Threat actorhigh
Capitalizing on Coronavirus Panic, Threat Actors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ac19.ir | ted on a website created by the Iranian government, https://ac19[.]ir/ . Domain Registrations Beginning in on January 12, the n |
| domain | cdc.gov | n” that appears to originate from the address CDC-Covid19[@]cdc[.]gov. When victims click on the embedded link, they are redire |
| domain | cdc-gov.org | d the CDC, in particular from emails containing the domains cdc-gov[.]org and cdcgov[.]org. In one instance, the URL contained with |
| domain | cdcgov.org | icular from emails containing the domains cdc-gov[.]org and cdcgov[.]org. In one instance, the URL contained within a phishing ema |
| domain | who.int | a legitimate address on the official domains (cdc[.]gov and who[.]int). Many of the phishing emails used the branding and trade |
From the original article
10 min read at recordedfuture.com
Recorded Future investigated how threat actors are using the global disruptions caused by COVID-19 to further their cyber threat activities. This research is targeted toward those who hope to understand the technical cybersecurity threats that have emerged from the spread of COVID-19.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.