Welcome to this week's edition of the Threat Source newsletter.
There is no shortage of [hyperbolic headlines](<https://www.businessinsider.com/chatgpt-jobs-at-risk-replacement-artificial-intelligence-ai-labor-trends-2023-02?ref=blog.talosintelligence.com>) about ChatGPT out there, everything from how it and other AI tools like it are here to replace all our jobs, make college essays a thing of the past and change the face of cybersecurity as we know it.
It's the talk of SEO managers everywhere who can't wait to find a way to work "ChatGPT" into a headline. And in the security community, everyone is concerned that AI models will help attackers get smarter, faster or more dangerous.
The biggest issue I'm seeing with that is these tools aren't that smart.
Other writers have done a [far more eloquent](<https://www.theatlantic.com/technology/archive/2022/12/chatgpt-openai-artificial-intelligence-writing-ethics/672386/?ref=blog.talosintelligence.com>) and interesting job than I can in a few dozen words here about [how bad these models are at writing creatively or interpreting human emotion](<https://www.vice.com/en/article/bvmk9m/everybody-please-calm-down-about-chatgpt?ref=blog.talosintelligence.com>), but I wanted to put my own spin on things with my incredibly niche interests and use case for ChatGPT.
First, I asked it to help me write this newsletter. While it politely declined to do the whole thing for me because it can't produce something on Talos' behalf, it did start to compile a list of "the top stories we're following this week."
These headlines included an update on the Cring malware that seems to be referencing [a campaign from November 2021](<https://www.zdnet.com/article/cring-ransomware-continues-assault-on-coldfusion-servers-vpns/?ref=blog.talosintelligence.com>), a [16-month-old CVE from Microsoft](<https://nvd.nist.gov/vuln/detail/CVE-2021-40444?ref=blog.talosintelligence.com>) and a story about [money laundering in "Fortnite"](<https://slate.com/technology/2019/01/fortnite-video-games-money-laundering-scams.html?ref=blog.talosintelligence.com>) that broke in January 2019.
Then I decided to ask it about wrestling, mainly because I was fresh off watching AEW: Revolution this weekend, about who will eventually beat Maxwell Jacob Friedman for the company's title. The information it provided was shockingly lackluster considering a quick Google provided more accurate details.
One of the examples it floated was that Bryan Danielson could eventually dethrone MJF, and that "if" they two were to face, it'd be a "must see" match. Problem is, the two did literally face off Sunday night and Danielson lost. Another option, CM Punk, would create a "huge moment" for the company if he won the AEW titles, something he's already done twice (he also may never appear on TV again, but that's a long story for not this newsletter).
These are two incredibly specific examples, but I felt like it was cathartic for me to see this in action so I didn't have to lose any sleep over thinking ChatGPT or another AI was going to take my job from me next week, or my wrestling fandom for that matter.
## The one big thing
U.S. President Joe Biden's administration [released its new National Cybersecurity Strategy on March 2](<https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/02/fact-sheet-biden-harris-administration-announces-national-cybersecurity-strategy/?ref=blog.talosintelligence.com>), outlining steps the federal government plans to take to combat cyber criminals, defend critical infrastructure and enforce security regulations in oft-targeted industries. The administration said it will pursue laws to hold software companies liable if they sell technology that lacks proper cybersecurity protections, and use "national powers" to disrupt state-sponsored actors.
### Why do I care?
This is the first new cybersecurity policy from the U.S. government in five years, outlining how the next few years of cybersecurity policy may look and what other goals would look like in a hypothetical second term for Biden. If the desired laws eventually pass and are enforced, they would [represent a major shift](<https://www.politico.com/news/2023/03/02/biden-regulations-infrastructure-cyberattacks-00085117?ref=blog.talosintelligence.com>) in the way we view digital service providers and reframes how government and private entities should look at cybersecurity.
### So now what?
The strategy doesn't mean much for the average user right now, but it does mean there will be heavy debates in the near future about regulating the software-as-a-service industry and the monetary investment needed to address many of the issues the Biden administration outlined.
## Top security headlines of the week
Meta, Google and other social media sites are **sharing user data and chat logs to prosecute individuals in states where abortion is illegal.** Since the Supreme Court overturned U.S. national abortion law last year, there have been several cases where prosecutors have relied on data collected by online pharmacies, social media posts, and user data requests to charge women who were seeking an abortion. Online pharmacies that sell abortion medication share sensitive information with Google and other third-party sites, including users' web addresses, relative location and search data, which the third parties may eventually be asked to turn over to law enforcement. The large companies who manage this data rarely turn down law enforcement requests for data. ([Insider](<https://www.businessinsider.com/police-getting-help-social-media-to-prosecute-people-seeking-abortions-2023-2?ref=blog.talosintelligence.com>), [Mashable](<https://mashable.com/article/police-using-facebook-google-user-data?ref=blog.talosintelligence.com>))
After the one-year anniversary of Russia's invasion of Ukraine, experts are looking at how **this has become one of the world's first hybrid wars**, including Russia's many cyber weapons its deployed against Ukraine over the past year. Other countries who feel they may be vulnerable to large-scale cyber attacks from nation-states (such as Taiwan against China) can learn quite a bit from how Ukraine has responded so far to Russian attacks. A new deep-dive report also outlines how crucial a cyber attack against the Viasat satellite network helped Russia prepare for its ground invasion just a few days prior. ([NPR](<https://www.npr.org/2023/03/02/1160714527/the-role-of-cyber-weapons-in-russias-war-on-ukraine?ref=blog.talosintelligence.com>), [Bloomberg](<https://www.bloomberg.com/features/2023-russia-viasat-hack-ukraine/?leadSource=uverify+wall&ref=blog.talosintelligence.com>))
Password management company **LastPass said attackers accessed a decrypted vault available to only a handful of company developers by hacking an employee's home computer** in August. The new details add on to a data breach the company first disclosed several months ago. LastPass said an unknown threat actor stole valid login credentials from a senior DevOps engineer and accessed the contents of a LastPass data vault. That vault contained access to a shared cloud storage environment that included encryption keys for customers' vault backups stored on Amazon S3 buckets. The attackers reportedly exploited a flaw in Plex, a media-sharing software, to access the user's home device in the first place. Plex disclosed its own data breach in late August. ([Ars Technica](<https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/?ref=blog.talosintelligence.com>), [Wired](<https://www.wired.com/story/lastpass-engineer-breach-security-roundup/?ref=blog.talosintelligence.com>))
## Can't get enough Talos?
* [Threat Roundup for Feb. 24 - March 3](<https://blog.talosintelligence.com/threat-roundup-feb-24-march-3-2023/>)
* [Talos Takes Ep. #129: The benefits of taking an active approach to threat defense](<https://www.buzzsprout.com/2018149/episodes/12367602?ref=blog.talosintelligence.com>)
* [The role of cyber weapons in Russia's war on Ukraine](<https://www.kalw.org/2023-03-02/the-role-of-cyber-weapons-in-russias-war-on-u?ref=blog.talosintelligence.com>)
## Upcoming events where you can find Talos
**[WiCyS](<https://www.wicys.org/events/wicys-2023/?ref=blog.talosintelligence.com>) (March 16 - 18)**
Denver, CO
**[RSA](<https://www.rsaconference.com/usa?ref=blog.talosintelligence.com>) (April 24 - 27)**
San Francisco, CA
## Most prevalent malware files from Talos telemetry over the past week
**SHA 256:** [e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934](<https://www.virustotal.com/gui/file/e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934/details?ref=blog.talosintelligence.com>)
**MD5:** 93fefc3e88ffb78abb36365fa5cf857c
**Typical Filename:** Wextract
**Claimed Product:** Internet Explorer
**Detection Name: **PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg
**SHA 256:** [00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725](<https://www.virustotal.com/gui/file/00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725/details?ref=blog.talosintelligence.com>)
**MD5:** d47fa115154927113b05bd3c8a308201
**Typical Filename:** mssqlsrv.exe
**Claimed Product:** N/A
**Detection Name:** Trojan.GenericKD.65065311
**SHA 256:** [de3908adc431d1e66656199063acbb83f2b2bfc4d21f02076fe381bb97afc423](<https://www.virustotal.com/gui/file/de3908adc431d1e66656199063acbb83f2b2bfc4d21f02076fe381bb97afc423/details?ref=blog.talosintelligence.com>)
**MD5:** 954a5fc664c23a7a97e09850accdfe8e
**Typical Filename:** teams15.exe
**Claimed Product:** teams15
**Detection Name:** Gen:Variant.MSILHeracles.59885
**SHA 256:** [9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507](<https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507/details?ref=blog.talosintelligence.com>)
**MD5: **2915b3f8b703eb744fc54c81f4a9c67f
**Typical Filename:** VID001.exe
**Claimed Product:** N/A
**Detection Name:** Win.Worm.Coinminer::1201
**SHA 256:** [e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c](<https://www.virustotal.com/gui/file/e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c/details?ref=blog.talosintelligence.com>)
**MD5:** a087b2e6ec57b08c0d0750c60f96a74c
**Typical Filename:** AAct.exe
**Claimed Product:** N/A
**Detection Name:** PUA.Win.Tool.Kmsauto::1201
{"id": "TALOSBLOG:446DF38AD4792F3CF775EEF8182E9A9B", "vendorId": null, "type": "talosblog", "bulletinFamily": "blog", "title": "Threat Source newsletter (March 9, 2023) \u2014 Stop freaking out about ChatGPT", "description": "\n\nWelcome to this week's edition of the Threat Source newsletter.\n\nThere is no shortage of [hyperbolic headlines](<https://www.businessinsider.com/chatgpt-jobs-at-risk-replacement-artificial-intelligence-ai-labor-trends-2023-02?ref=blog.talosintelligence.com>) about ChatGPT out there, everything from how it and other AI tools like it are here to replace all our jobs, make college essays a thing of the past and change the face of cybersecurity as we know it.\n\nIt's the talk of SEO managers everywhere who can't wait to find a way to work "ChatGPT" into a headline. And in the security community, everyone is concerned that AI models will help attackers get smarter, faster or more dangerous.\n\nThe biggest issue I'm seeing with that is these tools aren't that smart.\n\nOther writers have done a [far more eloquent](<https://www.theatlantic.com/technology/archive/2022/12/chatgpt-openai-artificial-intelligence-writing-ethics/672386/?ref=blog.talosintelligence.com>) and interesting job than I can in a few dozen words here about [how bad these models are at writing creatively or interpreting human emotion](<https://www.vice.com/en/article/bvmk9m/everybody-please-calm-down-about-chatgpt?ref=blog.talosintelligence.com>), but I wanted to put my own spin on things with my incredibly niche interests and use case for ChatGPT.\n\nFirst, I asked it to help me write this newsletter. While it politely declined to do the whole thing for me because it can't produce something on Talos' behalf, it did start to compile a list of "the top stories we're following this week."\n\n\n\nThese headlines included an update on the Cring malware that seems to be referencing [a campaign from November 2021](<https://www.zdnet.com/article/cring-ransomware-continues-assault-on-coldfusion-servers-vpns/?ref=blog.talosintelligence.com>), a [16-month-old CVE from Microsoft](<https://nvd.nist.gov/vuln/detail/CVE-2021-40444?ref=blog.talosintelligence.com>) and a story about [money laundering in "Fortnite"](<https://slate.com/technology/2019/01/fortnite-video-games-money-laundering-scams.html?ref=blog.talosintelligence.com>) that broke in January 2019.\n\nThen I decided to ask it about wrestling, mainly because I was fresh off watching AEW: Revolution this weekend, about who will eventually beat Maxwell Jacob Friedman for the company's title. The information it provided was shockingly lackluster considering a quick Google provided more accurate details.\n\n\n\nOne of the examples it floated was that Bryan Danielson could eventually dethrone MJF, and that "if" they two were to face, it'd be a "must see" match. Problem is, the two did literally face off Sunday night and Danielson lost. Another option, CM Punk, would create a "huge moment" for the company if he won the AEW titles, something he's already done twice (he also may never appear on TV again, but that's a long story for not this newsletter).\n\nThese are two incredibly specific examples, but I felt like it was cathartic for me to see this in action so I didn't have to lose any sleep over thinking ChatGPT or another AI was going to take my job from me next week, or my wrestling fandom for that matter.\n\n## The one big thing\n\nU.S. President Joe Biden's administration [released its new National Cybersecurity Strategy on March 2](<https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/02/fact-sheet-biden-harris-administration-announces-national-cybersecurity-strategy/?ref=blog.talosintelligence.com>), outlining steps the federal government plans to take to combat cyber criminals, defend critical infrastructure and enforce security regulations in oft-targeted industries. The administration said it will pursue laws to hold software companies liable if they sell technology that lacks proper cybersecurity protections, and use \"national powers" to disrupt state-sponsored actors.\n\n### Why do I care?\n\nThis is the first new cybersecurity policy from the U.S. government in five years, outlining how the next few years of cybersecurity policy may look and what other goals would look like in a hypothetical second term for Biden. If the desired laws eventually pass and are enforced, they would [represent a major shift](<https://www.politico.com/news/2023/03/02/biden-regulations-infrastructure-cyberattacks-00085117?ref=blog.talosintelligence.com>) in the way we view digital service providers and reframes how government and private entities should look at cybersecurity.\n\n### So now what?\n\nThe strategy doesn't mean much for the average user right now, but it does mean there will be heavy debates in the near future about regulating the software-as-a-service industry and the monetary investment needed to address many of the issues the Biden administration outlined.\n\n## Top security headlines of the week\n\nMeta, Google and other social media sites are **sharing user data and chat logs to prosecute individuals in states where abortion is illegal.** Since the Supreme Court overturned U.S. national abortion law last year, there have been several cases where prosecutors have relied on data collected by online pharmacies, social media posts, and user data requests to charge women who were seeking an abortion. Online pharmacies that sell abortion medication share sensitive information with Google and other third-party sites, including users' web addresses, relative location and search data, which the third parties may eventually be asked to turn over to law enforcement. The large companies who manage this data rarely turn down law enforcement requests for data. ([Insider](<https://www.businessinsider.com/police-getting-help-social-media-to-prosecute-people-seeking-abortions-2023-2?ref=blog.talosintelligence.com>), [Mashable](<https://mashable.com/article/police-using-facebook-google-user-data?ref=blog.talosintelligence.com>))\n\nAfter the one-year anniversary of Russia's invasion of Ukraine, experts are looking at how **this has become one of the world's first hybrid wars**, including Russia's many cyber weapons its deployed against Ukraine over the past year. Other countries who feel they may be vulnerable to large-scale cyber attacks from nation-states (such as Taiwan against China) can learn quite a bit from how Ukraine has responded so far to Russian attacks. A new deep-dive report also outlines how crucial a cyber attack against the Viasat satellite network helped Russia prepare for its ground invasion just a few days prior. ([NPR](<https://www.npr.org/2023/03/02/1160714527/the-role-of-cyber-weapons-in-russias-war-on-ukraine?ref=blog.talosintelligence.com>), [Bloomberg](<https://www.bloomberg.com/features/2023-russia-viasat-hack-ukraine/?leadSource=uverify+wall&ref=blog.talosintelligence.com>))\n\nPassword management company **LastPass said attackers accessed a decrypted vault available to only a handful of company developers by hacking an employee's home computer** in August. The new details add on to a data breach the company first disclosed several months ago. LastPass said an unknown threat actor stole valid login credentials from a senior DevOps engineer and accessed the contents of a LastPass data vault. That vault contained access to a shared cloud storage environment that included encryption keys for customers' vault backups stored on Amazon S3 buckets. The attackers reportedly exploited a flaw in Plex, a media-sharing software, to access the user's home device in the first place. Plex disclosed its own data breach in late August. ([Ars Technica](<https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/?ref=blog.talosintelligence.com>), [Wired](<https://www.wired.com/story/lastpass-engineer-breach-security-roundup/?ref=blog.talosintelligence.com>))\n\n## Can't get enough Talos?\n\n * [Threat Roundup for Feb. 24 - March 3](<https://blog.talosintelligence.com/threat-roundup-feb-24-march-3-2023/>)\n * [Talos Takes Ep. #129: The benefits of taking an active approach to threat defense](<https://www.buzzsprout.com/2018149/episodes/12367602?ref=blog.talosintelligence.com>)\n * [The role of cyber weapons in Russia's war on Ukraine](<https://www.kalw.org/2023-03-02/the-role-of-cyber-weapons-in-russias-war-on-u?ref=blog.talosintelligence.com>)\n\n## Upcoming events where you can find Talos\n\n**[WiCyS](<https://www.wicys.org/events/wicys-2023/?ref=blog.talosintelligence.com>) (March 16 - 18)**\n\nDenver, CO\n\n**[RSA](<https://www.rsaconference.com/usa?ref=blog.talosintelligence.com>) (April 24 - 27)**\n\nSan Francisco, CA\n\n## Most prevalent malware files from Talos telemetry over the past week\n\n \n**SHA 256:** [e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934](<https://www.virustotal.com/gui/file/e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934/details?ref=blog.talosintelligence.com>) \n**MD5:** 93fefc3e88ffb78abb36365fa5cf857c \n**Typical Filename:** Wextract \n**Claimed Product:** Internet Explorer \n**Detection Name: **PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg\n\n**SHA 256:** [00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725](<https://www.virustotal.com/gui/file/00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725/details?ref=blog.talosintelligence.com>) \n**MD5:** d47fa115154927113b05bd3c8a308201 \n**Typical Filename:** mssqlsrv.exe \n**Claimed Product:** N/A \n**Detection Name:** Trojan.GenericKD.65065311\n\n**SHA 256:** [de3908adc431d1e66656199063acbb83f2b2bfc4d21f02076fe381bb97afc423](<https://www.virustotal.com/gui/file/de3908adc431d1e66656199063acbb83f2b2bfc4d21f02076fe381bb97afc423/details?ref=blog.talosintelligence.com>) \n**MD5:** 954a5fc664c23a7a97e09850accdfe8e \n**Typical Filename:** teams15.exe \n**Claimed Product:** teams15 \n**Detection Name:** Gen:Variant.MSILHeracles.59885\n\n**SHA 256:** [9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507](<https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507/details?ref=blog.talosintelligence.com>) \n**MD5: **2915b3f8b703eb744fc54c81f4a9c67f \n**Typical Filename:** VID001.exe \n**Claimed Product:** N/A \n**Detection Name:** Win.Worm.Coinminer::1201\n\n**SHA 256:** [e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c](<https://www.virustotal.com/gui/file/e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c/details?ref=blog.talosintelligence.com>) \n**MD5:** a087b2e6ec57b08c0d0750c60f96a74c \n**Typical Filename:** AAct.exe \n**Claimed Product:** N/A \n**Detection Name:** PUA.Win.Tool.Kmsauto::1201", "published": "2023-03-09T19:00:12", "modified": "2023-03-09T19:00:12", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 6.8}, "severity": "MEDIUM", "exploitabilityScore": 8.6, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://blog.talosintelligence.com/threat-source-newsletter-march-9-2023-stop-freaking-out-about-chatgpt/", "reporter": "Jonathan Munshaw", "references": [], "cvelist": ["CVE-2021-40444"], "immutableFields": [], "lastseen": "2023-03-24T20:18:32", "viewCount": 17, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:1FA9A53C-0452-4411-96C9-C0DD833F8D18", "AKB:F7CCD0B7-220B-49E5-A4DF-27E26B64A3F0"]}, {"type": "avleonov", "idList": ["AVLEONOV:44DF3C4B3D05A7DC39FB6314F5D94892", "AVLEONOV:5945665DFA613F7707360C10CED8C916"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0554"]}, {"type": "cisa", "idList": ["CISA:C70D91615E3DC8B589B493118D474566"]}, {"type": "cisa_kev", "idList": ["CISA-KEV-CVE-2021-40444"]}, {"type": "cnvd", "idList": ["CNVD-2021-69088"]}, {"type": "cve", "idList": ["CVE-2021-40444"]}, {"type": "githubexploit", "idList": ["0990FE6E-7DC3-559E-9B84-E739872B988C", "0D0DAF60-4F3C-5B17-8BAB-5A8A73BC25CC", "0E388E09-F00E-58B6-BEFE-026913357CE0", "0E965070-1EAE-59AA-86E6-41ADEFDAED7D", "111C9F44-593D-5E56-8040-615B48ED3E24", "24DE1902-4427-5442-BF63-7657293966E2", "28B1FAAB-984F-5469-BC0D-3861F3BCF3B5", "29AB2E6A-3E44-55A2-801D-2971FABB2E5D", "37D2BE4F-9D7A-51CD-B802-2FAB35B39A4E", "588DA6EE-E603-5CF2-A9A3-47E98F68926C", "6BC80C90-569E-5084-8C0E-891F12F1805E", "72881C31-5BFD-5DAF-9D20-D6170EEC520D", "7333A285-768C-5AD9-B64E-0EC75F075597", "7643EC22-CCD0-56A6-9113-B5EF435E22FC", "7DE60C34-40B8-50E4-B1A0-FC1D10F97677", "88EFCA30-5DED-59FB-A476-A92F53D1497E", "8B907536-B213-590D-81B9-32CF4A55322E", "8CD90173-6341-5FAD-942A-A9617561026A", "9366C7C7-BF57-5CFF-A1B5-8D8CF169E72A", "AAFEAA7E-81B7-5CE7-9E2F-16828CC5468F", "B7D137AD-216F-5D27-9D7B-6F3B5EEB266D", "B9C2639D-9C07-5F11-B663-C144F457A9F7", "CC6DFDC6-184F-5748-A9EC-946E8BA5FB04", "CCA69DF0-1EB2-5F30-BEC9-04ED43F42EA5", "DD5D2BF7-BE9D-59EA-8DF2-D85AEC13A4A0", "E06577DB-A581-55E1-968E-81430C294A84", "F5CEF191-B04C-5FC5-82D1-3B728EC648A9", "FBB2DA29-1A11-5D78-A28C-1BF3821613AC", "FF761088-559C-5E71-A5CD-196D4E4571B8"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:3B4F7E79DDCD0AFF3B9BB86429182DCA", "GOOGLEPROJECTZERO:CA925EE6A931620550EF819815B14156"]}, {"type": "hivepro", "idList": ["HIVEPRO:B772F2F7B4C9AE8452D1197E2E240204", "HIVEPRO:E57DA2FED4B890B898EFA2B68C657043"]}, {"type": "ics", "idList": ["AA22-117A", "AA22-216A"]}, {"type": "kaspersky", "idList": ["KLA12277", "KLA12278"]}, {"type": "kitploit", "idList": ["KITPLOIT:1624142243530526923", "KITPLOIT:2590785192528609562", "KITPLOIT:3456474172768099634", "KITPLOIT:3697667464193804316", "KITPLOIT:4033244480100620751", "KITPLOIT:4074521293617632933", "KITPLOIT:5187040326820919368", "KITPLOIT:5230148353750207837", "KITPLOIT:698315176468431184", "KITPLOIT:942518396640901655"]}, {"type": "krebs", "idList": ["KREBS:2EC42B845847A6DCFE50ECEB9FF61C29", "KREBS:409088FC2DFC219B74043104C2B672CC"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:76333D1F0FCAFD79FA2EDD4A4CAFBB38", "MALWAREBYTES:801E20618F96EF51F9E60F7BC7906C2B", "MALWAREBYTES:DB54B348AF1AC41987150B5CE7B1BC66", "MALWAREBYTES:F1563A57212EB7AEC347075E94FF1605", "MALWAREBYTES:FC8647475CCD473D01B5C0257286E101"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT-WINDOWS-FILEFORMAT-WORD_MSHTML_RCE-"]}, {"type": "mmpc", "idList": ["MMPC:27EEFD67E5E7E712750B1472E15C5A0B", "MMPC:795E0A765679492C51FEFA2B19EAD597"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40444"]}, {"type": "mskb", "idList": ["KB5005563"]}, {"type": "mssecure", "idList": ["MSSECURE:27EEFD67E5E7E712750B1472E15C5A0B", "MSSECURE:795E0A765679492C51FEFA2B19EAD597"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_IE_SEPT_2021.NASL", "SMB_NT_MS21_SEP_5005565.NASL", "SMB_NT_MS21_SEP_5005566.NASL", "SMB_NT_MS21_SEP_5005568.NASL", "SMB_NT_MS21_SEP_5005569.NASL", "SMB_NT_MS21_SEP_5005573.NASL", "SMB_NT_MS21_SEP_5005613.NASL", "SMB_NT_MS21_SEP_INTERNET_EXPLORER.NASL"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:165214", "PACKETSTORM:167317"]}, {"type": "pentestpartners", "idList": ["PENTESTPARTNERS:E6B48FF79C5D0D1E4DD360F6010F2A93"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:0082A77BD8EFFF48B406D107FEFD0DD3", "QUALYSBLOG:5576D16DC39617927D8AEFF027CC0911", "QUALYSBLOG:BC22CE22A3E70823D5F0E944CBD5CE4A"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:AE824D3989C792700A622C455D8EE160", "RAPID7BLOG:CC071AA6971D64B0F7A596B2BBD5F046"]}, {"type": "securelist", "idList": ["SECURELIST:11665FFD7075FB9D59316195101DE894", "SECURELIST:29152837444B2A7E5A9B9FCB107DAB36", "SECURELIST:63306FA6D056BD9A04969409AC790D84", "SECURELIST:86368EF0EA7DAA3D2AB20E0597A62656", "SECURELIST:C1F2E1B6711C8D84F3E78D203B3CE837", "SECURELIST:C540EBB7FD8B7FB9E54E119E88DB5C48"]}, {"type": "thn", "idList": ["THN:4E80D9371FAC9B29044F9D8F732A3AD5", "THN:59AE75C78D4644BFA6AD90225B3DE0C1", "THN:67ECC712AB360F5A56F2434CDBF6B51F", "THN:8A60310AB796B7372A105B7C8811306B", "THN:959FD46A8D71CA9DDAEDD6516113CE3E", "THN:B399D1943153CEEF405B85D4310C2142", "THN:BD014635C5F702379060A20290985162", "THN:C4188C7A44467E425407D33067C14094", "THN:D4E86BD8938D3B2E15104CA4922A51F8", "THN:E7762183A6F7B3DDB942D3F1F99748F6"]}, {"type": "threatpost", "idList": ["THREATPOST:3C3F20C93519036CC712D1CA3A6D7C48", "THREATPOST:4C8D995307A845304CF691725B2352A2", "THREATPOST:62DC935BF4DB4EF8A4F1E83519B1D5CD", "THREATPOST:6D61C560E85ECD0A7A35C55E74849510", "THREATPOST:A98C64CB9BDDE55F51C984B749753904", "THREATPOST:B2FEDF3EA50507F526C77105093E8977"]}, {"type": "trellix", "idList": ["TRELLIX:0BACBA94111E0C364A9A1CCD8BD263DE", "TRELLIX:6949BCDE9887B6759BD81365E21DD71C", "TRELLIX:D8DB23FAEBC16DCFBC54050BEBBF650D", "TRELLIX:ED6978182DFD9CD1EA1E539B1EDABE6C"]}, {"type": "trendmicroblog", "idList": ["TRENDMICROBLOG:E0C479F55DF4C53A47CA2170110555AE", "TRENDMICROBLOG:E17B66F8728189778826A0F497A540F2"]}, {"type": "zdt", "idList": ["1337DAY-ID-37126"]}]}, "score": {"value": 7.8, "vector": "NONE"}, "epss": [{"cve": "CVE-2021-40444", "epss": 0.96612, "percentile": 0.99333, "modified": "2023-03-24"}], "vulnersScore": 7.8}, "_state": {"dependencies": 1679689170, "score": 1684017862, "epss": 1679689998}, "_internal": {"score_hash": "85b9a80acc77a8997401d2c3d531a20b"}}
Threat Source newsletter (March 9, 2023) — Stop freaking out about ChatGPT
