logo
DATABASE RESOURCES PRICING ABOUT US

IT threat evolution Q1 2021. Non-mobile statistics

2021-05-31T10:00:05

Description

![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2019/05/22101624/malware_SL_pic3-990x400.jpg) _These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data._ ## Quarterly figures According to Kaspersky Security Network, in Q1 2021: * Kaspersky solutions blocked 2,023,556,082 attacks launched from online resources across the globe. * 613,968,631 unique URLs were recognized as malicious by Web Anti-Virus components. * Attempts to run malware designed to steal money via online access to bank accounts were stopped on the computers of 118,099 users. * Ransomware attacks were defeated on the computers of 91,841 unique users. * Our File Anti-Virus detected 77,415,192 unique malicious and potentially unwanted objects. ## Financial threats ### Financial threat statistics At the end of last year, the number of users attacked by malware designed to steal money from bank accounts gradually decreased, a trend that continued in Q1 2021. This quarter, in total, Kaspersky solutions blocked the malware of such type on the computers of 118,099 unique users. _Number of unique users attacked by financial malware, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110545/01-en-malware-report-q1-2021-pc.png>))_ **Attack geography** _To evaluate and compare the risk of being infected by banking Trojans and ATM/POS malware worldwide, for each country we calculated the share of users of Kaspersky products who faced this threat during the reporting period as a percentage of all users of our products in that country._ _Geography of financial malware attacks, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110629/02-en-malware-report-q1-2021-pc.png>))_ **Top 10 countries by share of attacked users** | **Country*** | **%**** ---|---|--- 1 | Turkmenistan | 6.3 2 | Tajikistan | 5.3 3 | Afghanistan | 4.8 4 | Uzbekistan | 4.6 5 | Paraguay | 3.2 6 | Yemen | 2.1 7 | Costa Rica | 2.0 8 | Sudan | 2.0 9 | Syria | 1.5 10 | Venezuela | 1.4 _* Excluded are countries with relatively few Kaspersky product users (under 10,000). ** Unique users whose computers were targeted by financial malware as a percentage of all unique users of Kaspersky products in the country._ As before, the most widespread family of bankers in Q1 was ZeuS/Zbot (30.8%). Second place was taken by the CliptoShuffler family (15.9%), and third by Trickster (7.5%). All in all, more than half of all attacked users encountered these families. The notorious banking Trojan Emotet (7.4%) was deprived of its infrastructure this quarter as a result of a [joint operation](<https://www.europol.europa.eu/newsroom/news/world's-most-dangerous-malware-emotet-disrupted-through-global-action>) by Europol, the FBI and other law enforcement agencies, and its share predictably collapsed. **Top 10 banking malware families** | Name | Verdicts | %* ---|---|---|--- 1 | Zbot | Trojan.Win32.Zbot | 30.8 2 | CliptoShuffler | Trojan-Banker.Win32.CliptoShuffler | 15.9 3 | Trickster | Trojan.Win32.Trickster | 7.5 4 | Emotet | Backdoor.Win32.Emotet | 7.4 5 | RTM | Trojan-Banker.Win32.RTM | 6.6 6 | Nimnul | Virus.Win32.Nimnul | 5.1 7 | Nymaim | Trojan.Win32.Nymaim | 4.7 8 | SpyEye | Trojan-Spy.Win32.SpyEye | 3.8 9 | Danabot | Trojan-Banker.Win32.Danabot | 2.9 10 | Neurevt | Trojan.Win32.Neurevt | 2.2 _** Unique users who encountered this malware family as a percentage of all users attacked by financial malware._ ## Ransomware programs ### Quarterly trends and highlights **New additions to the ransomware arsenal** Last year, the SunCrypt and RagnarLocker ransomware groups adopted new scare tactics. If the victim organization is slow to pay up, even though its files are encrypted and some of its confidential data has been stolen, the attackers additionally threaten to carry out a DDoS attack. In Q1 2021, these two groups were joined by a third, Avaddon. Besides publishing stolen data, the ransomware operators said on their website that the victim would be subjected to a DDoS attack until it reached out to them. REvil (aka Sodinokibi) is another group looking to increase its extortion leverage. In addition to DDoS attacks, it has [added](<https://twitter.com/3xp0rtblog/status/1368149692383719426>) spam and calls to clients and partners of the victim company to its toolbox. **Attacks on vulnerable Exchange servers** [Serious vulnerabilities were recently discovered](<https://securelist.com/zero-day-vulnerabilities-in-microsoft-exchange-server/101096/>) in the Microsoft Exchange mail server, allowing [remote code execution](<https://encyclopedia.kaspersky.com/glossary/remote-code-execution-rce/?utm_source=securelist&utm_medium=blog&utm_campaign=termin-explanation>). Ransomware distributors wasted no time in exploiting these vulnerabilities; to date, this infection vector was seen being used by the Black Kingdom and DearCry families. **Publication of keys** The developers of the Fonix (aka XINOF) ransomware ceased distributing their Trojan and posted the master key online for decrypting affected files. We took this key and created a [decryptor](<https://www.kaspersky.com/blog/fonix-decryptor/38646/>) that anyone can use. The developers of another strain of ransomware, Ziggy, not only [published](<https://www.bleepingcomputer.com/news/security/ziggy-ransomware-shuts-down-and-releases-victims-decryption-keys/>) the keys for all victims, but also announced their [intention](<https://www.bleepingcomputer.com/news/security/ransomware-admin-is-refunding-victims-their-ransom-payments/>) to return the money to everyone who paid up. **Law enforcement successes** Law enforcement agencies under the US Department of Justice [seized](<https://www.justice.gov/opa/pr/department-justice-launches-global-action-against-netwalker-ransomware>) dark web resources used by NetWalker (aka Mailto) ransomware affiliates, and also brought charges against one of the alleged actors. French and Ukrainian law enforcers worked together to trace payments made through the Bitcoin ecosystem to Egregor ransomware distributors. The joint investigation resulted in the [arrest](<https://www.bleepingcomputer.com/news/security/egregor-ransomware-affiliates-arrested-by-ukrainian-french-police/>) of several alleged members of the Egregor gang. In South Korea, a suspect in the GandCrab ransomware operation was [arrested](<https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-affiliate-arrested-for-phishing-attacks/>) (this family ceased active distribution back in 2019). ### Number of new modifications In Q1 2021, we detected seven new ransomware families and 4,354 new modifications of this malware type. _Number of new ransomware modifications, Q1 2020 – Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110702/03-en-ru-es-malware-report-q1-2021-pc.png>))_ ### Number of users attacked by ransomware Trojans In Q1 2021, Kaspersky products and technologies protected 91,841 users from ransomware attacks. _Number of unique users attacked by ransomware Trojans, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110733/04-en-malware-report-q1-2021-pc.png>))_ ### Attack geography _Geography of attacks by ransomware Trojans, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110802/05-en-malware-report-q1-2021-pc.png>))_ **Top 10 countries attacked by ransomware Trojans** | **Country*** | **%**** ---|---|--- 1 | Bangladesh | 2.31% 2 | Ethiopia | 0.62% 3 | Greece | 0.49% 4 | Pakistan | 0.49% 5 | China | 0.48% 6 | Tunisia | 0.44% 7 | Afghanistan | 0.42% 8 | Indonesia | 0.38% 9 | Taiwan, Province of China | 0.37% 10 | Egypt | 0.28% _* Excluded are countries with relatively few Kaspersky users (under 50,000). ** Unique users attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country._ ### Top 10 most common families of ransomware Trojans | **Name** | **Verdicts** | **%*** ---|---|---|--- 1 | WannaCry | Trojan-Ransom.Win32.Wanna | 19.37% 2 | (generic verdict) | Trojan-Ransom.Win32.Gen | 12.01% 3 | (generic verdict) | Trojan-Ransom.Win32.Phny | 9.31% 4 | (generic verdict) | Trojan-Ransom.Win32.Encoder | 8.45% 5 | (generic verdict) | Trojan-Ransom.Win32.Agent | 7.36% 6 | PolyRansom/VirLock | Trojan-Ransom.Win32.PolyRansom Virus.Win32.PolyRansom | 3.78% 7 | (generic verdict) | Trojan-Ransom.Win32.Crypren | 2.93% 8 | Stop | Trojan-Ransom.Win32.Stop | 2.79% 9 | (generic verdict) | Trojan-Ransom.Win32.Cryptor | 2.17% 10 | REvil/Sodinokibi | Trojan-Ransom.Win32.Sodin | 1.85% _* Unique Kaspersky users attacked by this family of ransomware Trojans as a percentage of all users attacked by such malware._ ## Miners ### Number of new modifications In Q1 2021, Kaspersky solutions detected 23,894 new modifications of miners. And though January and February passed off relatively calmly, March saw a sharp rise in the number of new modifications — more than fourfold compared to February. _Number of new miner modifications, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24110831/06-en-malware-report-q1-2021-pc.png>))_ ### Number of users attacked by miners In Q1, we detected attacks using miners on the computers of 432,171 unique users of Kaspersky products worldwide. Although this figure has been rising for three months, it is premature to talk about a reversal of last year's trend, whereby the number of users attacked by miners actually fell. For now, we can tentatively assume that the growth in cryptocurrency prices, in particular bitcoin, has attracted the attention of cybercriminals and returned miners to their toolkit. _Number of unique users attacked by miners, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111053/07-en-malware-report-q1-2021-pc.png>))_ ### Attack geography _Geography of miner attacks, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111128/08-en-malware-report-q1-2021-pc.png>))_ **Top 10 countries attacked by miners** | **Country*** | **%**** ---|---|--- 1 | Afghanistan | 4.65 2 | Ethiopia | 3.00 3 | Rwanda | 2.37 4 | Uzbekistan | 2.23 5 | Kazakhstan | 1.81 6 | Sri Lanka | 1.78 7 | Ukraine | 1.59 8 | Vietnam | 1.48 9 | Mozambique | 1.46 10 | Tanzania | 1.45 _* Excluded are countries with relatively few users of Kaspersky products (under 50,000). ** Unique users attacked by miners as a percentage of all unique users of Kaspersky products in the country._ ## Vulnerable applications used by cybercriminals during cyber attacks In Q1 2021, we noted a drop in the share of exploits for vulnerabilities in the Microsoft Office suite, but they still lead the pack with 59%. The most common vulnerability in the suite remains [CVE-2017-11882](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882>), a stack buffer overflow that occurs when processing objects in the Equation Editor component. Exploits for [CVE-2015-2523](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2523>) — use-after-free vulnerabilities in Microsoft Excel — and [CVE-2018-0802](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802>), which we've often written about, were also in demand. Note the age of these vulnerabilities — even the latest of them was discovered almost three years ago. So, once again, we remind you of the importance of regular updates. The first quarter was rich not only in known exploits, but also new zero-day vulnerabilities. In particular, the interest of both [infosec experts](<https://securelist.com/zero-day-vulnerabilities-in-microsoft-exchange-server/101096/>) and cybercriminals was piqued by vulnerabilities in the popular Microsoft Exchange Server: * [CVE-2021-26855](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26855>)— a service-side request forgery vulnerability that allows remote code execution (RCE) * [CVE-2021-26857](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26857>)— an insecure deserialization vulnerability in the Unified Messaging service that can lead to code execution on the server * [CVE-2021-26858](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26858>)— a post-authorization arbitrary file write vulnerability in Microsoft Exchange, which could also lead to remote code execution * [CVE-2021-27065](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-27065>)— as in the case of [CVE-2021-26858](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26858>), allows an authorized Microsoft Exchange user to write data to an arbitrary file in the system Found [in the wild](<https://encyclopedia.kaspersky.com/glossary/exploitation-in-the-wild-itw/?utm_source=securelist&utm_medium=blog&utm_campaign=termin-explanation>), these vulnerabilities were used by APT groups, including as a springboard for ransomware distribution. During the quarter, vulnerabilities were also identified in Windows itself. In particular, the [CVE-2021-1732](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-1732>) vulnerability allowing privilege escalation was discovered in the Win32k subsystem. Two other vulnerabilities, [CVE-2021-1647](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-1647>) and [CVE-2021-24092](<https://nvd.nist.gov/vuln/detail/CVE-2021-24092>), were found in the Microsoft Defender antivirus engine, allowing elevation of user privileges in the system and execution of potentially dangerous code. _Distribution of exploits used by cybercriminals, by type of attacked application, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111159/09-en-malware-report-q1-2021-pc.png>))_ The second most popular were exploits for browser vulnerabilities (26.12%); their share in Q1 grew by more than 12 p.p. Here, too, there was no doing without newcomers: for example, the Internet Explorer script engine was found to contain the [CVE-2021-26411](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-26411>) vulnerability, which can lead to remote code execution on behalf of the current user through manipulations that corrupt the heap memory. This vulnerability was exploited by the [Lazarus](<https://securelist.ru/tag/lazarus/>) group to download malicious code and infect the system. Several vulnerabilities were discovered in Google Chrome: * [CVE-2021-21148](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21148>)— heap buffer overflow in the V8 script engine, leading to remote code execution * [CVE-2021-21166](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21166>)— overflow and unsafe reuse of an object in memory when processing audio data, also enabling remote code execution * [CVE-2021-21139](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21139>)— bypassing security restrictions when using an iframe. Other interesting findings include a critical vulnerability in VMware vCenter Server, [CVE-2021-21972](<https://nvd.nist.gov/vuln/detail/CVE-2021-21972>), which allows remote code execution without any rights. Critical vulnerabilities in the popular SolarWinds Orion Platform — [CVE-2021-25274](<https://nvd.nist.gov/vuln/detail/CVE-2021-25274>), [CVE-2021-25275](<https://nvd.nist.gov/vuln/detail/CVE-2021-25275>) and [CVE-2021-25276](<https://nvd.nist.gov/vuln/detail/CVE-2021-25276>) — caused a major splash in the infosec environment. They gave attackers the ability to infect computers running this software, usually machines inside corporate networks and government institutions. Lastly, the [CVE-2021-21017](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21017>) vulnerability, discovered in Adobe Reader, caused a heap buffer overflow by means of a specially crafted document, giving an attacker the ability to execute code. Analysis of network threats in Q1 2021 continued to show ongoing attempts to attack servers with a view to brute-force passwords for network services such as Microsoft SQL Server, RDP and SMB. Attacks using the popular EternalBlue, EternalRomance and other similar exploits were widespread. Among the most notable new vulnerabilities in this period were bugs in the Windows networking stack code related to handling the IPv4/IPv6 protocols: [CVE-2021-24074](<https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-24074>), [CVE-2021-24086](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24086>) and [CVE-2021-24094](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24094>). ## Attacks on macOS Q1 2021 was also rich in macOS-related news. Center-stage were cybercriminals who took pains to modify their [malware for the newly released MacBooks with M1 processors](<https://securelist.com/malware-for-the-new-apple-silicon-platform/101137/>). Updated adware for the new Macs also immediately appeared, in particular the [Pirrit family](<https://objective-see.com/blog/blog_0x62.html>) (whose members placed high in our Top 20 threats for macOS). In addition, we detected an interesting adware program written in the Rust language, and assigned it the verdict [AdWare.OSX.Convuster.a](<https://securelist.ru/convuster-macos-adware-in-rust/100859/>). **Top 20 threats for macOS** | **Verdict** | **%*** ---|---|--- 1 | AdWare.OSX.Pirrit.ac | 18.01 2 | AdWare.OSX.Pirrit.j | 12.69 3 | AdWare.OSX.Pirrit.o | 8.42 4 | AdWare.OSX.Bnodlero.at | 8.36 5 | Monitor.OSX.HistGrabber.b | 8.06 6 | AdWare.OSX.Pirrit.gen | 7.95 7 | Trojan-Downloader.OSX.Shlayer.a | 7.90 8 | AdWare.OSX.Cimpli.m | 6.17 9 | AdWare.OSX.Pirrit.aa | 6.05 10 | Backdoor.OSX.Agent.z | 5.27 11 | Trojan-Downloader.OSX.Agent.h | 5.09 12 | AdWare.OSX.Bnodlero.bg | 4.60 13 | AdWare.OSX.Ketin.h | 4.02 14 | AdWare.OSX.Bnodlero.bc | 3.87 15 | AdWare.OSX.Bnodlero.t | 3.84 16 | AdWare.OSX.Cimpli.l | 3.75 17 | Trojan-Downloader.OSX.Lador.a | 3.61 18 | AdWare.OSX.Cimpli.k | 3.48 19 | AdWare.OSX.Ketin.m | 2.98 20 | AdWare.OSX.Bnodlero.ay | 2.94 _* Unique users who encountered this malware as a percentage of all users of Kaspersky security solutions for macOS who were attacked._ Traditionally, most of the Top 20 threats for macOS are adware programs: 15 in Q1. In the list of malicious programs, Trojan-Downloader.OSX.Shlayer.a (7.90%) maintained its popularity. Incidentally, this Trojan's task is to download adware from the Pirrit and Bnodlero families. But we also saw the reverse, when a member of the AdWare.OSX.Pirrit family dropped Backdoor.OSX.Agent.z into the system. ### Threat geography _Geography of threats for macOS, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111228/10-en-malware-report-q1-2021-pc.png>))_ **Top 10 countries by share of attacked users** | **Country*** | **%**** ---|---|--- 1 | France | 4.62 2 | Spain | 4.43 3 | Italy | 4.36 4 | India | 4.11 5 | Canada | 3.59 6 | Mexico | 3.55 7 | Russia | 3.21 8 | Brazil | 3.18 9 | Great Britain | 2.96 10 | USA | 2.94 _* Excluded from the rating are countries with relatively few users of Kaspersky security solutions for macOS (under 10,000) ** Unique users attacked as a percentage of all users of Kaspersky security solutions for macOS in the country._ In Q1 2021, Europe accounted for the Top 3 countries by share of attacked macOS users: France (4.62%), Spain (4.43%) and Italy (4.36%). The most common threats in all three were adware apps from the Pirrit family. ## IoT attacks ### IoT threat statistics In Q1 2021, most of the devices that attacked Kaspersky traps did so using the Telnet protocol. A third of the attacking devices attempted to [brute-force](<https://encyclopedia.kaspersky.com/glossary/brute-force/?utm_source=securelist&utm_medium=blog&utm_campaign=termin-explanation>) our SSH traps. Telnet | 69.48% ---|--- SSH | 30.52% _Distribution of attacked services by number of unique IP addresses of devices that carried out attacks, Q1 2021_ The statistics for cybercriminal working sessions with Kaspersky honeypots show similar Telnet dominance. Telnet | 77.81% ---|--- SSH | 22.19% _Distribution of cybercriminal working sessions with Kaspersky traps, Q1 2021_ _Geography of IP addresses of devices from which attempts were made to attack Kaspersky Telnet traps, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111259/11-en-malware-report-q1-2021-pc.png>))_ **Top 10 countries by location of devices from which attacks were carried out on Kaspersky Telnet traps** ** ** | **Country** | **%*** ---|---|--- 1 | China | 33.40 2 | India | 13.65 3 | USA | 11.56 4 | Russia | 4.96 5 | Montenegro | 4.20 6 | Brazil | 4.19 7 | Taiwan, Province of China | 2.32 8 | Iran | 1.85 9 | Egypt | 1.84 10 | Vietnam | 1.73 _* Devices from which attacks were carried out in the given country as a percentage of the total number of devices in that country._ ### SSH-based attacks _Geography of IP addresses of devices from which attempts were made to attack Kaspersky SSH traps, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111335/12-en-malware-report-q1-2021-pc.png>))_ **Top 10 countries by location of devices from which attacks were made on Kaspersky SSH traps** ** ** | **Country** | **%*** ---|---|--- 1 | USA | 24.09 2 | China | 19.89 3 | Hong Kong | 6.38 4 | South Korea | 4.37 5 | Germany | 4.06 6 | Brazil | 3.74 7 | Russia | 3.05 8 | Taiwan, Province of China | 2.80 9 | France | 2.59 10 | India | 2.36 _* Devices from which attacks were carried out in the given country as a percentage of the total number of devices in that country._ ### Threats loaded into traps | Verdict | %* ---|---|--- 1 | Backdoor.Linux.Mirai.b | 50.50% 2 | Trojan-Downloader.Linux.NyaDrop.b | 9.26% 3 | Backdoor.Linux.Gafgyt.a | 3.01% 4 | HEUR:Trojan-Downloader.Shell.Agent.bc | 2.72% 5 | Backdoor.Linux.Mirai.a | 2.72% 6 | Backdoor.Linux.Mirai.ba | 2.67% 7 | Backdoor.Linux.Agent.bc | 2.37% 8 | Trojan-Downloader.Shell.Agent.p | 1.37% 9 | Backdoor.Linux.Gafgyt.bj | 0.78% 10 | Trojan-Downloader.Linux.Mirai.d | 0.66% _* Share of malware type in the total number of malicious programs downloaded to IoT devices following a successful attack._ ## Attacks via web resources _The statistics in this section are based on Web Anti-Virus, which protects users when malicious objects are downloaded from malicious/infected web pages. Cybercriminals create such sites on purpose; web resources with user-created content (for example, forums), as well as hacked legitimate resources, can be infected._ ### Countries that are sources of web-based attacks: Top 10 _The following statistics show the distribution by country of the sources of Internet attacks blocked by Kaspersky products on user computers (web pages with redirects to exploits, sites containing exploits and other malicious programs, botnet C&C centers, etc.). Any unique host could be the source of one or more web-based attacks._ _To determine the geographical source of web-based attacks, domain names are matched against their actual domain IP addresses, and then the geographical location of a specific IP address (GEOIP) is established._ In Q1 2021, Kaspersky solutions blocked 2,023,556,082 attacks launched from online resources located across the globe. 613,968,631 unique URLs were recognized as malicious by Web Anti-Virus. _Distribution of web attack sources by country, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111405/13-en-malware-report-q1-2021-pc.png>))_ ### Countries where users faced the greatest risk of online infection To assess the risk of online infection faced by users in different countries, for each country we calculated the percentage of Kaspersky users on whose computers Web Anti-Virus was triggered during the quarter. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries. This rating only includes attacks by malicious objects that fall under the **Malware class**; it does not include Web Anti-Virus detections of potentially dangerous or unwanted programs such as RiskTool or adware. | Country* | % of attacked users** ---|---|--- 1 | Belarus | 15.81 2 | Ukraine | 13.60 3 | Moldova | 13.16 4 | Kyrgyzstan | 11.78 5 | Latvia | 11.38 6 | Algeria | 11.16 7 | Russia | 11.11 8 | Mauritania | 11.08 9 | Kazakhstan | 10.62 10 | Tajikistan | 10.60 11 | Uzbekistan | 10.39 12 | Estonia | 10.20 13 | Armenia | 9.44 14 | Mongolia | 9.36 15 | France | 9.35 16 | Greece | 9.04 17 | Azerbaijan | 8.57 18 | Madagascar | 8.56 19 | Morocco | 8.55 20 | Lithuania | 8.53 _* Excluded are countries with relatively few Kaspersky users (under 10,000). ** Unique users targeted by **Malware-class** attacks as a percentage of all unique users of Kaspersky products in the country._ _These statistics are based on detection verdicts by the Web Anti-Virus module that were received from users of Kaspersky products who consented to provide statistical data._ On average, 7.67% of Internet user computers worldwide experienced at least one **Malware-class** attack. _Geography of web-based malware attacks, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111435/14-en-malware-report-q1-2021-pc.png>))_ ## Local threats _In this section, we analyze statistical data obtained from the OAS and ODS modules in Kaspersky products. It takes into account malicious programs that were found directly on users' computers or removable media connected to them (flash drives, camera memory cards, phones, external hard drives), or which initially made their way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.)._ In Q1 2021, our File Anti-Virus detected **77,415,192** malicious and potentially unwanted objects. ### Countries where users faced the highest risk of local infection For each country, we calculated the percentage of Kaspersky product users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in different countries. Note that this rating only includes attacks by malicious programs that fall under the **Malware class**; it does not include File Anti-Virus triggers in response to potentially dangerous or unwanted programs, such as RiskTool or adware. | Country* | % of attacked users** ---|---|--- 1 | Afghanistan | 47.71 2 | Turkmenistan | 43.39 3 | Ethiopia | 41.03 4 | Tajikistan | 38.96 5 | Bangladesh | 36.21 6 | Algeria | 35.49 7 | Myanmar | 35.16 8 | Uzbekistan | 34.95 9 | South Sudan | 34.17 10 | Benin | 34.08 11 | China | 33.34 12 | Iraq | 33.14 13 | Laos | 32.84 14 | Burkina Faso | 32.61 15 | Mali | 32.42 16 | Guinea | 32.40 17 | Yemen | 32.32 18 | Mauritania | 32.22 19 | Burundi | 31.68 20 | Sudan | 31.61 _* Excluded are countries with relatively few Kaspersky users (under 10,000)._ _** Unique users on whose computers **Malware-class** local threats were blocked, as a percentage of all unique users of Kaspersky products in the country._ _Geography of local infection attempts, Q1 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/05/24111505/15-en-malware-report-q1-2021-pc.png>))_ Overall, 15.05% of user computers globally faced at least one **Malware-class** local threat during Q1.


Related


securelist
blog

Kaspersky Security Bulletin 2020-2021. EU statistics

2021-05-26T10:00:32
securelist
blog

Zero-day vulnerabilities in Microsoft Exchange Server

2021-03-04T17:20:57
securelist
blog

Black Kingdom ransomware

2021-06-17T10:00:41
securelist
blog

IT threat evolution Q1 2021

2021-05-31T10:00:37
securelist
blog

Spam and phishing in Q3 2021

2021-11-01T12:00:26
securelist
blog

Recent Cloud Atlas activity

2019-08-12T10:00:58
securelist
blog

Spam and phishing in 2022

2023-02-16T08:00:07
securelist
blog

Spam and phishing in Q1 2019

2019-05-15T10:00:23
securelist
blog

Spam and phishing in 2021

2022-02-09T10:00:28
securelist
blog

Cycldek: Bridging the (air) gap

2020-06-03T10:00:32
securelist
blog

IT threat evolution Q2 2021

2021-08-12T10:00:37
securelist
blog

IT threat evolution Q3 2019

2019-11-29T10:00:12
thn
info

3 New Severe Security Vulnerabilities Found In SolarWinds Software

2021-02-03T11:31:00
thn
info

URGENT — 4 Actively Exploited 0-Day Flaws Found in Microsoft Exchange

2021-03-03T07:28:00
thn
info

Microsoft Exchange Cyber Attack — What Do We Know So Far?

2021-03-08T10:15:00
thn
info

New Chrome 0-day Bug Under Active Attacks – Update Your Browser ASAP!

2021-03-03T06:03:00
thn
info

Prometei Botnet Exploiting Unpatched Microsoft Exchange Servers

2021-04-23T07:42:00
thn
info

Microsoft Issues Security Patches for 89 Flaws — IE 0-Day Under Active Attacks

2021-03-10T05:37:00
thn
info

Microsoft Issues Patches for In-the-Wild 0-day and 55 Others Windows Bugs

2021-02-10T04:44:00
thn
info

Bitter APT Hackers Add Bangladesh to Their List of Targets in South Asia

2022-05-11T12:37:00
thn
info

Another Google Chrome 0-Day Bug Found Actively Exploited In-the-Wild

2021-03-13T03:16:00
thn
info

Another Critical RCE Flaw Discovered in SolarWinds Orion Platform

2021-03-26T05:07:00
thn
info

Hackers Actively Searching for Unpatched Microsoft Exchange Servers

2021-08-13T09:46:00
thn
info

New Chinese Malware Targeted Russia's Largest Nuclear Submarine Designer

2021-05-03T07:34:00
thn
info

New USBCulprit Espionage Tool Steals Data From Air-Gapped Computers

2020-06-04T08:31:00
thn
info

Hackers Exploit Microsoft Browser Bug to Deploy VBA Malware on Targeted PCs

2021-07-29T15:18:00
thn
info

New RIG Exploit Kit Campaign Infecting Victims' PCs with RedLine Stealer

2022-04-28T08:20:00
attackerkb
info

SolarWinds Orion Platform Unauthenticated RCE (CVE-2021-25274)

2021-02-03T00:00:00
attackerkb
info

Multiple Microsoft Exchange zero-day vulnerabilities - ProxyLogon Exploit Chain

2022-02-09T00:00:00
attackerkb
info

CVE-2021-24094

2021-02-25T00:00:00
attackerkb
info

CVE-2021-24074

2021-02-25T00:00:00
attackerkb
info

CVE-2021-26858

2021-03-03T00:00:00
attackerkb
info

CVE-2021-27065

2021-03-03T00:00:00
attackerkb
info

CVE-2021-26857

2021-03-03T00:00:00
attackerkb
info

CVE-2021-26855

2021-03-03T00:00:00
attackerkb
info

CVE-2021-21193

2021-03-16T00:00:00
attackerkb
info

CVE-2021-21017

2021-02-09T00:00:00
attackerkb
info

CVE-2018-0802

2018-01-10T00:00:00
attackerkb
info

CVE-2021-21148

2021-02-09T00:00:00
threatpost
info

SolarWinds Orion Bug Allows Easy Remote-Code Execution and Takeover

2021-02-03T11:00:21
threatpost
info

Microsoft Exchange 0-Day Attackers Spy on U.S. Targets

2021-03-03T15:30:52
threatpost
info

Microsoft Exchange Exploits Pave a Ransomware Path

2021-03-12T16:26:07
threatpost
info

Microsoft Exchange Servers Face APT Attack Tsunami

2021-03-11T18:01:16
threatpost
info

Attackers Target ProxyLogon Exploit to Install Cryptojacker

2021-04-15T12:19:13
threatpost
info

CISA Orders Fed Agencies to Patch Exchange Servers

2021-03-04T17:08:36
threatpost
info

Exchange Cyberattacks Escalate as Microsoft Rolls One-Click Fix

2021-03-16T16:56:26
threatpost
info

Microsoft Exchange Servers See ProxyLogon Patching Frenzy

2021-03-24T18:39:26
threatpost
info

Lemon Duck Cryptojacking Botnet Changes Up Tactics

2021-05-10T17:37:44
threatpost
info

Microsoft Exchange 'ProxyToken' Bug Allows Email Snooping

2021-08-30T17:31:06
threatpost
info

FBI Clears ProxyLogon Web Shells from Hundreds of Orgs

2021-04-14T17:31:13
threatpost
info

Microsoft Patch Tuesday Updates Fix 14 Critical Bugs

2021-03-09T22:12:56
threatpost
info

Prometei Botnet Could Fire Up APT-Style Attacks

2021-04-23T17:15:23
threatpost
info

Novel 'Victory' Backdoor Spotted in Chinese APT Campaign

2021-06-07T18:49:44
threatpost
info

PortDoor Espionage Malware Takes Aim at Russian Defense Sector

2021-04-30T19:32:34
threatpost
info

Despite Ringleader’s Arrest, Cobalt Group Still Active

2018-05-28T12:21:42
threatpost
info

Cobalt Group Pushes Revamped ThreadKit Malware

2018-12-11T18:40:00
threatpost
info

Safari Zero-Day Used in Malicious LinkedIn Campaign

2021-07-15T11:04:49
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-09T10:36:44
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-05T08:22:07
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-11T21:18:29
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-04-07T11:10:40
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-11-25T04:56:33
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-05-23T17:09:30
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-08T07:28:21
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-03T17:36:18
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-16T10:14:56
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-24T01:12:48
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-08T11:54:32
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-17T03:56:54
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-14T14:23:34
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-11T19:35:35
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-09T14:27:06
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-16T07:31:25
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-04-19T09:33:52
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-15T09:02:40
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-09T16:54:39
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-03-08T08:39:05
githubexploit
exploit

Exploit for Out-of-bounds Write in Adobe Acrobat

2021-02-26T14:18:13
githubexploit
exploit

Exploit for Out-of-bounds Write in Adobe Acrobat

2022-03-29T14:45:16
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2021-11-25T04:56:33
malwarebytes
blog

Patch now! Exchange servers attacked by Hafnium zero-days

2021-03-03T12:34:27
malwarebytes
blog

Big Patch Tuesday: Microsoft and Adobe fix in-the-wild exploits

2021-02-10T17:26:33
malwarebytes
blog

The top 5 most routinely exploited vulnerabilities of 2021

2022-04-29T16:28:20
malwarebytes
blog

Crimea “manifesto” deploys VBA Rat using double attack vectors

2021-07-29T15:00:00
malwarebytes
blog

Update now! Chrome patches zero-day that was exploited in the wild

2021-02-05T12:14:04
akamaiblog
blog

How Akamai Can Help You Fight the Latest Exploitation Attempts Against Microsoft Exchange

2021-03-15T22:30:00
akamaiblog
blog

Microsoft Exchange and Verkada Hacks: Isolate Your Apps and APIs from the Internet Cesspool

2021-03-15T22:15:00
akamaiblog
blog

Authentication: Lessons Learned from Microsoft Exchange and F5 BIG-IP Hacks

2021-03-24T14:00:00
krebs
blog

Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails

2021-03-02T21:19:17
krebs
blog

Microsoft Patch Tuesday, February 2021 Edition

2021-02-09T22:37:19
krebs
blog

Microsoft Patch Tuesday, March 2021 Edition

2021-03-10T01:42:39
carbonblack
blog

TAU Threat Advisory: Microsoft Exchange Servers Targeted with Four Zero-day Exploits

2021-03-08T21:05:13
msrc
blog

Guidance for responders: Investigating and remediating on-premises Exchange Server vulnerabilities

2021-03-16T07:00:00
msrc
blog

Guidance for responders: Investigating and remediating on-premises Exchange Server vulnerabilities

2021-03-16T18:44:28
msrc
blog

TCP/IP に影響を与える脆弱性情報に関する注意喚起

2021-02-11T08:00:00
msrc
blog

Multiple Security Updates Affecting TCP/IP:  CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086

2021-02-09T18:10:59
msrc
blog

Multiple Security Updates Affecting TCP/IP:  CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086

2021-02-09T08:00:00
hivepro
info

Have you patched the vulnerabilities in Microsoft Exchange Server?

2021-08-18T11:01:05
ics
info

Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization

2022-10-05T12:00:00
ics
info

Mitigate Microsoft Exchange Server Vulnerabilities

2021-07-19T12:00:00
cisa
info

Microsoft Releases Out-of-Band Security Updates for Exchange Server

2021-03-02T00:00:00
fireeye
info

Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities

2021-03-04T00:00:00
fireeye
info

Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities

2019-06-05T15:00:00
impervablog
blog

Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

2021-03-26T15:06:38
mssecure
blog

HAFNIUM targeting Exchange Servers with 0-day exploits

2021-03-02T21:07:53
mssecure
blog

Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021

2021-11-16T16:00:08
mssecure
blog

Profiling DEV-0270: PHOSPHORUS’ ransomware operations

2022-09-07T21:00:00
mssecure
blog

Analyzing attacks taking advantage of the Exchange Server vulnerabilities

2021-03-25T21:21:07
mssecure
blog

When coin miners evolve, Part 1: Exposing LemonDuck and LemonCat, modern mining malware infrastructure

2021-07-22T16:00:57
mssecure
blog

When coin miners evolve, Part 2: Hunting down LemonDuck and LemonCat attacks

2021-07-29T19:00:59
talosblog
blog

Threat Advisory: HAFNIUM and Microsoft Exchange zero-day

2021-03-08T10:18:43
mmpc
blog

HAFNIUM targeting Exchange Servers with 0-day exploits

2021-03-02T21:07:53
mmpc
blog

Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021

2021-11-16T16:00:08
mmpc
blog

Profiling DEV-0270: PHOSPHORUS’ ransomware operations

2022-09-07T21:00:00
mmpc
blog

Analyzing attacks taking advantage of the Exchange Server vulnerabilities

2021-03-25T21:21:07
mmpc
blog

When coin miners evolve, Part 1: Exposing LemonDuck and LemonCat, modern mining malware infrastructure

2021-07-22T16:00:57
mmpc
blog

When coin miners evolve, Part 2: Hunting down LemonDuck and LemonCat attacks

2021-07-29T19:00:59
qualysblog
blog

February 2021 Patch Tuesday – 56 Vulnerabilities, 11 Critical, Adobe

2021-02-09T20:22:38
qualysblog
blog

Microsoft Exchange Server Zero-Days (ProxyLogon) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR

2021-03-03T22:12:19
qualysblog
blog

CISA Alert: Top 15 Routinely Exploited Vulnerabilities

2022-05-06T12:19:24
mscve
microsoft

Windows TCP/IP Remote Code Execution Vulnerability

2021-02-09T08:00:00
mscve
microsoft

Windows TCP/IP Remote Code Execution Vulnerability

2021-02-09T08:00:00
mscve
microsoft

Windows TCP/IP Denial of Service Vulnerability

2021-02-09T08:00:00
mscve
microsoft

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-03-02T08:00:00
mscve
microsoft

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-03-02T08:00:00
mscve
microsoft

Microsoft Exchange Server Remote Code Execution Vulnerability

2021-03-02T08:00:00
mscve
microsoft

Microsoft Defender Elevation of Privilege Vulnerability

2021-02-09T08:00:00
mscve
microsoft

Chromium CVE-2021-21139: Inappropriate implementation in iframe sandbox

2021-01-21T08:00:00
mscve
microsoft

Internet Explorer Memory Corruption Vulnerability

2021-03-09T08:00:00
mscve
microsoft

Chromium CVE-2021-21148: Heap buffer overflow in V8

2021-02-05T08:00:00
trellix
info

Researchers Follow the Breadcrumbs: The Latest Vulnerabilities in Windows' Network Stack | McAfee Blogs

2021-02-09T00:00:00
rapid7blog
info

Rapid7’s InsightIDR Enables Detection And Response to Microsoft Exchange Zero-Day

2021-03-03T00:41:04
rapid7blog
info

Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange

2021-03-23T14:04:36
rapid7blog
info

SonicWall SNWLID-2021-0001 Zero-Day and SolarWinds’ 2021 CVE Trifecta: What You Need to Know

2021-02-03T23:33:40
rapid7blog
info

Mass Exploitation of Exchange Server Zero-Day CVEs: What You Need to Know

2021-03-03T19:23:42
rapid7blog
info

Metasploit Wrap-Up

2021-03-26T17:36:13
rapid7blog
info

Indiscriminate Exploitation of Microsoft Exchange Servers (CVE-2021-24085)

2021-03-02T19:53:28
nessus
scanner

Potential exposure to Hafnium Microsoft Exchange targeting

2021-03-08T00:00:00
nessus
scanner

SolarWinds Orion Platform < 2020.2.4 Multiple Vulnerabilities

2021-02-09T00:00:00
nessus
scanner

Security Updates for Microsoft Exchange Server (March 2021)

2021-03-03T00:00:00
nessus
scanner

SolarWinds Orion Platform < 2019.4.2 Remote Code Execution

2021-02-09T00:00:00
nessus
scanner

Serv-U FTP Server < 15.2.2 Hotfix 1 Arbitrary File Read/Write

2021-02-09T00:00:00
nessus
scanner

Security Update for Forefront Endpoint Protection (February 2021)

2021-02-09T00:00:00
nessus
scanner

Security Update for Windows Defender (February 2021)

2021-02-09T00:00:00
nessus
scanner

Security Updates for Internet Explorer (March 2021)

2021-03-09T00:00:00
nessus
scanner

openSUSE Security Update : chromium (openSUSE-2021-267)

2021-02-10T00:00:00
nessus
scanner

Google Chrome < 88.0.4324.150 Vulnerability

2021-02-04T00:00:00
nessus
scanner

Google Chrome < 88.0.4324.150 Vulnerability

2021-02-04T00:00:00
nessus
scanner

FreeBSD : chromium -- heap buffer overflow in V8 (3e01aad2-680e-11eb-83e2-e09467587c17)

2021-02-08T00:00:00
nessus
scanner

Microsoft Edge (Chromium) < 88.0.705.63 Vulnerability

2021-02-08T00:00:00
cve
NVD

CVE-2021-24094

2021-02-25T23:15:00
cve
NVD

CVE-2021-24074

2021-02-25T23:15:00
cve
NVD

CVE-2021-26854

2021-03-03T00:15:00
cve
NVD

CVE-2021-26412

2021-03-03T00:15:00
cve
NVD

CVE-2021-27078

2021-03-03T00:15:00
cve
NVD

CVE-2021-26858

2021-03-03T00:15:00
cve
NVD

CVE-2021-27065

2021-03-03T00:15:00
cve
NVD

CVE-2021-26857

2021-03-03T00:15:00
cve
NVD

CVE-2021-26855

2021-03-03T00:15:00
cve
NVD

CVE-2021-25274

2021-02-03T17:15:00
cve
NVD

CVE-2021-25276

2021-02-03T17:15:00
cve
NVD

CVE-2021-24092

2021-02-25T23:15:00
cve
NVD

CVE-2021-21017

2021-02-11T20:15:00
cve
NVD

CVE-2021-21139

2021-02-09T14:15:00
cve
NVD

CVE-2021-26411

2021-03-11T16:15:00
cve
NVD

CVE-2021-24086

2021-02-25T23:15:00
cve
NVD

CVE-2021-25275

2021-02-03T17:15:00
kaspersky
info

KLA12103 ACE vulnerabilities in Microsoft Exchange Server

2021-03-02T00:00:00
mskb
microsoft

Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: March 2, 2021 (KB5000871)

2021-03-02T08:00:00
mskb
microsoft

KB5000800: Cumulative security update for Internet Explorer: March 9, 2021

2021-03-09T08:00:00
cisa_kev
info

Microsoft OWA Exchange Control Panel (ECP) Exploit Chain

2021-11-03T00:00:00
cisa_kev
info

Microsoft OWA Exchange Control Panel (ECP) Exploit Chain

2021-11-03T00:00:00
cisa_kev
info

Microsoft OWA Exchange Control Panel (ECP) Exploit Chain

2021-11-03T00:00:00
cisa_kev
info

Microsoft Unified Messaging Deserialization Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Microsoft Internet Explorer and Edge Memory Corruption Vulnerability

2021-11-03T00:00:00
checkpoint_advisories
info

Microsoft Exchange Server Remote Code Execution (CVE-2021-26857; CVE-2021-26858)

2021-03-02T00:00:00
checkpoint_advisories
info

Microsoft Exchange Server Remote Code Execution (CVE-2021-26855; CVE-2021-27065)

2021-03-02T00:00:00
checkpoint_advisories
info

Adobe Acrobat and Reader Heap-based Buffer Overflow (APSB21-09: CVE-2021-21017)

2021-02-09T00:00:00
checkpoint_advisories
info

Microsoft Internet Explorer Memory Corruption (CVE-2021-26411)

2021-03-09T00:00:00
packetstorm
exploit

Microsoft Exchange ProxyLogon Collector

2021-05-21T00:00:00
packetstorm
exploit

Microsoft Exchange ProxyLogon Remote Code Execution

2021-03-23T00:00:00
zdt
exploit

Microsoft Exchange ProxyLogon Remote Code Execution Exploit

2021-03-23T00:00:00
zdt
exploit

Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon) Exploit

2021-03-11T00:00:00
zdt
exploit

Microsoft Exchange 2019 - Unauthenticated Email Download Exploit

2021-05-21T00:00:00
metasploit
exploit

Microsoft Exchange ProxyLogon RCE

2021-03-12T23:49:45
metasploit
exploit

Microsoft Exchange ProxyLogon Scanner

2021-03-07T13:37:20
myhack58
info

A CVE-2017-11882 vulnerability is a new variation of a sample of the debugging and analysis-vulnerability warning-the black bar safety net

2018-12-02T00:00:00
myhack58
info

A use cve-2017-11882 and cve-2018-0802 combination of vulnerability a malicious document analysis-vulnerability warning-the black bar safety net

2018-12-25T00:00:00
exploitdb
exploit

Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)

2021-05-21T00:00:00
avleonov
blog

Vulristics: Microsoft Patch Tuesdays Q1 2021

2021-03-26T02:47:52
avleonov
blog

Vulnerability Management news and publications #2

2022-08-14T11:30:44
debiancve
info

CVE-2021-21139

2021-02-09T14:15:00
debiancve
info

CVE-2021-21148

2021-02-09T16:15:00
ubuntucve
info

CVE-2021-21139

2021-02-09T00:00:00
veracode
software

Sandbox Restrictions Bypass

2021-01-22T21:31:44
seebug
exploit

Windows TCP/IP 拒绝服务漏洞（CVE-2021-24086）

2021-04-08T00:00:00
chrome
software

Stable Channel Update for Desktop

2021-02-04T00:00:00
freebsd
unix

chromium -- heap buffer overflow in V8

2021-02-04T00:00:00