Vulnerabilityhigh
APT group ToddyCat exploits a vulnerability in ESET for DLL proxying
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-36276 | Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of… | 7.8 | <1% | ||
| CVE-2024-11859 | DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its… | 8.4 | 2% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 008f506013456ea5151df779d3e3ff0f | Files Hashes D38E3830C8BA3A00794EF3077942AD96 version . dll 008F506013456EA5151DF779D3E3FF0F version . dll Legitimate file for DLL proxying 8795271F02B3 |
| md5 | 8795271f02b30980ebd9950fcc141304 | F779D3E3FF0F version . dll Legitimate file for DLL proxying 8795271F02B30980EBD9950FCC141304 ESET Command-line scanner Legitimate files for BYOVD B87944 |
| md5 | b87944dcc444e4c6ce9bb9fb8a9c0def | 141304 ESET Command-line scanner Legitimate files for BYOVD B87944DCC444E4C6CE9BB9FB8A9C0DEF dbutildrv2 . INF DE39EE41D03C97E37849AF90E408ABBE DBUtilDrv |
| md5 | d38e3830c8ba3a00794ef3077942ad96 | signature. Indicators of compromise Malicious Files Hashes D38E3830C8BA3A00794EF3077942AD96 version . dll 008F506013456EA5151DF779D3E3FF0F version . dl |
| md5 | dacb62578b3ea191ea37486d15f4f83c | rv2 . INF DE39EE41D03C97E37849AF90E408ABBE DBUtilDrv2 . cat DACB62578B3EA191EA37486D15F4F83C dbutildrv2 . sys |
| md5 | de39ee41d03c97e37849af90e408abbe | for BYOVD B87944DCC444E4C6CE9BB9FB8A9C0DEF dbutildrv2 . INF DE39EE41D03C97E37849AF90E408ABBE DBUtilDrv2 . cat DACB62578B3EA191EA37486D15F4F83C dbutildrv |
From the original article
7 min read at securelist.com
To hide their activity in infected systems, APT groups resort to various techniques to bypass defenses. Most of these techniques are well known and detectable by both EPP solutions and EDR threat-monitoring and response tools. For example, to hide their activity in Windows systems, cybercriminals can use kernel-level rootkits, in particular malicious drivers.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.