Threat actorhigh
The evolutions of APT28 attacks .... ..... .... .... .... .... ....
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-3333 | Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution | — | 89% | KEV | — KEV |
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
| CVE-2013-1347 | Memory corruption RCE in Microsoft Internet Explorer | — | 78% | KEV | — KEV |
| CVE-2013-3897 | Use-After-Free RCE in Microsoft Internet Explorer (CVE-2013-3897) | — | 77% | KEV | — KEV |
| CVE-2013-3906 | Memory Corruption RCE in Microsoft Graphics Component (Actively Exploited) | — | 85% | KEV | — KEV |
| CVE-2014-1776 | Use-After-Free Memory Corruption RCE in Microsoft Internet Explorer | — | 83% | KEV | — KEV |
| CVE-2015-1641 | Memory Corruption RCE in Microsoft Office via Malicious RTF Files | — | 97% | KEV | — KEV |
| CVE-2015-1642 | Memory Corruption RCE in Microsoft Office via Crafted Documents | — | 53% | KEV | — KEV |
| CVE-2015-1701 | Local Privilege Escalation in Microsoft Windows Win32k.sys Kernel-Mode Driver | — | 56% | KEVRansomware | — KEV |
| CVE-2015-2387 | Local Privilege Escalation in Microsoft ATM Font Driver (ATMFD.DLL) | — | 35% | KEV | — KEV |
| CVE-2015-2590 | Remote Code Execution Vulnerability in Oracle Java SE and Java SE Embedded | — | 25% | KEV | — KEV |
| CVE-2015-3043 | Memory Corruption RCE in Adobe Flash Player | — | 74% | KEV | — KEV |
| CVE-2015-4902 | Oracle Java SE Deployment Integrity Vulnerability Exploited in the Wild | — | 14% | KEV | — KEV |
| CVE-2015-5119 | Use-After-Free RCE in Adobe Flash Player (ActionScript 3 ByteArray) | — | 99% | KEV | — KEV |
| CVE-2015-7645 | Arbitrary Code Execution in Adobe Flash Player via Crafted SWF Files | — | 65% | KEVRansomware | — KEV |
| CVE-2017-0144 | Remote Code Execution in Microsoft SMBv1 (EternalBlue) affecting Windows and Siemens devices | 8.8 | 99% | KEVRansomwarePoC ×6 | KEV |
| CVE-2017-0262 | Memory Corruption RCE in Microsoft Office 2010, 2013, and 2016 | 7.8 | 81% | KEV | KEV |
| CVE-2017-0263 | Win32k Use-After-Free Local Privilege Escalation in Windows 7 through Server 2016 | 7.8 | 10% | KEVPoC ×2 | KEV |
From the original article
6 min read at securityaffairs.com
Analyzing how tactics, techniques and procedures of the Russia-linked APT28 cyberespionage group evolve over the time. APT28 is a well known Russian cyber espionage group attributed, with a medium level of confidence, to Russian military intelligence agency GRU (by CrowdStrike).
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.