Attackers are leveraging Follina. What can you do?
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) | 8.8 | 98% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-30190 | MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina) | 7.8 | 99% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | seller-notification.live | 22 – PH URL: http://45.76.53[.]253/1.html Payload: https://seller-notification[.]live/Zgfbe234dg Gathers info from browsers, registry, user acc |
| ipv4 | 45.76.53.253 | loyment Agreement Submitted: 2022-06-02 22 – PH URL: http://45.76.53[.]253/1.html Payload: https://seller-notification[.]live/Zgfbe2 |
| ipv4 | 45.77.156.179 | o from browsers, registry, user accounts etc Uploads ZIP to 45.77.156[.]179 pic.twitter.com/c9E0G1PLvM — Kimberly (@StopMalvertisin) |
From the original article
2 min read at helpnetsecurity.com
As the world is waiting for Microsoft to push out a patch for CVE-2022-30190 , aka “Follina”, attackers around the world are exploiting the vulnerability in a variety of campaigns.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.