Malwarehigh
Attackers target Ukraine using GoMet backdoor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-5902 | Unauthenticated RCE via path traversal in F5 BIG-IP TMUI | 9.8 | 100% | KEVRansomwarePoC ×8 | KEV |
| CVE-2022-1040 | Authentication Bypass Leading to Unauthenticated RCE in Sophos Firewall (SFOS) | 9.8 | 100% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 111.90.139.122 | b1dfaadf6919e05c854c2eaabbacb769b2ff684de11c3094a03ee88 IPs 111.90.139[.]122 |
| sha1 | 9b5e112e683a3605c9481d8f565cfb3b7e2feab7 | ued on April 4, 2021 as a self-signed certificate, with the 9b5e112e683a3605c9481d8f565cfb3b7e2feab7 SHA-1 fingerprint. This indicates that this campaign prepar |
| sha256 | 950ba2cc9b1dfaadf6919e05c854c2eaabbacb769b2ff684de11c3094a03ee88 | ee4de4cedd063541916175434f82047b6576f86897b1cb (FctSec.exe) 950ba2cc9b1dfaadf6919e05c854c2eaabbacb769b2ff684de11c3094a03ee88 (SQLocalM86.exe) These samples have minor differences but a |
| sha256 | f24158c5132943fbdeee4de4cedd063541916175434f82047b6576f86897b1cb | s: Talos found two samples of this version of the backdoor: f24158c5132943fbdeee4de4cedd063541916175434f82047b6576f86897b1cb (FctSec.exe) 950ba2cc9b1dfaadf6919e05c854c2eaabbacb769b2ff6 |
From the original article
6 min read at blog.talosintelligence.com
Since the Russian invasion of Ukraine began, Ukrainians have been under a nearly constant barrage of cyber attacks . Working jointly with Ukrainian organizations, Cisco Talos has discovered a fairly uncommon piece of malware targeting Ukraine — this time aimed at a large software development company whose software is used in various state organizations within Ukraine.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.