Vulnerabilitycritical
Russia-Aligned TAG-110 Targets Asia and Europe with HATVIBE and CHERRYSPY
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-23692 | Unauthenticated Template Injection RCE in Rejetto HTTP File Server 2.3m | 9.8 | 99% | KEVRansomwarePoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | enrollmentdm.com | as a PDF. Appendix A — Indicators of Compromise C2 Domains: enrollmentdm[.]com errorreporting[.]net experience-improvement[.]com game-wi |
| domain | errorreporting.net | A — Indicators of Compromise C2 Domains: enrollmentdm[.]com errorreporting[.]net experience-improvement[.]com game-wins[.]com internalsecu |
| domain | experience-improvement.com | promise C2 Domains: enrollmentdm[.]com errorreporting[.]net experience-improvement[.]com game-wins[.]com internalsecurity[.]us lanmangraphics[.]co |
| domain | game-wins.com | tdm[.]com errorreporting[.]net experience-improvement[.]com game-wins[.]com internalsecurity[.]us lanmangraphics[.]com retaildemo[.]i |
| domain | internalsecurity.us | eporting[.]net experience-improvement[.]com game-wins[.]com internalsecurity[.]us lanmangraphics[.]com retaildemo[.]info shared-rss[.]info |
| domain | lanmangraphics.com | nce-improvement[.]com game-wins[.]com internalsecurity[.]us lanmangraphics[.]com retaildemo[.]info shared-rss[.]info telemetry-network[.]c |
| domain | retaildemo.info | game-wins[.]com internalsecurity[.]us lanmangraphics[.]com retaildemo[.]info shared-rss[.]info telemetry-network[.]com tieringservice[ |
| domain | shared-rss.info | nternalsecurity[.]us lanmangraphics[.]com retaildemo[.]info shared-rss[.]info telemetry-network[.]com tieringservice[.]com trust-certif |
| domain | telemetry-network.com | us lanmangraphics[.]com retaildemo[.]info shared-rss[.]info telemetry-network[.]com tieringservice[.]com trust-certificate[.]net C2 IP Addres |
| domain | tieringservice.com | retaildemo[.]info shared-rss[.]info telemetry-network[.]com tieringservice[.]com trust-certificate[.]net C2 IP Addresses: 5.45.70[.]178 45 |
| domain | trust-certificate.net | red-rss[.]info telemetry-network[.]com tieringservice[.]com trust-certificate[.]net C2 IP Addresses: 5.45.70[.]178 45.136.198[.]18 45.136.198 |
| ipv4 | 185.158.248.198 | 36.198[.]189 46.183.219[.]228 84.32.188[.]23 185.62.56[.]47 185.158.248[.]198 185.167.63[.]42 194.31.55[.]131 212.224.86[.]69 Appendix |
| ipv4 | 185.167.63.42 | 3.219[.]228 84.32.188[.]23 185.62.56[.]47 185.158.248[.]198 185.167.63[.]42 194.31.55[.]131 212.224.86[.]69 Appendix B — Mitre ATT&CK |
| ipv4 | 185.62.56.47 | .198[.]184 45.136.198[.]189 46.183.219[.]228 84.32.188[.]23 185.62.56[.]47 185.158.248[.]198 185.167.63[.]42 194.31.55[.]131 212.224 |
| ipv4 | 194.31.55.131 | 2.188[.]23 185.62.56[.]47 185.158.248[.]198 185.167.63[.]42 194.31.55[.]131 212.224.86[.]69 Appendix B — Mitre ATT&CK Techniques Tact |
| ipv4 | 212.224.86.69 | 2.56[.]47 185.158.248[.]198 185.167.63[.]42 194.31.55[.]131 212.224.86[.]69 Appendix B — Mitre ATT&CK Techniques Tactic: Technique AT |
| ipv4 | 45.136.198.18 | ]com trust-certificate[.]net C2 IP Addresses: 5.45.70[.]178 45.136.198[.]18 45.136.198[.]184 45.136.198[.]189 46.183.219[.]228 84.32. |
| ipv4 | 45.136.198.184 | ficate[.]net C2 IP Addresses: 5.45.70[.]178 45.136.198[.]18 45.136.198[.]184 45.136.198[.]189 46.183.219[.]228 84.32.188[.]23 185.62.5 |
| ipv4 | 45.136.198.189 | P Addresses: 5.45.70[.]178 45.136.198[.]18 45.136.198[.]184 45.136.198[.]189 46.183.219[.]228 84.32.188[.]23 185.62.56[.]47 185.158.24 |
| ipv4 | 46.183.219.228 | .70[.]178 45.136.198[.]18 45.136.198[.]184 45.136.198[.]189 46.183.219[.]228 84.32.188[.]23 185.62.56[.]47 185.158.248[.]198 185.167.6 |
| ipv4 | 5.45.70.178 | eringservice[.]com trust-certificate[.]net C2 IP Addresses: 5.45.70[.]178 45.136.198[.]18 45.136.198[.]184 45.136.198[.]189 46.183. |
| ipv4 | 84.32.188.23 | 198[.]18 45.136.198[.]184 45.136.198[.]189 46.183.219[.]228 84.32.188[.]23 185.62.56[.]47 185.158.248[.]198 185.167.63[.]42 194.31.5 |
From the original article
3 min read at recordedfuture.com
Insikt Group has identified an ongoing cyber-espionage campaign conducted by TAG-110, a Russia-aligned threat group targeting organizations in Central Asia, East Asia, and Europe. Using custom malware tools HATVIBE and CHERRYSPY, TAG-110 primarily attacks government entities, human rights groups, and educational institutions.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.