Ransomwarehigh
Night Sky ransomware operators exploit Log4Shell to target VMware Horizon servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-26084 | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-34473 | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) | 9.1 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) | 10.0 | 100% | KEVRansomwarePoC ×9 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apicon.nvidialab.us | [.]com, api[.]rogerscorp[.]org, api[.]sophosantivirus[.]ga, apicon[.]nvidialab[.]us, among others. — Microsoft Threat Intelligence (@MsftSe |
| domain | api.rogerscorp.org | legitimate domains, for example service[.]trendmrcio[.]com, api[.]rogerscorp[.]org, api[.]sophosantivirus[.]ga, apicon[.]nvidialab[.]us, a |
| domain | api.sophosantivirus.ga | example service[.]trendmrcio[.]com, api[.]rogerscorp[.]org, api[.]sophosantivirus[.]ga, apicon[.]nvidialab[.]us, among others. — Microsoft Thr |
| domain | service.trendmrcio.com | use CnC servers that spoof legitimate domains, for example service[.]trendmrcio[.]com, api[.]rogerscorp[.]org, api[.]sophosantivirus[.]ga, ap |
From the original article
2 min read at securityaffairs.com
Another gang, Night Sky ransomware operation, started exploiting the Log4Shell vulnerability in the Log4j library to gain access to VMware Horizon systems. The Night Sky ransomware operation started exploiting the Log4Shell flaw (CVE-2021-44228) in the Log4j library to gain access to VMware Horizon systems.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.