Spyware isn’t going anywhere, and neither are its tactics
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-21893 | SSRF in Ivanti Connect Secure, Policy Secure, and Neurons SAML Component | 8.2 | 100% | KEVRansomware | KEV |
| CVE-2024-23222 | Apple WebKit Type Confusion Enables Arbitrary Code Execution Across iOS, macOS, tvOS | 8.8 | 11% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 040cd888e971f2872d6d5dafd52e6194 | b6dd56bc787fda46e6f4240aaa0353ead1e3071224d454038a545e MD5: 040cd888e971f2872d6d5dafd52e6194 Typical Filename: tmp000c3787 Claimed Product: Ultra Virus |
| md5 | 0e4c49327e3be816022a233f844a5731 | 77c58ac12e747da09d2810fd5ca611f56c0c900578bf750cab56b7 MD5: 0e4c49327e3be816022a233f844a5731 Typical Filename: aact.exe Claimed Product: AAct x86 Detect |
| md5 | 2cfc15cb15acc1ff2b2da65c790d7551 | 7478cba56ebbcc7a695cae2609010a897d766ff578a4260c2ac9cf MD5: 2cfc15cb15acc1ff2b2da65c790d7551 Typical Filename: rcx4d83.tmp Claimed Product: N/A Detectio |
| md5 | 93fefc3e88ffb78abb36365fa5cf857c | 81591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wextract Claimed Product: Internet Explor |
| md5 | ef6ff172bf3e480f1d633a6c53f7a35e | a08dd59e87de24590b938045f14e693a43a83b81ce8531127eb440 MD5: ef6ff172bf3e480f1d633a6c53f7a35e Typical Filename: iizbpyilb.bat Claimed Product: N/A Detect |
| sha256 | 4c3c7be970a08dd59e87de24590b938045f14e693a43a83b81ce8531127eb440 | ternet Explorer Detection Name: W32.File.MalParent SHA 256: 4c3c7be970a08dd59e87de24590b938045f14e693a43a83b81ce8531127eb440 MD5: ef6ff172bf3e480f1d633a6c53f7a35e Typical Filename: iiz |
| sha256 | 5e537dee6d7478cba56ebbcc7a695cae2609010a897d766ff578a4260c2ac9cf | ware files from Talos telemetry over the past week SHA 256: 5e537dee6d7478cba56ebbcc7a695cae2609010a897d766ff578a4260c2ac9cf MD5: 2cfc15cb15acc1ff2b2da65c790d7551 Typical Filename: rcx |
| sha256 | 77c2372364b6dd56bc787fda46e6f4240aaa0353ead1e3071224d454038a545e | 6 Detection Name: PUA.Win.Tool.Kmsauto::in03.talos SHA 256: 77c2372364b6dd56bc787fda46e6f4240aaa0353ead1e3071224d454038a545e MD5: 040cd888e971f2872d6d5dafd52e6194 Typical Filename: tmp |
| sha256 | 8664e2f59077c58ac12e747da09d2810fd5ca611f56c0c900578bf750cab56b7 | med Product: N/A Detection Name: Trojan.Agent.DDOH SHA 256: 8664e2f59077c58ac12e747da09d2810fd5ca611f56c0c900578bf750cab56b7 MD5: 0e4c49327e3be816022a233f844a5731 Typical Filename: aac |
| sha256 | e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 | oduct: N/A Detection Name: Win.Dropper.Pykspa::tpd SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wex |
From the original article
6 min read at blog.talosintelligence.com
Private and public efforts to curb the use of spyware and activity of other “mercenary” groups have heated up over the past week, with the U. S. government taking additional action against spyware users and some of the world’s largest tech companies calling out international governments to do more.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.