Threat Source newsletter (April 13, 2023) — Dark web forum whac-a
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-37969 | Out-of-bounds write flaw in Microsoft Windows CLFS driver enables privilege escalation | 7.8 | 28% | KEVRansomware | KEV |
| CVE-2023-28205 | Use-After-Free in Apple WebKit (iOS, iPadOS, macOS, Safari) Enables Code Execution | 8.8 | 27% | KEV | KEV |
| CVE-2023-28206 | Out-of-Bounds Write in Apple IOSurfaceAccelerator Allows Kernel-Level Code Execution | 8.6 | 23% | KEV | KEV |
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation | 7.8 | 49% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1e2a99ae43d6365148d412b5dfee0e1c | cde76b4d8e8077d4fcb4d0b70e5200bf4e738b45a0bd28fbc2cae6 MD5: 1e2a99ae43d6365148d412b5dfee0e1c Typical Filename: PDFpower.exe Claimed Product: PdfPower De |
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Typical Filename: VID001.exe Claimed Product: N/A Detection |
| md5 | 93fefc3e88ffb78abb36365fa5cf857c | 81591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wextract Claimed Product: Internet Explor |
| md5 | a2d60b5c01a305af1ac76c95e12fdf4a | 4319d78da574e2ec5cd0b9dd0712347622f1122f1cb821bb421f8f MD5: a2d60b5c01a305af1ac76c95e12fdf4a Typical Filename: KMSAuto.exe Claimed Product: N/A Detectio |
| md5 | d47fa115154927113b05bd3c8a308201 | cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725 MD5: d47fa115154927113b05bd3c8a308201 Typical Filename: mssqlsrv.exe Claimed Product: N/A Detecti |
| sha256 | 00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725 | ion Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg SHA 256: 00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725 MD5: d47fa115154927113b05bd3c8a308201 Typical Filename: mss |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | ware files from Talos telemetry over the past week SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Typical Filename: VID |
| sha256 | e248b01e3ccde76b4d8e8077d4fcb4d0b70e5200bf4e738b45a0bd28fbc2cae6 | duct: N/A Detection Name: Win.Worm.Coinminer::1201 SHA 256: e248b01e3ccde76b4d8e8077d4fcb4d0b70e5200bf4e738b45a0bd28fbc2cae6 MD5: 1e2a99ae43d6365148d412b5dfee0e1c Typical Filename: PDF |
| sha256 | e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 | ed Product: N/A Detection Name: W32.File.MalParent SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wex |
| sha256 | f3d5815e844319d78da574e2ec5cd0b9dd0712347622f1122f1cb821bb421f8f | wer Detection Name: Win32.Adware.Generic.SSO.TALOS SHA 256: f3d5815e844319d78da574e2ec5cd0b9dd0712347622f1122f1cb821bb421f8f MD5: a2d60b5c01a305af1ac76c95e12fdf4a Typical Filename: KMS |
From the original article
5 min read at blog.talosintelligence.com
Welcome to this week’s edition of the Threat Source newsletter. Law enforcement organizations across the globe notched a series of wins over the past few weeks against online forums for cybercriminals. On March 23, the FBI announced it disrupted the online cybercriminal marketplace BreachForums , known for being a place where users could buy and sell stolen user information.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.