Ransomwarehigh
Sodin ransomware exploits Windows vulnerability and processor architecture
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-8453 | Win32k Elevation of Privilege Flaw in Windows 7-10 and Windows Server (CVE-2018-8453) | 7.8 | 70% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1ce1ca85bff4517a1ef7e8f9a7c22b16 | aspersky.com/enterprise-security/cybersecurity-services IOC 1ce1ca85bff4517a1ef7e8f9a7c22b16 |
From the original article
6 min read at securelist.com
When Sodin (also known as Sodinokibi and REvil) appeared in the first half of 2019, it immediately caught our attention for distributing itself through an Oracle Weblogic vulnerability and carrying out attacks on MSP providers .
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.