Threat actorcritical
Sandworm APT's initial access subgroup hits organizations accross the globe
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-34473 | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) | 9.1 | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-41352 | Path Traversal Arbitrary File Upload in Synacor Zimbra Collaboration Suite | 9.8 | 95% | KEVRansomwarePoC | KEV |
| CVE-2023-23397 | Zero-Click Elevation of Privilege in Microsoft Outlook (Forced NTLM Credential Leak) | 9.8 | 97% | KEV | KEV |
| CVE-2023-32315 | Unauthenticated Path Traversal in Ignite Realtime Openfire Admin Console | 7.5 | 100% | KEVPoC ×2 | KEV |
| CVE-2023-42793 | Authentication bypass in JetBrains TeamCity enables unauthenticated RCE | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2023-48788 | Unauthenticated SQL Injection in Fortinet FortiClient EMS | 9.8 | 98% | KEVRansomware | KEV |
| CVE-2024-1709 | Authentication Bypass in ConnectWise ScreenConnect Creates Rogue Admin Accounts | 10.0 | 100% | KEVRansomwarePoC ×3 | KEV |
From the original article
3 min read at helpnetsecurity.com
A subgroup of Russia’s Sandworm APT has been working to achieve initial and persistent access to the IT networks of organizations working in economic sectors Russia is interested in. “In 2022, its primary focus was Ukraine, specifically targeting the energy, retail, education, consulting, and agriculture sectors.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.