Vulnerabilityhigh
Inception Attackers Target Europe with Year
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-1856 | Remote Code Execution via TabStrip ActiveX Control in Microsoft Office (MSCOMCTL.OCX) | — | 72% | KEV | — KEV |
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 108.170.52.158 | er 2018 200.122.128[.]208 POWERSHOWER C2 22 nd October 2018 108.170.52[.]158 Remote template host Table 1 – IP Addresses associated wi |
| ipv4 | 188.165.62.40 | 018 51.255.139[.]194 Remote template host 13 th August 2018 188.165.62[.]40 Remote template host 10 th October 2018 200.122.128[.]208 |
| ipv4 | 200.122.128.208 | 018 188.165.62[.]40 Remote template host 10 th October 2018 200.122.128[.]208 POWERSHOWER C2 22 nd October 2018 108.170.52[.]158 Remote |
| ipv4 | 51.255.139.194 | f018e0 Infrastructure First Seen IP Context 20 th July 2018 51.255.139[.]194 Remote template host 13 th August 2018 188.165.62[.]40 Re |
| sha256 | 13de9678279b6ce6d81aeb32c0dd9f7458ad1f92aee17f3e052be9f06d473bed | emote Template Documents where we have the matching payload 13de9678279b6ce6d81aeb32c0dd9f7458ad1f92aee17f3e052be9f06d473bed d547773733abef19f2720d4def2356d62a532f64bcb002fb2b799e9ae39 |
| sha256 | 2bcb8a4ddc2150b25a44c292db870124c65687444f96e078f575da69bbf018e0 | 68ba52283f6cf5521cf75567b3c5b5143f324d37c59906ee63f1bbafcaf 2bcb8a4ddc2150b25a44c292db870124c65687444f96e078f575da69bbf018e0 Infrastructure First Seen IP Context 20 th July 2018 51.255 |
| sha256 | 49dbcf1fc8d3381e495089f396727a959885c1dd2ab6cd202cf3c4dbd1d27c4f | 5ae Other related templates and exploit documents from 2018 49dbcf1fc8d3381e495089f396727a959885c1dd2ab6cd202cf3c4dbd1d27c4f 8b212ee2d65c4da033c39aebaf59cc51ade45f32f4d91d1daa0bd367889 |
| sha256 | 687ee860fd5cd9902b441c26d72788d5a52052d03047a9b071808fc4c53a7e8b | 2a532f64bcb002fb2b799e9ae39f805f Remote templates analyzed. 687ee860fd5cd9902b441c26d72788d5a52052d03047a9b071808fc4c53a7e8b 72eb022f395cc15bbe9582ee02f977ea0692932461a8b0bd608d9f09711 |
| sha256 | 72eb022f395cc15bbe9582ee02f977ea0692932461a8b0bd608d9f0971125999 | 860fd5cd9902b441c26d72788d5a52052d03047a9b071808fc4c53a7e8b 72eb022f395cc15bbe9582ee02f977ea0692932461a8b0bd608d9f0971125999 PowerShower sample 8aef4975d9c51821c4fa8ee1cbfe9c1f4a88c878 |
| sha256 | 8aef4975d9c51821c4fa8ee1cbfe9c1f4a88c8784427d467ea99b2c1dabe15ae | 02f977ea0692932461a8b0bd608d9f0971125999 PowerShower sample 8aef4975d9c51821c4fa8ee1cbfe9c1f4a88c8784427d467ea99b2c1dabe15ae Other related templates and exploit documents from 2018 49d |
| sha256 | 8b212ee2d65c4da033c39aebaf59cc51ade45f32f4d91d1daa0bd367889f934d | f1fc8d3381e495089f396727a959885c1dd2ab6cd202cf3c4dbd1d27c4f 8b212ee2d65c4da033c39aebaf59cc51ade45f32f4d91d1daa0bd367889f934d cc64a68ba52283f6cf5521cf75567b3c5b5143f324d37c59906ee63f1bb |
| sha256 | cc64a68ba52283f6cf5521cf75567b3c5b5143f324d37c59906ee63f1bbafcaf | ee2d65c4da033c39aebaf59cc51ade45f32f4d91d1daa0bd367889f934d cc64a68ba52283f6cf5521cf75567b3c5b5143f324d37c59906ee63f1bbafcaf 2bcb8a4ddc2150b25a44c292db870124c65687444f96e078f575da69bbf |
| sha256 | d547773733abef19f2720d4def2356d62a532f64bcb002fb2b799e9ae39f805f | 678279b6ce6d81aeb32c0dd9f7458ad1f92aee17f3e052be9f06d473bed d547773733abef19f2720d4def2356d62a532f64bcb002fb2b799e9ae39f805f Remote templates analyzed. 687ee860fd5cd9902b441c26d72788d5 |
From the original article
6 min read at unit42.paloaltonetworks.com
The Inception attackers have been active since at least 2014 and have been documented previously by both Blue Coat and Symantec ; historical attacks used custom malware for a variety of platforms, and targeting a range of industries, primarily in Russia, but also around the world.
By Tom Lancaster · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.