{"uuid": "fa76444b-bf00-4740-af1c-24db9c82e433", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40449", "type": "exploited", "source": "https://t.me/hacking_Attack/27438", "content": "Black Hat Ethical Hacking\nMicrosoft Kills Bug Being Exploited in MysterySnail Espionage Campaign\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Kills Bug Being Exploited in MysterySnail Espionage CampaignPost Views: 115 \nReading Time: 3 Minutes\nMicrosoft\u2019s October 2021 Patch Tuesday included security fixes for 74 vulnerabilities, one of which is a zero-day being used to deliver the MysterySnail RAT to Windows servers.\nToday is Microsoft\u2019s October 2021 Patch Tuesday, and it delivers fixes for four zero-day vulnerabilities, one of which is being exploited in a far-reaching espionage campaign that delivers the new MysterySnail RAT malware\u00a0to Windows servers. Microsoft reported\u00a0a total of 74 vulnerabilities, three of which are rated critical. MysterySnail Exploits Win32K BugSecurity researchers pointed to CVE-2021-40449, an elevation of privilege vulnerability in Win32k, as standing out from the crowd of patches, given that It\u2019s been exploited in the wild as a zero-day.\n\nThis summer, Kaspersky researchers discovered that the exploit was being used to elevate privileges and take over Windows servers as part of a Chinese-speaking advanced persistent threat (APT) campaign from the APT IronHusky.\n\nThe exploit chain ended with a freshly discovered remote access trojan (RAT) dubbed MysterySnail\u00a0being installed on compromised servers, with the goal of stealing data.\n\nBharat Jogi, Qualsys senior manager of vulnerability and threat research, told Threatpost on Tuesday that if left unpatched, \u201cMysterySnail has the potential to collect and exfiltrate system information from compromised hosts, in addition to other malicious users having the ability to gain complete control of the affected system and launch further attacks.\u201d\n\nJay Goodman, Automox director of product marketing, told Threatpost via email that these kinds of privilege elevation attacks \u201ccan be used to access beyond what the current user context of the device would allow, enabling attackers to perform unauthorized action, delete or move data, view private information, or install malicious software.\u201d\n\nThis bug, rated Important, is found in all supported versions of Windows.\n\nGreg Wiseman, Rapid7 senior security researcher, told Threatpost that this vulnerability is \u201clikely being used alongside Remote Code Execution (RCE) and/or social engineering attacks to gain more complete control of targeted systems.\u201d\n\nSatnam Narang, staff research engineer at Tenable, noted that elevation of privilege flaws \u201care most valuable in post-compromise scenarios once an attacker has gained access to a target system through other means, in order to execute code with elevated privileges.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Immersive Labs\u2019 Kevin Breen, director of cyber threat research, said that this all points to prioritizing this patch, particularly given how common these vulnerabilities are in ransomware attack chains: \u201cGaining this level of access on a compromised host is the first step towards becoming a domain admin \u2013 and securing full access to a network,\u201d he told Threastpost. \u201cAlmost every ransomware attack reported this year has included the use of one or more privilege escalation vulnerabilities as part of the attacker\u2019s workflow, so this is serious stuff indeed.\u201d A PrintNightmare Fix to Fix the Other PrintNightmare FixOther fixes released in the October Patch Tuesday batch include those that address what was a summer\u2019s full of Print Spooler-related patches. There\u2019s been a steady stream\u00a0of these patches\u00a0for flaws in Windows Print Spooler following June\u2019s disclosure of the PrintNightmare vulnerability\u00a0\u2013 a bu[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T08:00:06.738323Z"}