Vulnerabilityhigh
Cobalt crime gang is using again CobInt in attacks on former soviet states
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2017-8570 | Remote Code Execution in Microsoft Office via Malicious PPSX Files (CVE-2017-8570) | 7.8 | 90% | KEVPoC ×2 | KEV |
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor | 7.8 | 93% | KEVRansomwarePoC ×3 | KEV |
| CVE-2018-8174 | Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine | 7.5 | 88% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aifabank.com | es purporting to be from Alfa Bank using a lookalike domain aifabank[.]com and subjects such as “Fraud Control”, “Фрауд” (Translates |
| domain | inter-kassa.com | ing a sender email address with a lookalike domain “denis[@]inter-kassa[.]com”. August 14, 2018, Attackers used messages spoofing the S |
| domain | ralffeisen.com | g to be from Raiffeisen Bank using lookalike sender domains ralffeisen[.]com and subjects such as “Fraudulent transaction”, “Wire Tran |
| domain | sepa-europa.com | gle Euro Payments Area (SEPA) with lookalike sender domains sepa-europa[.]com or sepa-europa[.]info and subjects such as “notification” |
| domain | sepa-europa.info | a (SEPA) with lookalike sender domains sepa-europa[.]com or sepa-europa[.]info and subjects such as “notification”, “letter”, “message”, |
From the original article
4 min read at securityaffairs.com
The Russian Cobalt crime gang was particularly active in the last month, a new report confirms a massive use of the CobInt malware in recent attacks. Security researchers from Proofpoint reported the massive use of the CobInt malware by the Cobalt group in recent attacks. The Cobalt name is based on the association of the malware with the “Cobalt Group” and an internal DLL name of “int.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.