Vulnerabilityhigh
Reminder: be careful opening invoices on the 21st March
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-0188 | Arbitrary Code Execution in Adobe Reader and Acrobat via Malicious PDF Handling | — | 88% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 3772e3c2945e472247241ac27fbf5a16 | t-proxy.com/adobe-update.exe . The downloaded malware (MD5: 3772e3c2945e472247241ac27fbf5a16 ) is detected by Kaspersky Lab as Trojan.Win32.Yakes.cngh. |
| md5 | 97b720519aefa00da58026f03d818251 | uct. The emails all contained the same PDF attachment (MD5: 97b720519aefa00da58026f03d818251 ) but were being sent from many different source addresses. |
From the original article
2 min read at securelist.com
On March 4 th we spotted a large number of unusual emails being blocked by our Linux Mail Security product. The emails all contained the same PDF attachment (MD5: 97b720519aefa00da58026f03d818251 ) but were being sent from many different source addresses. The emails were written in German and most were sent from German IP addresses.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.