Exploit / PoCcritical
StrongPity APT - Waterhole attacks against Italian and Belgian users
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2011-0611 | Remote Code Execution in Adobe Flash Player via Crafted Flash Content | — | 99% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ralrab.com | distributors from Europe in an effort to redirect users to ralrab.com that was hosting the trojanized version of the legitimate a |
| domain | rarlab.com | et up the website ralrab.com aiming to mimic the legitimate rarlab.com website, the website was used as a landing domain to delive |
| domain | true-crypt.com | StrongPity group set up a rogue TrueCrypt website hosted at true-crypt.com, it was used to redirect users from software downloads webs |
| domain | winrar.it | ’Ivoire, Morroco, France, and Tunisia.” states the report . winrar[.]it StrongPity component geolocation distribution In the arse |
From the original article
3 min read at securityaffairs.comKaspersky published a report on cyber espionage activities conducted by StrongPity APT that most targeted Italians and Belgians with watering holes attacks. Experts from Kaspersky Lab have published a detailed report on the cyber espionage activities conducted by the StrongPity APT.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.