cve-2021-40444

cve-2021-40444 「A Letter Before Court 4.docx」という悪意のあるファイルをリバースエンジニアリングし、cve-2021-40444 を悪用する 悪意のある Word ファイルおよび cab ファイルを含むファイルは、any.run からダウンロードできます: https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ 注意！ 元の悪意のあるコード内のドメイン名は、悪意のあるコードの実行ミスを防ぐため 127.0.0.1:8000 に置き換えられています 。 独自の...

ICT287_CVE-2022-30190_Exploit

ICT287CVE-2022-30190Exploit CVE-2022-30190 익스플로잇 및 대응 전략에 관한 프로젝트 📌 개요 이 저장소는 ICT287 과정의 최종 프로젝트로, CVE-2022-30190"Follina" 취약점을 탐구합니다. 프로젝트는 다음을 포함합니다: 익스플로잇의 상세 분석 단계별 실행 과정 대응 전략 🔥 익스플로잇 데모 공격자 시스템: Kali Linux 2024.1 피해자 시스템: Windows 10 Pro 버전 1809 익스플로잇 방법: MSDT를 통해 원격 코드를 실행하는 악성 Word 문서...

Exploit for CVE-2022-30190

ICT287CVE-2022-30190Exploit Project on CVE-2022-30190 exploi...

Countering Follina Attack (CVE- 2022-30190) with Trellix Network Security Platform’s Advanced Detection Features

Countering Follina Attack CVE- 2022-30190 with Trellix Network Security Platform’s Advanced Detection Features By Trellix · July 19, 2022 This blog was also written by Chintan Shah Executive summary During the end of May 2022, independent security researcher reported a vulnerability assigned...

Lazarus Targets Defense Companies with ThreatNeedle Malware

The prolific North Korean APT known as Lazarus is behind a spear-phishing campaign aimed at stealing critical data from defense companies by leveraging an advanced malware called ThreatNeedle, new research has revealed. The elaborate and ongoing cyberespionage campaign used emails with COVID-19...

Threat Roundup for October 19 to October 26

Today, Talos is is publishing a glimpse into the most prevalent threats we've observed between Oct. 19 and Oct. 26. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Smoking Guns - Smoke Loader learned new tricks

This post is authored by Ben Baker and Holger Unterbrink Overview Cisco Talos has been tracking a new version of Smoke Loader — a malicious application that can be used to load other malware — for the past several months following an alert from Cisco Advanced Malware Protection’s AMP Exploit...

Threat Analysis: Word Documents with Embedded Macros Leveraging Emotet Trojan

Many customers have recently asked how Carbon Black's solutions detect macros and droppers specifically referencing Emotet dropper files. Customers often say that macros and droppers are an ongoing problem in their environments. They are also seen day-to-day by most practitioners. The analysis...

Latest Tax Scams Include Phishing Lures, Malware

Microsoft warned Monday this year’s crop of tax scams are using social engineering attacks based on fear to spread Zdowbot and Omaneat banking Trojans and collect personal info via spoofed tax sites linked to from phishing campaigns. The warning comes with less than a month before the April 18 ta...

NetTraveler Attackers Using PRISM Program as Bait

Never let it be said that attackers don’t keep up with the news. The crew behind the NetTraveler cyberespionage attacks is now using the news about the NSA’s PRISM surveillance program as bait in a new spear-phishing campaign. Security researcher Brandon Dixon of 9bplus came across a malicious...

Adobe Issues Emergency Fix For Flash Player Vulnerabilities

Adobe on Monday issued two emergency fixes for critical security vulnerabilities in its Flash Player product. The vulnerabilities, if left unpatched, could allow an attacker to take control of a system running a vulnerable version of Flash Player. Adobe on Monday issued two emergency fixes for...

Attackers Target CVE-2012-0754 Adobe Flash Bug

An Adobe Flash vulnerability fixed last month is being used in targeted attacks right now, with attackers attempting to persuade victims to open a malicious Word document that contains the payload for the Flash bug. The vulnerability has been patched for nearly a month, but history has shown that...

PT-2010-4740 · Microsoft · Internet Explorer +1

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 7 through 8 Description: A remote code execution issue exists due to the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted when a document in an HTML form...