Malwarecritical
Lazarus Group's infrastructure reuse leads to discovery of new malware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-47966 | Unauthenticated SAML RCE in Zoho ManageEngine On-Premise Products | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ec2-15-207-207-64.ap-south-1.compute.amazonaws.com | ]php hxxp[://]146[.]4[.]21[.]94/tmp/tmp/logs[.]php hxxp[://]ec2-15-207-207-64[.]ap-south-1[.]compute[.]amazonaws[.]com/resource/main/rawmail[.]php hxxp[://]109[.]248[.]15 |
| ipv4 | 108.61.186.55 | 123abe Networks IOCs 146[.]4[.]21[.]94 109[.]248[.]150[.]13 108[.]61[.]186[.]55:443 hxxp[://]146[.]4[.]21[.]94/tmp/tmp/comp[.]dat hxx |
| ipv4 | 109.248.150.13 | 1a67b77692567a4690935123abe Networks IOCs 146[.]4[.]21[.]94 109[.]248[.]150[.]13 108[.]61[.]186[.]55:443 hxxp[://]146[.]4[.]21[.]94/tm |
| ipv4 | 146.4.21.94 | c039739e2f93fc78341a67b77692567a4690935123abe Networks IOCs 146[.]4[.]21[.]94 109[.]248[.]150[.]13 108[.]61[.]186[.]55:443 hxxp[:// |
| sha256 | 05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9c66d15c1a3a11d | 57ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df DeimosC2 05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9c66d15c1a3a11d Trojanized Plink e3027062e602c5d1812c039739e2f93fc78341a67b |
| sha256 | 773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df | 934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df DeimosC2 05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9 |
| sha256 | db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 | 29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 CollectionRAT db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21a |
| sha256 | e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe | 096c291145c953ca3a3f8b3974f9c66d15c1a3a11d Trojanized Plink e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe Networks IOCs 146[.]4[.]21[.]94 109[.]248[.]150[.]13 108[.] |
| sha256 | ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 | so be found in our GitHub repository here . Hashes QuiteRAT ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 CollectionRAT db6a9934570fa98a93a979e7e0e218e0c9710e5a787b1 |
From the original article
8 min read at blog.talosintelligence.com
In the Lazarus Group’s latest campaign, which we detailed in a recent blog , the North Korean state-sponsored actor is exploiting CVE-2022-47966 , a ManageEngine ServiceDesk vulnerability to deploy multiple threats. In addition to their “QuiteRAT” malware, which we covered in the blog, we also discovered Lazarus Group using a new threat called “CollectionRAT.”
By Asheer Malhotra · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.