Ransomwarecritical
Experts Expose Secrets of Conti Ransomware Group That Made 25 Million from Victims
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-13374 | Improper Access Control in Fortinet FortiOS and FortiADC Exposes LDAP Credentials | 4.3 | 38% | KEVRansomware | KEV |
| CVE-2018-13379 | Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2021-1675 | Remote Code Execution in Microsoft Windows Print Spooler (PrintNightmare) | 7.8 | 85% | KEVRansomwarePoC | KEV |
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler | 8.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2021-36958 | A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations | 7.8 | 31% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | contirecovery.info | Cymru last month highlighted a similar open web URL named "contirecovery[.]info." "In order to tackle the complex challenge of disrupting |
| domain | contirecovery.ws | , revealing extensive details of a clearnet website called "contirecovery[.]ws" that contains instructions for purchasing decryption key |
| domain | xmpp.jp | g the roles of admin ("Tokyo"), assistant ("it_work_support@xmpp[.]jp"), and recruiter ("IT_Work") to attract new affiliates in |
| ipv4 | 217.12.204.135 | l IP address of one of its recovery (aka payment) servers — 217.12.204[.]135 — thereby effectively bolstering its security measures. " |
From the original article
3 min read at thehackernews.com
The clearnet and dark web payment portals operated by the Conti ransomware group have gone down in what appears to be an attempt to shift to new infrastructure after details about the gang's inner workings and its members were made public.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.