Vulnerabilitymedium
Targeted operation against Ukraine exploited 7-year
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files | 7.8 | 99% | KEVRansomwarePoC ×6 | KEV |
| CVE-2017-8570 | Remote Code Execution in Microsoft Office via Malicious PPSX Files (CVE-2017-8570) | 7.8 | 90% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | petapixel.fun | itary personnel. But the domain names weavesilk[.]space and petapixel[.]fun are disguised as an obscure generative art site (http://w |
| domain | weavesilk.space | rame.617766616773726468746672726a6834.html,” was hosted on “weavesilk[.]space,” protected by CloudFlare. Despite this, the true hosting |
| md5 | 617766616773726468746672726a6834 | for CVE-2017-0199 . The remote script, named “widget_iframe.617766616773726468746672726a6834.html,” was hosted on “weavesilk[.]space,” protected by Clou |
From the original article
2 min read at securityaffairs.com
A hacking campaign targeted Ukraine exploiting a seven-year-old vulnerability in Microsoft Office to deliver Cobalt Strike. Security experts at Deep Instinct Threat Lab have uncovered a targeted campaign against Ukraine, exploiting a Microsoft Office vulnerability dating back almost seven years to deploy Cobalt Strike on compromised systems.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.