Vulnerabilityhigh

‘Witchetty’ group targeted Middle Eastern gov'ts, stock exchange of African nation

The RecordJan 10, 2023 · 00:00 UTC (Jan 10, 2023)2 min read2 · 1 read

Read at therecord.media

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-34473 CVE-2021-34523 CVE-2021-31207 CVE-2021-26855

Tags: cve-2021-34473 cve-2021-34523 cve-2021-31207 cve-2021-26855 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-26855	Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)	9.1	100%	KEVRansomwarePoC ×4	Mar 3, 2021 KEV Nov 3, 2021
CVE-2021-31207	Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE	6.6	100%	KEVRansomwarePoC	May 11, 2021 KEV Nov 3, 2021
CVE-2021-34473 +1 related CVE CVE-2021-34523	SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell)	9.1 group max	100%	KEVRansomwarePoC	Jul 14, 2021 KEV Nov 3, 2021

From the original article

2 min read at therecord.media

A cyber espionage group is targeting the governments of several Middle Eastern nations and has previously attacked the stock exchange of an African country, using malware to steal troves of data. In a report published Thursday, the Symantec Threat Hunter Team named the espionage group “Witchetty” but said it has also been known as “LookingFrog.”

The Record

therecord.media

Read the full article at The Record

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.