Ransomwarecritical
Nokoyawa ransomware attacks with Windows zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-24521 | Out-of-bounds Write Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 7% | KEVRansomware | KEV |
| CVE-2022-37969 | Out-of-bounds write flaw in Microsoft Windows CLFS driver enables privilege escalation | 7.8 | 28% | KEVRansomware | KEV |
| CVE-2023-23376 | Out-of-Bounds Write Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 11% | KEVRansomware | KEV |
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation | 7.8 | 49% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | devsetgroup.com | 17 CobaltStrike C2s vnssinc[.]com qooqle[.]top vsexec[.]com devsetgroup[.]com Nokoyawa ransomware 8800e6f1501f69a0a04ce709e9fa251c |
| domain | qooqle.top | 3d7fdb2f8f5e5c1962e22b504a17 CobaltStrike C2s vnssinc[.]com qooqle[.]top vsexec[.]com devsetgroup[.]com Nokoyawa ransomware 8800e6 |
| domain | vnssinc.com | 16634e6e7 a2313d7fdb2f8f5e5c1962e22b504a17 CobaltStrike C2s vnssinc[.]com qooqle[.]top vsexec[.]com devsetgroup[.]com Nokoyawa rans |
| domain | vsexec.com | c1962e22b504a17 CobaltStrike C2s vnssinc[.]com qooqle[.]top vsexec[.]com devsetgroup[.]com Nokoyawa ransomware 8800e6f1501f69a0a04 |
| md5 | 1e4dd35b16ddc59c1ecf240c22b8a4c4 | ploit 46168ed7dbe33ffc4179974f8bf401aa CobaltStrike loaders 1e4dd35b16ddc59c1ecf240c22b8a4c4 f23be19024fcc7c8f885dfa16634e6e7 a2313d7fdb2f8f5e5c1962e22b |
| md5 | 46168ed7dbe33ffc4179974f8bf401aa | ner* C:\Users\Public\MyLog*.blf C:\Users\Public\p_* Exploit 46168ed7dbe33ffc4179974f8bf401aa CobaltStrike loaders 1e4dd35b16ddc59c1ecf240c22b8a4c4 f23be |
| md5 | 8800e6f1501f69a0a04ce709e9fa251c | le[.]top vsexec[.]com devsetgroup[.]com Nokoyawa ransomware 8800e6f1501f69a0a04ce709e9fa251c |
| md5 | a2313d7fdb2f8f5e5c1962e22b504a17 | 5b16ddc59c1ecf240c22b8a4c4 f23be19024fcc7c8f885dfa16634e6e7 a2313d7fdb2f8f5e5c1962e22b504a17 CobaltStrike C2s vnssinc[.]com qooqle[.]top vsexec[.]com de |
| md5 | f23be19024fcc7c8f885dfa16634e6e7 | 401aa CobaltStrike loaders 1e4dd35b16ddc59c1ecf240c22b8a4c4 f23be19024fcc7c8f885dfa16634e6e7 a2313d7fdb2f8f5e5c1962e22b504a17 CobaltStrike C2s vnssinc[. |
From the original article
7 min read at securelist.com
In February 2023, Kaspersky technologies detected a number of attempts to execute similar elevation-of-privilege exploits on Microsoft Windows servers belonging to small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.