Victim

Ukrainian government

0 mentions in 7 days · 1 in 30 days · 1 total · first seen Aug 17, 2026 · last 29d ago

Timeline1 articles

Threat Brief: Ongoing Russia and Ukraine Cyber Activity

Ukrainian government sites were defaced via OctoberCMS CVE-2021-32648 while Microsoft-attributed actor DEV-0586 deployed destructive WhisperGate malware.

Unit 42 tracks January 2022 attacks against Ukrainian government websites that were defaced or made inaccessible, which Ukraine attributed to Russia. Attackers exploited CVE-2021-32648, an account takeover flaw in OctoberCMS prior to 1.0.472, by submitting a boolean true as the password reset code to bypass validation. Separately, WhisperGate malware, attributed by Microsoft to DEV-0586, disabled Windows Defender and corrupted files across multiple Ukrainian organizations, using a ransomware-appearing first stage and an HTTPS-beaconing second stage with LOLBINs and anti-analysis techniques.

Palo Alto Unit 42Aug 17, 12:20 UTC · 29d agoThreat actor in the wildCVE-2021-326481

Related CVEsby mentions

CVE-2021-326489.190%
Authentication Bypass in October CMS Password Reset Enables Account Takeover
October CMS, a content management system built on the Laravel PHP framework, contains an improper authentication flaw (CWE-287) in its october/system package: an attacker can initiate a password reset for any account and then submit a specially crafted request that bypasses the reset-code check, gaining access to that account without knowing the current password. The flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1: 9.1, critical), and takeover of a back-end administrator account would grant the attacker full control of the CMS's content, users, and configuration. Any October CMS deployment running october/system versions prior to Build 472 or v1.1.5 is affected. Exploitation is confirmed in the wild: CISA added CVE-2021-32648 to its Known Exploited Vulnerabilities Catalog on 2022-01-18 as part of a batch of 17 added flaws, requiring patching per vendor instructions, and EPSS assigns a 90.4% probability of exploitation within 30 days (100th percentile). CISA lists ransomware use as unknown, and no public proof-of-concept exploit is known.
· October CMS (october/system package) All versions prior to Build 472 and prior to v1.1.5; fixed in Build 472 and v1.1.5 KEVlarge

Appears with

threat actor DEV-0586 1 malware WhisperGate 1 organization Microsoft 1 organization Palo Alto Networks 1 product Cortex XDR 1 product OctoberCMS 1 product Windows Defender 1 vendor Microsoft 1 vendor OctoberCMS 1 vendor Palo Alto Networks 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.