Vulnerabilityhigh
Central Tibetan Administration Website Compromised
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-4681 | Remote Code Execution in Oracle Java SE Runtime Environment (JRE) | — | 99% | KEVRansomware | — KEV |
| CVE-2013-2423 | Remote Integrity-Affecting Vulnerability in Oracle JRE HotSpot (CVE-2013-2423) | — | 85% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 59.188.239.46 | orrect. The related C2 is located at news.worldlinking.com (59.188.239.46). This threat actor has been quietly operating these sorts |
| md5 | a6d7edc77e745a91b1fc6be985994c6a | ell. That file is a 397 kb win32 executable “aMCBlHPl.exe” (a6d7edc77e745a91b1fc6be985994c6a) detected as “Trojan.Win32.Swisyn.cyxf”. Backdoors detected |
| md5 | edd8b301eeb083e9fdf0ae3a9bdb3cd6 | . The Java exploit being delivered is the 212kb “YPVo.jar” (edd8b301eeb083e9fdf0ae3a9bdb3cd6), which archives, drops and executes the backdoor as well. |
From the original article
3 min read at securelist.com
A snippet of code on the Central Tibetan Administration website redirects CN speaking visitors to a Java exploit that drops an APT-related backdoor. For some context, the site claims the administration itself as “… the Central Tibetan Administration (CTA) of His Holiness the Dalai Lama, this is the continuation of the government of independent Tibet.”
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.