Threat Source newsletter (July 1, 2021)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-3580 | Cross-Site Scripting in Cisco ASA and FTD Web Services Interface | 6.1 | 86% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1971fc3783aa6fa3c0efb1276dd1143c | fb2782cff3de09de5003f37d9bdd351e7094a22dbf205966cc8c43 MD5: 1971fc3783aa6fa3c0efb1276dd1143c Typical Filename: iRiNpQaAxCcNxPdKyG Claimed Product: Segur |
| md5 | 6be10a13c17391218704dc24b34cf736 | 38b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb MD5: 6be10a13c17391218704dc24b34cf736 Typical Filename: smbscanlocal0906.exe Claimed Product: N/A |
| md5 | 8193b63313019b614d5be721c538486b | 4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd MD5: 8193b63313019b614d5be721c538486b Typical Filename: SAService.exe Claimed Product: SAService |
| md5 | 8c80dd97c37525927c1e549cb59bcbf3 | BE5100C170B777E1647CE9F0F01E3AB9742DFC23F37CB0825B30B5 MD5: 8c80dd97c37525927c1e549cb59bcbf3 VirusTotal: Typical Filename: Eternalblue-2.2.0.exe Claimed |
| md5 | 9a4b7b0849a274f6f7ac13c7577daad8 | e188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww31.exe Claimed Product: N/A Detection N |
| sha256 | 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 | Detection Name: PUA.Win.File.Segurazo::222360.in02 SHA 256: 85B936960FBE5100C170B777E1647CE9F0F01E3AB9742DFC23F37CB0825B30B5 MD5: 8c80dd97c37525927c1e549cb59bcbf3 VirusTotal: Typical F |
| sha256 | 9a74640ca638b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb | Detection Name: W32.GenericKD:Attribute.24ch.1201 SHA 256: 9a74640ca638b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb MD5: 6be10a13c17391218704dc24b34cf736 Typical Filename: smb |
| sha256 | c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e | 864 - 57871 Most prevalent malware files this week SHA 256: c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww3 |
| sha256 | d0c3e85195fb2782cff3de09de5003f37d9bdd351e7094a22dbf205966cc8c43 | etection Name: PUA.Win.Dropper.Segurazo::95.sbx.tg SHA 256: d0c3e85195fb2782cff3de09de5003f37d9bdd351e7094a22dbf205966cc8c43 MD5: 1971fc3783aa6fa3c0efb1276dd1143c Typical Filename: iRi |
| sha256 | e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd | A Detection Name: Win.Dropper.Ranumbot::in03.talos SHA 256: e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd MD5: 8193b63313019b614d5be721c538486b Typical Filename: SAS |
From the original article
4 min read at blog.talosintelligence.com
There's been a lot of talk recently around how to address America's infrastructure cybersecurity. After attacks like Colonial Pipeline and JBS, everyone across the public and private sectors are wondering what they should be doing to avoid becoming the next major ransomware victim that disrupts their given industry.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.