Threat actorcritical
Russia-linked APT28 targets government Polish institutions
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-23397 | Zero-Click Elevation of Privilege in Microsoft Outlook (Forced NTLM Credential Leak) | 9.8 | 97% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | mocky.io | g on the link, the victims are redirected to the domain run.mocky[.]io, which is a free service used by developers to create and |
| domain | run.mocky.io | review recent connections to domains like webhook.site and run.mocky.io, as well as their appearance in received emails. These site |
| domain | webhook.site | domain, in turn, redirects to another legitimate site named webhook[.]site which allows logging all queries to the generated address |
From the original article
4 min read at securityaffairs.com
CERT Polska warns of a large-scale malware campaign against Polish government institutions conducted by Russia-linked APT28. CERT Polska and CSIRT MON teams issued a warning about a large-scale malware campaign targeting Polish government institutions, allegedly orchestrated by the Russia-linked APT28 group.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.