Threat actorcritical
Iranian threat actors exploit MS MSHTML bug to steal Google and Instagram credentials
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) | 8.8 | 98% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 858404225565c80972ba66d2c612e49f | 2021 by ShadowChasing. hi threat why did you use it 😀 ITW:858404225565c80972ba66d2c612e49f filename:جنایات خامنه ای.docx URL: hxxp://hr.dedyn.io/word. |
| url | http://hr.dedyn.io/1.ps1 | L: hxxp://hr.dedyn.io/word.html hxxp://hr.dedyn.io/word.cab hxxp://hr.dedyn.io/1.ps1 hxxp://hr.dedyn.io/upload.aspx?fn= hxxp://hr.dedyn.io/uploa |
| url | http://hr.dedyn.io/upload2.aspx | hxxp://hr.dedyn.io/1.ps1 hxxp://hr.dedyn.io/upload.aspx?fn= hxxp://hr.dedyn.io/upload2.aspx pic.twitter.com/fHsgAshCNc — Shadow Chaser Group (@ShadowCh |
| url | http://hr.dedyn.io/upload.aspx?fn= | d.html hxxp://hr.dedyn.io/word.cab hxxp://hr.dedyn.io/1.ps1 hxxp://hr.dedyn.io/upload.aspx?fn= hxxp://hr.dedyn.io/upload2.aspx pic.twitter.com/fHsgAshCNc |
| url | http://hr.dedyn.io/word.cab | name:جنایات خامنه ای.docx URL: hxxp://hr.dedyn.io/word.html hxxp://hr.dedyn.io/word.cab hxxp://hr.dedyn.io/1.ps1 hxxp://hr.dedyn.io/upload.aspx?fn= |
| url | http://hr.dedyn.io/word.html | 5565c80972ba66d2c612e49f filename:جنایات خامنه ای.docx URL: hxxp://hr.dedyn.io/word.html hxxp://hr.dedyn.io/word.cab hxxp://hr.dedyn.io/1.ps1 hxxp:/ |
From the original article
3 min read at securityaffairs.com
An Iranian threat actor is stealing Google and Instagram credentials of Farsi-speaking targets by exploiting a Microsoft MSHTML bug. Researchers from SafeBreach Labs have identified a new Iranian threat actor that is exploiting a Microsoft MSHTML Remote Code Execution (RCE) vulnerability in attacks targeting Farsi-speaking victims.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.