Threat actormedium

Russia-linked APT29 group changes TTPs following April advisories

Security Affairsby @securityaffairsMay 7, 2021 · 21:03 UTC (May 7, 2021)2 min read3 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-26855 CVE-2018-13379 CVE-2019-1653 CVE-2019-2725 CVE-2019-9670 CVE-2019-11510 CVE-2019-19781 CVE-2019-7609 CVE-2020-4006 CVE-2020-5902 CVE-2020-14882 CVE-2021-21972

Tags: cve-2021-26855 cve-2018-13379 cve-2019-1653 cve-2019-2725 cve-2019-9670 threat-actor

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2018-13379	Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN	9.8	100%	KEVRansomware	Jun 4, 2019 KEV Nov 3, 2021
CVE-2019-11510	Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN	10.0	100%	KEVRansomwarePoC ×2	May 8, 2019 KEV Nov 3, 2021
CVE-2019-1653	Unauthenticated Config Disclosure in Cisco RV320/RV325 Routers	7.5	100%	KEVPoC ×5	Jan 24, 2019 KEV Nov 3, 2021
CVE-2019-19781	Unauthenticated path traversal RCE in Citrix ADC, Gateway, and SD-WAN WANOP	9.8	100%	KEVRansomware	Dec 27, 2019 KEV Nov 3, 2021
CVE-2019-2725	Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE	9.8	100%	KEVRansomwarePoC	Apr 26, 2019 KEV Jan 10, 2022
CVE-2019-7609	Prototype Pollution RCE in Elastic Kibana Timelion Visualizer	10.0	95%	KEVPoC	Mar 25, 2019 KEV Jan 10, 2022
CVE-2019-9670	XML External Entity (XXE) Injection in Synacor Zimbra Collaboration Suite (ZCS)	9.8	100%	KEVPoC ×3	May 29, 2019 KEV Jan 10, 2022
CVE-2020-14882	Remote Code Execution in Oracle WebLogic Server	9.8	100%	KEVPoC ×3	Oct 21, 2020 KEV Nov 3, 2021
CVE-2020-4006	Command Injection in VMware Workspace ONE Access and Identity Manager	9.1	17%	KEV	Nov 23, 2020 KEV Nov 3, 2021
CVE-2020-5902	Unauthenticated RCE via path traversal in F5 BIG-IP TMUI	9.8	100%	KEVRansomwarePoC ×8	Jul 1, 2020 KEV Nov 3, 2021
CVE-2021-21972	Unauthenticated RCE in VMware vCenter Server vSphere Client Plugin	9.8	100%	KEVRansomwarePoC ×3	Feb 24, 2021 KEV Nov 3, 2021
CVE-2021-26855	Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)	9.1	100%	KEVRansomwarePoC ×4	Mar 3, 2021 KEV Nov 3, 2021

From the original article

2 min read at securityaffairs.com

The UK and US cybersecurity agencies have published a report detailing techniques used by Russia-linked cyberespionage group known APT29 (aka Cozy Bear). Today, UK NCSC and CISA-FBI-NSA cybersecurity agencies published a joint security advisory that warns organizations to patch systems immediately to mitigate the risk of attacks conducted by Russia-linked SVR group (aka APT29 , Cozy Bear , and The Dukes )).

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.