Threat Source newsletter (May 11, 2023) — So much for that ransomware decline
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-24932 | Secure Boot Security Feature Bypass Vulnerability | 6.7 | 11% | ||
| CVE-2023-27350 | Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2023-29336 | Use-after-free privilege escalation to SYSTEM in Microsoft Win32k | 7.8 | 41% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Typical Filename: VID001.exe Claimed Product: N/A Detection |
| md5 | 3e10a74a7613d1cae4b9749d7ec93515 | 40b49096e2f8f78d646891b45c649473a5b67b8beddac46ad398e1 MD5: 3e10a74a7613d1cae4b9749d7ec93515 Typical Filename: IMG001.exe Claimed Product: N/A Detection |
| md5 | 93fefc3e88ffb78abb36365fa5cf857c | 81591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wextract Claimed Product: Internet Explor |
| md5 | a087b2e6ec57b08c0d0750c60f96a74c | e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c MD5: a087b2e6ec57b08c0d0750c60f96a74c Typical Filename: AAct.exe Claimed Product: N/A Detection N |
| md5 | df11b3105df8d7c70e7b501e210e3cc3 | de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa MD5: df11b3105df8d7c70e7b501e210e3cc3 Typical Filename: DOC001.exe Claimed Product: N/A Detection |
| sha256 | 5616b94f1a40b49096e2f8f78d646891b45c649473a5b67b8beddac46ad398e1 | duct: N/A Detection Name: Win.Worm.Coinminer::1201 SHA 256: 5616b94f1a40b49096e2f8f78d646891b45c649473a5b67b8beddac46ad398e1 MD5: 3e10a74a7613d1cae4b9749d7ec93515 Typical Filename: IMG |
| sha256 | 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa | ion Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg SHA 256: 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa MD5: df11b3105df8d7c70e7b501e210e3cc3 Typical Filename: DOC |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | ware files from Talos telemetry over the past week SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Typical Filename: VID |
| sha256 | e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c | duct: N/A Detection Name: Win.Worm.Coinminer::1201 SHA 256: e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c MD5: a087b2e6ec57b08c0d0750c60f96a74c Typical Filename: AAc |
| sha256 | e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 | t: N/A Detection Name: Win.Dropper.Coinminer::1201 SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wex |
From the original article
5 min read at blog.talosintelligence.com
Welcome to this week’s edition of the Threat Source newsletter. I wrote a few weeks ago about how, between the public and private sectors, the security community was making some strides in fighting back against ransomware. Reports indicate that revenue for ransomware actors was down in 2022, and recent disruptions to larger ransomware networks like Hive have at least forced some actors offline for now.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.