Ransomwarehigh
A new video series, Google Forms spam and the various gray areas of cyber attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-22518 | Improper Authorization in Atlassian Confluence Data Center and Server | 9.8 | 100% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0e4c49327e3be816022a233f844a5731 | 77c58ac12e747da09d2810fd5ca611f56c0c900578bf750cab56b7 MD5: 0e4c49327e3be816022a233f844a5731 Typical Filename: aact.exe Claimed Product: AAct x86 Detect |
| md5 | 200206279107f4a2bb1832e3fcd7d64c | 8a912d4322b45ea64d69bb3add4d818fd1eb7723260b11d76a138a MD5: 200206279107f4a2bb1832e3fcd7d64c Typical Filename: lsgkozfm.bat Claimed Product: N/A Detecti |
| md5 | 2cfc15cb15acc1ff2b2da65c790d7551 | 7478cba56ebbcc7a695cae2609010a897d766ff578a4260c2ac9cf MD5: 2cfc15cb15acc1ff2b2da65c790d7551 Typical Filename: rcx4d83.tmp Claimed Product: N/A Detectio |
| md5 | 7bdbd180c081fa63ca94f9c22c457376 | 83227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Typical Filename: c0dwjdi6a.dll Claimed Product: N/A Detect |
| md5 | 9403425a34e0c78a919681a09e5c16da | 3fe020f1dbb1caafde7180fd9216dcbf0ea147675ec287287f86aa MD5: 9403425a34e0c78a919681a09e5c16da Typical Filename: vincpsarzh.exe Claimed Product: N/A Detec |
| sha256 | 5e537dee6d7478cba56ebbcc7a695cae2609010a897d766ff578a4260c2ac9cf | 6 Detection Name: PUA.Win.Tool.Kmsauto::in03.talos SHA 256: 5e537dee6d7478cba56ebbcc7a695cae2609010a897d766ff578a4260c2ac9cf MD5: 2cfc15cb15acc1ff2b2da65c790d7551 Typical Filename: rcx |
| sha256 | 8664e2f59077c58ac12e747da09d2810fd5ca611f56c0c900578bf750cab56b7 | Product: N/A Detection Name: Win.Dropper.Scar::tpd SHA 256: 8664e2f59077c58ac12e747da09d2810fd5ca611f56c0c900578bf750cab56b7 MD5: 0e4c49327e3be816022a233f844a5731 Typical Filename: aac |
| sha256 | 975517668a3fe020f1dbb1caafde7180fd9216dcbf0ea147675ec287287f86aa | oduct: N/A Detection Name: Win.Dropper.Pykspa::tpd SHA 256: 975517668a3fe020f1dbb1caafde7180fd9216dcbf0ea147675ec287287f86aa MD5: 9403425a34e0c78a919681a09e5c16da Typical Filename: vin |
| sha256 | a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 | ware files from Talos telemetry over the past week SHA 256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Typical Filename: c0d |
| sha256 | bea312ccbc8a912d4322b45ea64d69bb3add4d818fd1eb7723260b11d76a138a | uct: N/A Detection Name: Trojan.GenericKD.33515991 SHA 256: bea312ccbc8a912d4322b45ea64d69bb3add4d818fd1eb7723260b11d76a138a MD5: 200206279107f4a2bb1832e3fcd7d64c Typical Filename: lsg |
From the original article
6 min read at blog.talosintelligence.com
I found the juxtaposition of stories on the Talos blog over the past week-plus kind of funny. On one hand, we had a massive story about Arid Viper , a Middle Eastern threat actor spreading spyware, one of the most dangerous types of malware out there right now, operating out of Gaza no less. Then, we had “Roblox,” a children’s video game (which I’ve written about multiple times and I maintain was the OG metaverse).
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.