{"uuid": "15940cf8-fd5d-41bc-8f42-3a641af2fe91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "seen", "source": "https://t.me/cissp/3931", "content": "Malware analysis\n1. Malicious Content Delivered Through archive.org\ud83d\ude0a\nhttps://isc.sans.edu/forums/diary/Malicious+Content+Delivered+Through+archiveorg/27688\n2. Crimea \"manifesto\" deploys VBA Rat using double attack vectors\nhttps://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-deploys-vba-rat-using-double-attack-vectors\n\nexploit\nCVE-2021-34470:\nMS Exchange AD Schema Misconfiguration Privilege Escalation (PoC)\ud83d\ude03\nhttps://packetstormsecurity.com/files/163706/Microsoft-Exchange-AD-Schema-Misconfiguration-Privilege-Escalation.html\n\nThreat Research\n1. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group\nhttps://unit42.paloaltonetworks.com/thor-plugx-variant\n2. Vultur RAT malware, with a V for VNC\nhttps://www.threatfabric.com/blogs/vultur-v-for-vnc.html\n\nFinding and Exploiting Unintended Functionality in Main Web App APIs\nhttps://bendtheory.medium.com/finding-and-exploiting-unintended-functionality-in-main-web-app-apis-6eca3ef000af", "creation_timestamp": "2026-09-02T01:04:30.778483Z"}