logo
DATABASE RESOURCES PRICING ABOUT US

#StopRansomware: Hive Ransomware

2022-11-25T12:00:00

Description

### Summary Actions to Take Today to Mitigate Cyber Threats from Ransomware: • Prioritize remediating [known exploited vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>). • Enable and enforce multifactor authentication with strong passwords • Close unused ports and remove any application not deemed necessary for day-to-day operations. _Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit [stopransomware.gov](<https://www.cisa.gov/stopransomware>) to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources._ The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services (HHS) are releasing this joint CSA to disseminate known Hive IOCs and TTPs identified through FBI investigations as recently as November 2022. FBI, CISA, and HHS encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents. Victims of ransomware operations should report the incident to their local FBI field office or CISA. Download the PDF version of this report: pdf, 852.9 kb. For a downloadable copy of IOCs, see AA22-321A.stix (STIX, 43.6 kb). ### Technical Details _Note: This advisory uses the MITRE ATT&CK® for Enterprise framework, version 12. See [MITRE ATT&CK for Enterprise](<https://attack.mitre.org/versions/v12/matrices/enterprise/>) for all referenced tactics and techniques._ As of November 2022, Hive ransomware actors have victimized over 1,300 companies worldwide, receiving approximately US$100 million in ransom payments, according to FBI information. Hive ransomware follows the ransomware-as-a-service (RaaS) model in which developers create, maintain, and update the malware, and affiliates conduct the ransomware attacks. From June 2021 through at least November 2022, threat actors have used Hive ransomware to target a wide range of businesses and critical infrastructure sectors, including Government Facilities, Communications, Critical Manufacturing, Information Technology, and especially Healthcare and Public Health (HPH). The method of initial intrusion will depend on which affiliate targets the network. Hive actors have gained initial access to victim networks by using single factor logins via Remote Desktop Protocol (RDP), virtual private networks (VPNs), and other remote network connection protocols [[T1133](<https://attack.mitre.org/versions/v12/techniques/T1133/>)]. In some cases, Hive actors have bypassed multifactor authentication (MFA) and gained access to FortiOS servers by exploiting Common Vulnerabilities and Exposures (CVE) [CVE-2020-12812](<https://nvd.nist.gov/vuln/detail/CVE-2020-12812>). This vulnerability enables a malicious cyber actor to log in without a prompt for the user’s second authentication factor (FortiToken) when the actor changes the case of the username. Hive actors have also gained initial access to victim networks by distributing phishing emails with malicious attachments [[T1566.001](<https://attack.mitre.org/versions/v12/techniques/T1566/001/>)] and by exploiting the following vulnerabilities against Microsoft Exchange servers [[T1190](<https://attack.mitre.org/versions/v12/techniques/T1190/>)]: * [CVE-2021-31207](<https://nvd.nist.gov/vuln/detail/CVE-2021-31207>) \- Microsoft Exchange Server Security Feature Bypass Vulnerability * [CVE-2021-34473](<https://nvd.nist.gov/vuln/detail/CVE-2021-34473>) \- Microsoft Exchange Server Remote Code Execution Vulnerability * [CVE-2021-34523](<https://nvd.nist.gov/vuln/detail/CVE-2021-34523>) \- Microsoft Exchange Server Privilege Escalation Vulnerability After gaining access, Hive ransomware attempts to evade detention by executing processes to: * Identify processes related to backups, antivirus/anti-spyware, and file copying and then terminating those processes to facilitate file encryption [[T1562](<https://attack.mitre.org/versions/v12/techniques/T1562/001/>)]. * Stop the volume shadow copy services and remove all existing shadow copies via vssadmin on command line or via PowerShell [[T1059](<https://attack.mitre.org/versions/v12/techniques/T1059/>)] [[T1490](<https://attack.mitre.org/versions/v12/techniques/T1490/>)]. * Delete Windows event logs, specifically the System, Security and Application logs [[T1070](<https://attack.mitre.org/versions/v12/techniques/T1070/>)]. Prior to encryption, Hive ransomware removes virus definitions and disables all portions of Windows Defender and other common antivirus programs in the system registry [[T1112](<https://attack.mitre.org/versions/v12/techniques/T1112/>)]. Hive actors exfiltrate data likely using a combination of Rclone and the cloud storage service Mega.nz [[T1537](<https://attack.mitre.org/versions/v12/techniques/T1537/>)]. In addition to its capabilities against the Microsoft Windows operating system, Hive ransomware has known variants for Linux, VMware ESXi, and FreeBSD. During the encryption process, a file named *.key (previously *.key.*) is created in the root directory (C:\ or /root/). Required for decryption, this key file only exists on the machine where it was created and cannot be reproduced. The ransom note, HOW_TO_DECRYPT.txt is dropped into each affected directory and states the *.key file cannot be modified, renamed, or deleted, otherwise the encrypted files cannot be recovered [[T1486](<https://attack.mitre.org/versions/v12/techniques/T1486/>)]. The ransom note contains a “sales department” .onion link accessible through a TOR browser, enabling victim organizations to contact the actors through a live chat panel to discuss payment for their files. However, some victims reported receiving phone calls or emails from Hive actors directly to discuss payment. The ransom note also threatens victims that a public disclosure or leak site accessible on the TOR site, “HiveLeaks”, contains data exfiltrated from victim organizations who do not pay the ransom demand (see figure 1 below). Additionally, Hive actors have used anonymous file sharing sites to disclose exfiltrated data (see table 1 below). ![](/sites/default/files/publications/How%20to%20Decrypt.png) _Figure 1: Sample Hive Ransom Note_ _Table 1: Anonymous File Sharing Sites Used to Disclose Data_ https://anonfiles[.]com --- https://mega[.]nz https://send.exploit[.]in https://ufile[.]io https://www.sendspace[.]com https://privatlab[.]net https://privatlab[.]com Once the victim organization contacts Hive actors on the live chat panel, Hive actors communicate the ransom amount and the payment deadline. Hive actors negotiate ransom demands in U.S. dollars, with initial amounts ranging from several thousand to millions of dollars. Hive actors demand payment in Bitcoin. Hive actors have been known to reinfect—with either Hive ransomware or another ransomware variant—the networks of victim organizations who have restored their network without making a ransom payment. #### **Indicators of Compromise** Threat actors have leveraged the following IOCs during Hive ransomware compromises. Note: Some of these indicators are legitimate applications that Hive threat actors used to aid in further malicious exploitation. FBI, CISA, and HHS recommend removing any application not deemed necessary for day-to-day operations. See tables 2–3 below for IOCs obtained from FBI threat response investigations as recently as November 2022. _Table 2: Known IOCs as of November 2022_ Known IOCs - Files --- HOW_TO_DECRYPT.txt typically in directories with encrypted files *.key typically in the root directory, i.e., C:\ or /root hive.bat shadow.bat asq.r77vh0[.]pw - Server hosted malicious HTA file asq.d6shiiwz[.]pw - Server referenced in malicious regsvr32 execution asq.swhw71un[.]pw - Server hosted malicious HTA file asd.s7610rir[.]pw - Server hosted malicious HTA file Windows_x64_encrypt.dll Windows_x64_encrypt.exe Windows_x32_encrypt.dll Windows_x32_encrypt.exe Linux_encrypt Esxi_encrypt Known IOCs – Events System, Security and Application Windows event logs wiped Microsoft Windows Defender AntiSpyware Protection disabled Microsoft Windows Defender AntiVirus Protection disabled Volume shadow copies deleted Normal boot process prevented Known IOCs – Logged Processes wevtutil.exe cl system wevtutil.exe cl security wevtutil.exe cl application vssadmin.exe delete shadows /all /quiet wmic.exe SHADOWCOPY /nointeractive wmic.exe shadowcopy delete bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures bcdedit.exe /set {default} recoveryenabled no _Table 3: Potential IOC IP Addresses as of November 2022_ Note: Some of these observed IP addresses are more than a year old. FBI and CISA recommend vetting or investigating these IP addresses prior to taking forward-looking action like blocking. Potential IOC IP Addresses for Compromise or Exfil: --- 84.32.188[.]57 | 84.32.188[.]238 93.115.26[.]251 | 185.8.105[.]67 181.231.81[.]239 | 185.8.105[.]112 186.111.136[.]37 | 192.53.123[.]202 158.69.36[.]149 | 46.166.161[.]123 108.62.118[.]190 | 46.166.161[.]93 185.247.71[.]106 | 46.166.162[.]125 5.61.37[.]207 | 46.166.162[.]96 185.8.105[.]103 | 46.166.169[.]34 5.199.162[.]220 | 93.115.25[.]139 5.199.162[.]229 | 93.115.27[.]148 89.147.109[.]208 | 83.97.20[.]81 5.61.37[.]207 | 5.199.162[.]220 5.199.162[.]229; | 46.166.161[.]93 46.166.161[.]123; | 46.166.162[.]96 46.166.162[.]125 | 46.166.169[.]34 83.97.20[.]81 | 84.32.188[.]238 84.32.188[.]57 | 89.147.109[.]208 93.115.25[.]139; | 93.115.26[.]251 93.115.27[.]148 | 108.62.118[.]190 158.69.36[.]149/span> | 181.231.81[.]239 185.8.105[.]67 | 185.8.105[.]103 185.8.105[.]112 | 185.247.71[.]106 186.111.136[.]37 | 192.53.123[.]202 #### **MITRE ATT&CK TECHNIQUES** See table 4 for all referenced threat actor tactics and techniques listed in this advisory. Table 4: Hive Actors ATT&CK Techniques for Enterprise _Initial Access_ --- Technique Title | ID | Use External Remote Services | [T1133](<https://attack.mitre.org/versions/v12/techniques/T1133/>) | Hive actors gain access to victim networks by using single factor logins via RDP, VPN, and other remote network connection protocols. Exploit Public-Facing Application | [T1190](<https://attack.mitre.org/versions/v12/techniques/T1190/>) | Hive actors gain access to victim network by exploiting the following Microsoft Exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2021-42321. Phishing | [T1566.001](<https://attack.mitre.org/versions/v12/techniques/T1566/001/>) | Hive actors gain access to victim networks by distributing phishing emails with malicious attachments. _Execution_ Technique Title | ID | Use Command and Scripting Interpreter | [T1059](<https://attack.mitre.org/versions/v12/techniques/T1059/>) | Hive actors looks to stop the volume shadow copy services and remove all existing shadow copies via vssadmin on command line or PowerShell. _Defense Evasion_ Technique Title | ID | Use Indicator Removal on Host | [T1070](<https://attack.mitre.org/versions/v12/techniques/T1070/>) | Hive actors delete Windows event logs, specifically, the System, Security and Application logs. Modify Registry | [T1112](<https://attack.mitre.org/versions/v12/techniques/T1112/>) | Hive actors set registry values for DisableAntiSpyware and DisableAntiVirus to 1. Impair Defenses | [T1562](<https://attack.mitre.org/versions/v12/techniques/T1562/001/>) | Hive actors seek processes related to backups, antivirus/anti-spyware, and file copying and terminates those processes to facilitate file encryption. _Exfiltration_ Technique Title | ID | Use Transfer Data to Cloud Account | [T1537](<https://attack.mitre.org/versions/v12/techniques/T1537/>) | Hive actors exfiltrate data from victims, using a possible combination of Rclone and the cloud storage service Mega.nz. _Impact_ Technique Title | | Use Data Encrypted for Impact | [T1486](<https://attack.mitre.org/versions/v12/techniques/T1486/>) | Hive actors deploy a ransom note HOW_TO_DECRYPT.txt into each affected directory which states the *.key file cannot be modified, renamed, or deleted, otherwise the encrypted files cannot be recovered. Inhibit System Recovery | [T1490](<https://attack.mitre.org/versions/v12/techniques/T1490/>) | Hive actors looks to stop the volume shadow copy services and remove all existing shadow copies via vssadmin via command line or PowerShell. ### Mitigations FBI, CISA, and HHS recommend organizations, particularly in the HPH sector, implement the following to limit potential adversarial use of common system and network discovery techniques and to reduce the risk of compromise by Hive ransomware: * Verify Hive actors no longer have access to the network. * Install updates for operating systems, software, and firmware as soon as they are released. Prioritize patching VPN servers, remote access software, virtual machine software, and [known exploited vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>). Consider leveraging a centralized patch management system to automate and expedite the process. * Require [phishing-resistant MFA](<https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf>) for as many services as possible—particularly for webmail, VPNs, accounts that access critical systems, and privileged accounts that manage backups. * If used, secure and monitor RDP. * Limit access to resources over internal networks, especially by restricting RDP and using virtual desktop infrastructure. * After assessing risks, if you deem RDP operationally necessary, restrict the originating sources and require MFA to mitigate credential theft and reuse. * If RDP must be available externally, use a VPN, virtual desktop infrastructure, or other means to authenticate and secure the connection before allowing RDP to connect to internal devices. * Monitor remote access/RDP logs, enforce account lockouts after a specified number of attempts to block brute force campaigns, log RDP login attempts, and disable unused remote access/RDP ports. * Be sure to properly configure devices and enable security features. * Disable ports and protocols not used for business purposes, such as RDP Port 3389/TCP. * Maintain offline backups of data, and regularly maintain backup and restoration. By instituting this practice, the organization ensures they will not be severely interrupted, and/or only have irretrievable data. * Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure. Ensure your backup data is not already infected., * Monitor cyber threat reporting regarding the publication of compromised VPN login credentials and change passwords/settings if applicable. * Install and regularly update anti-virus or anti-malware software on all hosts. * Enable PowerShell Logging including module logging, script block logging and transcription. * Install an enhanced monitoring tool such as Sysmon from Microsoft for increased logging. * Review the following additional resources. * The joint advisory from Australia, Canada, New Zealand, the United Kingdom, and the United States on [Technical Approaches to Uncovering and Remediating Malicious Activity](<https://us-cert.cisa.gov/ncas/alerts/aa20-245a>) provides additional guidance when hunting or investigating a network and common mistakes to avoid in incident handling. * The Cybersecurity and Infrastructure Security Agency-Multi-State Information Sharing & Analysis Center [Joint Ransomware Guide](<https://www.cisa.gov/stopransomware/ransomware-guide>) covers additional best practices and ways to prevent, protect, and respond to a ransomware attack. * [StopRansomware.gov](<https://www.cisa.gov/stopransomware>) is the U.S. Government’s official one-stop location for resources to tackle ransomware more effectively. If your organization is impacted by a ransomware incident, FBI, CISA, and HHS recommend the following actions. * **Isolate the infected system**. Remove the infected system from all networks, and disable the computer’s wireless, Bluetooth, and any other potential networking capabilities. Ensure all shared and networked drives are disconnected. * **Turn off other computers and devices**. Power-off and segregate (i.e., remove from the network) the infected computer(s). Power-off and segregate any other computers or devices that share a network with the infected computer(s) that have not been fully encrypted by ransomware. If possible, collect and secure all infected and potentially infected computers and devices in a central location, making sure to clearly label any computers that have been encrypted. Powering-off and segregating infected computers and computers that have not been fully encrypted may allow for the recovery of partially encrypted files by specialists. * **Secure your backups**. Ensure that your backup data is offline and secure. If possible, scan your backup data with an antivirus program to check that it is free of malware. In addition, FBI, CISA, and HHS urge all organizations to apply the following recommendations to prepare for, mitigate/prevent, and respond to ransomware incidents. #### **Preparing for Cyber Incidents** * **Review the security posture of third-party vendors and those interconnected with your organization**. Ensure all connections between third-party vendors and outside software or hardware are monitored and reviewed for suspicious activity. * **Implement listing policies for applications and remote access that only allow systems to execute known and permitted programs** under an established security policy. * **Document and monitor external remote connections**. Organizations should document approved solutions for remote management and maintenance, and immediately investigate if an unapproved solution is installed on a workstation. * **Implement a recovery plan** to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud). #### **Identity and Access Management** * **Require all accounts** with password logins (e.g., service account, admin accounts, and domain admin accounts) to comply with [National Institute of Standards and Technology (NIST) standards](<https://pages.nist.gov/800-63-3/>) for developing and managing password policies. * Use longer passwords consisting of at least 8 characters and no more than 64 characters in length. * Store passwords in hashed format using industry-recognized password managers. * Add password user “salts” to shared login credentials. * Avoid reusing passwords. * Implement multiple failed login attempt account lockouts. * Disable password “hints.” * Refrain from requiring password changes more frequently than once per year unless a password is known or suspected to be compromised. Note: NIST guidance suggests favoring longer passwords instead of requiring regular and frequent password resets. Frequent password resets are more likely to result in users developing password “patterns” cyber criminals can easily decipher. * Require administrator credentials to install software. * **Require phishing-resistant multifactor authentication** for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems. * **Review domain controllers, servers, workstations, and active directories** for new and/or unrecognized accounts. * **Audit user accounts** with administrative privileges and configure access controls according to the principle of least privilege. * **Implement time-based access for accounts set at the admin level and higher**. For example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust model). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task. #### **Protective Controls and Architecture** * **Segment networks** to prevent the spread of ransomware. Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement. * **Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool**. To aid in detecting the ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host. * Install, regularly update, and enable real time detection for antivirus software on all hosts. Vulnerability and Configuration Management * **Consider adding an email banner to emails** received from outside your organization. * **Disable command-line and scripting activities and permissions**. Privilege escalation and lateral movement often depend on software utilities running from the command line. If threat actors are not able to run these tools, they will have difficulty escalating privileges and/or moving laterally. * **Ensure devices are properly configured and that security features are enabled**. * **Restrict Server Message Block (SMB) Protocol within the network to only access necessary servers and remove or disable outdated versions of SMB** (i.e., SMB version 1). Threat actors use SMB to propagate malware across organizations. #### **REFERENCES** * [Stopransomware.gov](<http://www.stopransomware.gov/>) is a whole-of-government approach that gives one central location for ransomware resources and alerts. * Resource to mitigate a ransomware attack: [CISA-Multi-State Information Sharing and Analysis Center (MS-ISAC) Joint Ransomware Guide](<https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware%20Guide_S508C.pdf>). * No-cost cyber hygiene services: [Cyber Hygiene Services](<https://www.cisa.gov/cyber-hygiene-services>) and [Ransomware Readiness Assessment](<https://github.com/cisagov/cset/>). #### **INFORMATION REQUESTED** The FBI, CISA, and HHS do not encourage paying a ransom to criminal actors. Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Paying the ransom also does not guarantee that a victim’s files will be recovered. However, the FBI, CISA, and HHS understand that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers. Regardless of whether you or your organization decide to pay the ransom, the FBI, CISA, and HHS urge you to promptly report ransomware incidents to your [local FBI field office](<https://www.fbi.gov/contact-us/field-offices>), or to CISA at [report@cisa.gov](<mailto:report@cisa.gov>) or (888) 282-0870. Doing so provides investigators with the critical information they need to track ransomware attackers, hold them accountable under US law, and prevent future attacks. The FBI may seek the following information that you determine you can legally share, including: * Recovered executable files * Live random access memory (RAM) capture * Images of infected systems * Malware samples * IP addresses identified as malicious or suspicious * Email addresses of the attackers * A copy of the ransom note * Ransom amount * Bitcoin wallets used by the attackers * Bitcoin wallets used to pay the ransom * Post-incident forensic reports #### DISCLAIMER The information in this report is being provided “as is” for informational purposes only. FBI, CISA, and HHS do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI, CISA, or HHS. ### Revisions Initial Version: November 17, 2022


Related


threatpost
info

Microsoft Breaks Silence on Barrage of ProxyShell Attacks

2021-08-26T12:39:54
threatpost
info

Exchange, Fortinet Flaws Being Exploited by Iranian APT, CISA Warns

2021-11-17T17:04:01
threatpost
info

New APT ChamelGang Targets Russian Energy, Aviation Orgs

2021-10-01T12:36:25
threatpost
info

‘Tortilla’ Wraps Exchange Servers in ProxyShell Attacks

2021-11-03T18:16:37
threatpost
info

Exchange Servers Under Active Attack via ProxyShell Bugs

2021-08-13T18:56:27
threatpost
info

IKEA Hit by Email Reply-Chain Cyberattack

2021-11-29T21:22:12
threatpost
info

Attackers Hijack Email Using Proxy Logon/Proxyshell Flaws

2021-11-22T19:26:25
threatpost
info

SideWalk Backdoor Linked to China-Linked Spy Group ‘Grayfly’

2021-09-09T14:30:56
trellix
info

Trellix Global Defenders: Analysis and Protections for BlackByte Ransomware

2022-02-28T00:00:00
zdt
exploit

Microsoft Exchange ProxyShell Remote Code Execution Exploit

2021-08-21T00:00:00
zdt
exploit

Microsoft Exchange Server Remote Code Execution Exploit

2022-02-26T00:00:00
zdt
exploit

PaperCut NG/MG 22.0.4 - Remote Code Execution Exploit

2023-05-23T00:00:00
zdt
exploit

PaperCut NG/MG 22.0.4 - Authentication Bypass Exploit

2023-04-25T00:00:00
zdt
exploit

Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution Exploit

2022-08-22T00:00:00
thn
info

New Incident Report Reveals How Hive Ransomware Targets Organizations

2022-04-21T10:00:00
thn
info

WARNING: Microsoft Exchange Under Attack With ProxyShell Flaws

2021-08-22T09:51:00
thn
info

A New APT Hacking Group Targeting Fuel, Energy, and Aviation Industries

2021-10-04T12:48:00
thn
info

ProxyNotShell – the New Proxy Hell?

2022-10-04T08:05:00
thn
info

U.S. Charges 3 Iranian Hackers and Sanctions Several Others Over Ransomware Attacks

2022-09-15T06:49:00
thn
info

Hackers Exploiting ProxyLogon and ProxyShell Flaws in Spam Campaigns

2021-11-22T11:47:00
thn
info

U.S., U.K. and Australia Warn of Iranian Hackers Exploiting Microsoft, Fortinet Flaws

2021-11-17T15:44:00
thn
info

Microsoft Warns of State-Sponsored Attacks Exploiting Critical PaperCut Vulnerability

2023-05-09T08:53:00
thn
info

Bl00dy Ransomware Gang Strikes Education Sector with Critical PaperCut Vulnerability

2023-05-12T07:59:00
thn
info

Russian Hackers Suspected in Ongoing Exploitation of Unpatched PaperCut Servers

2023-04-24T06:05:00
thn
info

Researchers Uncover New Exploit for PaperCut Vulnerability That Can Bypass Detection

2023-05-04T13:03:00
thn
info

Hackers Actively Searching for Unpatched Microsoft Exchange Servers

2021-08-13T09:46:00
thn
info

FIN7 Cybercrime Syndicate Emerges as a Major Player in Ransomware Landscape

2022-12-22T13:13:00
fireeye
info

PST, Want a Shell? ProxyShell Exploiting Microsoft Exchange Servers

2021-09-03T10:00:00
malwarebytes
blog

Patch now! Microsoft Exchange is being attacked via ProxyShell

2021-08-23T13:21:08
malwarebytes
blog

IIS extensions are on the rise as backdoors to servers

2022-07-27T13:58:06
malwarebytes
blog

AvosLocker ransomware uses Microsoft Exchange Server vulnerabilities, says FBI

2022-03-21T21:09:12
malwarebytes
blog

The top 5 most routinely exploited vulnerabilities of 2021

2022-04-29T16:28:20
malwarebytes
blog

Update your PaperCut application servers now: Exploits in the wild

2023-04-26T04:00:00
malwarebytes
blog

Ransomware review: May 2023

2023-05-08T13:45:00
hivepro
info

Hive Ransomware targets organizations with ProxyShell exploit

2022-04-22T14:34:47
hivepro
info

BlackByte ransomware exploits Microsoft Servers ProxyShell Vulnerabilities

2021-12-07T13:24:49
hivepro
info

Magic Hound Exploiting Old Microsoft Exchange ProxyShell Vulnerabilities

2022-03-25T04:05:09
hivepro
info

ProxyShell and PetitPotam exploits weaponized by LockFile Ransomware Group

2021-08-24T10:35:48
hivepro
info

AvosLocker Ransomware group has targeted 50+ Organizations Worldwide

2022-03-24T06:30:44
hivepro
info

Weekly Threat Digest: 18 – 24 April 2022

2022-04-27T12:44:38
hivepro
info

MuddyWater is taking advantage of old vulnerabilities

2021-11-18T11:45:32
hivepro
info

Weekly Threat Digest: 21 – 27 March 2022

2022-03-29T13:56:10
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-10-02T07:29:24
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-09-04T15:34:03
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-08-10T15:01:02
githubexploit
exploit

Exploit for CVE-2021-42321

2021-11-23T02:26:26
githubexploit
exploit

Exploit for CVE-2021-42321

2022-10-08T13:00:23
githubexploit
exploit

Exploit for Improper Access Control in Papercut Papercut Ng

2023-04-21T20:13:47
githubexploit
exploit

Exploit for Improper Access Control in Papercut Papercut Ng

2023-04-22T21:34:06
githubexploit
exploit

Exploit for Improper Access Control in Papercut Papercut Ng

2023-04-25T20:51:23
githubexploit
exploit

Exploit for Improper Access Control in Papercut Papercut Ng

2023-04-21T09:19:13
githubexploit
exploit

Exploit for Improper Access Control in Papercut Papercut Ng

2023-05-27T11:32:35
githubexploit
exploit

Exploit for Server-Side Request Forgery in Microsoft

2021-08-11T12:20:07
githubexploit
exploit

Exploit for Server-Side Request Forgery in Microsoft

2021-11-22T07:47:09
githubexploit
exploit

Exploit for Server-Side Request Forgery in Microsoft

2022-11-16T08:22:29
githubexploit
exploit

Exploit for Server-Side Request Forgery in Microsoft

2021-08-16T11:27:13
attackerkb
info

ProxyShell Exploit Chain

2021-08-20T00:00:00
attackerkb
info

CVE-2021-42321

2021-11-10T00:00:00
attackerkb
info

CVE-2021-31207

2021-05-11T00:00:00
attackerkb
info

CVE-2020-12812

2020-07-24T00:00:00
attackerkb
info

CVE-2023-27350

2023-04-20T00:00:00
rapid7blog
info

For Microsoft Exchange Server Vulnerabilities, Patching Remains Patchy

2021-10-06T14:07:12
rapid7blog
info

Metasploit Wrap-Up

2021-08-20T19:12:00
rapid7blog
info

ProxyShell: More Widespread Exploitation of Microsoft Exchange Servers

2021-08-12T21:08:43
rapid7blog
info

Metasploit Weekly Wrap-Up

2022-02-25T21:48:46
rapid7blog
info

Conti Ransomware Group Internal Chats Leaked Over Russia-Ukraine Conflict

2022-03-01T19:15:58
rapid7blog
info

CVE-2023-27350: Ongoing Exploitation of PaperCut Remote Code Execution Vulnerability

2023-05-17T18:35:01
metasploit
exploit

Microsoft Exchange ProxyShell RCE

2021-08-18T14:50:34
metasploit
exploit

Microsoft Exchange Server ChainedSerializationBinder RCE

2022-08-09T17:32:09
cisa
info

Urgent: Protect Against Active Exploitation of ProxyShell Vulnerabilities

2021-08-21T00:00:00
packetstorm
exploit

Microsoft Exchange ProxyShell Remote Code Execution

2021-08-20T00:00:00
packetstorm
exploit

Microsoft Exchange Server Remote Code Execution

2022-02-25T00:00:00
packetstorm
exploit

PaperCut NG/MG 22.0.4 Remote Code Execution

2023-05-24T00:00:00
packetstorm
exploit

PaperCut NG/MG 22.0.4 Authentication Bypass

2023-04-26T00:00:00
packetstorm
exploit

Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution

2022-08-22T00:00:00
pentestpartners
blog

Hive Ransomware is on the rise. How should you deal with it?

2022-11-18T06:44:42
qualysblog
blog

AvosLocker Ransomware Behavior Examined on Windows & Linux

2022-03-07T05:18:46
qualysblog
blog

In-Depth Look Into Data-Driven Science Behind Qualys TruRisk

2022-10-10T14:32:29
checkpoint_advisories
info

Microsoft Exchange Server Remote Code Execution (CVE-2021-34473; CVE-2021-34523)

2021-07-14T00:00:00
checkpoint_advisories
info

Microsoft Exchange Server Remote Code Execution (CVE-2021-42321)

2021-11-23T00:00:00
checkpoint_advisories
info

Microsoft Exchange Server Security Feature Authentication Bypass (CVE-2021-31207)

2021-12-16T00:00:00
ics
info

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities

2021-11-19T12:00:00
ics
info

Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations

2022-09-14T12:00:00
ics
info

Control System Defense: Know the Opponent

2022-09-22T12:00:00
ics
info

Update: Destructive Malware Targeting Organizations in Ukraine

2022-04-28T12:00:00
ics
info

#StopRansomware: Zeppelin Ransomware

2022-08-11T12:00:00
ics
info

North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector

2022-07-07T12:00:00
ics
info

#StopRansomware: MedusaLocker

2022-08-11T12:00:00
ics
info

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

2022-05-09T12:00:00
ics
info

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

2022-04-20T12:00:00
ics
info

#StopRansomware: LockBit 3.0

2023-03-16T12:00:00
ics
info

Tactics, Techniques, and Procedures of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector

2022-03-24T12:00:00
ics
info

Strengthening Cybersecurity of SATCOM Network Providers and Customers

2022-05-10T12:00:00
ics
info

#StopRansomware: Royal Ransomware

2023-03-02T12:00:00
ics
info

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

2023-02-28T12:00:00
ics
info

Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG

2023-05-11T12:00:00
ics
info

Hunting Russian Intelligence “Snake” Malware

2023-05-09T12:00:00
ics
info

Protecting Against Malicious Use of Remote Monitoring and Management Software

2023-01-26T12:00:00
ics
info

ESXiArgs Ransomware Virtual Machine Recovery Guidance

2023-02-08T12:00:00
ics
info

#StopRansomware: Daixin Team

2022-10-26T12:00:00
ics
info

Weak Security Controls and Practices Routinely Exploited for Initial Access

2022-12-08T12:00:00
ics
info

Protecting Against Cyber Threats to Managed Service Providers and their Customers

2022-05-11T12:00:00
ics
info

SamSam Ransomware

2018-12-03T12:00:00
ics
info

Ransomware Awareness for Holidays and Weekends

2022-02-10T12:00:00
ics
info

DNS Infrastructure Hijacking Campaign

2019-02-13T12:00:00
ics
info

New Exploits for Unsecure SAP Systems

2019-05-03T12:00:00
ics
info

Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool

2021-04-15T12:00:00
ics
info

TrickBot Malware

2021-05-20T12:00:00
ics
info

ATT&CK Table for Sophisticated Spearphishing Campaign CSA

2021-05-28T12:00:00
ics
info

DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks

2021-07-08T12:00:00
ics
info

North Korean Advanced Persistent Threat Focus: Kimsuky

2020-10-27T12:00:00
ics
info

Malicious Cyber Actor Use of Network Tunneling and Spoofing to Obfuscate Geolocation

2020-10-24T12:00:00
ics
info

Microsoft Ending Support for Windows 7 and Windows Server 2008 R2

2019-10-18T12:00:00
ics
info

Ransomware Activity Targeting the Healthcare and Public Health Sector

2020-11-02T12:00:00
ics
info

Guidance on the North Korean Cyber Threat

2020-06-23T12:00:00
ics
info

Technical Approaches to Uncovering and Remediating Malicious Activity

2020-09-24T12:00:00
ics
info

FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks

2020-10-24T12:00:00
ics
info

Phishing Emails Used to Deploy KONNI Malware

2020-10-24T12:00:00
ics
info

Malicious Cyber Actor Spoofing COVID-19 Loan Relief Webpage via Phishing Emails

2020-08-14T12:00:00
ics
info

Defending Against Malicious Cyber Activity Originating from Tor

2021-08-02T12:00:00
ics
info

Ongoing Cyber Threats to U.S. Water and Wastewater Systems

2021-10-25T12:00:00
ics
info

BlackMatter Ransomware

2021-10-18T12:00:00
ics
info

Microsoft Office 365 Security Recommendations

2020-04-29T12:00:00
ics
info

Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013

2021-07-21T12:00:00
ics
info

Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department

2021-07-20T12:00:00
ics
info

Potential for Iranian Cyber Response to U.S. Military Strike in Baghdad

2020-10-24T12:00:00
ics
info

Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data

2020-11-03T12:00:00
ics
info

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data

2020-12-10T12:00:00
ics
info

Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations

2021-04-15T12:00:00
ics
info

Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments

2021-04-15T12:00:00
ics
info

EINSTEIN Data Trends – 30-day Lookback

2020-06-30T12:00:00
ics
info

Ransomware Impacting Pipeline Operations

2020-10-24T12:00:00
ics
info

NSA and CISA Recommend Immediate Actions to Reduce Exposure Across Operational Technologies and Control Systems

2020-10-24T12:00:00
ics
info

Emotet Malware

2020-10-24T12:00:00
ics
info

Enterprise VPN Security

2020-04-15T12:00:00
ics
info

AppleJeus: Analysis of North Korea’s Cryptocurrency Malware

2021-04-15T12:00:00
ics
info

Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs

2021-05-29T12:00:00
ics
info

Advanced Persistent Threat Actors Targeting U.S. Think Tanks

2020-12-01T12:00:00
ics
info

Compromise of U.S. Water Treatment Facility

2021-02-12T12:00:00
ics
info

2021 Trends Show Increased Globalized Threat of Ransomware

2022-02-10T12:00:00
ics
info

New Sandworm Malware Cyclops Blink Replaces VPNFilter

2022-02-23T12:00:00
ics
info

Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

2022-11-25T12:00:00
ics
info

2021 Top Malware Strains

2022-08-25T12:00:00
ics
info

APT Cyber Tools Targeting ICS/SCADA Devices

2022-05-25T12:00:00
ics
info

Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability

2022-05-02T12:00:00
ics
info

APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers

2023-04-18T12:00:00
ics
info

#StopRansomware: BianLian Ransomware Group

2023-05-16T12:00:00
ics
info

Iranian State Actors Conduct Cyber Operations Against the Government of Albania

2022-09-23T12:00:00
ics
info

Threat Actors Exploiting F5 BIG-IP CVE-2022-1388

2022-10-12T12:00:00
ics
info

BadAlloc Vulnerability Affecting BlackBerry QNX RTOS

2021-08-23T12:00:00
ics
info

Microsoft Operating Systems BlueKeep Vulnerability

2019-06-17T12:00:00
ics
info

Critical Vulnerability in SAP NetWeaver AS Java

2020-07-13T12:00:00
ics
info

Potential Legacy Risk from Malware Targeting QNAP NAS Devices

2020-08-06T12:00:00
ics
info

Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

2020-10-24T12:00:00
ics
info

Publicly Available Tools Seen in Cyber Incidents Worldwide

2020-06-30T12:00:00
ics
info

LokiBot Malware

2020-10-24T12:00:00
ics
info

Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders

2021-04-26T12:00:00
ics
info

APT Groups Target Healthcare and Essential Services

2022-01-25T12:00:00
ics
info

COVID-19 Exploited by Malicious Cyber Actors

2020-04-08T12:00:00
ics
info

Dridex Malware

2020-06-30T12:00:00
ics
info

Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP

2020-05-21T12:00:00
ics
info

Detecting Citrix CVE-2019-19781

2020-05-21T12:00:00
ics
info

Continued Exploitation of Pulse Secure VPN Vulnerability

2020-04-15T12:00:00
ics
info

APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus

2021-11-22T12:00:00
ics
info

Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902

2020-07-24T12:00:00
securelist
blog

CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

2022-12-19T16:15:49
msrc
blog

April 2021 Update Tuesday packages now available

2021-04-13T07:00:00
nessus
scanner

Fortinet FortiOS < 6.0.10 / 6.2.x < 6.2.4 / 6.4.x < 6.4.1 Improper Authentication (FG-IR-19-283)

2020-10-02T00:00:00
nessus
scanner

PaperCut MF Authentication Bypass (CVE-2023-27350)

2023-05-18T00:00:00
nessus
scanner

PaperCut NG Authentication Bypass (CVE-2023-27350)

2023-04-25T00:00:00
nessus
scanner

Security Updates for Microsoft Exchange Server (April 2021)

2021-04-13T00:00:00
fortinet
software

FortiOS SSL VPN 2FA bypass by changing username case

2020-07-13T00:00:00
cisa_kev
info

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-11-17T00:00:00
cisa_kev
info

Microsoft Exchange Server Security Feature Bypass Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Microsoft Exchange Server Privilege Escalation Vulnerability

2021-11-03T00:00:00
cisa_kev
info

PaperCut MF/NG Improper Access Control Vulnerability

2023-04-21T00:00:00
cisa_kev
info

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-11-03T00:00:00
cve
NVD

CVE-2020-12812

2020-07-24T23:15:00
cve
NVD

CVE-2021-42321

2021-11-10T01:19:00
cve
NVD

CVE-2021-31207

2021-05-11T19:15:00
cve
NVD

CVE-2023-27350

2023-04-20T16:15:00
cnvd
cnvd

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2021-90307)

2021-11-12T00:00:00
mscve
microsoft

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-11-09T08:00:00
mscve
microsoft

Microsoft Exchange Server Security Feature Bypass Vulnerability

2021-05-11T07:00:00
zdi
info

(Pwn2Own) Microsoft Exchange Server Arbitrary File Write Remote Code Execution Vulnerability

2021-07-19T00:00:00
zdi
info

(Pwn2Own) Microsoft Exchange Server PowerShell Improper Authentication Remote Code Execution Vulnerability

2021-07-19T00:00:00
zdi
info

PaperCut NG SetupCompleted Improper Access Control Authentication Bypass Vulnerability

2023-03-14T00:00:00
zdi
info

(Pwn2Own) Microsoft Exchange Server Autodiscover Server Side Request Forgery Authentication Bypass Vulnerability

2021-07-19T00:00:00
saint
exploit

PaperCut authentication bypass

2023-05-12T00:00:00
saint
exploit

PaperCut authentication bypass

2023-05-12T00:00:00
talosblog
blog

Threat Source newsletter (April 27, 2023) — New Cisco Secure offerings and extra security from Duo

2023-04-27T18:00:00
trendmicroblog
blog

Update Now: PaperCut Vulnerability CVE-2023-27350 Under Active Exploitation

2023-04-26T00:00:00
avleonov
blog

Security News: Exchange ProxyShell, Zoom RCE, Citrix Canceled PT Acknowledgments, Cisco No Patch Router RCEs

2021-08-31T23:16:51
avleonov
blog

Vulnerability Management news and publications #2

2022-08-14T11:30:44
exploitdb
exploit

PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)

2023-05-23T00:00:00
exploitdb
exploit

PaperCut NG/MG 22.0.4 - Authentication Bypass

2023-04-25T00:00:00
kaspersky
info

KLA12224 Multiple vulnerabilities in Microsoft Exchange Server

2021-07-13T00:00:00
mskb
microsoft

Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: April 13, 2021 (KB5001779)

2021-07-13T07:00:00