Vulnerabilitycritical
CVE-2022-41040 and CVE-2022-41082 – zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-31207 | Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE | 6.6 | 100% | KEVRansomwarePoC | KEV |
CVE-2021-34473+1 related CVE | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
CVE-2022-41040+1 related CVE | Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell) | 8.8 group max | 100% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 193.149.185.52 | vulnerable binary for DLL hijack PDM:Exploit.Win32.Generic 193.149.185.52:443 С2 server sync.service.auzreservices.com С2 server |
| md5 | 379f87daa6a23400adf19c1cdd6b0dc9 | lib-2.0.dll Malware hijack library Trojan.Win64.Dllhijacker 379F87DAA6A23400ADF19C1CDD6B0DC9 vmwarexferlogs.exe Dropped vulnerable binary for DLL hijack |
| md5 | 47a0814408210e6fca502b3799b3952b | oxy Trojan.Win64.Agent.qwibok HEUR:HackTool.Win64.Proxy.gen 47A0814408210E6FCA502B3799B3952B Glib-2.0.dll Malware hijack library Trojan.Win64.Dllhijacke |
| md5 | a2fae32f116870e5a94b5fab50a1cb71 | vulnerable binary for DLL hijack PDM:Exploit.Win32.Generic A2FAE32F116870E5A94B5FAB50A1CB71 Svchosts.exe Malware reverse proxy Trojan.Win64.Agent.qwibo |
| md5 | f77e55fd56fdad21766caa9c896734e9 | stop attacks in the early stages. Indicators of compromise F77E55FD56FDAD21766CAA9C896734E9 LockDown.dll Malware hijack library Trojan.Win64.Dllhijacke |
| md5 | f9322ead69300501356b13d751165daa | ockDown.dll Malware hijack library Trojan.Win64.Dllhijacker F9322EAD69300501356B13D751165DAA mfeann.exe Dropped vulnerable binary for DLL hijack PDM:Exp |
From the original article
4 min read at securelist.com
At the end of September, GTSC reported an attack on critical infrastructure that took place in August. During the investigation, experts found that two 0-day vulnerabilities in Microsoft Exchange Server were used in the attack.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.