals during cyberattacks
Quarter highlights
Vulnerability statistics
Attacks on macOS
Geography of threats for macOS
IoT attacks
IoT threat
Securelist
PC malware statistics, Q1 2022
blogs_securelist·2022-05-27
PC malware statistics, Q1 2022
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by criminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q1 2022
- IT threat evolution in Q1 2022. Non-mobile statistics
- IT threat evolution in Q1 2022. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q1 2022:
- Kaspersky solutions blocked 1,216,350,437 attacks from online resources across the globe.
- Web Anti-Virus recognized 313,164,030 unique URLs as malicious.
- Attempts to run malware
Checkpoint
21st March – Threat Intelligence Report
blogs_checkpoint·2022-03-21
CVE-2022-0811 21st March – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 21st March – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 21st March, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research has found sensitive data of a number of mobile applications exposed and available to anyone. By searching VirusTotal, CPR found 2113 mobile applications whose databases were unprotected and exposed throughout the course of a three month research study.
Check Point CloudGuard for Application Security prov
Tenable
Behind the Scenes: How We Picked 2021’s Top Vulnerabilities – and What We Left Out
blogs_tenable·2022-03-11
Behind the Scenes: How We Picked 2021’s Top Vulnerabilities – and What We Left Out
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Fortinet
From User to Domain Admin in (less than) 60 seconds: CVE-2021-42278/CVE-2021-42287 | FortiGuard Labs
blogs_fortinet·2022-01-05·CVSS 7.5
CVE-2021-42278 [HIGH] From User to Domain Admin in (less than) 60 seconds: CVE-2021-42278/CVE-2021-42287 | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
From User to Domain Admin in (less than) 60 seconds: CVE-2021-42278/CVE-2021-42287
By Udi Yavo | January 05, 2022
On Patch Tuesday of last November, Microsoft released advisories to address several vulnerabilities in Active-Directory. Analysis of these vulnerabilities showed that by combining CVE-2021-42278 and CVE-2021-42287 it is possible, under default conditions, for a regular user to easily impersonate a domain admin. This means that any domain user can effectively become a domain administrator, which makes these vulnerabilities extremely severe. Moreover, there are already several Github repositories with free-to-use PoC code that facilitates the exploitation of these vulnerabilities.
In this post, we will describe how the exploitation of these vul
Checkpoint
29th November – Threat Intelligence Report
blogs_checkpoint·2021-11-29·CVSS 7.5
CVE-2021-40444 [HIGH] 29th November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 29th November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 29th November, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
GoDaddy has announced they suffered a data breach with data of up to 1.2 million of its customers being exposed after an unauthorized person used a compromised password to gain access to the company’s Managed WordPress hosting environment.
Iranian airline Mahan Air has been victim of a cyber-attack which resulted in it
Securelist
IT threat evolution Q3 2021
blogs_securelist·2021-11-26
IT threat evolution Q3 2021
Table of Contents
- Targeted attacks
- Other malware
Authors
- David Emm
- IT threat evolution Q3 2021
- IT threat evolution in Q3 2021. PC statistics
- IT threat evolution in Q3 2021. Mobile statistics
## Targeted attacks
### WildPressure targets macOS
Last March, we reported a WildPressure campaign targeting industrial-related entities in the Middle East. While tracking this threat actor in spring 2021, we discovered a newer version. It contains the C++ Milum Trojan, a corresponding VBScript variant and a set of modules that include an orchestrator and three plugins. This confirms our previous assumption that there were more last-stagers besides the C++ ones.
Another language used by WildPressure is Python. The PyInstaller module for Windows contains a script named “Guard”. Inter
Securelist
IT threat evolution in Q3 2021. PC statistics
blogs_securelist·2021-11-26
IT threat evolution in Q3 2021. PC statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Ransomware programs
Quarterly trends and highlights
Attack on Kaseya and the REvil story
The arrival of BlackMatter: DarkSide restored?
Q3 closures
Exploitation of vulnerabilities and new attack methods
Number of new ransomware modifications
Number of users attacked by ransomware Trojans
Geography of ransomware attacks
Top 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by cybercriminals during cyberattacks
Quarter highlights
Statistics
Attacks on macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries tha
Securelist
IT threat evolution in Q3 2021. PC statistics
blogs_securelist·2021-11-26
IT threat evolution in Q3 2021. PC statistics
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Number of users attacked by ransomware Trojans
- Geography of ransomware attacks
- Top 10 most common families of ransomware Trojans
- Miners
- Vulnerable applications used by cybercriminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution Q3 2021
- IT threat evolution in Q3 2021. PC statistics
- IT threat evolution in Q3 2021. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q3 2021:
- Kaspersky solutions blocked 1,098,968,315 attacks from online reso
Securelist
IT threat evolution Q3 2021
blogs_securelist·2021-11-26·CVSS 8.8
CVE-2021-40444 [HIGH] IT threat evolution Q3 2021
Table of Contents
Targeted attacks
WildPressure targets macOS
LuminousMoth: sweeping attacks for the chosen few
Targeted attacks exploiting CVE-2021-40444
Tomiris backdoor linked to SolarWinds attack
GhostEmperor
FinSpy: analysis of current capabilities
Other malware
REvil attack on MSPs and their customers worldwide
What a [Print]Nightmare
Grandoreiro and Melcoz arrests
Gamers beware
Triada Trojan in WhatsApp mod
Qakbot banking Trojan
Authors
David Emm
IT threat evolution Q3 2021
IT threat evolution in Q3 2021. PC statistics
IT threat evolution in Q3 2021. Mobile statistics
## Targeted attacks
## WildPressure targets macOS
Last March, we reported a WildPressure campaign targeting industrial-related entities in the Middle East . While tracking this threat actor in spr
Checkpoint
15th November – Threat Intelligence Report
blogs_checkpoint·2021-11-15
CVE-2021-42237 15th November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 15th November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 15th November, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research notes a 178% increase in the number of malicious shopping websites, compared to the rest of the year, spotting over 5300 different malicious websites per week ahead of the end of this year’s e-shopping season.
Check Point Research has analyzed the operations of threat actor MosesStaff following its
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01
## Table of Contents
Overview
Directive Scope
CISA Catalog of Known Exploited Vulnerabilities
Detect CISAs Vulnerabilities Using Qualys VMDR
Remediation
Federal Enterprises and Agencies Can Act Now
Summary
Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01 , “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to remediate
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
#### Table of Contents
- Overview
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISAs Vulnerabilities Using Qualys VMDR
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01, “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to
Tenable
Examining the Treat Landscape
blogs_tenable·2021-10-29
Examining the Treat Landscape
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
This Week in Security News – October 1, 2021
blogs_trendmicro·2021-10-01
This Week in Security News – October 1, 2021
# This Week in Security News – October 1, 2021
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about Zloader, a notable recent ZBOT variant. Also, read on a recently introduced bill that would mandate ransom payment reporting.
By: Jon Clay
2021/10/01
Read time: ( words)
Save to Folio
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about Zloader, a notable recent ZBOT variant. Also, read on a recently introduced bill that would mandate ransom payment reporting.
Read on:
IoT and Zero Trust Are Incompatible? Just the Opposite
With more IT and security becoming softwa
Trendmicro
FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
blogs_trendmicro·2021-09-29·CVSS 8.8
CVE-2021-40444 [HIGH] FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
Ausnutzung von Schwachstellen
## FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal
Trend Micro detected a new campaign using a recent version of the known FormBook infostealer. Newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444.
By: Trend Micro Sep 29, 2021 Read time: ( words)
Save to Folio
Trend Micro detected a new campaign using a recent version of the known FormBook malware, an infostealer that has been around since 2016. Several analyses have been written about FormBook in the last few years, including the expanded support for macOS. FormBook is famous for highly obfuscated payloads and the use of document CVE exploitation. Until recently, FormBook mostly exploited CVE- 2017-0199 , but newer FormBook variant
Trendmicro
FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
blogs_trendmicro·2021-09-29·CVSS 8.8
CVE-2021-40444 [HIGH] FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
Exploits & Vulnerabilities
# FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal
Trend Micro detected a new campaign using a recent version of the known FormBook infostealer. Newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444.
By: Trend Micro
2021/09/29
Read time: ( words)
Save to Folio
Trend Micro detected a new campaign using a recent version of the known FormBook malware, an infostealer that has been around since 2016. Several analyses have been written about FormBook in the last few years, including the expanded support for macOS. FormBook is famous for highly obfuscated payloads and the use of document CVE exploitation. Until recently, FormBook mostly exploited CVE- 2017-0199, but newer FormBook variants used
Trendmicro
FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
blogs_trendmicro·2021-09-29·CVSS 8.8
CVE-2021-40444 [HIGH] FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
Exploits & Vulnerabilities
## FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal
Trend Micro detected a new campaign using a recent version of the known FormBook infostealer. Newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444.
By: Trend Micro Sep 29, 2021 Read time: ( words)
Save to Folio
Trend Micro detected a new campaign using a recent version of the known FormBook malware, an infostealer that has been around since 2016. Several analyses have been written about FormBook in the last few years, including the expanded support for macOS. FormBook is famous for highly obfuscated payloads and the use of document CVE exploitation. Until recently, FormBook mostly exploited CVE- 2017-0199 , but newer FormBook variants u
Trendmicro
FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
blogs_trendmicro·2021-09-29·CVSS 8.8
CVE-2021-40444 [HIGH] FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
Exploits & Vulnerabilities
## FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal
Trend Micro detected a new campaign using a recent version of the known FormBook infostealer. Newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444.
By: Trend Micro 2021/09/29 Read time: ( words)
Save to Folio
Trend Micro detected a new campaign using a recent version of the known FormBook malware, an infostealer that has been around since 2016. Several analyses have been written about FormBook in the last few years, including the expanded support for macOS. FormBook is famous for highly obfuscated payloads and the use of document CVE exploitation. Until recently, FormBook mostly exploited CVE- 2017-0199 , but newer FormBook variants use
Trendmicro
FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
blogs_trendmicro·2021-09-29·CVSS 8.8
CVE-2021-40444 [HIGH] FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
Exploits y vulnerabilidades
## FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal
Trend Micro detected a new campaign using a recent version of the known FormBook infostealer. Newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444.
By: Trend Micro Sep 29, 2021 Read time: ( words)
Save to Folio
Trend Micro detected a new campaign using a recent version of the known FormBook malware, an infostealer that has been around since 2016. Several analyses have been written about FormBook in the last few years, including the expanded support for macOS. FormBook is famous for highly obfuscated payloads and the use of document CVE exploitation. Until recently, FormBook mostly exploited CVE- 2017-0199 , but newer FormBook variants
Trendmicro
FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
blogs_trendmicro·2021-09-29·CVSS 8.8
CVE-2021-40444 [HIGH] FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
Sfruttamento vulnerabilità
## FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal
Trend Micro detected a new campaign using a recent version of the known FormBook infostealer. Newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444.
By: Trend Micro Sep 29, 2021 Read time: ( words)
Save to Folio
Trend Micro detected a new campaign using a recent version of the known FormBook malware, an infostealer that has been around since 2016. Several analyses have been written about FormBook in the last few years, including the expanded support for macOS. FormBook is famous for highly obfuscated payloads and the use of document CVE exploitation. Until recently, FormBook mostly exploited CVE- 2017-0199 , but newer FormBook variants u
Trendmicro
FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
blogs_trendmicro·2021-09-29·CVSS 7.8
CVE-2021-40444 [HIGH] FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal
Exploits & Vulnerabilities
## FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal
Trend Micro detected a new campaign using a recent version of the known FormBook infostealer. Newer FormBook variants used the recent Office 365 zero-day vulnerability, CVE-2021-40444.
By: Trend Micro Sep 29, 2021 Read time: ( words)
Save to Folio
Trend Micro detected a new campaign using a recent version of the known FormBook malware, an infostealer that has been around since 2016. Several analyses have been written about FormBook in the last few years, including the expanded support for macOS. FormBook is famous for highly obfuscated payloads and the use of document CVE exploitation. Until recently, FormBook mostly exploited CVE-2017-0199 , but newer FormBook variants us
Sentinelone
CVE-2021-40444 | MS Office Zero-Day Vulnerability
blogs_sentinelone·2021-09-23·CVSS 8.8
CVE-2021-40444 [HIGH] CVE-2021-40444 | MS Office Zero-Day Vulnerability
Microsoft Office has long been a common attack vector, with abuse of its macro functionality a firm favorite of phishing and malspam attacks. These typically attempt to infect users through maliciously crafted Word or Excel files received as an attachment or as a download link via email. Macro-based attacks, however, require an extra social engineering step or two as such functionality has to be explicitly approved by the user on a per-document basis. CVE-2021-40444, however, is a Microsoft Office MSHTML Remote Code Execution Vulnerability that requires no macros and only a single approval to “display content”. Threat actors wasted no time in putting this zero day vulnerability to ill-use before Microsoft provided a fix in September’s Patch Tuesday. In this post, we provide a technical ana
Sentinelone
CVE-2021-40444 | MS Office Zero-Day Vulnerability
blogs_sentinelone·2021-09-23·CVSS 8.8
CVE-2021-40444 [HIGH] CVE-2021-40444 | MS Office Zero-Day Vulnerability
Microsoft Office has long been a common attack vector, with abuse of its macro functionality a firm favorite of phishing and malspam attacks. These typically attempt to infect users through maliciously crafted Word or Excel files received as an attachment or as a download link via email. Macro-based attacks, however, require an extra social engineering step or two as such functionality has to be explicitly approved by the user on a per-document basis. CVE-2021-40444 , however, is a Microsoft Office MSHTML Remote Code Execution Vulnerability that requires no macros and only a single approval to “display content”. Threat actors wasted no time in putting this zero day vulnerability to ill-use before Microsoft provided a fix in September’s Patch Tuesday. In this post, we provide a technical an
Sentinelone
SentinelOne vs CVE-2021-40444 (Microsoft MSHTML Remote Code Execution Vulnerability) - Prevent Mode
blogs_sentinelone·2021-09-20·CVSS 8.8
CVE-2021-40444 [HIGH] SentinelOne vs CVE-2021-40444 (Microsoft MSHTML Remote Code Execution Vulnerability) - Prevent Mode
Platform
- Platform Overview
- Singularity Platform
Welcome to IntegratedEnterprise Security
- AI Security Portfolio
Leading the Way in AI-Powered Security Solutions
- How It Works
The Singularity XDR Difference
- Singularity Marketplace
One-Click Integrations to Unlock the Power of XDR
- Pricing & Packaging
Comparisons and Guidance at a Glance
- Data & AI
- Purple AI
Accelerate SecOps with Generative AI
- Singularity Hyperautomation
Easily Automate Security Processes
- AI-SIEM
The AI SIEM for the Autonomous SOC
- Singularity Data Lake
AI-Powered, Unified Data Lake
- Singularity Data Lake for Log Analytics
Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
- Endpoint Security
- Singularity Endpoint
Autonomous Prevention, Detection, and Response
- Singularity XDR
Native &
Sentinelone
SentinelOne vs CVE-2021-40444 (Microsoft MSHTML Remote Code Execution Vulnerability) - Prevent Mode
blogs_sentinelone·2021-09-20·CVSS 8.8
[HIGH] SentinelOne vs CVE-2021-40444 (Microsoft MSHTML Remote Code Execution Vulnerability) - Prevent Mode
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Fortinet
Vaccine Passports for Sale on the Dark Web | FortiGuard Labs
blogs_fortinet·2021-09-20
Vaccine Passports for Sale on the Dark Web | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Vaccine Passports for Sale on the Dark Web
By Fred Gutierrez | September 20, 2021
The battle against COVID has been waged for almost two years. With over 2 billion people around the globe now fully vaccinated, some countries have introduced a vaccine passport (certificate) program to allow people with proof of vaccination to travel, return to the office, and participate in public events.
For a time, the United Kingdom considered having nightclubs and other similar indoor venues require proof of vaccination for entry by the end of September. However, that idea has since been rescinded. In the United States, President Joe Biden recently mandated that certain members of the workforce be vaccinated, and proof of vaccination may be required. Other activities,
Checkpoint
20th September – Threat Intelligence Report
blogs_checkpoint·2021-09-19·CVSS 7.8
CVE-2021-40444 [HIGH] 20th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 20th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 20th September, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research has seen a global surge in the black market for fake COVID-19 vaccine certificates on Telegram, following US President Biden’s vaccine mandate announcements. The black market has expanded to serve 28 countries, including Austria, UAE, Brazil, UK, Singapore and more. The price for fake vaccine cert
Talos
Threat Source newsletter (Sept. 16, 2021)
blogs_talos·2021-09-16
Threat Source newsletter (Sept. 16, 2021)
Good afternoon, Talos readers.
It's a bird, it's a plane, it's a rat!
We've been tracking a series of trojans targeting the aviation industry, and trying to lure victims in by sending them spam related to flight itineraries and other transportation news. In our latest blog post, we discuss how we've followed the actor behind these attacks, and what we can learn about tracking a threat actor in the future.
This week was also Patch Tuesday, so you'll want to update your Microsoft products as soon as possible if you haven't already. Most notably, there's an official update to patch the high-profile MSHTML vulnerability.
## Upcoming Talos public engagements
Chats, Cheats, and Cracks: Abuse of Collaboration Platforms in Malware Campaigns at BSides Charlotte
Speaker: Edmund Brumaghin
Date
Securelist
Exploitation of the CVE-2021-40444 vulnerability in MSHTML
blogs_securelist·2021-09-16·CVSS 8.8
CVE-2021-40444 [HIGH] Exploitation of the CVE-2021-40444 vulnerability in MSHTML
Table of Contents
Summary
Technical details
Mitigations
IoC
Authors
AMR
## Summary
Last week, Microsoft reported the remote code execution vulnerability CVE-2021-40444 in the MSHTML browser engine. According to the company, this vulnerability has already been used in targeted attacks against Microsoft Office users. In attempt to exploit this vulnerability, attackers create a document with a specially-crafted object. If a user opens the document, MS Office will download and execute a malicious script.
According to our data, the same attacks are still happening all over the world. We are currently seeing attempts to exploit the CVE-2021-40444 vulnerability targeting companies in the research and development sector, the energy sector and large industrial sectors, banking and medical t
Securelist
Exploitation of the CVE-2021-40444 vulnerability in MSHTML
blogs_securelist·2021-09-16·CVSS 8.8
CVE-2021-40444 [HIGH] Exploitation of the CVE-2021-40444 vulnerability in MSHTML
Table of Contents
- Summary
- Technical details
- Mitigations
- IoC
Authors
- AMR
## Summary
Last week, Microsoft reported the remote code execution vulnerability CVE-2021-40444 in the MSHTML browser engine. According to the company, this vulnerability has already been used in targeted attacks against Microsoft Office users. In attempt to exploit this vulnerability, attackers create a document with a specially-crafted object. If a user opens the document, MS Office will download and execute a malicious script.
According to our data, the same attacks are still happening all over the world. We are currently seeing attempts to exploit the CVE-2021-40444 vulnerability targeting companies in the research and development sector, the energy sector and large industrial sectors, banking and
Talos
Threat Source newsletter (Sept. 16, 2021)
blogs_talos·2021-09-16
Threat Source newsletter (Sept. 16, 2021)
## Threat Source newsletter (Sept. 16, 2021)
Good afternoon, Talos readers.
It's a bird, it's a plane, it's a rat!
We've been tracking a series of trojans targeting the aviation industry, and trying to lure victims in by sending them spam related to flight itineraries and other transportation news. In our latest blog post , we discuss how we've followed the actor behind these attacks, and what we can learn about tracking a threat actor in the future.
This week was also Patch Tuesday , so you'll want to update your Microsoft products as soon as possible if you haven't already. Most notably, there's an official update to patch the high-profile MSHTML vulnerability .
## Upcoming Talos public engagements
Chats, Cheats, and Cracks: Abuse of Collaboration Platforms in Malware Campaigns at
Sentinelone
SentinelOne vs CVE-2021-40444 (Microsoft MSHTML Remote Code Execution Vulnerability) Using STAR ⭐️
blogs_sentinelone·2021-09-15·CVSS 8.8
[HIGH] SentinelOne vs CVE-2021-40444 (Microsoft MSHTML Remote Code Execution Vulnerability) Using STAR ⭐️
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Fortinet
More ProxyShell? Web Shells Lead to ZeroLogon and Application Impersonation Attacks | FortiGuardLabs
blogs_fortinet·2021-09-14
More ProxyShell? Web Shells Lead to ZeroLogon and Application Impersonation Attacks | FortiGuardLabs
FORTIGUARD LABS THREAT RESEARCH
More ProxyShell? Web Shells Lead to ZeroLogon and Application Impersonation Attacks
By John Simmons | September 14, 2021
FortiGuard Labs Threat Research Report
Affected platforms: Microsoft Exchange
Impacted parties: Exchange Mailboxes
Impact: Gives unauthorized users the ability to access and send emails from any user within the organization
Severity level: Critical
Special thanks to Angelo Cris Deveraturda, Wilson Agad, Llallum Victoria, Wil Vidal, Jared Betts, and Ken Evans.
Introduction of ProxyShell
FortiGuard Labs recently discovered an unidentified threat actor leveraging ProxyShell exploits using techniques that have yet to be reported. Multiple instances of FortiEDR had detected malicious DLLs in memory, and we uncovered these new techniques w
Qualys
Microsoft and Adobe Patch Tuesday (September 2021) – Microsoft 60 Vulnerabilities with 3 Critical, Adobe 61 Vulnerabilities
blogs_qualys·2021-09-14·CVSS 8.1
CVE-2021-40444 [HIGH] Microsoft and Adobe Patch Tuesday (September 2021) – Microsoft 60 Vulnerabilities with 3 Critical, Adobe 61 Vulnerabilities
## Microsoft Patch Tuesday – September 2021
Microsoft patched 60 vulnerabilities in their September 2021 Patch Tuesday release, and an additional 26 CVEs since September 1st. Among the 60 released in the September Patch Tuesday, 3 of them are rated as critical severity, one as moderate, and 56 as important.
## Critical Microsoft Vulnerabilities Patched
CVE-2021-40444 – Microsoft MSHTML Remote Code Execution Vulnerability
This vulnerability has been publicly disclosed and is known to be exploited. The vulnerability allows for remote code execution via MSHTML, a component used by Internet Explorer and Office. Microsoft also released a workaround to show how users can disable ActiveX controls in IE. The vendor has assigned a CVSSv3 base score of 8.8. It should be prioritized for patching.
Krebs
Microsoft Patch Tuesday, September 2021 Edition
blogs_krebs·2021-09-14·CVSS 4.2
[MEDIUM] Microsoft Patch Tuesday, September 2021 Edition
Microsoft today pushed software updates to plug dozens of security holes in Windows and related products, including a vulnerability that is already being exploited in active attacks. Also, Apple has issued an emergency update to fix a flaw that’s reportedly been abused to install spyware on iOS products, and Google‘s got a new version of Chrome that tackles two zero-day flaws. Finally, Adobe has released critical security updates for Acrobat, Reader and a slew of other software.
Four of the flaws fixed in this patch batch earned Microsoft’s most-dire “critical” rating, meaning they could be exploited by miscreants or malware to remotely compromise a Windows PC with little or no help from the user.
Top of the critical heap is CVE-2021-40444, which affects the “MSHTML” component of Interne
Talos
Microsoft Patch Tuesday for Sept. 2021 — Snort rules and prominent vulnerabilities
blogs_talos·2021-09-14·CVSS 8.1
CVE-2021-40444 [HIGH] Microsoft Patch Tuesday for Sept. 2021 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Holger Unterbrink.
Microsoft released its monthly security update Tuesday, disclosing 85 vulnerabilities across the company’s firmware and software. This month’s release is headlined by an official patch for the critical remote code execution vulnerability disclosed earlier this month in MSHTML.
CVE-2021-40444 is being actively exploited in the wild, according to Microsoft, and proof-of-concept code is now available, potentially widening the potential for attacks exploiting this vulnerability. This is the first official Microsoft update to address this issue. Talos has additional protection available here.
Users should download this patch immediately. Additionally, they can disable the installation of all ActiveX controls in Internet Explorer to m
Trendmicro
September Patch Tuesday: 66 Bulletins, Only 3 Critical
blogs_trendmicro·2021-09-14·CVSS 8.1
[HIGH] September Patch Tuesday: 66 Bulletins, Only 3 Critical
Exploits & Vulnerabilities
# September Patch Tuesday: 66 Bulletins, Only 3 Critical
The September 2021 Patch Tuesday cycle is relatively good news for system administrators with only 66 total bulletins. Perhaps more significantly, only three of these were Critical bulletins.
By: Trend Micro
2021/09/14
Read time: ( words)
Save to Folio
The September 2021 Patch Tuesday cycle is relatively good news for system administrators with only 66 total bulletins. Perhaps more significantly, only three of these were Critical bulletins. Eleven of these bulletins fixed vulnerabilities that were disclosed to Microsoft via the Zero Day Initiative. Overall, the month offers system administrators a chance to catch up on other necessary tasks.
Only 3 Critical Patches for September
As mentioned previou
Talos
Microsoft Patch Tuesday for Sept. 2021 — Snort rules and prominent vulnerabilities
blogs_talos·2021-09-14·CVSS 8.1
CVE-2021-40444 [HIGH] Microsoft Patch Tuesday for Sept. 2021 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for Sept. 2021 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Holger Unterbrink.
Microsoft released its monthly security update Tuesday, disclosing 85 vulnerabilities across the company’s firmware and software. This month’s release is headlined by an official patch for the critical remote code execution vulnerability disclosed earlier this month in MSHTML .
CVE-2021-40444 is being actively exploited in the wild, according to Microsoft, and proof-of-concept code is now available, potentially widening the potential for attacks exploiting this vulnerability. This is the first official Microsoft update to address this issue. Talos has additional protection available here .
Users should download this patch immediately. Addition
Qualys
Microsoft and Adobe Patch Tuesday (September 2021) – Microsoft 60 Vulnerabilities with 3 Critical, Adobe 61 Vulnerabilities | Qualys
blogs_qualys·2021-09-14·CVSS 8.1
CVE-2021-40444 [HIGH] Microsoft and Adobe Patch Tuesday (September 2021) – Microsoft 60 Vulnerabilities with 3 Critical, Adobe 61 Vulnerabilities | Qualys
### Microsoft Patch Tuesday – September 2021
Microsoft patched 60 vulnerabilities in their September 2021 Patch Tuesday release, and an additional 26 CVEs since September 1st. Among the 60 released in the September Patch Tuesday, 3 of them are rated as critical severity, one as moderate, and 56 as important.
#### Critical Microsoft Vulnerabilities Patched
CVE-2021-40444 – Microsoft MSHTML Remote Code Execution Vulnerability
This vulnerability has been publicly disclosed and is known to be exploited. The vulnerability allows for remote code execution via MSHTML, a component used by Internet Explorer and Office. Microsoft also released a workaround to show how users can disable ActiveX controls in IE. The vendor has assigned a CVSSv3 base score of 8.8. It should be prioritized for patchi
Tenable
Microsoft’s September 2021 Patch Tuesday Addresses 60 CVEs (CVE-2021-40444)
blogs_tenable·2021-09-14·CVSS 8.8
[HIGH] Microsoft’s September 2021 Patch Tuesday Addresses 60 CVEs (CVE-2021-40444)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Krebs
Microsoft Patch Tuesday, September 2021 Edition
blogs_krebs·2021-09-14·CVSS 4.2
[MEDIUM] Microsoft Patch Tuesday, September 2021 Edition
Microsoft today pushed software updates to plug dozens of security holes in Windows and related products, including a vulnerability that is already being exploited in active attacks. Also, Apple has issued an emergency update to fix a flaw that’s reportedly been abused to install spyware on iOS products, and Google ‘s got a new version of Chrome that tackles two zero-day flaws. Finally, Adobe has released critical security updates for Acrobat , Reader and a slew of other software.
Four of the flaws fixed in this patch batch earned Microsoft’s most-dire “critical” rating, meaning they could be exploited by miscreants or malware to remotely compromise a Windows PC with little or no help from the user.
Top of the critical heap is CVE-2021-40444 , which affects the “MSHTML” component of Inte
Checkpoint
13th September – Threat Intelligence Report
blogs_checkpoint·2021-09-13·CVSS 9.8
CVE-2018-13379 [CRITICAL] 13th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 13th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 13th September, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Mēris, a new distributed denial-of-service (DDos) botnet has broken a record with a 21.8 million requests-per-second attack on Russian internet company Yandex; 250,000 devices are assumed to be compromised.
MyRepublic, a Singaporean communications services company, has disclosed a data breach exposing government ID c
Trendmicro
This Week in Security News - September 10, 2021
blogs_trendmicro·2021-09-10
This Week in Security News - September 10, 2021
Cyber Threats
# This Week in Security News - September 10, 2021
Biden announces cybersecurity initiative partnership, US Government seeks public feedback on draft federal zero trust strategy and more.
By: Jon Clay
2021/09/10
Read time: ( words)
Save to Folio
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, read about Biden’s partnership initiative to develop a new cybersecurity framework. Also, learn about the US’s new draft zero trust strategy.
Read on:
Biden Announces Cybersecurity Initiative Partnership
Biden’s announcement marks the US’s extensive collaboration with various private and education sector leaders to address the rising cyber threats in the country. The White Hou
Fortinet
Microsoft MSHTML Remote Code Execution Vulnerability Exploited in the Wild (CVE-2021-40444) | FortiGuard Labs
blogs_fortinet·2021-09-09·CVSS 8.8
CVE-2021-40444 [HIGH] Microsoft MSHTML Remote Code Execution Vulnerability Exploited in the Wild (CVE-2021-40444) | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Microsoft MSHTML Remote Code Execution Vulnerability Exploited in the Wild (CVE-2021-40444)
By Val Saengphaibul | September 09, 2021
FortiGuard Labs Threat Research Report
On September 7, 2021, Microsoft disclosed an active in-the-wild attack affecting Microsoft Windows. This vulnerability, CVE-2020-40444, is a remote code execution vulnerability in MSHTML. It does not currently have a patch, MSHTML is also referred to as Trident, is a legacy proprietary browser engine specific to Internet Explorer and Windows platforms. In-the-wild attacks on targets were observed to be using specially crafted malicious Microsoft Office documents. Like most such attacks, targets have to be compelled or lured to open the malicious document for it to run successfully.
Thi
Trendmicro
Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
blogs_trendmicro·2021-09-09·CVSS 8.8
CVE-2021-40444 [HIGH] Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Exploits & Vulnerabilities
# Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger.
By: Trend Micro
2021/09/09
Read time: ( words)
Save to Folio
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger. It should be noted that by default, Office documents downloaded from th
Trendmicro
Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
blogs_trendmicro·2021-09-09·CVSS 8.8
CVE-2021-40444 [HIGH] Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Ausnutzung von Schwachstellen
## Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger.
By: Trend Micro Sep 09, 2021 Read time: ( words)
Save to Folio
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444 ) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger. It should be noted that by default, Office documents downloaded f
Trendmicro
Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
blogs_trendmicro·2021-09-09·CVSS 8.8
CVE-2021-40444 [HIGH] Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Exploits & Vulnerabilities
## Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger.
By: Trend Micro 2021/09/09 Read time: ( words)
Save to Folio
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444 ) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger. It should be noted that by default, Office documents downloaded from t
Trendmicro
Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
blogs_trendmicro·2021-09-09·CVSS 8.8
CVE-2021-40444 [HIGH] Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Sfruttamento vulnerabilità
## Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger.
By: Trend Micro Sep 09, 2021 Read time: ( words)
Save to Folio
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444 ) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger. It should be noted that by default, Office documents downloaded from
Talos
Talos release protection against zero-day vulnerability (CVE-2021-40444) in Microsoft MSHTML
blogs_talos·2021-09-09·CVSS 8.8
CVE-2021-40444 [HIGH] Talos release protection against zero-day vulnerability (CVE-2021-40444) in Microsoft MSHTML
## Talos release protection against zero-day vulnerability (CVE-2021-40444) in Microsoft MSHTML
Cisco Talos released new SNORT® rules Thursday to protect against the exploitation of a zero-day vulnerability in Microsoft MSHTML that the company warns is being actively exploited in the wild.
Users are encouraged to deploy SIDs 58120 – 58129, Snort 3 SID 300049 and ClamAV signature ID: 9891528 (Doc.Exploit.CVE_2021_40444-9891528-0) to detect and prevent the exploitation of CVE-2021-40444 . Cisco Secure Endpoint users can use Orbital Advanced Search to run complex OSqueries to see if their endpoints are vulnerable to this specific threat. An OSquery ( CVE-2021-40444_vulnerability status ) has been added for this threat.
If an adversary were to successfully exploit this vulnerability, they c
Huntress
Threat Advisory: Hackers Are Exploiting CVE-2021-40444 | Huntress
blogs_huntress·2021-09-09·CVSS 7.8
CVE-2021-40444 [HIGH] Threat Advisory: Hackers Are Exploiting CVE-2021-40444 | Huntress
On September 7, Huntress was made aware of a new threat against Windows operating systems and Microsoft Office products. With the identifier CVE-2021-40444 , the MSHTML engine is vulnerable to arbitrary code execution by a specially crafted Microsoft Office document or rich text format file.
All modern Windows operating systems are susceptible to this attack, with a severity score of 8.8. Currently, there is no patch available, but Microsoft is urging users to mitigate this with workarounds until a formal fix is released. Under scrutiny, it seems this workaround is not effective in all cases.
Update #3 - 09/14/2021 @ 3:20pm ET - Updated with information on a patch, which the Huntress team has begun to validate for its effectiveness
Update #2 - 09/13/2021 @ 6:03pm ET - Added proof-of-con
Trendmicro
Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
blogs_trendmicro·2021-09-09·CVSS 8.8
CVE-2021-40444 [HIGH] Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Exploits y vulnerabilidades
## Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger.
By: Trend Micro Sep 09, 2021 Read time: ( words)
Save to Folio
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444 ) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger. It should be noted that by default, Office documents downloaded fro
Zscaler
Microsoft MSHTML Remote Code Execution Vulnerability | Blog
blogs_zscaler·2021-09-09·CVSS 8.8
[HIGH] Microsoft MSHTML Remote Code Execution Vulnerability | Blog
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Talos
Talos release protection against zero-day vulnerability (CVE-2021-40444) in Microsoft MSHTML
blogs_talos·2021-09-09·CVSS 8.8
CVE-2021-40444 [HIGH] Talos release protection against zero-day vulnerability (CVE-2021-40444) in Microsoft MSHTML
Cisco Talos released new SNORT® rules Thursday to protect against the exploitation of a zero-day vulnerability in Microsoft MSHTML that the company warns is being actively exploited in the wild.
Users are encouraged to deploy SIDs 58120 – 58129, Snort 3 SID 300049 and ClamAV signature ID: 9891528 (Doc.Exploit.CVE_2021_40444-9891528-0) to detect and prevent the exploitation of CVE-2021-40444. Cisco Secure Endpoint users can use Orbital Advanced Search to run complex OSqueries to see if their endpoints are vulnerable to this specific threat. An OSquery (CVE-2021-40444_vulnerability status) has been added for this threat.
If an adversary were to successfully exploit this vulnerability, they could remotely execute code on the victim machine or gain complete control. The Microsoft advisory al
Trendmicro
Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
blogs_trendmicro·2021-09-09·CVSS 8.8
CVE-2021-40444 [HIGH] Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Exploits & Vulnerabilities
## Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger.
By: Trend Micro Sep 09, 2021 Read time: ( words)
Save to Folio
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444 ) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger. It should be noted that by default, Office documents downloaded from
Krebs
Microsoft: Attackers Exploiting Windows Zero-Day Flaw
blogs_krebs·2021-09-08·CVSS 8.8
CVE-2021-40444 [HIGH] Microsoft: Attackers Exploiting Windows Zero-Day Flaw
Microsoft Corp. warns that attackers are exploiting a previously unknown vulnerability in Windows 10 and many Windows Server versions to seize control over PCs when users open a malicious document or visit a booby-trapped website. There is currently no official patch for the flaw, but Microsoft has released recommendations for mitigating the threat.
According to a security advisory from Redmond, the security hole CVE-2021-40444 affects the “MSHTML” component of Internet Explorer (IE) on Windows 10 and many Windows Server versions. IE been slowly abandoned for more recent Windows browsers like Edge, but the same vulnerable component also is used by Microsoft Office applications for rendering web-based content.
“An attacker could craft a malicious ActiveX control to be used by a Microsoft
Krebs
Microsoft: Attackers Exploiting Windows Zero-Day Flaw
blogs_krebs·2021-09-08·CVSS 8.8
CVE-2021-40444 [HIGH] Microsoft: Attackers Exploiting Windows Zero-Day Flaw
Microsoft Corp. warns that attackers are exploiting a previously unknown vulnerability in Windows 10 and many Windows Server versions to seize control over PCs when users open a malicious document or visit a booby-trapped website. There is currently no official patch for the flaw, but Microsoft has released recommendations for mitigating the threat.
According to a security advisory from Redmond, the security hole CVE-2021-40444 affects the “MSHTML” component of Internet Explorer (IE) on Windows 10 and many Windows Server versions. IE been slowly abandoned for more recent Windows browsers like Edge , but the same vulnerable component also is used by Microsoft Office applications for rendering web-based content.
“An attacker could craft a malicious ActiveX control to be used by a Microsoft
Sentinelone
HiveNightmare | Protecting Windows 10 Security Account Manager Against CVE-2021-36934
blogs_sentinelone·2021-08-05·CVSS 7.8
CVE-2021-36934 [HIGH] HiveNightmare | Protecting Windows 10 Security Account Manager Against CVE-2021-36934
It has been a tough few weeks for many enterprise security teams fighting a series of severe bugs in Microsoft Windows 10. Shortly after being ‘all hands on deck’ dealing with the remote code execution (RCE) vulnerability dubbed PrintNightmare , IT admins and security teams were plunged into another unexpected crisis thanks to the emergence of the unrelated but familiar sounding ‘HiveNightmare’ bug, aka SeriousSAM.
More formerly tracked as CVE-2021-36934 , HiveNightmare is a local privilege escalation (LPE) that allows any standard user to achieve SYSTEM privileges, with all the security headaches that that entails: the ability to install malware, delete data, create new user accounts and pretty much conduct any other malicious behavior so desired.
Although HiveNightmare requires an atta
Crowdstrike
September 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] September 2021 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Threat Intel
EXOTIC LILY
threat_intel·CVSS 8.8
CVE-2021-40444 [HIGH] EXOTIC LILY
# Threat Actor: EXOTIC LILY
## Description
EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol. In early September 2021, the group has been obeserved exploiting a 0day in Microsoft MSHTML (CVE-2021-40444). Investigation lead researchers to believe that they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPIDER (CrowdStrike). This threat actor deploys tactics, techniques and procedures (TTPs) that are traditionally associated with more targeted attacks, like spoofing companies and employees as a means of gaining trust of a targeted organization through email c
Zscaler
Zscaler protects against Windows vulnerability | 09-14-2021
blogs_zscaler·CVSS 7.8
[HIGH] Zscaler protects against Windows vulnerability | 09-14-2021
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Huntress
Rapid Response: Microsoft Office RCE - “Follina” MSDT Attack | Huntress
blogs_huntress·CVSS 7.8
[HIGH] Rapid Response: Microsoft Office RCE - “Follina” MSDT Attack | Huntress
This post, as is the norm for emerging threats, is a developing article and may be subject to change as the Huntress team learns more about this attack vector and new information is available.
UPDATE 4:51pm ET June 14, 2022:
Microsoft announced an available patch for the Follina exploit. Our team has been working to validate the patch, and we have tested and verified that the patch is effective both for Windows 10 and Windows 11:
Just to note, your KB# may vary based on your operating system—check out Microsoft's update for the full list.
Below, the code fails to execute on Windows 10:
In the below image, the raw command fails on Windows 10:
UPDATE 11:16pm ET May 30, 2022:
Microsoft has now revealed the CVE identifier for this vulnerability is CVE-2022-30190, including a Security Up
Sentinelone
Black Basta
blogs_sentinelone
Black Basta
# Black Basta Ransomware: In-Depth Analysis, Detection, and Mitigation
## Summary of Black Basta Ransomware
Black Basta first emerged in early 2022. The ransomware family is an evolution of the Hermes/Ryuk/Conti families. Black Basta was heavily advertised in underground cybercrime markets. Black Basta practices double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data. There are Windows and LInux variants of Black Basta ransomware. The group is responsible for hundreds of attacks against global targets of varying sectors.
February 2025 Update: Nearly a year’s worth of Black Basta chat logs have been released on Telegram, providing detailed insight into the groups operational workflow, reconnaissance activities, and specific userID and details o
Threat Intel
EXOTIC LILY (EXOTIC LILY)
threat_intel
EXOTIC LILY (EXOTIC LILY)
# Threat Actor Profile: EXOTIC LILY
ATT&CK ID: G1011
Also known as: EXOTIC LILY
## Overview
EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.(Citation: Google EXOTIC LILY March 2022)
## Techniques (TTPs)
### Reconnaissance
- T1594 Search Victim-Owned Websites
Usage: EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.(Citation: Google EXOTIC LILY March 2022)
- T1597 Search Closed Sources
Usage: EXOTIC LILY has searched for information on targeted individual
Huntress
Threat Advisory: Hackers Are Exploiting CVE-2021-40444 | Huntress
blogs_huntress·CVSS 7.8
CVE-2021-40444 [HIGH] Threat Advisory: Hackers Are Exploiting CVE-2021-40444 | Huntress
On September 7, Huntress was made aware of a new threat against Windows operating systems and Microsoft Office products. With the identifier CVE-2021-40444, the MSHTML engine is vulnerable to arbitrary code execution by a specially crafted Microsoft Office document or rich text format file.
All modern Windows operating systems are susceptible to this attack, with a severity score of 8.8. Currently, there is no patch available, but Microsoft is urging users to mitigate this with workarounds until a formal fix is released. Under scrutiny, it seems this workaround is not effective in all cases.
- Update #3 - 09/14/2021 @ 3:20pm ET - Updated with information on a patch, which the Huntress team has begun to validate for its effectiveness
- Update #2 - 09/13/2021 @ 6:03pm ET - Added proof-of-c
Crowdstrike
Honey Spider Adversary Profile
blogs_crowdstrike·CVSS 8.8
[HIGH] Honey Spider Adversary Profile
Experienced a breach?
Blog
Contact us
Careers
Latest Innovations
Upcoming events
Conference
CrowdTour
Find a city near you
Summit
Day Zero 2026
Las Vegas, NV
Login
Your Cart
Added to Cart
There's nothing in your cart
per endpoint / per year
per endpoint / per month
Login
Experienced a breach?
Blog
Contact us
Careers
Latest Innovations
## Honey Spider
Discover the adversaries targeting your industry
HONEY SPIDER—the developer of Shindig (publicly known as Bumblebee)—is a financially motivated eCrime group that likely operates on an affiliate-based model. The developers have been operating Shindig since late January 2022 and were first observed developing a Cobalt Strike loader used in a campaign exploiting CVE-2021-40444 in August 2021. HONEY SPIDER has invested
Crowdstrike
How CrowdStrike Falcon® Protects Against Follina (CVE-2022-30190)
blogs_crowdstrike·CVSS 7.8
CVE-2026-20929 [HIGH] How CrowdStrike Falcon® Protects Against Follina (CVE-2022-30190)
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
arXiv
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
arxiv_fulltext·2024-07-31
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
Raveen Kanishka Jayalath*
University of Adelaide, Australia
[email protected]
Hussain Ahmad* *Authors contributed equally to this work. Corresponding author.
University of Adelaide, Australia
[email protected]
Diksha Goel
CSIRO's Data61, Australia
[email protected]
3cmMuhammad Shuja Syed
3cmSLB, USA
[email protected]
Faheem Ullah
University of Adelaide, Australia
[email protected]
plain
## Abstract
Microservice architectures are revolutionizing both small businesses and large corporations, igniting a new era of innovation with their exceptional advantages in maintainability, reusability, and scalability. However, these benefits come w
CTF
README
ctf_writeups
README
# CTF Writeups
Welcome to my CTF Writeups repository! Here, I document the solutions and methodologies used to solve various Capture The Flag (CTF) challenges. This repository is intended to serve as a learning resource for others interested in cybersecurity and CTF competitions.
Capture The Flag (CTF) competitions are a popular way to practice and improve cybersecurity skills. These competitions present various challenges that require problem-solving, creativity, and technical knowledge.
## Writeups
The writeups in this repository (located in the "writeups" folder) are categorised based on the nature of the challenge. Each writeup provides step-by-step solutions, along with explanations of the tools and techniques used. The difficulty rating associated with each challenge matches the dif
http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.htmlhttp://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.htmlhttp://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40444
2021-09-15
Published
2021-11-03
Added to CISA KEV
Exploited in the wild