Exploit / PoCcritical
Threat Source newsletter (April 27, 2023) — New Cisco Secure offerings and extra security from Duo
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27350 | Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1e2a99ae43d6365148d412b5dfee0e1c | cde76b4d8e8077d4fcb4d0b70e5200bf4e738b45a0bd28fbc2cae6 MD5: 1e2a99ae43d6365148d412b5dfee0e1c Typical Filename: PDFpower.exe Claimed Product: PdfPower De |
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Typical Filename: VID001.exe Claimed Product: N/A Detection |
| md5 | 93fefc3e88ffb78abb36365fa5cf857c | 81591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wextract Claimed Product: Internet Explor |
| md5 | cdd331078279960a1073b03e0bb6fce4 | 7cab6396e187a5d5156f04d80220dd386b0b6941251188104b2e53 MD5: cdd331078279960a1073b03e0bb6fce4 Typical Filename: mediaget.exe Claimed Product: MediaGet De |
| md5 | d47fa115154927113b05bd3c8a308201 | cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725 MD5: d47fa115154927113b05bd3c8a308201 Typical Filename: mssqlsrv.exe Claimed Product: N/A Detecti |
| sha256 | 00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725 | ion Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg SHA 256: 00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725 MD5: d47fa115154927113b05bd3c8a308201 Typical Filename: mss |
| sha256 | 4ad8893f8c7cab6396e187a5d5156f04d80220dd386b0b6941251188104b2e53 | uct: N/A Detection Name: Trojan.GenericKD.65065311 SHA 256: 4ad8893f8c7cab6396e187a5d5156f04d80220dd386b0b6941251188104b2e53 MD5: cdd331078279960a1073b03e0bb6fce4 Typical Filename: med |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | ware files from Talos telemetry over the past week SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Typical Filename: VID |
| sha256 | e248b01e3ccde76b4d8e8077d4fcb4d0b70e5200bf4e738b45a0bd28fbc2cae6 | duct: N/A Detection Name: Win.Worm.Coinminer::1201 SHA 256: e248b01e3ccde76b4d8e8077d4fcb4d0b70e5200bf4e738b45a0bd28fbc2cae6 MD5: 1e2a99ae43d6365148d412b5dfee0e1c Typical Filename: PDF |
| sha256 | e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 | wer Detection Name: Win32.Adware.Generic.SSO.TALOS SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wex |
From the original article
4 min read at blog.talosintelligence.com
Welcome to this week’s edition of the Threat Source newsletter. I’m writing this earlier in the week as I get ready for some personal travel (everyone is lucky I passed on writing another Cybersecurity Mock Draft ), so apologies if I miss anything major that happens at RSA. But Cisco beat everyone to the punch Monday morning anyway, making a slew of major announcements on RSA travel day.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.