Ransomwarehigh
IT threat evolution Q3 2019
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor | 7.8 | 93% | KEVRansomwarePoC ×3 | KEV |
| CVE-2019-2725 | Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2019-2729 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent | 9.8 | 89% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | new.net | pt KopiLuwak malware in a new dropper called Topinambour, a new.NET file that is being used by Turla to distribute and drop its |
From the original article
14 min read at securelist.com
At the end of June we reported the details of a highly targeted campaign that we dubbed ‘Operation ViceLeaker’ involving the spread of malicious Android samples via instant messaging. The campaign affected several dozen victims in Israel and Iran.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.