logo
DATABASE RESOURCES PRICING ABOUT US

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities

2021-11-19T12:00:00

Description

### Summary _**Actions to Take Today to Protect Against Iranian State-Sponsored Malicious Cyber Activity** • Immediately patch software affected by the following vulnerabilities: CVE-2021-34473, 2018-13379, 2020-12812, and 2019-5591._ • _Implement [multi-factor authentication](<https://us-cert.cisa.gov/ncas/tips/ST05-012>)._ _• Use [strong, unique passwords](<https://us-cert.cisa.gov/ncas/tips/ST04-002>).v_ ___**Note:** this advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, version 10. See the [ATT&CK for Enterprise](<https://attack.mitre.org/versions/v9/techniques/enterprise/>) for all referenced threat actor tactics and techniques.___ This joint cybersecurity advisory is the result of an analytic effort among the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), and the United Kingdom’s National Cyber Security Centre (NCSC) to highlight ongoing malicious cyber activity by an advanced persistent threat (APT) group that FBI, CISA, ACSC, and NCSC assess is associated with the government of Iran. FBI and CISA have observed this Iranian government-sponsored APT group exploit Fortinet vulnerabilities since at least March 2021 and a Microsoft Exchange ProxyShell vulnerability since at least October 2021 to gain initial access to systems in advance of follow-on operations, which include deploying ransomware. ACSC is also aware this APT group has used the same Microsoft Exchange vulnerability in Australia. The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations. FBI, CISA, ACSC, and NCSC assess the actors are focused on exploiting known vulnerabilities rather than targeting specific sectors. These Iranian government-sponsored APT actors can leverage this access for follow-on operations, such as data exfiltration or encryption, ransomware, and extortion. This advisory provides observed tactics and techniques, as well as indicators of compromise (IOCs) that FBI, CISA, ACSC, and NCSC assess are likely associated with this Iranian government-sponsored APT activity. The FBI, CISA, ACSC, and NCSC urge critical infrastructure organizations to apply the recommendations listed in the Mitigations section of this advisory to mitigate risk of compromise from Iranian government-sponsored cyber actors. For a downloadable copy of IOCs, see AA21-321A.stix. For more information on Iranian government-sponsored malicious cyber activity, see [us-cert.cisa.gov/Iran](<https://www.us-cert.cisa.gov/iran>). Click here for a PDF version of this report. ### Technical Details ### Threat Actor Activity Since at least March 2021, the FBI and CISA have observed Iranian government-sponsored APT actors leverage Microsoft Exchange and Fortinet vulnerabilities to target a broad range of victims across multiple critical infrastructure sectors in furtherance of malicious activities. Observed activity includes the following. * In March 2021, the FBI and CISA observed these Iranian government-sponsored APT actors scanning devices on ports 4443, 8443, and 10443 for Fortinet FortiOS vulnerability [CVE-2018-13379](<https://vulners.com/cve/CVE-2018-13379>), and enumerating devices for FortiOS vulnerabilities [CVE-2020-12812](<https://vulners.com/cve/CVE-2020-12812>) and [CVE-2019-5591](<https://vulners.com/cve/CVE-2019-5591>). The Iranian Government-sponsored APT actors likely exploited these vulnerabilities to gain access to vulnerable networks. **Note:** for previous FBI and CISA reporting on this activity, refer to Joint Cybersecurity Advisory: [APT Actors Exploit Vulnerabilities to Gain Initial Access for Future Attacks](<https://www.ic3.gov/media/news/2021/210402.pdf>). * In May 2021, these Iranian government-sponsored APT actors exploited a Fortigate appliance to access a webserver hosting the domain for a U.S. municipal government. The actors likely created an account with the username `elie` to further enable malicious activity. **Note: **for previous FBI reporting on this activity, refer to [FBI FLASH: APT Actors Exploiting Fortinet Vulnerabilities to Gain Initial Access for Malicious Activity](<https://www.ic3.gov/media/news/2021/210527.pdf>). * In June 2021, these APT actors exploited a Fortigate appliance to access environmental control networks associated with a U.S.-based hospital specializing in healthcare for children. The Iranian government-sponsored APT actors likely leveraged a server assigned to IP addresses `91.214.124[.]143` and `162.55.137[.]20`—which FBI and CISA judge are associated with Iranian government cyber activity—to further enable malicious activity against the hospital’s network. The APT actors accessed known user accounts at the hospital from IP address `154.16.192[.]70`, which FBI and CISA judge is associated with government of Iran offensive cyber activity. * As of October 2021, these APT actors have leveraged a Microsoft Exchange ProxyShell vulnerability—`CVE-2021-34473`—to gain initial access to systems in advance of follow-on operations. ACSC considers that this APT group has also used the same Microsoft Exchange vulnerability ([CVE-2021-34473](<https://vulners.com/cve/CVE-2021-34473>)) in Australia. ### MITRE ATT&CK Tactics and Techniques FBI, CISA, ACSC, and NCSC assess the following tactics and techniques are associated with this activity. #### Resource Development [[TA0042](<https://attack.mitre.org/versions/v10/tactics/TA0042>)] The APT actors have used the following malicious and legitimate tools [[T1588.001](<https://attack.mitre.org/versions/v10/techniques/T1588/001>), [T1588.002](<https://attack.mitre.org/versions/v10/techniques/T1588/002>)] for a variety of tactics across the enterprise spectrum. * [Mimikatz](<https://attack.mitre.org/software/S0002>) for credential theft [[TA0006](<https://attack.mitre.org/versions/v10/tactics/TA0042>)] * WinPEAS for privilege escalation [[TA0004](<https://attack.mitre.org/versions/v10/tactics/TA0004>)] * SharpWMI (Windows Management Instrumentation) * WinRAR for archiving collected data [[TA0009](<https://attack.mitre.org/versions/v10/tactics/TA0009>), [T1560.001](<https://attack.mitre.org/versions/v10/techniques/T1560/001>)] * FileZilla for transferring files [[TA0010](<https://attack.mitre.org/versions/v10/tactics/TA0010>)] #### Initial Access [[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)] The Iranian government-sponsored APT actors gained initial access by exploiting vulnerabilities affecting Microsoft Exchange servers (CVE-2021-34473) and Fortinet devices (CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591) [[T1190](<https://attack.mitre.org/versions/v10/techniques/T1190/>)]. #### Execution [[TA0002](<https://attack.mitre.org/versions/v10/tactics/TA0002>)] The Iranian government-sponsored APT actors may have made modifications to the Task Scheduler [[T1053.005](<https://attack.mitre.org/versions/v10/techniques/T1053/005>)]. These modifications may display as unrecognized scheduled tasks or actions. Specifically, the below established tasks may be associated with this activity: * `SynchronizeTimeZone` * `GoogleChangeManagement` * `MicrosoftOutLookUpdater` * `MicrosoftOutLookUpdateSchedule` #### Persistence [[TA0003](<https://attack.mitre.org/versions/v10/tactics/TA0003>)] The Iranian government-sponsored APT actors may have established new user accounts on domain controllers, servers, workstations, and active directories [[T1136.001](<https://attack.mitre.org/versions/v10/techniques/T1136/001>), [T1136.002](<https://attack.mitre.org/versions/v10/techniques/T1136/002>)]. Some of these accounts appear to have been created to look similar to other existing accounts on the network, so specific account names may vary per organization. In addition to unrecognized user accounts or accounts established to masquerade as existing accounts, the following account usernames may be associated with this activity: * `Support` * `Help` * `elie` * `WADGUtilityAccount` #### Exfiltration [[TA0010](<https://attack.mitre.org/versions/v10/tactics/TA0010/>)] The FBI and CISA observed outbound File Transfer Protocol (FTP) transfers over port 443. #### Impact [[TA0040](<https://attack.mitre.org/versions/v10/tactics/TA0040>)] The APT actors forced BitLocker activation on host networks to encrypt data [T1486]. The corresponding threatening notes were either sent to the victim or left on the victim network as a .txt file. The ransom notes included ransom demands and the following contact information. * sar_addr@protonmail[.]com * WeAreHere@secmail[.]pro * nosterrmann@mail[.]com * nosterrmann@protonmail[.]com ## Detection The FBI, CISA, ACSC, and NCSC recommend that organizations using Microsoft Exchange servers and Fortinet investigate potential suspicious activity in their networks. * Search for IOCs. Collect known-bad IOCs and search for them in network and host artifacts. **Note: **refer to Appendix A for IOCs. * Investigate exposed Microsoft Exchange servers (both patched and unpatched) for compromise. * Investigate changes to Remote Desktop Protocol (RDP), firewall, and Windows Remote Management (WinRM) configurations that may allow attackers to maintain persistent access. * Review domain controllers, servers, workstations, and active directories for new or unrecognized user accounts. * Review Task Scheduler for unrecognized scheduled tasks. Additionally, manually review operating-system defined or recognized scheduled tasks for unrecognized “actions” (for example, review the steps each scheduled task is expected to perform). * Review antivirus logs for indications they were unexpectedly turned off. * Look for WinRAR and FileZilla in unexpected locations. **Note:** for additional approaches on uncovering malicious cyber activity, see joint advisory [Technical Approaches to Uncovering and Remediating Malicious Activity](<https://us-cert.cisa.gov/sites/default/files/publications/AA20-245A-Joint_CSA-Technical_Approaches_to_Uncovering_Malicious_Activity_508.pdf>), authored by CISA and the cybersecurity authorities of Australia, Canada, New Zealand, and the United Kingdom. ### Mitigations The FBI, CISA, ACSC, and NCSC urge network defenders to apply the following mitigations to reduce the risk of compromise by this threat. #### Patch and Update Systems * Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. * Immediately patch software affected by vulnerabilities identified in this advisory: CVE-2021-34473, CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591. #### Evaluate and Update Blocklists and Allowlists * Regularly evaluate and update blocklists and allowlists. * If FortiOS is not used by your organization, add the key artifact files used by FortiOS to your organization’s execution blocklist. Any attempts to install or run this program and its associated files should be prevented. #### Implement and Enforce Backup and Restoration Policies and Procedures * Regularly back up data, air gap, and password protect backup copies offline. * Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides. * Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (e.g., hard drive, storage device, the cloud). #### Implement Network Segmentation * Implement network segmentation to restrict adversary’s lateral movement. #### Secure User Accounts * Audit user accounts with administrative privileges and configure access controls under the principles of least privilege and separation of duties. * Require administrator credentials to install software. #### Implement Multi-Factor Authentication * Use multifactor authentication where possible, particularly for webmail, virtual private networks (VPNs), and accounts that access critical systems. #### Use Strong Passwords * Require all accounts with password logins to have strong, unique passwords. #### Secure and Monitor RDP and other Potentially Risky Services * If you use RDP, restrict it to limit access to resources over internal networks. * Disable unused remote access/RDP ports. * Monitor remote access/RDP logs. #### Use Antivirus Programs * Install and regularly update antivirus and anti-malware software on all hosts. #### Secure Remote Access * Only use secure networks and avoid using public Wi-Fi networks. * Consider installing and using a VPN for remote access. #### Reduce Risk of Phishing * Consider adding an email banner to emails received from outside your organization. * Disable hyperlinks in received emails ## Resources * For more information on Iranian government-sponsored malicious cyber activity, see [us-cert.cisa.gov/Iran](<https://www.us-cert.cisa.gov/iran>). * For information and resources on protecting against and responding to ransomware, refer to [StopRansomware.gov](<https://www.cisa.gov/stopransomware/>), a centralized, whole-of-government webpage providing ransomware resources and alerts. * The joint advisory from the cybersecurity authorities of Australia, Canada, New Zealand, the United Kingdom, and the United States: [Technical Approaches to Uncovering and Remediating Malicious Activity](<https://us-cert.cisa.gov/sites/default/files/publications/AA20-245A-Joint_CSA-Technical_Approaches_to_Uncovering_Malicious_Activity_508.pdf>) provides additional guidance when hunting or investigating a network and common mistakes to avoid in incident handling. * CISA offers a range of no-cost [cyber hygiene services](<https://www.cisa.gov/cyber-hygiene-services>) to help critical infrastructure organizations assess, identify, and reduce their exposure to threats, including ransomware. By requesting these services, organizations of any size could find ways to reduce their risk and mitigate attack vectors. * The U.S. Department of State’s Rewards for Justice (RFJ) program offers a reward of up to $10 million for reports of foreign government malicious activity against U.S. critical infrastructure. See the [RFJ](<https://rewardsforjustice.net/english>) website for more information and how to report information securely. * ACSC can provide tailored cyber security advice and assistance, reporting, and incident response support at [cyber.gov.au](<https://www.cyber.gov.au/>) and via 1300 292 371 (1300 CYBER1). ### Appendix A: Indicators of Compromise IP addresses and executables files are listed below. For a downloadable copy of IOCs, see AA21-321A.stix. IP Addresses * `91.214.124[.]143 ` * `162.55.137[.]20 ` * `154.16.192[.]70` #### Executable Files Executable files observed in this activity are identified in table 1. Table 1: Executable Files **Filename:** | MicrosoftOutLookUpdater[.]exe ---|--- MD5: | 1444884faed804667d8c2bfa0d63ab13 SHA-1: | 95E045446EFB8C9983EBFD85E39B4BE5D92C7A2A SHA-256: | c51fe5073bd493c7e8d83365aace3f9911437a0f2ae80042ba01ea46b55d2624 SHA-512: | 6451077B99C5F8ECC5C0CA88FE272156296BEB91218B39AE28A086DBA5E7E39813F044F9AF0FEDBB260941B1CD52FA237C098CBF4B2A822F08E3E98E934D0ECF **Filename:** | **MicrosoftOutlookUpdater.bat** MD5: | 1A44368EB5BF68688BA4B4357BDC874F SHA-1 | FA36FEBFD5A5CA0B3A1B19005B952683A7188A13 SHA-256 | 3A08D0CB0FF4D95ED0896F22F4DA8755525C243C457BA6273E08453E0E3AC4C4 SHA-512 | 70AA89449EB5DA1D84B70D114EF9D24CB74751CE12D12C783251E51775C89FDCE61B4265B43B1D613114D6A85E9C75927B706F39C576DBB036079C7E8CAF28B2 **Filename:** | **MicrosoftOutlookUpdater.xml** MD5: | AA40C49E309959FA04B7E5AC111BB770 SHA-1 | F1D90E10E6E3654654E0A677763C9767C913F8F0 SHA-256 | 5C818FE43F05F4773AD20E0862280B0D5C66611BB12459A08442F55F148400A6 SHA-512 | E55A86159F2E869DCDB64FDC730DA893718E20D65A04071770BD32CAE75FF8C34704BDF9F72EF055A3B362759EDE3682B3883C4D9BCF87013076638664E8078E **Filename:** | **GoogleChangeManagement.xml** MD5: | AF2D86042602CBBDCC7F1E8EFA6423F9 SHA-1 | CDCD97F946B78831A9B88B0A5CD785288DC603C1 SHA-256 | 4C691CCD811B868D1934B4B8E9ED6D5DB85EF35504F85D860E8FD84C547EBF1D SHA-512 | 6473DAC67B75194DEEAEF37103BBA17936F6C16FFCD2A7345A5A46756996FAD748A97F36F8FD4BE4E1F264ECE313773CC5596099D68E71344D8135F50E5D8971 **Filename:** | **Connector3.exe** MD5: | e64064f76e59dea46a0768993697ef2f **Filename:** | **Audio.exe or frpc.exe** MD5: | b90f05b5e705e0b0cb47f51b985f84db SHA-1 | 5bd0690247dc1e446916800af169270f100d089b SHA-256: | 28332bdbfaeb8333dad5ada3c10819a1a015db9106d5e8a74beaaf03797511aa Vhash: | 017067555d5d15541az28!z Authentihash: | ed463da90504f3adb43ab82044cddab8922ba029511da9ad5a52b8c20bda65ee Imphash: | 93a138801d9601e4c36e6274c8b9d111 SSDEEP: | 98304:MeOuFco2Aate8mjOaFEKC8KZ1F4ANWyJXf/X+g4:MeHFV2AatevjOaDC8KZ1xNWy93U Note: | Identical to “frpc.exe” available at: https://github[.]com/fatedier/frp/releases/download/v0.34.3/frp_0.34.3_windows_amd64.zip **Filename:** | **Frps.exe** MD5: | 26f330dadcdd717ef575aa5bfcdbe76a SHA-1 | c4160aa55d092cf916a98f3b3ee8b940f2755053 SHA-256: | d7982ffe09f947e5b4237c9477af73a034114af03968e3c4ce462a029f072a5a Vhash: | 017057555d6d141az25!z Authentihash: | 40ed1568fef4c5f9d03c370b2b9b06a3d0bd32caca1850f509223b3cee2225ea Imphash: | 91802a615b3a5c4bcc05bc5f66a5b219 SSDEEP: | 196608:/qTLyGAlLrOt8enYfrhkhBnfY0NIPvoOQiE:GLHiLrSfY5voO Note: | Identical to “frps.exe” available at: https://github[.]com/fatedier/frp/releases/download/v0.33.0/frp_0.33.0_windows_amd64.zip ### APPENDIX B: MITRE ATT&CK TACTICS AND TECHNIQUES Table 2 identifies MITRE ATT&CK Tactics and techniques observed in this activity. Table 2: Observed Tactics and Techniques Tactic | Technique ---|--- Resource Development [[TA0042](<https://attack.mitre.org/versions/v10/tactics/TA0042>)] | Obtain Capabilities: Malware [[T1588.001](<https://attack.mitre.org/versions/v10/techniques/T1588/001>)] Obtain Capabilities: Tool [[T1588.002](<https://attack.mitre.org/versions/v10/techniques/T1588/002>)] Initial Access [[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)] | Exploit Public-Facing Application [[T1190](<https://attack.mitre.org/versions/v10/techniques/T1190/>)] Execution [[TA0002](<https://attack.mitre.org/versions/v10/tactics/TA0002>)] | Scheduled Task/Job: Scheduled Task [[T1053.005](<https://attack.mitre.org/versions/v10/techniques/T1053/005>)] Persistence [[TA0003](<https://attack.mitre.org/versions/v10/tactics/TA0003>)] | Create Account: Local Account [[T1136.001](<https://attack.mitre.org/versions/v10/techniques/T1136/001>)] Create Account: Domain Account [[T1136.002](<https://attack.mitre.org/versions/v10/techniques/T1136/002>)] Privilege Escalation [[TA0004](<https://attack.mitre.org/versions/v10/tactics/TA0004>)] | Credential Access [[TA0006](<https://attack.mitre.org/versions/v10/tactics/TA0042>)] | Collection [[TA0009](<https://attack.mitre.org/versions/v10/tactics/TA0009>)] | Archive Collected Data: Archive via Utility [[T1560.001](<https://attack.mitre.org/versions/v10/techniques/T1560/001>)] Exfiltration [[TA0010](<https://attack.mitre.org/versions/v10/tactics/TA0010/>)] | Impact [[TA0040](<https://attack.mitre.org/versions/v10/tactics/TA0040>)] | Data Encrypted for Impact [[T1486](<https://attack.mitre.org/versions/v10/techniques/T1486>)] ### Contact Information To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at <https://www.fbi.gov/contact-us/field-offices>, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at [CyWatch@fbi.gov](<mailto:CyWatch@fbi.gov>). When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at [Central@cisa.dhs.gov](<mailto:Central@cisa.dhs.gov> "Email CISA Central" ). Australian organizations can visit [cyber.gov.au](<https://www.cyber.gov.au/>) or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. ### Revisions November 17, 2021: Initial Version|November 19, 2021: Added STIX files


Related


thn
info

U.S., U.K. and Australia Warn of Iranian Hackers Exploiting Microsoft, Fortinet Flaws

2021-11-17T15:44:00
thn
info

Unpatched Remote Hacking Flaw Disclosed in Fortinet's FortiWeb WAF

2021-08-18T03:41:00
thn
info

U.S. Charges 3 Iranian Hackers and Sanctions Several Others Over Ransomware Attacks

2022-09-15T06:49:00
thn
info

Hackers Leak VPN Account Passwords From 87,000 Fortinet FortiGate Devices

2021-09-09T07:16:00
thn
info

Microsoft Blocks Iran-linked Lebanese Hackers Targeting Israeli Companies

2022-06-03T09:19:00
thn
info

Hackers Exploited ColdFusion Vulnerability to Breach Federal Agency Servers

2023-12-06T10:10:00
thn
info

Data Wiper Malware Disguised As Ransomware Targets Israeli Entities

2021-05-26T15:30:00
thn
info

Hackers Exploit Unpatched VPNs to Install Ransomware on Industrial Targets

2021-04-08T13:12:00
thn
info

Iranian Hackers Targeting VMware Horizon Log4j Flaws to Deploy Ransomware

2022-02-18T07:40:00
thn
info

CISA Issues Urgent Warning: Adobe ColdFusion Vulnerability Exploited in the Wild

2023-03-16T04:47:00
thn
info

PoC Exploit Released for Critical Fortinet Auth Bypass Bug Under Active Attacks

2022-10-14T03:35:00
thn
info

Fortinet Warns of Active Exploitation of Newly Discovered Critical Auth Bypass Bug

2022-10-11T06:21:00
thn
info

Critical Adobe ColdFusion Flaw Added to CISA's Exploited Vulnerability Catalog

2023-08-22T03:36:00
thn
info

New Incident Report Reveals How Hive Ransomware Targets Organizations

2022-04-21T10:00:00
cisa
info

FBI-CISA Joint Advisory on Exploitation of Fortinet FortiOS Vulnerabilities

2021-04-02T00:00:00
attackerkb
info

CVE-2019-5591

2020-08-14T00:00:00
attackerkb
info

CVE-2018-13379 Path Traversal in Fortinet FortiOS

2019-06-04T00:00:00
attackerkb
info

CVE-2020-12812

2020-07-24T00:00:00
attackerkb
info

CVE-2023-26359

2023-03-14T00:00:00
attackerkb
info

CVE-2023-26360

2023-04-14T00:00:00
attackerkb
info

CVE-2023-29298

2023-07-12T00:00:00
threatpost
info

Exchange, Fortinet Flaws Being Exploited by Iranian APT, CISA Warns

2021-11-17T17:04:01
threatpost
info

FBI: APTs Actively Exploiting Fortinet VPN Bugs

2021-04-02T19:56:57
threatpost
info

Unpatched Fortinet Bug Allows Firewall Takeovers

2021-08-18T12:07:33
threatpost
info

Hackers Exploit Fortinet Flaw in Sophisticated Cring Ransomware Attacks

2021-04-08T14:00:32
threatpost
info

Thousands of Fortinet VPN Account Credentials Leaked

2021-09-09T22:49:27
threatpost
info

Accenture Confirms LockBit Ransomware Attack

2021-08-11T21:56:00
threatpost
info

IKEA Hit by Email Reply-Chain Cyberattack

2021-11-29T21:22:12
ics
info

#StopRansomware: Hive Ransomware

2022-11-25T12:00:00
ics
info

Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations

2022-09-14T12:00:00
ics
info

Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology

2022-02-16T12:00:00
ics
info

#StopRansomware: Royal Ransomware

2023-11-13T12:00:00
ics
info

Ongoing Cyber Threats to U.S. Water and Wastewater Systems

2021-10-25T12:00:00
ics
info

Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool

2021-04-15T12:00:00
ics
info

TrickBot Malware

2021-05-20T12:00:00
ics
info

AppleJeus: Analysis of North Korea’s Cryptocurrency Malware

2021-04-15T12:00:00
ics
info

Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments

2021-04-15T12:00:00
ics
info

Phishing Emails Used to Deploy KONNI Malware

2020-10-24T12:00:00
ics
info

#StopRansomware: Snatch Ransomware

2023-09-20T12:00:00
ics
info

New Exploits for Unsecure SAP Systems

2019-05-03T12:00:00
ics
info

DNS Infrastructure Hijacking Campaign

2019-02-13T12:00:00
ics
info

Ransomware Activity Targeting the Healthcare and Public Health Sector

2020-11-02T12:00:00
ics
info

Advanced Persistent Threat Actors Targeting U.S. Think Tanks

2020-12-01T12:00:00
ics
info

#StopRansomware: MedusaLocker

2022-08-11T12:00:00
ics
info

Strengthening Cybersecurity of SATCOM Network Providers and Customers

2022-05-10T12:00:00
ics
info

Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department

2021-07-20T12:00:00
ics
info

Emotet Malware

2020-10-24T12:00:00
ics
info

Malicious Cyber Actor Spoofing COVID-19 Loan Relief Webpage via Phishing Emails

2020-08-14T12:00:00
ics
info

Potential for Iranian Cyber Response to U.S. Military Strike in Baghdad

2020-10-24T12:00:00
ics
info

SamSam Ransomware

2018-12-03T12:00:00
ics
info

Ransomware Awareness for Holidays and Weekends

2022-02-10T12:00:00
ics
info

Protecting Against Malicious Use of Remote Monitoring and Management Software

2023-01-26T12:00:00
ics
info

Control System Defense: Know the Opponent

2022-09-22T12:00:00
ics
info

#StopRansomware: Zeppelin Ransomware

2022-08-11T12:00:00
ics
info

#StopRansomware: AvosLocker Ransomware (Update)

2023-10-11T12:00:00
ics
info

Weak Security Controls and Practices Routinely Exploited for Initial Access

2022-12-08T12:00:00
ics
info

Tactics, Techniques, and Procedures of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector

2022-03-24T12:00:00
ics
info

DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks

2021-07-08T12:00:00
ics
info

Compromise of U.S. Water Treatment Facility

2021-02-12T12:00:00
ics
info

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data

2020-12-10T12:00:00
ics
info

Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data

2020-11-03T12:00:00
ics
info

North Korean Advanced Persistent Threat Focus: Kimsuky

2020-10-27T12:00:00
ics
info

NSA and CISA Recommend Immediate Actions to Reduce Exposure Across Operational Technologies and Control Systems

2020-10-24T12:00:00
ics
info

Guidance on the North Korean Cyber Threat

2020-06-23T12:00:00
ics
info

ESXiArgs Ransomware Virtual Machine Recovery Guidance

2023-02-08T12:00:00
ics
info

Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations

2021-04-15T12:00:00
ics
info

Protecting Against Cyber Threats to Managed Service Providers and their Customers

2022-05-11T12:00:00
ics
info

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

2022-04-20T12:00:00
ics
info

New Sandworm Malware Cyclops Blink Replaces VPNFilter

2022-02-23T12:00:00
ics
info

BlackMatter Ransomware

2021-10-18T12:00:00
ics
info

Scattered Spider

2023-11-16T12:00:00
ics
info

#StopRansomware: Daixin Team

2022-10-26T12:00:00
ics
info

FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks

2020-10-24T12:00:00
ics
info

Microsoft Office 365 Security Recommendations

2020-04-29T12:00:00
ics
info

Ransomware Impacting Pipeline Operations

2020-10-24T12:00:00
ics
info

Enhanced Monitoring to Detect APT Activity Targeting Outlook Online

2023-07-12T12:00:00
ics
info

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

2022-05-09T12:00:00
ics
info

Enterprise VPN Security

2020-04-15T12:00:00
ics
info

2021 Trends Show Increased Globalized Threat of Ransomware

2022-02-10T12:00:00
ics
info

Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013

2021-07-21T12:00:00
ics
info

Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs

2021-05-29T12:00:00
ics
info

ATT&CK Table for Sophisticated Spearphishing Campaign CSA

2021-05-28T12:00:00
ics
info

Update: Destructive Malware Targeting Organizations in Ukraine

2022-04-28T12:00:00
ics
info

Microsoft Ending Support for Windows 7 and Windows Server 2008 R2

2019-10-18T12:00:00
ics
info

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

2023-02-28T12:00:00
ics
info

#StopRansomware: LockBit 3.0

2023-03-16T12:00:00
ics
info

Identification and Disruption of QakBot Infrastructure

2023-08-30T12:00:00
ics
info

People's Republic of China-Linked Cyber Actors Hide in Router Firmware

2023-09-27T12:00:00
ics
info

IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities

2023-12-01T12:00:00
ics
info

Hunting Russian Intelligence “Snake” Malware

2023-05-09T12:00:00
ics
info

Technical Approaches to Uncovering and Remediating Malicious Activity

2020-09-24T12:00:00
ics
info

Malicious Cyber Actor Use of Network Tunneling and Spoofing to Obfuscate Geolocation

2020-10-24T12:00:00
ics
info

Defending Against Malicious Cyber Activity Originating from Tor

2021-08-02T12:00:00
ics
info

Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns

2023-12-07T12:00:00
ics
info

North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector

2022-07-07T12:00:00
ics
info

EINSTEIN Data Trends – 30-day Lookback

2020-06-30T12:00:00
ics
info

Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers

2023-12-05T12:00:00
ics
info

Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets

2020-12-01T12:00:00
ics
info

Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability

2022-05-02T12:00:00
ics
info

Continued Exploitation of Pulse Secure VPN Vulnerability

2020-04-15T12:00:00
ics
info

Publicly Available Tools Seen in Cyber Incidents Worldwide

2020-06-30T12:00:00
ics
info

APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers

2023-04-18T12:00:00
ics
info

Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG

2023-05-11T12:00:00
ics
info

Threat Actors Exploiting F5 BIG-IP CVE-2022-1388

2022-10-12T12:00:00
ics
info

Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902

2020-07-24T12:00:00
ics
info

APT Groups Target Healthcare and Essential Services

2022-01-25T12:00:00
ics
info

Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

2020-10-24T12:00:00
ics
info

#StopRansomware: Rhysida Ransomware

2023-11-15T12:00:00
ics
info

Detecting Citrix CVE-2019-19781

2020-05-21T12:00:00
ics
info

Karakurt Data Extortion Group

2022-06-02T12:00:00
ics
info

Potential Legacy Risk from Malware Targeting QNAP NAS Devices

2020-08-06T12:00:00
ics
info

Iranian State Actors Conduct Cyber Operations Against the Government of Albania

2022-09-23T12:00:00
ics
info

LokiBot Malware

2020-10-24T12:00:00
ics
info

Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

2022-11-25T12:00:00
ics
info

2021 Top Malware Strains

2022-08-25T12:00:00
ics
info

Microsoft Operating Systems BlueKeep Vulnerability

2019-06-17T12:00:00
ics
info

Dridex Malware

2020-06-30T12:00:00
ics
info

Understanding Ransomware Threat Actors: LockBit

2023-06-14T12:00:00
ics
info

Threat Actors Exploit Atlassian Confluence CVE-2023-22515 for Initial Access to Networks

2023-10-16T12:00:00
ics
info

APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus

2021-12-06T12:00:00
ics
info

APT Cyber Tools Targeting ICS/SCADA Devices

2022-05-25T12:00:00
ics
info

APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus

2021-11-22T12:00:00
ics
info

BadAlloc Vulnerability Affecting BlackBerry QNX RTOS

2021-08-23T12:00:00
ics
info

Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders

2021-04-26T12:00:00
ics
info

Critical Vulnerability in SAP NetWeaver AS Java

2020-07-13T12:00:00
ics
info

COVID-19 Exploited by Malicious Cyber Actors

2020-04-08T12:00:00
ics
info

Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP

2020-05-21T12:00:00
ics
info

#StopRansomware: BianLian Ransomware Group

2023-05-16T12:00:00
ics
info

Preventing Web Application Access Control Abuse

2023-07-27T12:00:00
ics
info

APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations

2020-10-24T12:00:00
ics
info

#StopRansomware: Vice Society

2022-09-08T12:00:00
cve
NVD

CVE-2020-12812

2020-07-24T23:15:00
cve
NVD

CVE-2023-26360

2023-03-23T20:15:00
cve
NVD

CVE-2018-13379

2019-06-04T21:29:00
cve
NVD

CVE-2019-5591

2020-08-14T16:15:00
cve
NVD

CVE-2021-31196

2021-07-14T18:15:00
nessus
scanner

Fortinet FortiOS < 6.0.10 / 6.2.x < 6.2.4 / 6.4.x < 6.4.1 Improper Authentication (FG-IR-19-283)

2020-10-02T00:00:00
nessus
scanner

Fortinet FortiGate < 6.2.1 Information Disclosure (FG-IR-19-037)

2019-08-12T00:00:00
nessus
scanner

Fortinet FortiOS 5.4.6 <= 5.4.12 / 5.6.3 < 5.6.8 / 6.0.x < 6.0.5 SSL VPN Directory Traversal (FG-IR-18-384)

2019-06-14T00:00:00
nessus
scanner

Fortinet FortiOS (Mac OS X) 5.4.6 <= 5.4.12 / 5.6.3 < 5.6.8 / 6.0.x < 6.0.5 SSL VPN Directory Traversal (FG-IR-18-384) (deprecated)

2019-06-14T00:00:00
nessus
scanner

Fortinet FortiOS SSL VPN Directory Traversal Vulnerability (FG-IR-18-384) (Direct Check)

2019-09-06T00:00:00
rapid7blog
info

Attackers Targeting Fortinet Devices and SAP Applications

2021-04-08T17:18:07
rapid7blog
info

CVE-2022-40684: Remote Authentication Bypass Vulnerability in Fortinet Firewalls, Web Proxies

2022-10-07T16:24:42
rapid7blog
info

Rapid7 Observed Exploitation of Adobe ColdFusion

2023-03-21T15:10:50
rapid7blog
info

Metasploit Wrap-Up

2021-03-05T17:20:43
rapid7blog
info

CVE-2023-29298: Adobe ColdFusion Access Control Bypass

2023-07-11T15:30:00
rapid7blog
info

For Microsoft Exchange Server Vulnerabilities, Patching Remains Patchy

2021-10-06T14:07:12
zdi
info

(Pwn2Own) Microsoft Exchange Server Autodiscover Server Side Request Forgery Authentication Bypass Vulnerability

2021-07-19T00:00:00
prion
NVD

Authentication flaw

2020-07-24T23:15:00
prion
NVD

Improper access control

2023-03-23T20:15:00
prion
NVD

Path traversal

2019-06-04T21:29:00
prion
NVD

Default configuration

2020-08-14T16:15:00
prion
NVD

Remote code execution

2021-07-14T18:15:00
prion
NVD

Remote code execution

2021-07-14T18:15:00
fortinet
software

Protect

2020-07-13T00:00:00
fortinet
software

Protect

2019-05-24T00:00:00
fortinet
software

Protect

2019-07-26T00:00:00
fortinet
software

FortiProxy - system file leak through SSL VPN special crafted HTTP resource requests

2021-06-01T00:00:00
cisa_kev
info

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Fortinet FortiOS Default Configuration Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

2023-03-15T00:00:00
exploitpack
exploit

FortiOS 5.6.3 - 5.6.7 FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure

2019-08-19T00:00:00
exploitpack
exploit

FortiOS 5.6.3 - 5.6.7 FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure (Metasploit)

2019-08-19T00:00:00
malwarebytes
blog

Adobe Coldfusion vulnerability used in attacks on government servers

2023-12-06T14:15:54
malwarebytes
blog

500,000 Fortinet VPN credentials exposed: Turn off, patch, reset passwords

2021-09-09T15:37:43
malwarebytes
blog

Adobe ColdFusion vulnerability exploited in the wild

2023-08-23T12:30:00
zdt
exploit

Adobe ColdFusion Unauthenticated Remote Code Execution Exploit

2023-05-02T00:00:00
zdt
exploit

FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure Exploit (2)

2019-08-19T00:00:00
zdt
exploit

FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure Exploit

2019-08-19T00:00:00
hivepro
info

Adobe ColdFusion Vulnerability Leads to Federal Agency Breach

2023-12-07T05:51:09
hivepro
info

MuddyWater is taking advantage of old vulnerabilities

2021-11-18T11:45:32
hivepro
info

LockBit 2.0 Ransomware affiliates targeting Renowned Organizations

2022-03-15T10:07:18
hivepro
info

Russian state-sponsored cyber actors targeting U.S. critical infrastructure

2022-02-18T12:20:35
packetstorm
exploit

FortiOS 5.6.7 / 6.0.4 Credential Disclosure

2019-08-19T00:00:00
packetstorm
exploit

FortiOS 5.6.7 / 6.0.4 Credential Disclosure

2019-08-19T00:00:00
packetstorm
exploit

Adobe ColdFusion Unauthenticated Remote Code Execution

2023-05-01T00:00:00
mmpc
blog

Exposing POLONIUM activity and infrastructure targeting Israeli organizations

2022-06-02T16:00:00
githubexploit
exploit

Exploit for Server-Side Request Forgery in Microsoft

2021-08-11T12:20:07
githubexploit
exploit

Exploit for Server-Side Request Forgery in Microsoft

2021-11-22T07:47:09
githubexploit
exploit

Exploit for Server-Side Request Forgery in Microsoft

2021-08-16T11:27:13
githubexploit
exploit

Exploit for Server-Side Request Forgery in Microsoft

2022-11-16T08:22:29
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-10-02T07:29:24
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-08-10T15:01:02
metasploit
exploit

Adobe ColdFusion Unauthenticated Arbitrary File Read

2023-04-14T14:52:13
metasploit
exploit

Adobe ColdFusion Unauthenticated Remote Code Execution

2023-04-14T14:52:13
dsquare
exploit

Fortinet FortiGate SSL VPN File Disclosure

2019-08-17T00:00:00
kitploit
tools

Fortiscan - A High Performance FortiGate SSL-VPN Vulnerability Scanning And Exploitation Tool

2020-11-30T11:30:00
mssecure
blog

Exposing POLONIUM activity and infrastructure targeting Israeli organizations

2022-06-02T16:00:00
checkpoint_advisories
info

Fortinet FortiOS SSL VPN Directory Traversal (CVE-2018-13379)

2019-10-17T00:00:00
checkpoint_advisories
info

Microsoft Exchange Server Remote Code Execution (CVE-2021-34473; CVE-2021-34523)

2021-07-14T00:00:00
nuclei
software

Fortinet FortiOS - Credentials Disclosure

2020-04-22T00:00:00
nuclei
software

Unauthenticated File Read Adobe ColdFusion

2023-05-09T00:00:00
mscve
microsoft

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-07-13T07:00:00
impervablog
blog

CVE-2023-26360 – Adobe ColdFusion Arbitrary Code Execution

2023-04-04T10:04:27
exploitdb
exploit

Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure

2019-08-19T00:00:00
exploitdb
exploit

Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure (Metasploit)

2019-08-19T00:00:00
msrc
blog

April 2021 Update Tuesday packages now available

2021-04-13T07:00:00