Malwarecritical
CactusPete APT group’s updated Bisonal backdoor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-8174 | Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine | 7.5 | 88% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 11b8016045a861be0518c9c398a79573 | 8CE791A836F54708F5FB9935F3 3E431E5CF4DA9CAE83C467BC1AE818A0 11B8016045A861BE0518C9C398A79573 Related material: January 29, 2020 https://nao-sec.org/2020 |
| md5 | 3e431e5cf4da9cae83c467bc1ae818a0 | rve\Debug\MyServe.pdb MD5: A3F6818CE791A836F54708F5FB9935F3 3E431E5CF4DA9CAE83C467BC1AE818A0 11B8016045A861BE0518C9C398A79573 Related material: January |
| md5 | a3f6818ce791a836f54708f5fb9935f3 | PDB path: E:\vs2010\new big!\MyServe\Debug\MyServe.pdb MD5: A3F6818CE791A836F54708F5FB9935F3 3E431E5CF4DA9CAE83C467BC1AE818A0 11B8016045A861BE0518C9C398 |
From the original article
5 min read at securelist.com
CactusPete (also known as Karma Panda or Tonto Team) is an APT group that has been publicly known since at least 2013. Some of the group’s activities have been previously described in public by multiple sources. We have been investigating and privately reporting on this group’s activity for years as well.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.