Ransomwarehigh
New financially motivated attacks in Western Europe traced to Russian
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-1322 | Local Privilege Escalation in Microsoft Windows 10 and Windows Server | 7.8 | 19% | KEVRansomwarePoC | KEV |
| CVE-2019-1405 | Local Privilege Escalation in Microsoft Windows UPnP Service | 7.8 | 30% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 195.123.246.126 | have managed to establish the CnCs used during the attacks 195.123.246[.]126 and 37.120.145[.]253. The former has been active since la |
| md5 | 363df0b3c8b7b390573d3a9f09953feb | 63d83cdd333) and 2 upgraded versions of Silence.MainModule (363df0b3c8b7b390573d3a9f09953feb & 800060b75675493f2df6d9e0f81474fd). During the analysis of |
| md5 | 800060b75675493f2df6d9e0f81474fd | s of Silence.MainModule (363df0b3c8b7b390573d3a9f09953feb & 800060b75675493f2df6d9e0f81474fd). During the analysis of these samples Group-IB Threat Hunt |
| md5 | ce04972114bbd5844aa2f63d83cdd333 | bruary 2 and have been classified as Silence.ProxyBot (MD5: ce04972114bbd5844aa2f63d83cdd333) and 2 upgraded versions of Silence.MainModule (363df0b3c8b |
From the original article
3 min read at securityaffairs.com
Researchers at Group-IB observed new financially motivated attacks in Western Europe traced to Russian-speaking threat actors. Group-IB , a Singapore-based cybersecurity company that specializes in preventing cyberattacks, has detected successful attacks in Western Europe carried out in late January 2020 traced to Russian-speaking threat actors.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.