Malwarecritical

Commercial spyware vendor exploits used by Kremlin

Ars Technica · SecurityAug 29, 2024 · 21:05 UTC (Aug 29, 2024)2 min read2

Read at arstechnica.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-41993 CVE-2024-5274 CVE-2024-4671 CVE-2021-37973

Tags: cve-2023-41993 cve-2024-5274 cve-2024-4671 cve-2021-37973 malware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-37973	Use-After-Free Sandbox Escape in Google Chrome/Chromium Portals	9.6	12%	KEV	Oct 8, 2021 KEV Nov 3, 2021
CVE-2023-41993	WebKit Code Execution Flaw in Apple iOS, iPadOS, macOS, and Safari	8.8	24%	KEV	Sep 21, 2023 KEV Sep 25, 2023
CVE-2024-4671	Use-After-Free Sandbox Escape in Google Chrome/Chromium	9.6	8%	KEV	May 14, 2024 KEV May 13, 2024
CVE-2024-5274	Google Chrome V8 Type Confusion Allows In-Sandbox RCE via Crafted HTML Pages	9.6	8%	KEVPoC	May 28, 2024 KEV May 28, 2024

From the original article

2 min read at arstechnica.com

In one case, Lecigne said, TAG observed APT29 compromising the Mongolian government sites mfa. gov[.] mn and cabinet.

Ars Technica · Security

arstechnica.com

Read the full article at Ars Technica · Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.