Malwarecritical
Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-43451 | NTLMv2 Hash Disclosure Spoofing Vulnerability in Microsoft Windows | 6.5 | 84% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 92.42.96.30 | is designed to establish connections with a remote server ("92.42.96[.]30") to download additional payloads, including Spark RAT. " |
From the original article
2 min read at thehackernews.com
A newly patched security flaw impacting Windows NT LAN Manager (NTLM) was exploited as a zero-day by a suspected Russia-linked actor as part of cyber attacks targeting Ukraine. The vulnerability in question, CVE-2024-43451 (CVSS score: 6. 5), refers to an NTLM hash disclosure spoofing vulnerability that could be exploited to steal a user's NTLMv2 hash.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.