Russian group RomCom exploited Firefox and Tor Browser zero-days to target attacks Europe and North America
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-49039 | Windows Task Scheduler Elevation-of-Privilege Flaw Actively Exploited in the Wild | 8.8 | 14% | KEVRansomware | KEV |
| CVE-2024-9680 | Use-After-Free in Mozilla Firefox Animation Timelines Allows Code Execution | 9.8 | 23% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | correctiv.sbs | the RomCom backdoor from C2 servers like journalctd[.]live, correctiv[.]sbs, or cwise[.]store. ESET reported that between October 10 |
| domain | cwise.store | from C2 servers like journalctd[.]live, correctiv[.]sbs, or cwise[.]store. ESET reported that between October 10 and November 4, 20 |
| domain | journalctd.live | ding and executing the RomCom backdoor from C2 servers like journalctd[.]live, correctiv[.]sbs, or cwise[.]store. ESET reported that be |
From the original article
2 min read at securityaffairs.com
The Russian RomCom group exploited Firefox and Tor Browser zero-day vulnerabilities in attacks on users in Europe and North America. Russian-based cybercrime group RomCom (aka UAT-5647 , Storm-0978 , Tropical Scorpius , UAC-0180, UNC2596 ) exploited two Firefox and Tor Browser zero-day vulnerabilities in recent attacks on users across Europe and North America.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.