Ransomwarecritical
RansomHub Becomes 2024’s Top Ransomware Group, Hitting 600+ Organizations Globally
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-1472 | Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers | 5.5 | 99% | KEVRansomwarePoC | KEV |
| CVE-2021-20038 | Unauthenticated Stack Buffer Overflow in SonicWall SMA 100 Appliances | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2021-42278 | Privilege Escalation via sAMAccountName Spoofing in Microsoft Active Directory | 7.5 | 73% | KEVRansomware | KEV |
| CVE-2024-3400 | Unauthenticated Root Command Injection in Palo Alto Networks PAN-OS GlobalProtect | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
From the original article
4 min read at thehackernews.com
The threat actors behind the RansomHub ransomware-as-a-service (RaaS) scheme have been observed leveraging now-patched security flaws in Microsoft Active Directory and the Netlogon protocol to escalate privileges and gain unauthorized access to a victim network's domain controller as part of their post-compromise strategy.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.