cve-2021-40444

cve-2021-40444 逆向分析利用 cve-2021-40444 的恶意文件 "A Letter Before Court 4.docx" 文件（包括恶意 Word 文档和 cab 文件）可在 any.run 下载：https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ 注意！ 原始恶意代码中的域名已替换为 127.0.0.1:8000 ，以避免执行恶意代码时发生意外。 因此，如果你想提供自己的 championship.inf 文件（实际上是一个 PE 文件），只需使用： python3 -m...

ICT287_CVE-2022-30190_Exploit

ICT287CVE-2022-30190Exploit 关于 CVE-2022-30190 漏洞利用与缓解策略的项目 📌 关于 此仓库包含我的 ICT287 期末项目，其中我探索了 CVE-2022-30190（“Follina”）漏洞。项目涵盖： 漏洞利用的详细分析 分步执行过程 缓解策略 🔥 利用演示 攻击机：Kali Linux 2024.1 受害机：Windows 10 Pro（版本 1809） 利用方法：通过 MSDT 执行远程代码的恶意 Word 文档 Microsoft Office Pro Plus 2019 16.0.10325.20118 🛡️ 缓解措施 禁用 MSDT...

Exploit for CVE-2022-30190

ICT287CVE-2022-30190Exploit Project on CVE-2022-30190 exploi...

Countering Follina Attack (CVE- 2022-30190) with Trellix Network Security Platform’s Advanced Detection Features

Countering Follina Attack CVE- 2022-30190 with Trellix Network Security Platform’s Advanced Detection Features By Trellix · July 19, 2022 This blog was also written by Chintan Shah Executive summary During the end of May 2022, independent security researcher reported a vulnerability assigned...

Lazarus Targets Defense Companies with ThreatNeedle Malware

The prolific North Korean APT known as Lazarus is behind a spear-phishing campaign aimed at stealing critical data from defense companies by leveraging an advanced malware called ThreatNeedle, new research has revealed. The elaborate and ongoing cyberespionage campaign used emails with COVID-19...

Threat Roundup for October 19 to October 26

Today, Talos is is publishing a glimpse into the most prevalent threats we've observed between Oct. 19 and Oct. 26. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Smoking Guns - Smoke Loader learned new tricks

This post is authored by Ben Baker and Holger Unterbrink Overview Cisco Talos has been tracking a new version of Smoke Loader — a malicious application that can be used to load other malware — for the past several months following an alert from Cisco Advanced Malware Protection’s AMP Exploit...

Threat Analysis: Word Documents with Embedded Macros Leveraging Emotet Trojan

Many customers have recently asked how Carbon Black's solutions detect macros and droppers specifically referencing Emotet dropper files. Customers often say that macros and droppers are an ongoing problem in their environments. They are also seen day-to-day by most practitioners. The analysis...

Latest Tax Scams Include Phishing Lures, Malware

Microsoft warned Monday this year’s crop of tax scams are using social engineering attacks based on fear to spread Zdowbot and Omaneat banking Trojans and collect personal info via spoofed tax sites linked to from phishing campaigns. The warning comes with less than a month before the April 18 ta...

NetTraveler Attackers Using PRISM Program as Bait

Never let it be said that attackers don’t keep up with the news. The crew behind the NetTraveler cyberespionage attacks is now using the news about the NSA’s PRISM surveillance program as bait in a new spear-phishing campaign. Security researcher Brandon Dixon of 9bplus came across a malicious...

Adobe Issues Emergency Fix For Flash Player Vulnerabilities

Adobe on Monday issued two emergency fixes for critical security vulnerabilities in its Flash Player product. The vulnerabilities, if left unpatched, could allow an attacker to take control of a system running a vulnerable version of Flash Player. Adobe on Monday issued two emergency fixes for...

Attackers Target CVE-2012-0754 Adobe Flash Bug

An Adobe Flash vulnerability fixed last month is being used in targeted attacks right now, with attackers attempting to persuade victims to open a malicious Word document that contains the payload for the Flash bug. The vulnerability has been patched for nearly a month, but history has shown that...

PT-2010-4740 · Microsoft · Internet Explorer +1

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 7 through 8 Description: A remote code execution issue exists due to the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted when a document in an HTML form...