Malwarehigh

Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries

The Hacker Newsby @TheHackersNewsNov 28, 2024 · 09:13 UTC (Nov 28, 2024)3 min read3 · 2 reads

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-46805 CVE-2024-21887 CVE-2023-48788 CVE-2022-3236 CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065

Tags: cve-2023-46805 cve-2024-21887 cve-2023-48788 cve-2022-3236 cve-2021-26855 malware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-26855 +3 related CVEs CVE-2021-27065 CVE-2021-26857 CVE-2021-26858	Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)	9.1 group max	100%	KEVRansomwarePoC ×4	Mar 3, 2021 KEV Nov 3, 2021
CVE-2022-3236	Unauthenticated Code Injection RCE in Sophos Firewall (User Portal/Webadmin)	9.8	99%	KEV	Sep 23, 2022 KEV Sep 23, 2022
CVE-2024-21887 +1 related CVE CVE-2023-46805	Command Injection RCE in Ivanti Connect Secure and Policy Secure	9.1 group max	100%	KEVRansomwarePoC	Jan 12, 2024 KEV Jan 10, 2024
CVE-2023-48788	Unauthenticated SQL Injection in Fortinet FortiClient EMS	9.8	98%	KEVRansomware	Mar 12, 2024 KEV Mar 25, 2024

From the original article

3 min read at thehackernews.com

The China-linked threat actor known as Earth Estries has been observed using a previously undocumented backdoor called GHOSTSPIDER as part of its attacks targeting Southeast Asian telecommunications companies.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.