{"vulnerability": "CVE-2021-34523", "sightings": [{"uuid": "3e9ff675-a9dc-4bf3-91b2-65416b1c7d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://www.thezdi.com/blog/2024/9/4/exploiting-exchange-powershell-after-proxynotshell-part-1-multivaluedproperty", "content": "", "creation_timestamp": "2024-09-05T15:39:37.000000Z"}, {"uuid": "48b0c28d-6197-4eb0-973e-c2ebbc80e52f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/b4779706-9ec4-44cb-afe8-97771711623b", "content": "", "creation_timestamp": "2021-08-23T11:50:10.000000Z"}, {"uuid": "deb9a7fe-65de-4a6f-9081-043d27558723", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "cbaa0127-3382-4e9d-8784-14795b58b680", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "be992dde-570a-48c7-8921-1fff05881750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/35b42540-d55e-4aed-99e3-be21d39a5a88", "content": "", "creation_timestamp": "2022-07-11T09:22:39.000000Z"}, {"uuid": "13f8ebff-b361-4ae7-8116-3273191f3b8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/5b421c0a-3bc4-4bce-a7cc-daa036ea090b", "content": "", "creation_timestamp": "2021-09-16T11:20:21.000000Z"}, {"uuid": "1a3365dc-6d91-4fa9-9549-047cd936c6ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/90e532fb-4efa-4ff2-95ab-ddaf25454791", "content": "", "creation_timestamp": "2022-10-27T20:30:22.000000Z"}, {"uuid": "2421803d-f4c0-453d-8c5c-dfc06d36bb3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:30:42.000000Z"}, {"uuid": "798a3375-2634-4637-b39d-d45f5f0820b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/5fac61d7-a610-49f6-8b37-440a91c67978", "content": "", "creation_timestamp": "2024-07-17T07:25:22.000000Z"}, {"uuid": "1b52c675-a578-4329-ab2b-ae80ccf120f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/cec219ff-8f6d-45c9-bdbb-b4fb8c9c0f2b", "content": "", "creation_timestamp": "2023-09-20T10:33:09.000000Z"}, {"uuid": "973a65fd-5b92-4ec1-80aa-b4a728de7028", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/a9eb9e8e-d894-4f36-a6c2-ca8142f72d29", "content": "", "creation_timestamp": "2024-05-21T13:04:43.000000Z"}, {"uuid": "e60fca9d-9d17-4711-8abb-225d873e8bcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/fb8794e7-3965-40fc-ac5a-80fd9be85476", "content": "", "creation_timestamp": "2024-07-30T09:15:03.000000Z"}, {"uuid": "6f35a71c-c344-4cae-8270-c4c3f6f7f9c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://msrc.microsoft.com/blog/2021/04/april-2021-update-tuesday-packages-now-available/", "content": "", "creation_timestamp": "2021-04-13T05:00:00.000000Z"}, {"uuid": "469b684a-a379-4749-a77b-5bb223032780", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971027", "content": "", "creation_timestamp": "2024-12-24T20:23:14.606162Z"}, {"uuid": "d481f4a0-dda2-4626-80ba-ec7c9a04caf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "79e323c1-9be1-4152-bd5a-b686827cd1e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:38.000000Z"}, {"uuid": "e1433372-064b-4d2a-83d5-d2a2ffa48c6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://bsky.app/profile/aakl.bsky.social/post/3likimyxics2p", "content": "", "creation_timestamp": "2025-02-19T19:20:21.635179Z"}, {"uuid": "c561971d-ceff-48ff-91c7-fa24f62aafeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:56.000000Z"}, {"uuid": "a20ac728-8f00-4209-9777-da862cdc5b4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/35b42540-d55e-4aed-99e3-be21d39a5a88", "content": "", "creation_timestamp": "2025-06-04T13:18:47.000000Z"}, {"uuid": "0b3dcbf5-1284-4fe7-a2ad-41c0676dfb64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://bsky.app/profile/bilaltariq01.bsky.social/post/3lseujqi4mt2q", "content": "", "creation_timestamp": "2025-06-24T19:49:14.269273Z"}, {"uuid": "7ed9fd63-3f01-4b54-b3e4-6782fe5fa69f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3lswtzea4w22p", "content": "", "creation_timestamp": "2025-07-01T23:28:04.054168Z"}, {"uuid": "441a3c72-cda0-4eb1-b6ca-56428b05d916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/90e532fb-4efa-4ff2-95ab-ddaf25454791", "content": "", "creation_timestamp": "2025-07-01T21:18:45.000000Z"}, {"uuid": "ae742cd3-e7aa-49f6-a799-f9616b9509e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://gist.github.com/Hamid-K/f4288dae3a1f2dea8905b1cf16d59c1b", "content": "", "creation_timestamp": "2025-10-03T16:37:38.000000Z"}, {"uuid": "fe01fb99-9f89-48e7-85ab-713ec6ed47ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:12:40.000000Z"}, {"uuid": "5c3215de-a7dc-4415-b1a0-6207a8c43a5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:50.000000Z"}, {"uuid": "3303e1d2-eee6-4b8c-bbec-20b740a12006", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://gist.github.com/Darkcrai86/52f50f5d0ddb5131ec29c2994cfdb19c", "content": "", "creation_timestamp": "2025-09-19T17:07:08.000000Z"}, {"uuid": "77ccecc0-1d83-42db-bc1a-f1b7f1334f53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb", "content": "", "creation_timestamp": "2021-08-19T15:41:58.000000Z"}, {"uuid": "0f577e15-72b4-4390-9029-9d2719a9afae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/a9eb9e8e-d894-4f36-a6c2-ca8142f72d29", "content": "", "creation_timestamp": "2026-02-06T21:11:55.000000Z"}, {"uuid": "15de587f-e834-4a42-9dca-34002fc2e0f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_21/2021", "content": "", "creation_timestamp": "2021-07-15T10:13:10.000000Z"}, {"uuid": "cd705a00-2309-4214-ac10-42dea0c2271b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/d41ef7ed-39b6-4408-a718-2c3bce5fc99e", "content": "", "creation_timestamp": "2025-03-03T08:51:11.190614Z"}, {"uuid": "4ff9934d-d6ad-456e-828b-3c786e294518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d8d4bf5a-324b-4e70-bab3-be55d588d75d", "content": "", "creation_timestamp": "2026-02-02T12:28:50.775159Z"}, {"uuid": "64d336d4-dafa-42e3-b7b2-adf33d3e8dcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/Linux_Arabss/84", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2025-08-15T00:31:25.000000Z"}, {"uuid": "88738d9a-f01a-4b1c-a66d-769f6af60856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/ggfcvj/2954", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2021-12-03T14:02:51.000000Z"}, {"uuid": "367252d6-faba-44ec-a714-dafec71c4bfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/c2d3cd1d-c08d-4312-8a7f-882826e2d83b", "content": "", "creation_timestamp": "2026-04-19T02:35:52.000000Z"}, {"uuid": "96f27ad2-0e89-4852-b340-2b2ca86e77a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/itsec_news/520", "content": "\u200b\u2694\ufe0f \u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f Hive \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Microsoft Exchange.\n\n\ud83d\udcac \u041f\u0430\u0440\u0442\u043d\u0451\u0440 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f Hive \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b \u0441\u0435\u0440\u0432\u0435\u0440\u044b Microsoft Exchange, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438\u0441\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ProxyShell, \u2014 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043c\u0430\u044f\u0447\u043a\u0438 Cobalt Strike. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0442 \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443, \u043a\u0440\u0430\u0434\u0443\u0442 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u043f\u043e\u0445\u0438\u0449\u0430\u044e\u0442 \u0446\u0435\u043d\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u041f\u041e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432.\n\nProxyShell \u2014 \u043d\u0430\u0431\u043e\u0440 \u0438\u0437 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Microsoft Exchange Server, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0440\u0435\u0434\u0430\u0445. \u041f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Conti, BlackByte, Babuk, Cuba \u0438 LockFile.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31297) \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043e\u0446\u0435\u043d\u043a\u0443 \u043e\u0442 7,2 \u0434\u043e 9,8 \u0438\u0437 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 10 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS \u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u043c\u0430\u0435 2021-\u0433\u043e \u0433\u043e\u0434\u0430.\n\n\u041f\u043e\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 ProxyShell \u0445\u0430\u043a\u0435\u0440\u044b \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0447\u0435\u0442\u044b\u0440\u0435 web-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u044e Exchange \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u043b\u0438 PowerShell-\u043a\u043e\u0434 \u0441 \u0432\u044b\u0441\u043e\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Cobalt Strike. Web-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0431\u044b\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u044b \u0438\u0437 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Git \u0438 \u0431\u044b\u043b\u0438 \u043f\u0435\u0440\u0435\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u044b \u0441 \u0446\u0435\u043b\u044c\u044e \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a.\n\n\u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 Mimikatz \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u043f\u0430\u0440\u043e\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0431\u043e\u043b\u044c\u0448\u0435\u043c\u0443 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u0425\u0430\u043a\u0435\u0440\u044b \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043e\u0431\u0448\u0438\u0440\u043d\u044b\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u043f\u043e\u0438\u0441\u043a\u0443 \u0431\u043e\u043b\u0435\u0435 \u0446\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0436\u0435\u0440\u0442\u0432\u0443 \u0437\u0430\u043f\u043b\u0430\u0442\u0438\u0442\u044c \u043a\u0440\u0443\u043f\u043d\u044b\u0439 \u0432\u044b\u043a\u0443\u043f.\n\n#Microsoft #\u0425\u0430\u043a\u0435\u0440\u044b\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-04-21T08:34:18.000000Z"}, {"uuid": "24dfaed9-98de-4243-99f3-3f9bc2e452f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/codeby_sec/4863", "content": "\u200b\u200b\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell\n\n\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u043c\u0435\u043d\u0443\u0435\u043c\u0430\u044f \u043a\u0430\u043a LockFile, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell.\n\nProxyShell - \u044d\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0451\u0445 (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0451 \u0432 \u043c\u0430\u0435 2021 \u0433\u043e\u0434\u0430, \u043d\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u0432\u0442\u043e\u0440\u0443\u044e \u0436\u0438\u0437\u043d\u044c.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \u041f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exchange, \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u043d\u0430 \u043d\u0435\u0433\u043e, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u0430\u0432\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0431\u043e\u043b\u0435\u0435 \u043e\u0431\u0448\u0438\u0440\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439. \u041f\u0440\u0438 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0438 \u0432 \u0441\u0435\u0442\u044c, LockFile \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0430 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Exchange, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0430\u0442\u0430\u043a\u0443 ProxyShell, \u0430 \u043f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c PetitPotam \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\n\u0427\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ProxyShell, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f Microsoft Exchange. \u0410\u0442\u0430\u043a\u0443 PetitPotam \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c  \u043d\u0435 \u0442\u0430\u043a \u043f\u0440\u043e\u0441\u0442\u043e, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Microsoft \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442 \u0432\u0441\u0435 \u0432\u0435\u043a\u0442\u043e\u0440\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0427\u0442\u043e\u0431\u044b \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 NTLM, \u043c\u043e\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u0442\u0447 \u043e\u0442 0patch, \u043b\u0438\u0431\u043e \u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0444\u0438\u043b\u044c\u0442\u0440\u044b NETSH RPC,  \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c \u0432 MS-EFSRPC API.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\n\n#infosec #microsoft #exploit", "creation_timestamp": "2024-03-12T14:43:07.000000Z"}, {"uuid": "825caa2b-7a3d-47d1-86a1-8d8e0da84e48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/BleepingComputer/11058", "content": "Microsoft Exchange servers hacked to deploy BlackByte ransomware\n\nBlackByte ransomware actors were observed exploiting the ProxyShell set of vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to compromise Microsoft Exchange servers. [...]\n\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware/", "creation_timestamp": "2021-12-03T16:36:50.000000Z"}, {"uuid": "61a5c41c-7072-4ea7-9d17-cafe6cb1a4fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/avleonovrus/54", "content": "\u0412 \u0442\u043e\u043c \u0436\u0435 \u043e\u0442\u0447\u0435\u0442\u0435 Palo Alto 2022 Unit 42 Incident Response Report \u0435\u0441\u0442\u044c \u0435\u0449\u0451 \u043e\u0434\u0438\u043d \u043f\u0440\u0438\u043a\u043e\u043b\u044c\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442. \u0413\u0440\u0443\u043f\u043f\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u043b\u043e\u043c\u0430\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \"\u0412 \u0441\u043b\u0443\u0447\u0430\u044f\u0445, \u043a\u043e\u0433\u0434\u0430 \u0440\u0435\u0441\u043f\u043e\u043d\u0434\u0435\u043d\u0442\u044b \u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0431\u043e\u043b\u0435\u0435 87% \u0438\u0437 \u043d\u0438\u0445 \u043f\u043e\u043f\u0430\u043b\u0438 \u0432 \u043e\u0434\u043d\u0443 \u0438\u0437 \u0448\u0435\u0441\u0442\u0438 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 CVE\".\n\n\u041a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438: \n\n\u2022 55% Microsoft Exchange ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)\n\u2022 14% Log4j\n\u2022 7% SonicWall CVEs\n\u2022 5% Microsoft Exchange ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)\n\u2022 4% Zoho ManageEngine ADSelfService Plus (CVE-2021-40539)\n\u2022 3% Fortinet CVEs\n\n\u2022 13% Other\n\n\u0421 \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u044d\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0434\u043b\u044f \u043e\u0431\u0449\u0438\u0445 \u0440\u0430\u0437\u043c\u044b\u0448\u043b\u0435\u043d\u0438\u0439 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u0430\u043a\u043e\u043c \u0441\u043e\u0444\u0442\u0435 \u0441\u0442\u043e\u0438\u0442 \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0431\u0440\u0430\u0449\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435. \u041d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0437 Other \u044f \u0431\u044b \u0442\u043e\u0436\u0435 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u043b, \u043d\u043e \u0438\u0445 \u043a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u043d\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435. \n\n\u0421 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u044d\u0442\u043e \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043c\u0430 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0438\u043e\u043d\u0430. \u041d\u0443 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c Exchange \u0432\u0435\u0437\u0434\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442, \u044d\u0442\u043e \u0434\u0430. Log4j \u0442\u0430\u043a\u0436\u0435 \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435. \u041c\u043e\u0436\u043d\u043e \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c, \u0447\u0442\u043e \u0432 \u043d\u0430\u0448\u0438\u0445 \u0448\u0438\u0440\u043e\u0442\u0430\u0445 \u043a\u043e\u0435-\u043a\u0442\u043e \u043a\u0440\u0435\u043f\u043a\u043e \u0441\u0438\u0434\u0438\u0442 \u043d\u0430 Fortinet. \u041d\u043e \u0432\u043e\u0442 SonicWall \u0438 Zoho \u043a\u0430\u0436\u0443\u0442\u0441\u044f \u0447\u0435\u043c-\u0442\u043e \u0441\u043e\u0432\u0441\u0435\u043c \u044d\u043a\u0437\u043e\u0442\u0438\u0447\u043d\u044b\u043c. \u0410 \u0442\u0430\u043c, \u0433\u0434\u0435 Unit 42  incident response \u043a\u0435\u0439\u0441\u044b \u0440\u0435\u0448\u0430\u0435\u0442, \u044d\u0442\u043e \u043e\u0447\u0435\u043d\u044c \u0437\u043d\u0430\u0447\u0438\u043c\u044b\u0435 \u0448\u0442\u0443\u043a\u0438. \u0418\u043b\u0438 \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u044e\u044e \u044d\u043f\u043e\u043f\u0435\u044e, \u043a\u043e\u0433\u0434\u0430  \u043c\u0430\u0441\u0441\u043e\u0432\u043e \u043f\u043e\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Kaseya VSA. \u0411\u043e\u043b\u044c\u0448\u0435 \u0442\u044b\u0441\u044f\u0447\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u0438, \u043d\u043e \u043e\u043f\u044f\u0442\u044c \u0436\u0435 \u044d\u0442\u043e \u043d\u0435 \u0432 \u043d\u0430\u0448\u0435\u043c \u0440\u0435\u0433\u0438\u043e\u043d\u0435, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u043c \u043d\u0435 \u043e\u0441\u043e\u0431\u043e \u044d\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0431\u044b\u043b\u043e. \n\n\u0421 \u0443\u0447\u0435\u0442\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u0430 \u0437\u0430\u043f\u0430\u0434\u043d\u044b\u0445 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432 \u0441 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0440\u044b\u043d\u043a\u0430 IT \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u044b \"\u0437\u0434\u0435\u0441\u044c\" \u0438 \"\u0442\u0430\u043c\" \u0431\u0443\u0434\u0443\u0442 \u0432\u0441\u0435 \u0431\u043e\u043b\u044c\u0448\u0435 \u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u0442\u044c\u0441\u044f. \u0418 \u0432\u0441\u0435 \u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0440\u043e\u043b\u044c \u0432 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0431\u0443\u0434\u0443\u0442 \u0438\u0433\u0440\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u043e\u0444\u0442\u0435, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0437\u0430\u043f\u0430\u0434\u043d\u044b\u0435 \u0418\u0411 \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0438 \u043d\u0435 \u0441\u043b\u044b\u0448\u0430\u043b\u0438 \u043d\u0438\u043a\u043e\u0433\u0434\u0430. \u0418 \u044d\u0442\u043e \u0432 \u043e\u0431\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442. \u0417\u043d\u0430\u0447\u0438\u0442 \u043b\u0438 \u044d\u0442\u043e, \u0447\u0442\u043e \u0438 Vulnerability Management \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u044f\u0442\u0441\u044f \u0432\u0441\u0435 \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0437\u0430\u0442\u043e\u0447\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0448\u0438 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0440\u0435\u0430\u043b\u0438\u0438? \u041d\u0443 \u0432\u0438\u0434\u0438\u043c\u043e \u0434\u0430. \n\n\u041f\u043e\u0445\u043e\u0436\u0435, \u0447\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0431\u0435\u0437\u0443\u0441\u043b\u043e\u0432\u043d\u043e\u0439 \u0433\u043b\u043e\u0431\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 IT \u0443\u0445\u043e\u0434\u0438\u0442, \u0430 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u0442\u0435\u043c \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 VM-\u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 \u043d\u043e\u0432\u044b\u0445 \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u0445. \u0427\u0442\u043e \u043f\u043e\u0434\u0435\u043b\u0430\u0442\u044c.\n\n@avleonovrus #VMnews #PaloAlto", "creation_timestamp": "2023-09-21T09:23:10.000000Z"}, {"uuid": "1b2aa65e-aedc-429d-9dec-dc29e3e3bb3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/justsecurity/116", "content": "\u041f\u043e\u0437\u043d\u0430\u0439 \u0441\u0432\u043e\u0439 Exchange \u0441\u0435\u0440\u0432\u0435\u0440 \u0438 OWA\n\n\u041c\u043d\u043e\u0433\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e\u0442 Microsoft \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0438\u0441\u0435\u043c, \u043d\u043e \u043c\u0430\u043b\u043e \u043a\u0442\u043e \u0437\u043d\u0430\u0435\u0442, \u043a\u0430\u043a\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0432 Exchange \u0438 OWA.\n\n\u041e\u0431\u0449\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043d\u0438\u0445:\n\n\u25ab\ufe0f ProxyLogon: \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u25ab\ufe0f ProxyShell: \u043d\u0430\u0431\u043e\u0440 \u0438\u0437 \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u25ab\ufe0f ProxyToken: \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u041c\u043d\u043e\u0433\u0438\u0435 \u0438\u0445 \u043d\u0438\u0445 \u2014 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, ProxyShell \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u0435\u0442 \u0432 \u0441\u0435\u0431\u044f CVE-2021-34473, CVE-2021-34523, CVE-2021-31207.\n\n\u0427\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c \u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043a \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c \u0431\u0430\u0433\u0430\u043c, \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441\u043a\u0430\u043d\u0435\u0440\u0430\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Nuclei \u0438\u043b\u0438 \u0433\u043e\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u043e\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430.\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0438\u043c\u0435\u044e\u0442 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043c\u043e\u0447\u044c \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0443\u0448\u0443\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a.\n\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438:\n\n\u25ab\ufe0f\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 (Timing-Based Username Enumeration): \u0430\u0442\u0430\u043a\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e OWA \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0441 \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u043e\u0439, \u0435\u0441\u043b\u0438 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u0430\u0440\u043e\u043b\u044c \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u0439. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c email-\u0430\u0434\u0440\u0435\u0441\u0430 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a.\n\n\u25ab\ufe0fPassword Spraying: \u0430\u0442\u0430\u043a\u0430, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0430\u0440\u043e\u043b\u044c, \u0430 \u043b\u043e\u0433\u0438\u043d \u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f. \u041f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u0435 \u0431\u043e\u043b\u0435\u0435 N-\u0440\u0430\u0437 \u0437\u0430 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u043a \u0432\u0440\u0435\u043c\u0435\u043d\u0438. \n\n\u041a\u0430\u043a \u0431\u044b\u0442\u044c?\n\n\u2192 \u0414\u0435\u0440\u0436\u0438\u043c \u0441\u0432\u043e\u0435 \u041f\u041e \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0438 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\u2192 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0441\u0442\u0440\u043e\u0433\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0438 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.\n\u2192 \u0415\u0441\u043b\u0438 \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u043c \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u043e \u0413\u0435\u043e-\u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u043c.\n\u2192 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 CAPTCHA (\u0441\u043b\u043e\u0436\u043d\u043e \u0434\u043b\u044f OWA, \u043d\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e).\n\n\u041a\u0441\u0442\u0430\u0442\u0438, \u0443 \u043a\u043e\u0433\u043e-\u0442\u043e \u0431\u044b\u043b \u043e\u043f\u044b\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f https://www.messageware.com/epg/? \u041f\u043e\u0434\u0435\u043b\u0438\u0442\u0435\u0441\u044c \u0441\u0432\u043e\u0438\u043c \u043c\u043d\u0435\u043d\u0438\u0435\u043c)", "creation_timestamp": "2022-10-22T09:21:32.000000Z"}, {"uuid": "f90902d9-5597-4d60-9d4b-23eb62e96a2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/SpadSec/25", "content": "\u203c\ufe0f \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0633\u06cc\u06a9\u06cc\u0645 \u062e\u06cc\u0627\u0631\u06cc \u067e\u0648\u0631\u062a 443 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc Exchange \u0632\u06cc\u0631 \u062d\u0645\u0644\u0627\u062a ProxyShell  !!!\n\n\u25aa\ufe0f  \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0647\u0627\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 \u062f\u0631 Exchange \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u0627\u0645\u0644 ProxyShell Attack \u0645\u06cc\u200c\u0627\u0646\u062c\u0627\u0645\u062f \u0648 \u0647\u06a9\u0631 \u0644\u0627\u0634\u06cc \u062a\u06a9 \u062e\u0648\u0631 \u0645\u06cc\u062a\u0648\u0627\u0646\u062f \u06a9\u062f \u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u0638\u0631 \u062e\u0648\u062f \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u067e\u0648\u0631\u062a 443 \u0628\u0627 \u0628\u0627\u0644\u0627\u062a\u0631\u06cc\u0646 \u0633\u0637\u062d \u062f\u0631 \u0633\u0631\u0648\u0631 \u0627\u062c\u0631\u0627 \u0646\u0645\u0627\u06cc\u062f.\n\n\u203c\ufe0f \u0627\u06af\u0631 \u0639\u0628\u0627\u0631\u0627\u062a \" /mapi/nspi/ \" \u0648 \" /autodiscover/autodiscover.json \" \u062f\u0631 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Log \u0633\u0631\u0648\u06cc\u0633 \u062f\u0647\u0646\u062f\u0647 IIS \u0633\u0631\u0648\u0631\u0634\u0645\u0627 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f \u06cc\u0639\u0646\u06cc \u0647\u06a9\u0631\u0647\u0627 \u0628\u0647 \u0633\u0648\u0644\u0627\u062e\u06cc \u0633\u0631\u0648\u0631 \u0634\u0645\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc\u0647\u0627 \u0645\u0648\u0631\u062f \u0627\u0633\u06a9\u0646 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0628\u0627\u06cc\u062f \u0633\u0631\u0648\u0631 \u0628\u0631\u0631\u0633\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0627\u0645\u0644 \u0634\u0648\u062f.\n\n\u203c\ufe0f \u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627\u06cc \u0645\u062a\u0639\u062f\u062f \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0631\u0648\u06cc \u067e\u0648\u0631\u062a 443 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc Exchange \u062f\u0631 \u0633\u0627\u0644 2021 \u0627\u06a9\u06cc\u062f\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u06af\u0631\u062f\u062f \u0627\u06cc\u0646 \u067e\u0648\u0631\u062a \u062a\u0648\u0633\u0637 \u0645\u062d\u062f\u0648\u062f \u06af\u0631\u062f\u062f.\n\n#\u0628\u06af\u0627\u06cc\u06cc\n#\u0627\u06cc\u06a9\u0633_\u0686\u0646\u062c\n\n\ud83c\uddee\ud83c\uddf7 @SpadSec", "creation_timestamp": "2021-08-23T12:25:04.000000Z"}, {"uuid": "e27dedae-e7de-45b2-9324-25188e06775d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/anwar1213xx/1411", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2021-12-03T15:03:05.000000Z"}, {"uuid": "78bef00a-7ad4-4a65-8ba1-c66a9d447318", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/ViralCyber/5196", "content": "\u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 \u06a9\u0633\u067e\u0631\u0633\u06a9\u06cc \u0628\u0647 \u0628\u0645\u0628\u0627\u0631\u0627\u0646 \u06af\u0632\u0627\u0631\u0634 \u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0627\u062f\u0627\u0645\u0647 \u0645\u06cc \u062f\u0647\u062f.\n\n\u062f\u0631 \u06cc\u06a9\u06cc \u0627\u0632 \u062c\u062f\u06cc\u062f\u062a\u0631\u06cc\u0646 \u0647\u0627\u060c \u0645\u062d\u0642\u0642\u0627\u0646 \u0628\u0647 \u062a\u0641\u0635\u06cc\u0644 \u06cc\u06a9 \u062d\u0645\u0644\u0647 \u0647\u062f\u0641\u0645\u0646\u062f \u062a\u0648\u0633\u0637 \u06af\u0631\u0648\u0647 APT \u0686\u06cc\u0646\u06cc Tropic Trooper \u0631\u0627 \u06a9\u0647 \u062a\u062d\u0642\u06cc\u0642\u0627\u062a \u062d\u0642\u0648\u0642 \u0628\u0634\u0631 \u062f\u0631 \u062e\u0627\u0648\u0631\u0645\u06cc\u0627\u0646\u0647 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc \u062f\u0647\u062f\u060c \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0645\u06cc \u06a9\u0646\u0646\u062f.\n\nTropic Trooper \u06a9\u0647 \u0627\u0632 \u0633\u0627\u0644 2011 \u0641\u0639\u0627\u0644 \u0627\u0633\u062a\u060c \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0627 \u0646\u0627\u0645 \u0647\u0627\u06cc APT23\u060c Earth Centaur\u060c KeyBoy \u0648 Pirate Panda \u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u06cc \u0634\u0648\u062f\u060c \u0628\u0647 \u062f\u0644\u06cc\u0644 \u062d\u0645\u0644\u0627\u062a \u062e\u0648\u062f \u0628\u0647 \u062f\u0648\u0644\u062a\u060c \u0645\u0631\u0627\u0642\u0628\u062a \u0647\u0627\u06cc \u0628\u0647\u062f\u0627\u0634\u062a\u06cc\u060c \u062d\u0645\u0644 \u0648 \u0646\u0642\u0644 \u0648 \u0634\u0631\u06a9\u062a \u0647\u0627\u06cc \u0641\u0646\u0627\u0648\u0631\u06cc \u067e\u06cc\u0634\u0631\u0641\u062a\u0647 \u062f\u0631 \u062a\u0627\u06cc\u0648\u0627\u0646\u060c \u0647\u0646\u06af \u06a9\u0646\u06af \u0648 \u0641\u06cc\u0644\u06cc\u067e\u06cc\u0646 \u0634\u0646\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a. \n\n\u0631\u0648\u0627\u0628\u0637 \u0646\u0632\u062f\u06cc\u06a9\u06cc \u0628\u0627 \u06af\u0631\u0648\u0647 \u062f\u06cc\u06af\u0631\u06cc \u062f\u0627\u0631\u062f \u06a9\u0647 \u0628\u0627 \u0646\u0627\u0645 FamousSparrow \u062f\u0646\u0628\u0627\u0644 \u0645\u06cc \u0634\u0648\u062f.\n\n\u0645\u062d\u0642\u0642\u0627\u0646 \u06af\u0632\u0627\u0631\u0634 \u0645\u06cc \u062f\u0647\u0646\u062f \u06a9\u0647 \u062d\u062f\u0627\u0642\u0644 \u0627\u0632 \u0698\u0648\u0626\u0646 2023\u060c Tropic Trooper \u06cc\u06a9 \u06a9\u0645\u067e\u06cc\u0646 \u062c\u0627\u0633\u0648\u0633\u06cc \u0633\u0627\u06cc\u0628\u0631\u06cc \u0631\u0627 \u0628\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0633\u0627\u0632\u0645\u0627\u0646 \u0647\u0627\u06cc \u062f\u0648\u0644\u062a\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u062f\u0631 \u062e\u0627\u0648\u0631\u0645\u06cc\u0627\u0646\u0647 \u0648 \u0645\u0627\u0644\u0632\u06cc \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\u0627\u06cc\u0646 \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 \u062f\u0631 \u0698\u0648\u0626\u0646 2024 \u0641\u0639\u0627\u0644\u06cc\u062a\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f \u0648 \u0646\u0633\u062e\u0647 \u062c\u062f\u06cc\u062f\u06cc \u0627\u0632 \u067e\u0648\u0633\u062a\u0647 \u0648\u0628 China Chopper \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f - \u0627\u0628\u0632\u0627\u0631\u06cc \u06a9\u0647 \u0645\u0648\u0631\u062f \u0639\u0644\u0627\u0642\u0647 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 APT\u0647\u0627\u06cc \u0686\u06cc\u0646\u06cc \u0632\u0628\u0627\u0646 \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0647 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0627\u0633\u062a - \u062f\u0631 \u06cc\u06a9 \u0648\u0628 \u0633\u0631\u0648\u0631 \u0639\u0645\u0648\u0645\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 Umbraco CMS \u0645\u06cc\u0632\u0628\u0627\u0646\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0632\u0646\u062c\u06cc\u0631\u0647 \u0627\u06cc \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0634\u0627\u0645\u0644 \u062a\u0632\u0631\u06cc\u0642 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u06cc \u0628\u0647 \u0646\u0627\u0645 Crowdoor \u0628\u0648\u062f \u06a9\u0647 \u0646\u0648\u0639\u06cc \u0627\u0632 \u062f\u0631\u067e\u0634\u062a\u06cc SparrowDoor \u0627\u0633\u062a \u06a9\u0647 \u062a\u0648\u0633\u0637 ESET \u062f\u0631 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 2021 \u0645\u0633\u062a\u0646\u062f \u0634\u062f\u0647 \u0628\u0648\u062f.\n\n\u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0628\u0639\u062f\u06cc \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u0633\u062a\u0642\u0631\u0627\u0631 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0627\u0633\u06a9\u0646 \u0634\u0628\u06a9\u0647\u060c \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc \u0648 \u0628\u0627\u06cc \u067e\u0633 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062a\u06a9\u0646\u06cc\u06a9 \u0647\u0627\u06cc \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u062c\u0627\u0646\u0628\u06cc DLL (Fscan\u060c Swor\u060c Neo-reGeorg\u060c ByPassGodzilla) \u0645\u06cc \u0634\u0648\u062f.\n\n\u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u067e\u0648\u0633\u062a\u0647 \u0647\u0627\u06cc \u0648\u0628 \u0628\u0627 \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627\u06cc \u0634\u0646\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u062f\u0631 \u0628\u0631\u0646\u0627\u0645\u0647 \u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u0648\u0628 \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0639\u0645\u0648\u0645 \u0645\u0627\u0646\u0646\u062f Adobe ColdFusion (CVE-2023-26360) \u0648 Microsoft Exchange Server (CVE-2021-34473\u060c CVE-2021-34523 \u0648 CVE-2021-31) \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc \u0634\u0648\u0646\u062f.\n\n\u0628\u0647 \u0646\u0648\u0628\u0647 \u062e\u0648\u062f\u060c Crowdoor \u06a9\u0647 \u0628\u0631\u0627\u06cc \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0631 \u0698\u0648\u0626\u0646 2023 \u06a9\u0634\u0641 \u0634\u062f\u060c \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u06cc\u06a9 \u062f\u0627\u0646\u0644\u0648\u062f \u06a9\u0646\u0646\u062f\u0647 \u0628\u0631\u0627\u06cc \u0646\u0635\u0628 Cobalt Strike \u0648 \u062d\u0641\u0638 \u067e\u0627\u06cc\u062f\u0627\u0631\u06cc \u0631\u0648\u06cc \u0645\u06cc\u0632\u0628\u0627\u0646 \u0647\u0627\u06cc \u0622\u0644\u0648\u062f\u0647 \u0639\u0645\u0644 \u0645\u06cc \u06a9\u0646\u062f.\n\n\u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u0627\u06cc\u0646\u060c \u0639\u0645\u0644\u06a9\u0631\u062f Backdoor \u0631\u0627 \u0628\u0631\u0627\u06cc \u062c\u0645\u0639 \u0622\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u062d\u0631\u0645\u0627\u0646\u0647\u060c \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u067e\u0648\u0633\u062a\u0647 \u0645\u0639\u06a9\u0648\u0633\u060c \u062f\u0627\u0646\u0644\u0648\u062f \u0641\u0627\u06cc\u0644 \u0647\u0627\u06cc \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062f\u06cc\u06af\u0631 \u0648 \u062a\u06a9\u0645\u06cc\u0644 \u06a9\u0627\u0631 \u062e\u0648\u062f \u067e\u06cc\u0627\u062f\u0647 \u0633\u0627\u0632\u06cc \u0645\u06cc \u06a9\u0646\u062f.\n\n\u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0627\u06cc\u0646 \u062d\u0627\u062f\u062b\u0647\u060c \u0645\u062d\u0642\u0642\u0627\u0646 LC \u0645\u062a\u0648\u062c\u0647 \u0634\u062f\u0646\u062f \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u067e\u0633 \u0627\u0632 \u0627\u0637\u0644\u0627\u0639 \u0627\u0632 \u06a9\u0634\u0641 \u062f\u0631\u0647\u0627\u06cc \u067e\u0634\u062a\u06cc\u060c \u0633\u0639\u06cc \u06a9\u0631\u062f\u0646\u062f \u0646\u0645\u0648\u0646\u0647 \u0647\u0627\u06cc \u062c\u062f\u06cc\u062f\u062a\u0631\u06cc \u0631\u0627 \u062f\u0627\u0646\u0644\u0648\u062f \u06a9\u0646\u0646\u062f \u0648 \u062a\u0645\u0627\u0645 \u062a\u0644\u0627\u0634 \u062e\u0648\u062f \u0631\u0627 \u0628\u0631\u0627\u06cc \u062d\u0641\u0638 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u06a9\u0627\u0631 \u06af\u0631\u0641\u062a\u0646\u062f.\n\n\u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u0646\u0641\u0648\u0630 \u0647\u062f\u0641\u0645\u0646\u062f \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0628\u0647 \u06cc\u06a9 \u0645\u0631\u06a9\u0632 \u062f\u0648\u0644\u062a\u06cc \u062f\u0631 \u062e\u0627\u0648\u0631\u0645\u06cc\u0627\u0646\u0647\u060c \u0645\u062d\u0642\u0642\u0627\u0646 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u0632\u06cc\u0631 \u0645\u062c\u0645\u0648\u0639\u0647 \u0627\u06cc \u0627\u0632 \u0646\u0645\u0648\u0646\u0647 \u0647\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0647 \u0628\u0647 \u06cc\u06a9 \u0645\u0631\u06a9\u0632 \u062f\u0648\u0644\u062a\u06cc \u062f\u0631 \u0645\u0627\u0644\u0632\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a.\n\n\u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0641\u0648\u0630 \u0647\u062f\u0641\u0645\u0646\u062f \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u06cc\u06a9 \u067e\u0644\u062a\u0641\u0631\u0645 \u0628\u0627 \u0646\u0634\u0631\u06cc\u0627\u062a \u062f\u0631 \u0645\u0648\u0631\u062f \u0645\u0633\u0627\u0626\u0644 \u062d\u0642\u0648\u0642 \u0628\u0634\u0631 \u062f\u0631 \u062e\u0627\u0648\u0631\u0645\u06cc\u0627\u0646\u0647 \u062a\u0646\u0647\u0627 \u0647\u062f\u0641 \u0628\u0648\u062f \u06a9\u0647 \u0646\u0634\u0627\u0646 \u062f\u0647\u0646\u062f\u0647 \u0639\u0644\u0627\u0642\u0647 \u0627\u0633\u062a\u0631\u0627\u062a\u0698\u06cc\u06a9 \u0648\u06cc\u0698\u0647 \u0628\u0627\u0632\u06cc\u06af\u0631 \u062f\u0631 \u0631\u0627\u0628\u0637\u0647 \u0628\u0627 \u062f\u0631\u06af\u06cc\u0631\u06cc \u0628\u06cc\u0646 \u0627\u0633\u0631\u0627\u0626\u06cc\u0644 \u0648 \u062d\u0645\u0627\u0633 \u0627\u0633\u062a.\n\n\u0634\u0627\u062e\u0635 \u0647\u0627\u06cc \u0645\u0635\u0627\u0644\u062d\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0641\u0646\u06cc \u062f\u0642\u06cc\u0642 \u062f\u0631 \u0627\u06cc\u0646 \u06af\u0632\u0627\u0631\u0634 \u0622\u0645\u062f\u0647 \u0627\u0633\u062a.\n\nhttps://securelist.com/new-tropic-trooper-web-shell-infection/113737/\n\n\ud83d\udc6e\u200d\u2640\ufe0f\ud83d\udc6e\u200d\u2640\ufe0f \u0628\u0627\u0632\u0646\u0634\u0631 \u0645\u0637\u0627\u0644\u0628 \u0627\u06cc\u0646 \u06a9\u0627\u0646\u0627\u0644 \u0635\u0631\u0641\u0627 \u0628\u0627 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0648 \u0622\u062f\u0631\u0633 \u06a9\u0627\u0645\u0644 \u06a9\u0627\u0646\u0627\u0644 \u0645\u062c\u0627\u0632 \u0645\u06cc\u0628\u0627\u0634\u062f.\n\n\ud83e\udd81\u00ab\u06a9\u062a\u0627\u0633\u00bb\n\u200fhttp://t.me/ict_security", "creation_timestamp": "2024-09-08T21:55:02.000000Z"}, {"uuid": "ca8b63a3-4193-4b71-a261-8688c1f52889", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/Termux_AND_Security7667/408", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2021-12-03T15:02:36.000000Z"}, {"uuid": "9d8c2fb7-dff4-45c3-9567-06dd5cee4bf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/hack77z99/9372", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2021-12-03T15:02:58.000000Z"}, {"uuid": "53efcbe0-9fe3-4d2c-8170-4647fc6167f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/6178", "content": "\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0431\u043e\u043c\u0431\u0438\u0442\u044c \u043d\u043e\u0432\u044b\u043c\u0438 \u043e\u0442\u0447\u0435\u0442\u0430\u043c\u0438.\n\n\u0412 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0442 \u0446\u0435\u043b\u0435\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 APT-\u0433\u0440\u0443\u043f\u043f\u044b Tropic Trooper, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0440\u0430\u0432 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0430 \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435.\n\n\u0414\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u0441 2011, Tropic Trooper, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a APT23, Earth Centaur, KeyBoy \u0438 Pirate Panda, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u043d\u0430 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435, \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u0438\u0435, \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043d\u044b\u0435 \u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u0422\u0430\u0439\u0432\u0430\u043d\u0435, \u0413\u043e\u043d\u043a\u043e\u043d\u0433\u0435 \u0438 \u043d\u0430 \u0424\u0438\u043b\u0438\u043f\u043f\u0438\u043d\u0430\u0445. \n\n\u0418\u043c\u0435\u0435\u0442 \u0442\u0435\u0441\u043d\u044b\u0435 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043a\u0430\u043a FamousSparrow.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430, Tropic Trooper \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430, \u043e\u0431\u044a\u0435\u043a\u0442\u0430\u043c\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043d\u0435\u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0435 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435 \u0438 \u0432 \u041c\u0430\u043b\u0430\u0439\u0437\u0438\u0438.\n\n\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0438\u044e\u043d\u0435 2024 \u0433\u043e\u0434\u0430, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 China Chopper - \u0438\u0437\u043b\u044e\u0431\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u044f\u0437\u044b\u0447\u043d\u044b\u043c\u0438 APT \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c, - \u043d\u0430 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u043c \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u043e\u0439 Umbraco CMS.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Crowdoor, \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u0430\u00a0SparrowDoor, \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e ESET \u0435\u0449\u0435 \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430.\n\n\u041f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0442\u0438, \u0431\u043e\u043a\u043e\u0432\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0431\u043e\u043a\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 DLL (Fscan, Swor, Neo-reGeorg, ByPassGodzilla).\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Adobe ColdFusion (CVE-2023-26360) \u0438 Microsoft Exchange Server (CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31207).\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, Crowdoor, \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 \u0438\u044e\u043d\u0435 2023 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Cobalt Strike \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u044f \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0441\u0442\u0438 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u0430\u0445.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438, \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u044b.\n\n\u041a\u0430\u0441\u0430\u0435\u043c\u043e \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u041a \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0437\u043d\u0430\u043b\u0438 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438\u043c\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u044b, \u043f\u0440\u0438\u043b\u0430\u0433\u0430\u044f \u0432\u0441\u0435 \u0443\u0441\u0438\u043b\u0438\u044f \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n\u041f\u043e\u043c\u0438\u043c\u043e \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u044f \u0432 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u044a\u0435\u043a\u0442 \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0432\u0438\u0434\u0435\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0434\u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u044a\u0435\u043a\u0442 \u0432 \u041c\u0430\u043b\u0430\u0439\u0437\u0438\u0438.\n\n\u0410\u043d\u0430\u043b\u0438\u0437 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u044f \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0441 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f\u043c\u0438 \u043f\u043e \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0435 \u043f\u0440\u0430\u0432 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0430 \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435 \u0431\u044b\u043b\u0430 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e, \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u044f \u043e\u0431 \u043e\u0441\u043e\u0431\u043e\u0439 \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u043e\u0441\u0442\u0438 \u0430\u043a\u0442\u043e\u0440\u0430 \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u043a\u043e\u043d\u0444\u043b\u0438\u043a\u0442\u0430 \u043c\u0435\u0436\u0434\u0443 \u0418\u0437\u0440\u0430\u0438\u043b\u0435\u043c \u0438 \u0425\u0410\u041c\u0410\u0421.\n\n\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2024-09-06T18:10:05.000000Z"}, {"uuid": "67f9989b-7b30-40ce-820b-077219e7dde3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/true_secator/3223", "content": "\u0423 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0435\u0449\u0435 \u043c\u0435\u043d\u044c\u0448\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0447\u0435\u043c \u0441\u0447\u0438\u0442\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u043d\u0435\u0435.\n\n\u041d\u043e\u0432\u044b\u0439\u00a0\u043e\u0442\u0447\u0435\u0442 \u0437\u0430 2022 \u0433\u043e\u0434 Palo Alto Unit 42 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0445\u043e\u0441\u0442\u044b \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 15 \u043c\u0438\u043d\u0443\u0442 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043d\u043e\u0432\u044b\u0439 CVE \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c.\n\nPalo Alto Unit 42 \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u041f\u041e \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u0434\u043b\u044f RCE. \n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u043f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0440\u043e\u0441\u043b\u0430.\n\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043e\u0441\u043e\u0431\u044b\u0445 \u0443\u0441\u0438\u043b\u0438\u0439 \u043d\u0438\u0437\u043a\u043e\u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u0435\u0434\u0443\u0442 \u043c\u043e\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0434\u0430\u044e\u0442 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0441\u0432\u043e\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0434\u0430\u0440\u043a\u043d\u0435\u0442\u0435 \u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u044b\u0442\u043d\u044b\u043c \u0445\u0430\u043a\u0435\u0440\u0430\u043c, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u043c \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0422\u0430\u043a, \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-1388 \u0432 F5 BIG-IP \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 4 \u043c\u0430\u044f 2022 \u0433\u043e\u0434\u0430, \u0438, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Unit 42, \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u0441\u044f\u0442\u044c \u0447\u0430\u0441\u043e\u0432 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0431\u044b\u043b\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e 2552 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0435 Palo Alto, \u0441\u0440\u0435\u0434\u0438 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0438 \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043f\u043e\u043b\u0443\u0433\u043e\u0434\u0438\u0438 2022\u00a0\u0433\u043e\u0434\u0430 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 ProxyShell (CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31207), \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0434\u043e 55% \u043e\u0442 \u043e\u0431\u0449\u0435\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432.\u00a0\n\n\u041d\u0430 \u0432\u0442\u043e\u0440\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u043b\u0441\u044f Log4Shell \u0441 14%, \u0434\u0430\u043b\u0435\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 CVE SonicWall \u2014 7%, ProxyLogon \u2014 5%, \u0430 RCE \u0432\u00a0Zoho ManageEngine ADSelfService Plus \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0432 3% \u0441\u043b\u0443\u0447\u0430\u0435\u0432.\n\n\u041a\u0430\u043a \u0432\u0438\u0434\u043d\u043e \u0438\u0437 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438, \u043b\u044c\u0432\u0438\u043d\u0430\u044f \u0434\u043e\u043b\u044f \u0432 \u043e\u0431\u044a\u0435\u043c\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043d\u0435 \u0441\u0430\u043c\u044b\u0435 \u0441\u0432\u0435\u0436\u0438\u0435, \u0430 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 CVE, \u0447\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0438 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0430\u0442\u0430\u043a\u0443\u044e\u0442\u0441\u044f \u0447\u0430\u0449\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c 0-day \u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0435\u043e\u0431\u044a\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Unit 42, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u041f\u041e \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043e\u0434\u043d\u0443 \u0442\u0440\u0435\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u0432\u0441\u0435\u0445 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0439.\n\n\u0412 37% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0444\u0438\u0448\u0438\u043d\u0433 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u043f\u043e\u0447\u0442\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\u00a0\u0412 15% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u043e\u043d\u0438\u043a\u0430\u043b\u0438 \u0432 \u0441\u0435\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0421\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0434\u043a\u0443\u043f \u0438\u043d\u0441\u0430\u0439\u0434\u0435\u0440\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 10% \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432.\n\n\u0412\u044b\u0432\u043e\u0434\u044b \u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u0441\u0430\u043c\u0438: \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430.", "creation_timestamp": "2022-07-27T13:35:05.000000Z"}, {"uuid": "38f7b966-7bd5-4b77-9086-bafd283fa7f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/true_secator/2402", "content": "\u0421\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange \u0432\u043d\u043e\u0432\u044c \u043f\u043e\u0434 \u0443\u0434\u0430\u0440\u043e\u043c.\n \nRed Canary \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 BlackByte, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u044e\u0442 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0435\u0442\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u044b Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell. \n \n\u0412\u0441\u0435 \u043c\u044b \u043f\u043e\u043c\u043d\u0438\u043c \u043e \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Microsoft Exchange, \u0432\u043a\u043b\u044e\u0447\u0430\u044f CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31207, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u043e\u0442\u044c \u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u0430\u043f\u0440\u0435\u043b\u0435-\u043c\u0430\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430, \u043d\u043e \u043d\u0430 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n \n\u0414\u0435\u0439\u0441\u0442\u0432\u0443\u044f \u043f\u043e \u043d\u0430\u043a\u0430\u0442\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438, BlackByte \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u044b \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange, \u0437\u0430\u0442\u0435\u043c \u0446\u0435\u043f\u043b\u044f\u044e\u0442 Cobalt Strike, \u0430 \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0430\u044e\u0442 \u043a \u0440\u0430\u0431\u043e\u0442\u0435 \u0441\u043e \u0441\u0432\u043e\u0438\u043c \u0441\u043e\u0444\u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442 BlackByte \u043e\u0442 \u043a\u043e\u043b\u043b\u0435\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438\u043b\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f ransomware.\n \n\u0418\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b BlackByte \u0438\u0433\u0440\u0430\u0435\u0442 \u043a\u043b\u044e\u0447\u0435\u0432\u0443\u044e \u0440\u043e\u043b\u044c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u043a\u0430\u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u0442\u0430\u043a \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0431\u043e\u043a\u043e\u0432\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435. \u041f\u041e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0442\u0440\u0438 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0435\u0441\u0442\u0440\u0430: \u043e\u0434\u043d\u043e \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043e\u0434\u043d\u043e \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043c\u0435\u0436\u0434\u0443 \u0432\u0441\u0435\u043c\u0438 \u0443\u0440\u043e\u0432\u043d\u044f\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u043e\u0434\u043d\u043e \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u0438\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u043f\u0443\u0442\u0438 \u0434\u043b\u044f \u043f\u0443\u0442\u0435\u0439 \u043a \u0444\u0430\u0439\u043b\u0430\u043c.\n \n\u041f\u0435\u0440\u0435\u0434 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c malware \u0443\u0434\u0430\u043b\u044f\u0435\u0442 \u0437\u0430\u0434\u0430\u0447\u0443 Raccine Rules Updater \u0438 \u0441\u0442\u0438\u0440\u0430\u0435\u0442 \u0442\u0435\u043d\u0435\u0432\u044b\u0435 \u043a\u043e\u043f\u0438\u0438 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0447\u0435\u0440\u0435\u0437 WMI \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b PowerShell. \u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a, \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WinRAR \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u043e\u0431\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a file.io \u0438\u043b\u0438 anonymfiles.com.\n \n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439 Red Canary \u0432\u0440\u044f\u0434 \u043b\u0438 \u043f\u043e\u0440\u0430\u0434\u0443\u044e\u0442, \u0432\u0435\u0434\u044c \u0441\u0442\u0430\u043b\u043e \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0439 Trustwave \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 \u0434\u0435\u043a\u0440\u0438\u043f\u0442\u043e\u0440 \u0443\u0436\u0435 \u0431\u0435\u0441\u043f\u043e\u043b\u0435\u0437\u0435\u043d \u043f\u0435\u0440\u0435\u0434  \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u0431\u043e\u043b\u0435\u0435 \u0441\u0432\u0435\u0436\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 BlackByte.\n\n\u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f\u043c ProxyShell \u043a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, \u0443\u0436\u0435 \u043d\u0438\u043a\u043e\u0433\u043e \u043d\u0435 \u0443\u0434\u0438\u0432\u0438\u0448\u044c, \u043d\u043e \u0432\u0441\u0435 \u0436\u0435 \u0441\u0445\u0435\u043c\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u0432\u0440\u0435\u043c\u044f \u0434\u043b\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u0435\u0449\u0435 \u043f\u043e\u0437\u0430\u0432\u0447\u0435\u0440\u0430, \u043f\u0440\u0435\u0436\u0434\u0435 \u0432\u0441\u0435\u0433\u043e, \u0434\u043b\u044f \u0442\u0435\u0445, \u043a\u0442\u043e \u0435\u0449\u0435 \u043d\u0435 \u0437\u043d\u0430\u043a\u043e\u043c \u0441 ransomware.", "creation_timestamp": "2021-12-02T18:01:00.000000Z"}, {"uuid": "8df6f7fd-ac69-4063-9b13-8766b0e78107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/true_secator/1917", "content": "\u200b\u200b\u041e\u0442\u043b\u0438\u0447\u0438\u043b\u0441\u044f \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e SAP, \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0438 Microsoft \u0441\u0432\u043e\u0438\u043c \u044d\u043f\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u043f\u0430\u0442\u0447\u0435\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 117 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f 9 \u043e\u0448\u0438\u0431\u043e\u043a \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n\n\u0412 \u043e\u0431\u0449\u0435\u043c \u0440\u0430\u0441\u043a\u043b\u0430\u0434 \u0442\u0430\u043a\u043e\u0439: 13 \u0438\u043c\u0435\u044e\u0442 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445, 103 - \u0432\u0430\u0436\u043d\u044b\u0445, \u0430 1 - \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438.\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0442 Windows, Bing, Dynamics, Exchange Server, Office, Scripting Engine, Windows DNS \u0438 Visual Studio Code.\n\n\u041f\u043e\u0434 \u0437\u0430\u043a\u0430\u0442\u043e\u0447\u043d\u044b\u0439 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u0436\u0435 \u043f\u043e\u043f\u0430\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0439 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 (CVE-2021-34527), \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044f\u0434\u0440\u0430 Windows, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c\u00a0\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (CVE-2021-31979\u00a0\u0438 33771), \u043a\u043e\u0441\u044f\u043a\u0438 \u043c\u043e\u0434\u0443\u043b\u044f \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e\u00a0\u043f\u0430\u043c\u044f\u0442\u0438 (CVE-2021-34448).\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442: Microsoft Exchange Server (CVE-2021-34473\u00a0- \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 CVE-2021-34523\u00a0- \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439), Active Directory (CVE-2021-33781\u00a0- \u043e\u0431\u0445\u043e\u0434 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438), Windows ADFS (CVE-2021-33779\u00a0- \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e), Windows (CVE-2021-34492\u00a0- \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0438 CVE-2021-34458 - \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430), Windows DNS Server (CVE-2021-34494 - \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430).\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, Microsoft \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u043e\u043c\u0435\u0442\u0440\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Windows hello (CVE-2021-34466), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430\u00a0\u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043b\u0438\u0446\u043e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\n\nMSFT \u0432 \u0446\u0435\u043b\u043e\u043c \u0443\u0436\u0435 \u0431\u043b\u0438\u0437\u043a\u0438 \u0432 \u0442\u043e\u043c\u0443 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0442\u0440\u0430\u043d\u0441\u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u043e: \u0432 \u043c\u0430\u0435 \u0438 \u0438\u044e\u043d\u0435 \u043e\u043d\u0438 \u0437\u0430\u043a\u0440\u044b\u043b\u0438 55 \u0438 50 \u0434\u044b\u0440 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e. \u041d\u043e, \u0447\u0442\u043e-\u0442\u043e \u0437\u043d\u0430\u044f \u043c\u0435\u043b\u043a\u043e\u043c\u044f\u0433\u043a\u0438\u0445, \u0434\u0443\u043c\u0430\u0435\u0442, \u0447\u0442\u043e \u0438\u043c \u0435\u0449\u0451 \u0434\u043e\u043b\u0433\u043e \u0432\u0435\u0441\u0442\u0438 \u0431\u043e\u0439 \u0432 \u0442\u0435\u043d\u044c\u044e.", "creation_timestamp": "2021-07-14T16:59:39.000000Z"}, {"uuid": "3b2b04e8-e4f9-4c8e-b73c-657a54a19b88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/NeKaspersky/1158", "content": "\u041d\u043e\u0432\u044b\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Microsoft Exchange\n\nLockFile - \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440 \u043e\u0434\u043d\u043e\u0438\u043c\u0451\u043d\u043d\u043e\u0433\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0448\u0438\u0444\u0440\u0443\u0435\u0442 \u0434\u043e\u043c\u0435\u043d\u044b Windows \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange. \u0412\u0441\u0435\u0433\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f ProxyShell \u0431\u044b\u043b\u043e \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043e \u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430\u043c\u0438 \u0431\u043e\u043b\u0435\u0435 2000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432. \n\n\u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Microsoft, \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u0435\u0449\u0451 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0430\u0432\u0433\u0443\u0441\u0442\u0430. \u041e\u0431\u0449\u0435\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u0434\u043b\u044f \u043d\u0438\u0445 ProxyShell: \n\nCVE-2021-34473: Path Confusion \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0432\u0435\u0434\u0443\u0449\u0438\u0439 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 ACL (\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 \u0432\u00a0KB5001779);\n\nCVE-2021-34523: \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0431\u044d\u043a\u044d\u043d\u0434\u0435 Exchange PowerShell (\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 \u0432\u00a0KB5001779);\n\nCVE-2021-31207: \u0437\u0430\u043f\u0438\u0441\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0447\u0442\u043e \u0432\u0435\u0434\u0435\u0442 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 (\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 \u043c\u0430\u0435 \u0432\u00a0KB5003435).\n\nPoC \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 6 \u0430\u0432\u0433\u0443\u0441\u0442\u0430, \u043d\u043e 8 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u0431\u043e\u043b\u0435\u0435 30 000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u0434\u043b\u044f \u0430\u0442\u0430\u043a. \u0423\u043f\u0440\u043e\u0441\u0442\u0438\u043b\u043e \u0437\u0430\u0434\u0430\u0447\u0443 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0444\u043e\u0440\u0443\u043c\u043e\u0432 \u0441\u043f\u0438\u0441\u043a\u0430 100 000 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Exchange. \n\nMicrosoft \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u043f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e \u043d\u0435 \u0432\u0441\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0442\u043e\u0440\u043e\u043f\u044f\u0442\u0441\u044f \u0441 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u043f\u0430\u0442\u0447\u0435\u0439.", "creation_timestamp": "2021-08-23T23:01:21.000000Z"}, {"uuid": "130f0346-0909-4ff6-b4d2-8633bd23c4e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/NeKaspersky/2147", "content": "Hive \u043d\u0430\u0446\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Microsoft Exchange\n\n\u041f\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 Varonis, \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0440\u0430\u043d\u0441\u043e\u043c\u0432\u0430\u0440\u0449\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 ProxyShell \u2014 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u0438\u0437 \u0442\u0440\u0435\u0445 \u0431\u0430\u0433\u043e\u0432 (CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31297), \u0434\u0430\u044e\u0449\u0438\u0439 RCE \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \n\n\u0412 \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u043c\u043e\u043c \u043a\u0435\u0439\u0441\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u0448\u0430\u0433\u043e\u043c \u0441\u0442\u0430\u043b\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u043e\u043f\u0435\u043d\u0441\u043e\u0440\u0441\u043d\u044b\u0445 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 .ps-\u0441\u043a\u0440\u0438\u043f\u0442\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Cobalt Strike. \u0417\u0430\u043f\u0443\u0441\u0442\u0438\u0432 Mimikatz \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0437\u0430\u0431\u0435\u043a\u0434\u043e\u0440\u0435\u043d\u043d\u043e\u0439 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0443\u0447\u0435\u0442\u043a\u0438, \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u044b\u0442\u044c \u043a\u0440\u0435\u0434\u0435\u043d\u0448\u043b\u044b \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0431\u043e\u043a\u043e\u0432\u043e\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435.  \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0437\u0430\u043d\u044f\u0442\u043d\u043e, \u0440\u0435\u0448\u0438\u043b\u0438 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0439 \u0442\u0443\u043b\u0437\u043e\u0439 \u00abSoftPerfect Network Scanner\u00bb: \u0441 \u0435\u0433\u043e \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0438\u0441\u043a\u0430\u043b\u0438 \u0436\u0438\u0432\u044b\u0435 \u0445\u043e\u0441\u0442\u044b \u0432 \u0441\u0435\u0442\u0438, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0438 \u0441\u0432\u043e\u044e \u043c\u0430\u043b\u0432\u0430\u0440\u044c.\n\n\u0417\u0430\u0442\u0435\u043c \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445 \u0438\u0441\u043a\u0430\u043b\u0438 \u0432\u0430\u0436\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438\u0433\u0440\u043e\u0437\u0438\u0442\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0432\u044b\u043a\u0443\u043f\u0430.  \u041a\u043e\u0433\u0434\u0430 \u0441 \u044d\u0442\u0438\u043c \u0431\u044b\u043b\u043e \u043f\u043e\u043a\u043e\u043d\u0447\u0435\u043d\u043e, \u0440\u0430\u043d\u0441\u043e\u043c\u0432\u0430\u0440\u0449\u0438\u043a\u0438 (\u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043f\u043e\u0441\u043b\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0430\u043f\u043e\u0432, \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0417\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0430 Windows \u0438 \u0437\u0430\u043c\u0435\u0442\u0430\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432) \u0441\u0432\u0430\u043b\u0438\u043b\u0438 \u0432 \u0437\u0430\u043a\u0430\u0442, \u043e\u0441\u0442\u0430\u0432\u0438\u0432 \u043f\u043e\u0441\u043b\u0435 \u0441\u0435\u0431\u044f \u043b\u0438\u0448\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0430\u0437\u0432\u0430\u043b\u0438 Windows.exe.\n@NeKaspersky", "creation_timestamp": "2022-04-21T16:39:23.000000Z"}, {"uuid": "d836042d-c8eb-4ab2-bc37-bccf5e78e914", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/cibsecurity/26163", "content": "\u203c CVE-2021-33768 \u203c\n\nMicrosoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-34470, CVE-2021-34523.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-14T22:31:53.000000Z"}, {"uuid": "1ed00889-5ebe-4f4a-908a-01d5ab1c439e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/SecLabNews/12481", "content": "\u0423 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0435\u0449\u0435 \u043c\u0435\u043d\u044c\u0448\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0447\u0435\u043c \u0441\u0447\u0438\u0442\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u043d\u0435\u0435.\n\n\u041d\u043e\u0432\u044b\u0439\u00a0\u043e\u0442\u0447\u0435\u0442 \u0437\u0430 2022 \u0433\u043e\u0434 Palo Alto Unit 42 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0445\u043e\u0441\u0442\u044b \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 15 \u043c\u0438\u043d\u0443\u0442 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043d\u043e\u0432\u044b\u0439 CVE \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c.\n\nPalo Alto Unit 42 \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u041f\u041e \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u0434\u043b\u044f RCE. \n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u043f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0440\u043e\u0441\u043b\u0430.\n\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043e\u0441\u043e\u0431\u044b\u0445 \u0443\u0441\u0438\u043b\u0438\u0439 \u043d\u0438\u0437\u043a\u043e\u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u0435\u0434\u0443\u0442 \u043c\u043e\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0434\u0430\u044e\u0442 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0441\u0432\u043e\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0434\u0430\u0440\u043a\u043d\u0435\u0442\u0435 \u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u044b\u0442\u043d\u044b\u043c \u0445\u0430\u043a\u0435\u0440\u0430\u043c, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u043c \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0422\u0430\u043a, \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-1388 \u0432 F5 BIG-IP \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 4 \u043c\u0430\u044f 2022 \u0433\u043e\u0434\u0430, \u0438, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Unit 42, \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u0441\u044f\u0442\u044c \u0447\u0430\u0441\u043e\u0432 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0431\u044b\u043b\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e 2552 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0435 Palo Alto, \u0441\u0440\u0435\u0434\u0438 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0438 \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043f\u043e\u043b\u0443\u0433\u043e\u0434\u0438\u0438 2022\u00a0\u0433\u043e\u0434\u0430 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 ProxyShell (CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31207), \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0434\u043e 55% \u043e\u0442 \u043e\u0431\u0449\u0435\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432.\u00a0\n\n\u041d\u0430 \u0432\u0442\u043e\u0440\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u043b\u0441\u044f Log4Shell \u0441 14%, \u0434\u0430\u043b\u0435\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 CVE SonicWall \u2014 7%, ProxyLogon \u2014 5%, \u0430 RCE \u0432\u00a0Zoho ManageEngine ADSelfService Plus \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0432 3% \u0441\u043b\u0443\u0447\u0430\u0435\u0432.\n\n\u041a\u0430\u043a \u0432\u0438\u0434\u043d\u043e \u0438\u0437 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438, \u043b\u044c\u0432\u0438\u043d\u0430\u044f \u0434\u043e\u043b\u044f \u0432 \u043e\u0431\u044a\u0435\u043c\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043d\u0435 \u0441\u0430\u043c\u044b\u0435 \u0441\u0432\u0435\u0436\u0438\u0435, \u0430 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 CVE, \u0447\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0438 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0430\u0442\u0430\u043a\u0443\u044e\u0442\u0441\u044f \u0447\u0430\u0449\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c 0-day \u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0435\u043e\u0431\u044a\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Unit 42, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u041f\u041e \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043e\u0434\u043d\u0443 \u0442\u0440\u0435\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u0432\u0441\u0435\u0445 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0439.\n\n\u0412 37% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0444\u0438\u0448\u0438\u043d\u0433 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u043f\u043e\u0447\u0442\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\u00a0\u0412 15% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u043e\u043d\u0438\u043a\u0430\u043b\u0438 \u0432 \u0441\u0435\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0421\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0434\u043a\u0443\u043f \u0438\u043d\u0441\u0430\u0439\u0434\u0435\u0440\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 10% \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432.\n\n\u0412\u044b\u0432\u043e\u0434\u044b \u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u0441\u0430\u043c\u0438: \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430.", "creation_timestamp": "2022-07-28T07:20:54.000000Z"}, {"uuid": "565cd207-4ef9-4e79-924f-3b045fd59738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/forensictools/469", "content": "RedTeam Toolkit\n[https://github.com/signorrayan/RedTeam_toolkit]\n\nweb-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Python (Django), \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0435 \u043d\u0430\u0431\u043e\u0440 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 red-team \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u043b\u0435\u0436\u0430\u0442 \u0442\u0430\u043a\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u043a\u0430\u043a nmap, rustscan, dirsearch, shreder, circl, crowbar \u0438 \u0442.\u0434.\n\n\u2022 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0446\u0435\u043b\u0438\n\u2022 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0436\u0438\u0432\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0432 \u043f\u043e\u0434\u0441\u0435\u0442\u0438\n\u2022 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 \u0446\u0435\u043b\u0438\n\u2022 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 CVE \u043f\u043e CveID\n\u2022 \u0430\u0442\u0430\u043a\u0430 \u043f\u043e \u0441\u043b\u043e\u0432\u0430\u0440\u044e SSH\n\u2022 RDP BruteForce\n\u2022 \u0440\u0430\u0437\u0434\u0435\u043b WebApps: Apache Path Traversal PoC (CVE-2021-41773), \u0412\u0435\u0431-\u043a\u0440\u0430\u0443\u043b\u0435\u0440 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 URL-\u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435 \u0441\u0443\u0431\u0434\u043e\u043c\u0435\u043d\u043e\u0432\n\u2022 \u0440\u0430\u0437\u0434\u0435\u043b Windows (\u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u0442\u0441\u044f, \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 CVE \u0431\u0443\u0434\u0443\u0442 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u044b): Microsoft Exchange ProxyShell PoC (CVE-2021-34523, CVE-2021-34473, CVE-2021-31207)\n\u2022 \u0440\u0430\u0437\u0434\u0435\u043b Linux \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 CVE \u0432 Linux \u0442\u0430\u043a\u0436\u0435 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\n\n#pentest #python #redteam #vulns", "creation_timestamp": "2021-11-29T11:51:06.000000Z"}, {"uuid": "77282e55-73a8-4eff-9c04-c48cbaf5af70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1683", "content": "POC for scanning ProxyShell (CVE-2021-34523,CVE-2021-34473,CVE-2021-31207) https://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2026-08-03T05:00:04.027633Z"}, {"uuid": "44c882c6-9616-473c-b45e-a84d5d053922", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/Linux_Arabs/60", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2024-11-02T22:56:11.000000Z"}, {"uuid": "6786685c-23da-45c7-99df-804d2a858b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1683", "content": "POC for scanning ProxyShell (CVE-2021-34523,CVE-2021-34473,CVE-2021-31207) https://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2026-08-04T01:00:25.896130Z"}, {"uuid": "947c9220-d87b-4f42-a661-43031c6f40b6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1988d76b-6513-4205-8db3-5e0a327bd38b", "content": "", "creation_timestamp": "2026-06-19T12:47:50.088400Z"}, {"uuid": "6bbc05f2-3b4c-4480-902f-452c17d7326d", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/00b23576-4b17-447d-89fb-15f0d8f84c97", "content": "", "creation_timestamp": "2026-06-23T14:04:38.817854Z"}, {"uuid": "4313495b-1bbb-41cb-a10a-91d0490aaeaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3msqvm45rhs2z", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2021-34523: Microsoft Exchange Server Elevation of Privilege Vulnerability\nCVSS 9 \u00b7 EPSS 100.0% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2021-34523\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-10T20:06:35.958345Z"}, {"uuid": "e6baa4a4-60fd-43a4-9e4f-de393718da9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/b4779706-9ec4-44cb-afe8-97771711623b", "content": "", "creation_timestamp": "2026-07-11T03:15:04.767536Z"}, {"uuid": "effb853a-f512-4d22-9e10-1412bbc9f1eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/b4779706-9ec4-44cb-afe8-97771711623b", "content": "", "creation_timestamp": "2026-07-12T00:15:03.128846Z"}, {"uuid": "b4cb6b39-b9b9-4c17-a0a7-5ffe91c79fa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/securixy_kz/659", "content": "\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell\n\n\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u043c\u0435\u043d\u0443\u0435\u043c\u0430\u044f \u043a\u0430\u043a LockFile, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell.\n\nProxyShell - \u044d\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0451\u0445 (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0451 \u0432 \u043c\u0430\u0435 2021 \u0433\u043e\u0434\u0430, 5 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA 2021 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u044f\u0445 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 MS Exchange \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2021-31195, CVE-2021-31196, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u0432\u0442\u043e\u0440\u0443\u044e \u0436\u0438\u0437\u043d\u044c.\n\n\u0412\u0441\u0435\u043c\u0443 \u041a\u0430\u0437\u043d\u0435\u0442\u0443, \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c \u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0441\u043e\u0432\u0435\u0442\u0443\u0435\u043c \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u043b\u0430\u0442\u043a\u0438.", "creation_timestamp": "2026-07-12T22:00:13.845442Z"}, {"uuid": "9d796fb2-ce6d-49b2-a719-be9c61dd0ebb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/securixy_kz/660", "content": "\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31195\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31195\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\nCVSS Score: 8.8 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31196\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34473\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34523\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MS Exchange\nCVE-ID: CVE-2021-31207\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31207\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b:\nMicrosoft Exchange Server 2013\nMicrosoft Exchange Server 2016\nMicrosoft Exchange Server 2019", "creation_timestamp": "2026-07-12T22:00:13.630277Z"}, {"uuid": "2a14be84-19cb-4da8-9a83-ad93196a8fd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/securixy_kz/660", "content": "\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31195\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31195\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\nCVSS Score: 8.8 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31196\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34473\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34523\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MS Exchange\nCVE-ID: CVE-2021-31207\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31207\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b:\nMicrosoft Exchange Server 2013\nMicrosoft Exchange Server 2016\nMicrosoft Exchange Server 2019", "creation_timestamp": "2026-07-13T00:00:37.576606Z"}, {"uuid": "5e184a37-9d4a-4853-9028-c216ef5b17e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/securixy_kz/659", "content": "\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell\n\n\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u043c\u0435\u043d\u0443\u0435\u043c\u0430\u044f \u043a\u0430\u043a LockFile, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell.\n\nProxyShell - \u044d\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0451\u0445 (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0451 \u0432 \u043c\u0430\u0435 2021 \u0433\u043e\u0434\u0430, 5 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA 2021 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u044f\u0445 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 MS Exchange \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2021-31195, CVE-2021-31196, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u0432\u0442\u043e\u0440\u0443\u044e \u0436\u0438\u0437\u043d\u044c.\n\n\u0412\u0441\u0435\u043c\u0443 \u041a\u0430\u0437\u043d\u0435\u0442\u0443, \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c \u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0441\u043e\u0432\u0435\u0442\u0443\u0435\u043c \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u043b\u0430\u0442\u043a\u0438.", "creation_timestamp": "2026-07-13T00:00:37.798270Z"}, {"uuid": "9f628041-889b-4087-9893-8625fd590ca5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/securixy_kz/659", "content": "\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell\n\n\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u043c\u0435\u043d\u0443\u0435\u043c\u0430\u044f \u043a\u0430\u043a LockFile, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell.\n\nProxyShell - \u044d\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0451\u0445 (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0451 \u0432 \u043c\u0430\u0435 2021 \u0433\u043e\u0434\u0430, 5 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA 2021 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u044f\u0445 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 MS Exchange \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2021-31195, CVE-2021-31196, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u0432\u0442\u043e\u0440\u0443\u044e \u0436\u0438\u0437\u043d\u044c.\n\n\u0412\u0441\u0435\u043c\u0443 \u041a\u0430\u0437\u043d\u0435\u0442\u0443, \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c \u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0441\u043e\u0432\u0435\u0442\u0443\u0435\u043c \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u043b\u0430\u0442\u043a\u0438.", "creation_timestamp": "2026-07-14T00:00:55.295932Z"}, {"uuid": "17b42913-c348-4899-b8fb-f3c207349de1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/securixy_kz/660", "content": "\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31195\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31195\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\nCVSS Score: 8.8 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31196\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34473\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34523\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MS Exchange\nCVE-ID: CVE-2021-31207\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31207\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b:\nMicrosoft Exchange Server 2013\nMicrosoft Exchange Server 2016\nMicrosoft Exchange Server 2019", "creation_timestamp": "2026-07-14T00:00:55.557039Z"}, {"uuid": "121f1916-cbd7-4d9c-867e-a6adc1f59f32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/EchelonEyes/232", "content": "\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438, \u041a\u0430\u043d\u0430\u0434\u044b, \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 \u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0430\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0432 2021-\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA). \u041e\u043d \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430c\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 (CISA, \u0410\u041d\u0411, \u0424\u0411\u0420), \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 (\u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - ACSC), \u041a\u0430\u043d\u0430\u0434\u044b (\u041a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - CCCS), \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 - NZ NCSC) \u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 - NCSC-UK).\n\n\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0432\u0430 \u0441\u043f\u0438\u0441\u043a\u0430: \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439, \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e 15 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n1. CVE-2021-44228, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u043a\u0430\u043a Log4Shell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Apache Log4j. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n2. CVE-2021-40539, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Zoho ManageEngine AD SelfService Plus. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n3 \u2013 5. CVE-2021-34523, CVE-2021-34473, CVE-2021-31207, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyShell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n6 \u2013 9. CVE-2021-27065, CVE-2021-26858, CVE-2021-26857, CVE-2021-26855, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyLogon. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server. \u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n10. CVE-2021-26084, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Atlassian Confluence Server and Data Center. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n11. CVE-2021-21972, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 VMware vSphere Client. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n12. CVE-2020-1472, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Netlogon Remote Protocol (MS-NRPC). \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n13. CVE-2020-0688, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Exchange Server. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n14. CVE-2019-11510, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Pulse Secure Pulse Connect Secure. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n15. CVE-2018-13379, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Fortinet FortiOS and FortiProxy. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u0415\u0449\u0435 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Sitecore XP, ForgeRock OpenAM server, Accellion FTA, SonicWall Secure Mobile Access (SMA), VMware vCenter Server, Checkbox Survey, QNAP QTS and QuTS hero, Cisco IOS Software and IOS XE Software, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u044f\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0438 \u0441\u043b\u0443\u0436\u0431 Microsoft Windows. \n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0434\u0435\u043b\u044f\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u0430\u0445. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/uscert/ncas/alerts/aa22-117a", "creation_timestamp": "2026-07-17T05:00:05.920595Z"}, {"uuid": "c296c0e0-e6ae-4af3-a1d9-fbacb57a8761", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/rtinfobez/244", "content": "KillChain: \u0437\u0430\u043a\u0443\u043b\u0438\u0441\u044c\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0430\u0442\u0430\u043a\u0438\n\n\ud83d\udce2 \u041f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u0410\u043d\u0434\u0440\u0435\u0439 \u0424\u0435\u0434\u043e\u0440\u043e\u0432, \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f RT Protect SOC. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c \u043f\u0435\u0440\u0432\u0443\u044e \u0433\u043b\u0430\u0432\u0443 \u0440\u0430\u0437\u0431\u043e\u0440\u0430: \u043a\u0430\u043a \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443. \u0413\u043e\u0442\u043e\u0432\u044b \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043f\u043e \u0442\u0443 \u0441\u0442\u043e\u0440\u043e\u043d\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438?\n\n\u042d\u0442\u0430\u043f 0 \u2014 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 \u043a \u0430\u0442\u0430\u043a\u0435\n\u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043d\u0430\u0447\u043d\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0435\u043c\u0443 \u043d\u0443\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438 \u0441\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443.\n\u26ab\ufe0f \u0412 \u043d\u0430\u0448\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u043d \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Exchange Server \u0432\u0435\u0440\u0441\u0438\u0438 2016 CU12, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u043c\u0435\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207). \n\u26ab\ufe0f \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0443\u044f\u0437\u0432\u0438\u043c \u0434\u043b\u044f ProxyShell, \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0442\u043e\u0447\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Exchange. \n\u26ab\ufe0f ProxyShell \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0415\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Exchange 2016 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d \u0434\u043e Cumulative Update 21, \u043e\u043d \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439.\n\n\u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \n\ud83d\udcce \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Metasploit \n\ud83d\udcce BOF MiniDumpWriteDump\n\ud83d\udcce \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 pypykatz\n\ud83d\udcce \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 CrackMapExec\n\ud83d\udcce \u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u0441\u043a\u0430\u043d\u0435\u0440 Nmap\n\ud83d\udcce \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 John The Ripper\n\ud83d\udcce \u0423\u0442\u0438\u043b\u0438\u0442\u0430 PsExec\n\n\u042d\u0442\u0430\u043f 1 \u2014 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\u0412 Metasploit \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043d\u0430\u0445\u043e\u0434\u0438\u0442 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0443. \n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442? \u041e\u043d \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Microsoft Exchange. \u041c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u041d\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0442\u043e\u0436\u0435 \u043d\u0435 \u0441\u043f\u0438\u0442.\n\n\u041a\u0430\u043a \u043e\u0442\u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043b RT Protect EDR? \n\u0417\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0442\u0440\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430: \n1\ufe0f\u20e3 \u0414\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 MSExchangeMailboxReplication.exe. \n2\ufe0f\u20e3 \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \n\u0412\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 System. \n3\ufe0f\u20e3 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e PowerShell-\u043a\u043e\u0434\u0430\n\u0422\u0440\u0435\u0442\u0438\u0439 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0432\u043e\u0437\u043d\u0438\u043a \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 powershell \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f base64 \u0441\u0442\u0440\u043e\u043a\u0438.\n\n\u0418\u0442\u043e\u0433\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u0444\u0430\u0437\u044b \u0430\u0442\u0430\u043a\u0438\n\u2b1b\ufe0f \u0427\u0442\u043e \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443?\n\u0423\u0441\u043f\u0435\u0448\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\n\u2b1b\ufe0f \u0427\u0442\u043e \u0443\u0432\u0438\u0434\u0435\u043b RT Protect EDR? \n\u0414\u0430\u043d\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 RT Protect EDR \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u043b\u0430 \u0431\u044b\u0442\u044c \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0430.\n\n\ud83d\udd25 \u041f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0442\u0435\u0441\u044c, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u0442\u044c\n\u0421\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0432\u044b\u0439\u0434\u0435\u0442 \u0440\u043e\u0432\u043d\u043e \u0447\u0435\u0440\u0435\u0437 7 \u0434\u043d\u0435\u0439!\n\n#KillChain", "creation_timestamp": "2026-07-17T11:00:04.317567Z"}, {"uuid": "7825052b-4ff0-4f09-8878-092b770ea638", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/rtinfobez/244", "content": "KillChain: \u0437\u0430\u043a\u0443\u043b\u0438\u0441\u044c\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0430\u0442\u0430\u043a\u0438\n\n\ud83d\udce2 \u041f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u0410\u043d\u0434\u0440\u0435\u0439 \u0424\u0435\u0434\u043e\u0440\u043e\u0432, \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f RT Protect SOC. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c \u043f\u0435\u0440\u0432\u0443\u044e \u0433\u043b\u0430\u0432\u0443 \u0440\u0430\u0437\u0431\u043e\u0440\u0430: \u043a\u0430\u043a \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443. \u0413\u043e\u0442\u043e\u0432\u044b \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043f\u043e \u0442\u0443 \u0441\u0442\u043e\u0440\u043e\u043d\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438?\n\n\u042d\u0442\u0430\u043f 0 \u2014 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 \u043a \u0430\u0442\u0430\u043a\u0435\n\u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043d\u0430\u0447\u043d\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0435\u043c\u0443 \u043d\u0443\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438 \u0441\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443.\n\u26ab\ufe0f \u0412 \u043d\u0430\u0448\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u043d \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Exchange Server \u0432\u0435\u0440\u0441\u0438\u0438 2016 CU12, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u043c\u0435\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207). \n\u26ab\ufe0f \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0443\u044f\u0437\u0432\u0438\u043c \u0434\u043b\u044f ProxyShell, \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0442\u043e\u0447\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Exchange. \n\u26ab\ufe0f ProxyShell \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0415\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Exchange 2016 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d \u0434\u043e Cumulative Update 21, \u043e\u043d \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439.\n\n\u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \n\ud83d\udcce \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Metasploit \n\ud83d\udcce BOF MiniDumpWriteDump\n\ud83d\udcce \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 pypykatz\n\ud83d\udcce \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 CrackMapExec\n\ud83d\udcce \u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u0441\u043a\u0430\u043d\u0435\u0440 Nmap\n\ud83d\udcce \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 John The Ripper\n\ud83d\udcce \u0423\u0442\u0438\u043b\u0438\u0442\u0430 PsExec\n\n\u042d\u0442\u0430\u043f 1 \u2014 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\u0412 Metasploit \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043d\u0430\u0445\u043e\u0434\u0438\u0442 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0443. \n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442? \u041e\u043d \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Microsoft Exchange. \u041c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u041d\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0442\u043e\u0436\u0435 \u043d\u0435 \u0441\u043f\u0438\u0442.\n\n\u041a\u0430\u043a \u043e\u0442\u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043b RT Protect EDR? \n\u0417\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0442\u0440\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430: \n1\ufe0f\u20e3 \u0414\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 MSExchangeMailboxReplication.exe. \n2\ufe0f\u20e3 \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \n\u0412\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 System. \n3\ufe0f\u20e3 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e PowerShell-\u043a\u043e\u0434\u0430\n\u0422\u0440\u0435\u0442\u0438\u0439 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0432\u043e\u0437\u043d\u0438\u043a \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 powershell \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f base64 \u0441\u0442\u0440\u043e\u043a\u0438.\n\n\u0418\u0442\u043e\u0433\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u0444\u0430\u0437\u044b \u0430\u0442\u0430\u043a\u0438\n\u2b1b\ufe0f \u0427\u0442\u043e \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443?\n\u0423\u0441\u043f\u0435\u0448\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\n\u2b1b\ufe0f \u0427\u0442\u043e \u0443\u0432\u0438\u0434\u0435\u043b RT Protect EDR? \n\u0414\u0430\u043d\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 RT Protect EDR \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u043b\u0430 \u0431\u044b\u0442\u044c \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0430.\n\n\ud83d\udd25 \u041f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0442\u0435\u0441\u044c, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u0442\u044c\n\u0421\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0432\u044b\u0439\u0434\u0435\u0442 \u0440\u043e\u0432\u043d\u043e \u0447\u0435\u0440\u0435\u0437 7 \u0434\u043d\u0435\u0439!\n\n#KillChain", "creation_timestamp": "2026-07-18T00:00:31.242625Z"}, {"uuid": "93bf93ca-1640-4bf3-9f8c-2737d196b249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/EchelonEyes/232", "content": "\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438, \u041a\u0430\u043d\u0430\u0434\u044b, \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 \u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0430\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0432 2021-\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA). \u041e\u043d \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430c\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 (CISA, \u0410\u041d\u0411, \u0424\u0411\u0420), \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 (\u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - ACSC), \u041a\u0430\u043d\u0430\u0434\u044b (\u041a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - CCCS), \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 - NZ NCSC) \u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 - NCSC-UK).\n\n\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0432\u0430 \u0441\u043f\u0438\u0441\u043a\u0430: \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439, \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e 15 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n1. CVE-2021-44228, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u043a\u0430\u043a Log4Shell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Apache Log4j. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n2. CVE-2021-40539, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Zoho ManageEngine AD SelfService Plus. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n3 \u2013 5. CVE-2021-34523, CVE-2021-34473, CVE-2021-31207, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyShell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n6 \u2013 9. CVE-2021-27065, CVE-2021-26858, CVE-2021-26857, CVE-2021-26855, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyLogon. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server. \u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n10. CVE-2021-26084, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Atlassian Confluence Server and Data Center. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n11. CVE-2021-21972, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 VMware vSphere Client. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n12. CVE-2020-1472, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Netlogon Remote Protocol (MS-NRPC). \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n13. CVE-2020-0688, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Exchange Server. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n14. CVE-2019-11510, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Pulse Secure Pulse Connect Secure. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n15. CVE-2018-13379, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Fortinet FortiOS and FortiProxy. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u0415\u0449\u0435 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Sitecore XP, ForgeRock OpenAM server, Accellion FTA, SonicWall Secure Mobile Access (SMA), VMware vCenter Server, Checkbox Survey, QNAP QTS and QuTS hero, Cisco IOS Software and IOS XE Software, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u044f\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0438 \u0441\u043b\u0443\u0436\u0431 Microsoft Windows. \n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0434\u0435\u043b\u044f\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u0430\u0445. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/uscert/ncas/alerts/aa22-117a", "creation_timestamp": "2026-07-18T00:00:37.782895Z"}, {"uuid": "2f7963ff-28ff-47ce-a5c9-203db69d7a52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/cec219ff-8f6d-45c9-bdbb-b4fb8c9c0f2b", "content": "", "creation_timestamp": "2026-07-23T21:15:02.594525Z"}, {"uuid": "72008188-15fe-4fa8-8820-fe921b19df62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/cec219ff-8f6d-45c9-bdbb-b4fb8c9c0f2b", "content": "", "creation_timestamp": "2026-07-24T00:15:03.309976Z"}, {"uuid": "7e9428f9-caa3-458e-824b-5e83ffe3f37b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/469a09e8-cdbb-405e-b1fa-87ee37a92c1b", "content": "", "creation_timestamp": "2026-07-25T06:15:04.515126Z"}, {"uuid": "b9c28725-48e4-4d90-99a1-8992fc9fd8ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "MISP/469a09e8-cdbb-405e-b1fa-87ee37a92c1b", "content": "", "creation_timestamp": "2026-07-26T00:15:02.107074Z"}, {"uuid": "1008c4dc-bc98-45c9-9127-1b11626afbbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/EchelonEyes/1201", "content": "ProxyShellMiner \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u044f \u0441\u0447\u0435\u0442\u0430 \u0437\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u0438\u0447\u0435\u0441\u0442\u0432\u043e\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Morphisec \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e ProxyShellMiner \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438 Windows.\n\n\u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0437 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f, ProxyShellMiner \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ProxyShell CVE-2021-34473  \u0438 CVE-2021-34523 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows Exchange \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u043c\u0430\u0439\u043d\u0435\u0440\u0430. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exchange \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u0430\u043f\u043a\u0443 NETLOGON \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430, \u0447\u0442\u043e\u0431\u044b \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u043c\u0430\u0439\u043d\u0435\u0440 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u0443, \u043f\u043e\u0434\u043e\u0431\u043d\u043e \u0442\u043e\u043c\u0443, \u043a\u0430\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 (GPO). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0447\u0435\u0442\u044b\u0440\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438. \n\n\u041e\u0431\u0440\u0430\u0437\u0446\u044b, \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 Morphisec, \u0442\u0440\u0435\u0431\u0443\u044e\u0442 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u00ab000\u00bb. \u041f\u043e\u0437\u0436\u0435 \u044d\u0442\u043e\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043b\u044e\u0447\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043c\u0430\u0439\u043d\u0435\u0440\u0430 XMRig \u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f.\n\nProxyShellMiner \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0441\u043b\u043e\u0432\u0430\u0440\u044c, \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 XOR \u0438 \u043a\u043b\u044e\u0447 XOR, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440 C# CSC.exe \u0441 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u0438 \u00abInMemory\u00bb \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u041d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u044d\u0442\u0430\u043f\u0435 ProxyShellMiner \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0444\u0430\u0439\u043b \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u00abDC_DLL\u00bb \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 .NET-\u0440\u0435\u0444\u043b\u0435\u043a\u0441\u0438\u044e \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442 \u0442\u0430\u043a\u0438\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u0430\u043a \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0449\u0438\u043a \u0437\u0430\u0434\u0430\u0447, XML \u0438 \u043a\u043b\u044e\u0447 XMRig. \u0410\u0432\u0442\u043e\u0440 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u0440\u0430\u0437\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 Confuser, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043f\u0443\u0442\u044b\u0432\u0430\u0435\u0442 \u043a\u043e\u0434.\n\n\u0427\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u0441\u0442\u0432\u043e, \u043c\u0430\u0439\u043d\u0435\u0440 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0437\u0430\u0434\u0430\u0447\u0443, \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0437\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u0438 \u0432\u0445\u043e\u0434\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u0441\u043b\u0435\u0434\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Deflate \u0434\u043b\u044f \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u0437\u0430\u0434\u0430\u0447 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 .XML.\n\n\u0414\u0430\u043b\u0435\u0435 \u043c\u0430\u0439\u043d\u0435\u0440 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u0438 \u0438\u043c\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 (7826F246.exe) \u0432 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f Defender \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0444\u0430\u0439\u043b\u0430 \u043a\u0430\u043a \u00ab\u0441\u043a\u0440\u044b\u0442\u044b\u0439\u00bb, \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439\u00bb \u0438 \u00ab\u043d\u0435\u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u0443\u0435\u043c\u044b\u0439\u00bb.\n\n\u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0438\u043c\u0435\u0435\u0442 \u043a\u043b\u044e\u0447 \u0434\u043b\u044f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432: \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u00abLC_DLL\u00bb, \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 XMrig \u0438 \u0434\u0432\u0443\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u0417\u0430\u0442\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0444\u0430\u0439\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 XMrig \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a IP-\u0430\u0434\u0440\u0435\u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 XMrig, \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044c, \u043f\u0435\u0440\u0435\u0434\u0430\u043d\u043d\u044b\u0439 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u0442\u043e\u0440\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043b\u0438 \u0432 \u043f\u0443\u0442\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 WinRing0x64.sys, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u0438 \u0445\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430 \u0441\u0447\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u043c MSR. \u0415\u0441\u043b\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u043d\u0435 \u043d\u0430\u0439\u0434\u0435\u043d, \u043e\u043d \u043f\u0438\u0448\u0435\u0442\u0441\u044f \u0438\u0437 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 sys, \u0430 \u0441\u043b\u0435\u0434\u043e\u043c \u043d\u0430 \u043d\u0435\u0433\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u00ab\u0441\u043a\u0440\u044b\u0442\u044b\u0439\u00bb, \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439\u00bb \u0438 \u00ab\u043d\u0435\u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u0443\u0435\u043c\u044b\u0439\u00bb.\n\n\u041d\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c \u044d\u0442\u0430\u043f\u0435 ProxyShellMiner \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u0430, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0432\u0435\u0441\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u0430 \u0437\u0430\u0442\u0435\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 \u043e\u0434\u0438\u043d \u0438\u0437 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 XMrig \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 RunPE.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e ProxyShellMiner \u0437\u0430\u043c\u0435\u0434\u043b\u044f\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0435\u0442\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0441\u0447\u0435\u0442\u0430 \u0437\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u044d\u043d\u0435\u0440\u0433\u0438\u044e, \u043f\u0435\u0440\u0435\u0433\u0440\u0435\u0432\u0430\u0435\u0442 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441\u043b\u0443\u0436\u0431. \u041e\u0434\u043d\u0430\u043a\u043e \u0433\u043b\u0430\u0432\u043d\u0430\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e, \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0432\u0448\u0438\u0441\u044c \u0432 \u0441\u0435\u0442\u0438 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0432 \u0431\u044d\u043a\u0434\u043e\u0440\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432 \u0441\u0435\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://blog.morphisec.com/proxyshellminer-campaign \n\n#ProxyShellMiner", "creation_timestamp": "2026-07-26T02:02:29.979860Z"}, {"uuid": "271ad111-9e7c-4b4a-a37f-f771f63f2ca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/EchelonEyes/1201", "content": "ProxyShellMiner \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u044f \u0441\u0447\u0435\u0442\u0430 \u0437\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u0438\u0447\u0435\u0441\u0442\u0432\u043e\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Morphisec \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e ProxyShellMiner \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438 Windows.\n\n\u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0437 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f, ProxyShellMiner \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ProxyShell CVE-2021-34473  \u0438 CVE-2021-34523 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows Exchange \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u043c\u0430\u0439\u043d\u0435\u0440\u0430. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exchange \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u0430\u043f\u043a\u0443 NETLOGON \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430, \u0447\u0442\u043e\u0431\u044b \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u043c\u0430\u0439\u043d\u0435\u0440 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u0443, \u043f\u043e\u0434\u043e\u0431\u043d\u043e \u0442\u043e\u043c\u0443, \u043a\u0430\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 (GPO). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0447\u0435\u0442\u044b\u0440\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438. \n\n\u041e\u0431\u0440\u0430\u0437\u0446\u044b, \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 Morphisec, \u0442\u0440\u0435\u0431\u0443\u044e\u0442 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u00ab000\u00bb. \u041f\u043e\u0437\u0436\u0435 \u044d\u0442\u043e\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043b\u044e\u0447\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043c\u0430\u0439\u043d\u0435\u0440\u0430 XMRig \u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f.\n\nProxyShellMiner \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0441\u043b\u043e\u0432\u0430\u0440\u044c, \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 XOR \u0438 \u043a\u043b\u044e\u0447 XOR, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440 C# CSC.exe \u0441 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u0438 \u00abInMemory\u00bb \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u041d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u044d\u0442\u0430\u043f\u0435 ProxyShellMiner \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0444\u0430\u0439\u043b \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u00abDC_DLL\u00bb \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 .NET-\u0440\u0435\u0444\u043b\u0435\u043a\u0441\u0438\u044e \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442 \u0442\u0430\u043a\u0438\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u0430\u043a \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0449\u0438\u043a \u0437\u0430\u0434\u0430\u0447, XML \u0438 \u043a\u043b\u044e\u0447 XMRig. \u0410\u0432\u0442\u043e\u0440 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u0440\u0430\u0437\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 Confuser, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043f\u0443\u0442\u044b\u0432\u0430\u0435\u0442 \u043a\u043e\u0434.\n\n\u0427\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u0441\u0442\u0432\u043e, \u043c\u0430\u0439\u043d\u0435\u0440 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0437\u0430\u0434\u0430\u0447\u0443, \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0437\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u0438 \u0432\u0445\u043e\u0434\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u0441\u043b\u0435\u0434\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Deflate \u0434\u043b\u044f \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u0437\u0430\u0434\u0430\u0447 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 .XML.\n\n\u0414\u0430\u043b\u0435\u0435 \u043c\u0430\u0439\u043d\u0435\u0440 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u0438 \u0438\u043c\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 (7826F246.exe) \u0432 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f Defender \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0444\u0430\u0439\u043b\u0430 \u043a\u0430\u043a \u00ab\u0441\u043a\u0440\u044b\u0442\u044b\u0439\u00bb, \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439\u00bb \u0438 \u00ab\u043d\u0435\u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u0443\u0435\u043c\u044b\u0439\u00bb.\n\n\u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0438\u043c\u0435\u0435\u0442 \u043a\u043b\u044e\u0447 \u0434\u043b\u044f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432: \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u00abLC_DLL\u00bb, \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 XMrig \u0438 \u0434\u0432\u0443\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u0417\u0430\u0442\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0444\u0430\u0439\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 XMrig \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a IP-\u0430\u0434\u0440\u0435\u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 XMrig, \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044c, \u043f\u0435\u0440\u0435\u0434\u0430\u043d\u043d\u044b\u0439 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u0442\u043e\u0440\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043b\u0438 \u0432 \u043f\u0443\u0442\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 WinRing0x64.sys, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u0438 \u0445\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430 \u0441\u0447\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u043c MSR. \u0415\u0441\u043b\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u043d\u0435 \u043d\u0430\u0439\u0434\u0435\u043d, \u043e\u043d \u043f\u0438\u0448\u0435\u0442\u0441\u044f \u0438\u0437 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 sys, \u0430 \u0441\u043b\u0435\u0434\u043e\u043c \u043d\u0430 \u043d\u0435\u0433\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u00ab\u0441\u043a\u0440\u044b\u0442\u044b\u0439\u00bb, \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439\u00bb \u0438 \u00ab\u043d\u0435\u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u0443\u0435\u043c\u044b\u0439\u00bb.\n\n\u041d\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c \u044d\u0442\u0430\u043f\u0435 ProxyShellMiner \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u0430, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0432\u0435\u0441\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u0430 \u0437\u0430\u0442\u0435\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 \u043e\u0434\u0438\u043d \u0438\u0437 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 XMrig \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 RunPE.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e ProxyShellMiner \u0437\u0430\u043c\u0435\u0434\u043b\u044f\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0435\u0442\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0441\u0447\u0435\u0442\u0430 \u0437\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u044d\u043d\u0435\u0440\u0433\u0438\u044e, \u043f\u0435\u0440\u0435\u0433\u0440\u0435\u0432\u0430\u0435\u0442 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441\u043b\u0443\u0436\u0431. \u041e\u0434\u043d\u0430\u043a\u043e \u0433\u043b\u0430\u0432\u043d\u0430\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e, \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0432\u0448\u0438\u0441\u044c \u0432 \u0441\u0435\u0442\u0438 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0432 \u0431\u044d\u043a\u0434\u043e\u0440\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432 \u0441\u0435\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://blog.morphisec.com/proxyshellminer-campaign \n\n#ProxyShellMiner", "creation_timestamp": "2026-07-27T00:01:06.749529Z"}, {"uuid": "1bcc4550-fb26-4f95-a50a-ba55c9491d77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/1201", "content": "ProxyShellMiner \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u044f \u0441\u0447\u0435\u0442\u0430 \u0437\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u0438\u0447\u0435\u0441\u0442\u0432\u043e\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Morphisec \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e ProxyShellMiner \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438 Windows.\n\n\u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0437 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f, ProxyShellMiner \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ProxyShell CVE-2021-34473  \u0438 CVE-2021-34523 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows Exchange \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u043c\u0430\u0439\u043d\u0435\u0440\u0430. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exchange \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u0430\u043f\u043a\u0443 NETLOGON \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430, \u0447\u0442\u043e\u0431\u044b \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u043c\u0430\u0439\u043d\u0435\u0440 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u0443, \u043f\u043e\u0434\u043e\u0431\u043d\u043e \u0442\u043e\u043c\u0443, \u043a\u0430\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 (GPO). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0447\u0435\u0442\u044b\u0440\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438. \n\n\u041e\u0431\u0440\u0430\u0437\u0446\u044b, \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 Morphisec, \u0442\u0440\u0435\u0431\u0443\u044e\u0442 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u00ab000\u00bb. \u041f\u043e\u0437\u0436\u0435 \u044d\u0442\u043e\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043b\u044e\u0447\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043c\u0430\u0439\u043d\u0435\u0440\u0430 XMRig \u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f.\n\nProxyShellMiner \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0441\u043b\u043e\u0432\u0430\u0440\u044c, \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 XOR \u0438 \u043a\u043b\u044e\u0447 XOR, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440 C# CSC.exe \u0441 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u0438 \u00abInMemory\u00bb \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u041d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u044d\u0442\u0430\u043f\u0435 ProxyShellMiner \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0444\u0430\u0439\u043b \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u00abDC_DLL\u00bb \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 .NET-\u0440\u0435\u0444\u043b\u0435\u043a\u0441\u0438\u044e \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442 \u0442\u0430\u043a\u0438\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u0430\u043a \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0449\u0438\u043a \u0437\u0430\u0434\u0430\u0447, XML \u0438 \u043a\u043b\u044e\u0447 XMRig. \u0410\u0432\u0442\u043e\u0440 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u0440\u0430\u0437\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 Confuser, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043f\u0443\u0442\u044b\u0432\u0430\u0435\u0442 \u043a\u043e\u0434.\n\n\u0427\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u0441\u0442\u0432\u043e, \u043c\u0430\u0439\u043d\u0435\u0440 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0437\u0430\u0434\u0430\u0447\u0443, \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0437\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u0438 \u0432\u0445\u043e\u0434\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u0441\u043b\u0435\u0434\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Deflate \u0434\u043b\u044f \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u0437\u0430\u0434\u0430\u0447 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 .XML.\n\n\u0414\u0430\u043b\u0435\u0435 \u043c\u0430\u0439\u043d\u0435\u0440 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u0438 \u0438\u043c\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 (7826F246.exe) \u0432 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f Defender \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0444\u0430\u0439\u043b\u0430 \u043a\u0430\u043a \u00ab\u0441\u043a\u0440\u044b\u0442\u044b\u0439\u00bb, \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439\u00bb \u0438 \u00ab\u043d\u0435\u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u0443\u0435\u043c\u044b\u0439\u00bb.\n\n\u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0438\u043c\u0435\u0435\u0442 \u043a\u043b\u044e\u0447 \u0434\u043b\u044f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432: \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u00abLC_DLL\u00bb, \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 XMrig \u0438 \u0434\u0432\u0443\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u0417\u0430\u0442\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0444\u0430\u0439\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 XMrig \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a IP-\u0430\u0434\u0440\u0435\u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 XMrig, \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044c, \u043f\u0435\u0440\u0435\u0434\u0430\u043d\u043d\u044b\u0439 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u0442\u043e\u0440\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043b\u0438 \u0432 \u043f\u0443\u0442\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 WinRing0x64.sys, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u0438 \u0445\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430 \u0441\u0447\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u043c MSR. \u0415\u0441\u043b\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u043d\u0435 \u043d\u0430\u0439\u0434\u0435\u043d, \u043e\u043d \u043f\u0438\u0448\u0435\u0442\u0441\u044f \u0438\u0437 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 sys, \u0430 \u0441\u043b\u0435\u0434\u043e\u043c \u043d\u0430 \u043d\u0435\u0433\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u00ab\u0441\u043a\u0440\u044b\u0442\u044b\u0439\u00bb, \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439\u00bb \u0438 \u00ab\u043d\u0435\u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u0443\u0435\u043c\u044b\u0439\u00bb.\n\n\u041d\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c \u044d\u0442\u0430\u043f\u0435 ProxyShellMiner \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u0430, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0432\u0435\u0441\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u0430 \u0437\u0430\u0442\u0435\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 \u043e\u0434\u0438\u043d \u0438\u0437 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 XMrig \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 RunPE.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e ProxyShellMiner \u0437\u0430\u043c\u0435\u0434\u043b\u044f\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0435\u0442\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0441\u0447\u0435\u0442\u0430 \u0437\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u044d\u043d\u0435\u0440\u0433\u0438\u044e, \u043f\u0435\u0440\u0435\u0433\u0440\u0435\u0432\u0430\u0435\u0442 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441\u043b\u0443\u0436\u0431. \u041e\u0434\u043d\u0430\u043a\u043e \u0433\u043b\u0430\u0432\u043d\u0430\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e, \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0432\u0448\u0438\u0441\u044c \u0432 \u0441\u0435\u0442\u0438 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0432 \u0431\u044d\u043a\u0434\u043e\u0440\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432 \u0441\u0435\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://blog.morphisec.com/proxyshellminer-campaign \n\n#ProxyShellMiner", "creation_timestamp": "2026-07-28T01:00:05.321537Z"}, {"uuid": "ad1f8af3-3efb-4a26-9f88-6a4e2595cff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/1201", "content": "ProxyShellMiner \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u044f \u0441\u0447\u0435\u0442\u0430 \u0437\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u0438\u0447\u0435\u0441\u0442\u0432\u043e\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Morphisec \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e ProxyShellMiner \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438 Windows.\n\n\u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0437 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f, ProxyShellMiner \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ProxyShell CVE-2021-34473  \u0438 CVE-2021-34523 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows Exchange \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u043c\u0430\u0439\u043d\u0435\u0440\u0430. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exchange \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u0430\u043f\u043a\u0443 NETLOGON \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430, \u0447\u0442\u043e\u0431\u044b \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u043c\u0430\u0439\u043d\u0435\u0440 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u0443, \u043f\u043e\u0434\u043e\u0431\u043d\u043e \u0442\u043e\u043c\u0443, \u043a\u0430\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 (GPO). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0447\u0435\u0442\u044b\u0440\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438. \n\n\u041e\u0431\u0440\u0430\u0437\u0446\u044b, \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 Morphisec, \u0442\u0440\u0435\u0431\u0443\u044e\u0442 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u00ab000\u00bb. \u041f\u043e\u0437\u0436\u0435 \u044d\u0442\u043e\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043b\u044e\u0447\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043c\u0430\u0439\u043d\u0435\u0440\u0430 XMRig \u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f.\n\nProxyShellMiner \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0441\u043b\u043e\u0432\u0430\u0440\u044c, \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 XOR \u0438 \u043a\u043b\u044e\u0447 XOR, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440 C# CSC.exe \u0441 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u0438 \u00abInMemory\u00bb \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u041d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u044d\u0442\u0430\u043f\u0435 ProxyShellMiner \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0444\u0430\u0439\u043b \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u00abDC_DLL\u00bb \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 .NET-\u0440\u0435\u0444\u043b\u0435\u043a\u0441\u0438\u044e \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442 \u0442\u0430\u043a\u0438\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u0430\u043a \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0449\u0438\u043a \u0437\u0430\u0434\u0430\u0447, XML \u0438 \u043a\u043b\u044e\u0447 XMRig. \u0410\u0432\u0442\u043e\u0440 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u0440\u0430\u0437\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 Confuser, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043f\u0443\u0442\u044b\u0432\u0430\u0435\u0442 \u043a\u043e\u0434.\n\n\u0427\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u0441\u0442\u0432\u043e, \u043c\u0430\u0439\u043d\u0435\u0440 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0437\u0430\u0434\u0430\u0447\u0443, \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0437\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u0438 \u0432\u0445\u043e\u0434\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u0441\u043b\u0435\u0434\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Deflate \u0434\u043b\u044f \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u0437\u0430\u0434\u0430\u0447 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 .XML.\n\n\u0414\u0430\u043b\u0435\u0435 \u043c\u0430\u0439\u043d\u0435\u0440 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u0438 \u0438\u043c\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 (7826F246.exe) \u0432 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f Defender \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0444\u0430\u0439\u043b\u0430 \u043a\u0430\u043a \u00ab\u0441\u043a\u0440\u044b\u0442\u044b\u0439\u00bb, \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439\u00bb \u0438 \u00ab\u043d\u0435\u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u0443\u0435\u043c\u044b\u0439\u00bb.\n\n\u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0438\u043c\u0435\u0435\u0442 \u043a\u043b\u044e\u0447 \u0434\u043b\u044f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432: \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u00abLC_DLL\u00bb, \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 XMrig \u0438 \u0434\u0432\u0443\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u0417\u0430\u0442\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0444\u0430\u0439\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 XMrig \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a IP-\u0430\u0434\u0440\u0435\u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 XMrig, \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044c, \u043f\u0435\u0440\u0435\u0434\u0430\u043d\u043d\u044b\u0439 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u0442\u043e\u0440\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043b\u0438 \u0432 \u043f\u0443\u0442\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 WinRing0x64.sys, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u0438 \u0445\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430 \u0441\u0447\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u043c MSR. \u0415\u0441\u043b\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u043d\u0435 \u043d\u0430\u0439\u0434\u0435\u043d, \u043e\u043d \u043f\u0438\u0448\u0435\u0442\u0441\u044f \u0438\u0437 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 sys, \u0430 \u0441\u043b\u0435\u0434\u043e\u043c \u043d\u0430 \u043d\u0435\u0433\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u00ab\u0441\u043a\u0440\u044b\u0442\u044b\u0439\u00bb, \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439\u00bb \u0438 \u00ab\u043d\u0435\u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u0443\u0435\u043c\u044b\u0439\u00bb.\n\n\u041d\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c \u044d\u0442\u0430\u043f\u0435 ProxyShellMiner \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u0430, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0432\u0435\u0441\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u0430 \u0437\u0430\u0442\u0435\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 \u043e\u0434\u0438\u043d \u0438\u0437 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 XMrig \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 RunPE.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e ProxyShellMiner \u0437\u0430\u043c\u0435\u0434\u043b\u044f\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0435\u0442\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0441\u0447\u0435\u0442\u0430 \u0437\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u044d\u043d\u0435\u0440\u0433\u0438\u044e, \u043f\u0435\u0440\u0435\u0433\u0440\u0435\u0432\u0430\u0435\u0442 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441\u043b\u0443\u0436\u0431. \u041e\u0434\u043d\u0430\u043a\u043e \u0433\u043b\u0430\u0432\u043d\u0430\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e, \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0432\u0448\u0438\u0441\u044c \u0432 \u0441\u0435\u0442\u0438 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0432 \u0431\u044d\u043a\u0434\u043e\u0440\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432 \u0441\u0435\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://blog.morphisec.com/proxyshellminer-campaign \n\n#ProxyShellMiner", "creation_timestamp": "2026-07-29T00:00:53.022976Z"}, {"uuid": "8795215c-401c-4467-98b2-05fe0c8b4de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/reverseame/1683", "content": "POC for scanning ProxyShell (CVE-2021-34523,CVE-2021-34473,CVE-2021-31207) https://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2026-07-29T12:02:52.608049Z"}, {"uuid": "95f067ac-059d-41fc-b5a2-4646c95fb51a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/reverseame/1683", "content": "POC for scanning ProxyShell (CVE-2021-34523,CVE-2021-34473,CVE-2021-31207) https://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2026-07-30T00:02:43.070813Z"}, {"uuid": "d96c4931-2ace-43a3-be53-9a6f2306ce04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/cissp/7266", "content": "#DiyakoSecureBow\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\nWhy incident response is so critical:\nRansomware is overtaking money theft and other impacts as a more\nconvenient monetization scheme with much broader industry coverage \n(not just the Financial sector). We can confidently classify most incidents with\ncauses before impact (suspicious events, tool alerts, etc.) as ransomware.\n\nVulnerability Exploitation:\nIn all cases when exploiting vulnerabilities was used as the initial vector, \nthe main damage is data encryption.The most prevalent vulnerability in our data set is the list of vulnerabilities related to Microsoft Exchange Server ( CVE-2021-26855 , CVE-2021-34523 , CVE-2021-26855 ,CVE-2021-34523 )\n\nTop initial compromise vectors and how long the attack went unnoticed:\nIn most cases where initial access wasn\u2019t identified, the attack lasted for\nmore than a year before being detected by the organization, by which time\n\nno artefacts were left to analyze due to log rotation policies. More than\nhalf of all attacks that started with malicious e-mails, stolen credentials\nor external application exploitation were detected in hours or days.\n\nLegitimate tools in MITRE ATT&CK\u00ae\nIn most cases, security teams can mitigate the initial vector of attack with\nprevention solutions. The most prevalent vectors of attack (exploitation \nof public-facing applications, compromised accounts, malicious e-mail) could\nhave been mitigated - with timely patch management and implementation \nof multifactor authentication, solutions with anti-phishing software to defend\nagainst phishing attacks, and implementation of security awareness training \nfor employees.\n\n\n-Business Secure Continuity-\n1402.07.23\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\n#MDR #NDR #EDR #Malware\n#BusinessSecureContinuity\n\nhttps://www.linkedin.com/feed/update/activity:7119244412445933568", "creation_timestamp": "2026-09-01T17:00:16.737236Z"}, {"uuid": "54364a04-4e3f-4256-89c4-38626e8b8eec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/hacking_Attack/82154", "content": "Black Hat Ethical Hacking\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection Vulnerabilities\n\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection VulnerabilitiesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Cybersecurity analysts at Prodraft\u2019s threat intelligence team detected\u00a0that the hacker group FIN7 was actively exploiting vulnerabilities in Microsoft Exchange and SQL injection through an automated attack system in an attempt to perform the following illicit activities:* Infiltrate corporate networks in order to steal information.\n* Data theft.\n* Adaptive ransomware attacks based on the financial size of the networks.\n\nFor years now, this security organization has closely followed the operations of FIN7. There are a number of details revealed by Prodaft about FIN7\u2019s behind-the-scenes:-\n\n* The hierarchy at the internal level.\n* Affiliations with a variety of ransomware projects.\n* A new SSH backdoor system.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Attack Modes and Auto-attackingFIN7 is a Russian-speaking threat group that has been active at least since 2012, and its motivations seem to be financial. \n\nA number of attacks have been linked to this threat group including:-\n\n* Attacks on ATMs.\n* The use of teddy bears to conceal malware-carrying USB drives.\n* Hiring pentesters to analyze ransomware attacks by setting up a false cybersecurity firm.\n* \nhttps://lh6.googleusercontent.com/bxGOUHzyqt1-qg7Uq2jsUnRi1HV_TyXD8GskpkUj8FCiC0GcPWtjfi1GMoJ-uOXsAZfvxua6L2oUgzkvxxELVUGQ2UjGfe91LwMwV280f0XKIkkr4TtLr72lNqOC0B11-KSzNN_roFQhJ-iK1PsO5AxGzJHFdVXCeJJ3oYQIowsVpWt1QF7TR92MaYZJZw \n<figcaptionAttack Modes \nThere is a system for automatic attacks called Checkmarks that has been discovered by Prodaft. So, in this scenario Checkmarks works as a scanner that scans for vulnerabilities that could result in remote code execution or privilege elevation in Microsoft Exchange, including:-\n\n* CVE-2021-34473\n* CVE-2021-34523\n* CVE-2021-31207\n\nSince June 2021 it\u2019s actively using Checkmarks for finding the corporate networks\u2019 vulnerable endpoints and exploiting them by using PowerShell to drop web shells which enabled FIN7 to gain access to corporate networks.\nhttps://lh5.googleusercontent.com/uIhqkcqkv5Fd4OCX_BWdGS6STKMeUdYYmhw9uRj__fsVqBI7uAhuNZHgOhZhXV_2An9pGMP4hb5CddH9eIejslPtDCRRpadLboahh3o-3DL3d5Ai92zpEY4yKqlriuK9MNXxCCiMAjJXcYTq0qC3BrITuQAUajMTQETbMuX6a7hAcHpuKxHPYxoHZaosXw \nAs part of its attack, FIN7 used multiple exploits, including its own custom code and publicly available Proof Of Concepts, to gain access to the target networks.\n\nThere are some other vulnerabilities that can be exploited with the Checkmarks attack platform in addition to the MS Exchange flaws. There is also a SQL injection module that uses SQLMap to scan for potential vulnerabilities on a website that may be exploited.\n\nFollowing the scanning of over 1.8 million targets with FIN7\u2019s Checkmarks platform, 8,147 companies have already been infiltrated. Here the most interesting thing is that all these companies are mainly based in the United States. \nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Digital Forensics Tool: Email Analyzer Communications With the C&C ServerApart from this, from the retrieved Jabber logs, the security analysts also found extensive evidence that multiple ransomware groups were in communication with FIN7, including:-\n\n* Darkside\n* REvil\n* LockBit\n\nThere is one particular det[...]", "creation_timestamp": "2026-09-01T20:01:12.660511Z"}, {"uuid": "035fdd0b-0d71-4a8b-a4a7-26b463caf3a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/hacking_Attack/83430", "content": "code execution and privilege elevation vulnerabilities, such as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.\n\nFIN7\u2019s new platform has already been used to infiltrate 8,147 companies, primarily located in the United States (16.7%), after scanning over 1.8 million targets.\nTrending: Operation OpRussia \u2013 Anonymous attacks on Russia Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-3-300x150.png PyTorch Framework compromised with dependency confusion attackJanuary 3, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-9-300x150.png New Linux malware uses 30 plugin exploits to backdoor WordPress sitesJanuary 2, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-8-300x150.png Google Home speakers allowed hackers to snoop on conversationsDecember 30, 2022\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-7-300x150.png Hackers abuse Google Ads to spread malware in legit softwareDecember 29, 2022\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Over 60,000 Exchange servers vulnerable to ProxyNotShell attacks first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:01:12.136573Z"}, {"uuid": "e53357e6-6fb0-4733-b543-2d7438e98458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/hacking_Attack/33374", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange servers hacked to deploy BlackByte ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange servers hacked to deploy BlackByte ransomwarePost Views: 118 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe BlackByte ransomware gang is now breaching corporate networks by exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities.\nProxyShell is the name for a set of three Microsoft Exchange vulnerabilities that allow unauthenticated, remote code execution on the server when chained together.\n\nThese vulnerabilities are listed below and were fixed by security updates released in April and May 2021:\n\n* CVE-2021-34473\u00a0\u2013 Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)\n* CVE-2021-34523\u00a0\u2013 Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)\n* CVE-2021-31207\u00a0\u2013 Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)\n\nSince researchers disclosed the vulnerabilities, threat actors have begun to exploit them\u00a0to breach servers and install web shells, coin miners, and ransomware.\nSee Also: Complete Offensive Security and Ethical Hacking Course BlackByte\u00a0begins exploiting ProxyShellIn a detailed report by Red Canary, researchers analyzed a BlackByte\u00a0ransomware attack where they saw them exploiting the ProxyShell vulnerabilities to install web shells on a compromised Microsoft Exchange server.\n\nWeb Shells are small scripts uploaded to web servers that allow a threat actor to gain persistence to a device and remotely execute commands or upload additional files to the server.\nhttps://www.bleepstatic.com/images/news/security/webshell-example.jpg \nBlackByte is still a severe threatWhen conducting ransomware attacks, threat actors commonly use third-party tools to gain elevated privileges or deploy the ransomware on a network.\n\nHowever, the actual BlackByte ransomware executable plays a central role as it handles both privilege escalation and the ability to worm, or perform lateral movement, within the compromised environment.\n\nThe malware sets three registry values, one for local privilege elevation, one for enabling network connection sharing between all privilege levels, and one to allow long path values for file paths, names, and namespaces.\n\nBefore encryption, the malware deletes the \u201cRaccine Rules Updater\u201d scheduled task to prevent last-minute interceptions and also wipes shadow copies directly through WMI objects using an obfuscated PowerShell command.\n\nFinally, stolen files are exfiltrated using WinRAR to archive files and anonymous file-sharing platforms such as \u201cfile.io\u201d or \u201canonymfiles.com.\u201d\n\nAlthough Trustwave released a decryptor\u00a0for BlackByte ransomware in October 2021, it is unlikely that the operators are still using the same encryption tactics that allowed victims to restore their files for free.\n\nAs such, you may or may not be able to restore your files using that decryptor, depending on what key wa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:07.444996Z"}, {"uuid": "703e27f1-26a3-465f-8acb-e7dab6866905", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/hacking_Attack/82154", "content": "Black Hat Ethical Hacking\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection Vulnerabilities\n\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection VulnerabilitiesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Cybersecurity analysts at Prodraft\u2019s threat intelligence team detected\u00a0that the hacker group FIN7 was actively exploiting vulnerabilities in Microsoft Exchange and SQL injection through an automated attack system in an attempt to perform the following illicit activities:* Infiltrate corporate networks in order to steal information.\n* Data theft.\n* Adaptive ransomware attacks based on the financial size of the networks.\n\nFor years now, this security organization has closely followed the operations of FIN7. There are a number of details revealed by Prodaft about FIN7\u2019s behind-the-scenes:-\n\n* The hierarchy at the internal level.\n* Affiliations with a variety of ransomware projects.\n* A new SSH backdoor system.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Attack Modes and Auto-attackingFIN7 is a Russian-speaking threat group that has been active at least since 2012, and its motivations seem to be financial. \n\nA number of attacks have been linked to this threat group including:-\n\n* Attacks on ATMs.\n* The use of teddy bears to conceal malware-carrying USB drives.\n* Hiring pentesters to analyze ransomware attacks by setting up a false cybersecurity firm.\n* \nhttps://lh6.googleusercontent.com/bxGOUHzyqt1-qg7Uq2jsUnRi1HV_TyXD8GskpkUj8FCiC0GcPWtjfi1GMoJ-uOXsAZfvxua6L2oUgzkvxxELVUGQ2UjGfe91LwMwV280f0XKIkkr4TtLr72lNqOC0B11-KSzNN_roFQhJ-iK1PsO5AxGzJHFdVXCeJJ3oYQIowsVpWt1QF7TR92MaYZJZw \n<figcaptionAttack Modes \nThere is a system for automatic attacks called Checkmarks that has been discovered by Prodaft. So, in this scenario Checkmarks works as a scanner that scans for vulnerabilities that could result in remote code execution or privilege elevation in Microsoft Exchange, including:-\n\n* CVE-2021-34473\n* CVE-2021-34523\n* CVE-2021-31207\n\nSince June 2021 it\u2019s actively using Checkmarks for finding the corporate networks\u2019 vulnerable endpoints and exploiting them by using PowerShell to drop web shells which enabled FIN7 to gain access to corporate networks.\nhttps://lh5.googleusercontent.com/uIhqkcqkv5Fd4OCX_BWdGS6STKMeUdYYmhw9uRj__fsVqBI7uAhuNZHgOhZhXV_2An9pGMP4hb5CddH9eIejslPtDCRRpadLboahh3o-3DL3d5Ai92zpEY4yKqlriuK9MNXxCCiMAjJXcYTq0qC3BrITuQAUajMTQETbMuX6a7hAcHpuKxHPYxoHZaosXw \nAs part of its attack, FIN7 used multiple exploits, including its own custom code and publicly available Proof Of Concepts, to gain access to the target networks.\n\nThere are some other vulnerabilities that can be exploited with the Checkmarks attack platform in addition to the MS Exchange flaws. There is also a SQL injection module that uses SQLMap to scan for potential vulnerabilities on a website that may be exploited.\n\nFollowing the scanning of over 1.8 million targets with FIN7\u2019s Checkmarks platform, 8,147 companies have already been infiltrated. Here the most interesting thing is that all these companies are mainly based in the United States. \nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Digital Forensics Tool: Email Analyzer Communications With the C&C ServerApart from this, from the retrieved Jabber logs, the security analysts also found extensive evidence that multiple ransomware groups were in communication with FIN7, including:-\n\n* Darkside\n* REvil\n* LockBit\n\nThere is one particular det[...]", "creation_timestamp": "2026-09-02T01:01:29.335990Z"}, {"uuid": "422f7ad2-be8e-440e-802e-9a4a0d9b7fea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/hacking_Attack/83430", "content": "code execution and privilege elevation vulnerabilities, such as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.\n\nFIN7\u2019s new platform has already been used to infiltrate 8,147 companies, primarily located in the United States (16.7%), after scanning over 1.8 million targets.\nTrending: Operation OpRussia \u2013 Anonymous attacks on Russia Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-3-300x150.png PyTorch Framework compromised with dependency confusion attackJanuary 3, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-9-300x150.png New Linux malware uses 30 plugin exploits to backdoor WordPress sitesJanuary 2, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-8-300x150.png Google Home speakers allowed hackers to snoop on conversationsDecember 30, 2022\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-7-300x150.png Hackers abuse Google Ads to spread malware in legit softwareDecember 29, 2022\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Over 60,000 Exchange servers vulnerable to ProxyNotShell attacks first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:01:28.715494Z"}, {"uuid": "75b318d0-5b3d-4be4-8c7a-4d42d51b269b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/hacking_Attack/33374", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange servers hacked to deploy BlackByte ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange servers hacked to deploy BlackByte ransomwarePost Views: 118 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe BlackByte ransomware gang is now breaching corporate networks by exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities.\nProxyShell is the name for a set of three Microsoft Exchange vulnerabilities that allow unauthenticated, remote code execution on the server when chained together.\n\nThese vulnerabilities are listed below and were fixed by security updates released in April and May 2021:\n\n* CVE-2021-34473\u00a0\u2013 Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)\n* CVE-2021-34523\u00a0\u2013 Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)\n* CVE-2021-31207\u00a0\u2013 Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)\n\nSince researchers disclosed the vulnerabilities, threat actors have begun to exploit them\u00a0to breach servers and install web shells, coin miners, and ransomware.\nSee Also: Complete Offensive Security and Ethical Hacking Course BlackByte\u00a0begins exploiting ProxyShellIn a detailed report by Red Canary, researchers analyzed a BlackByte\u00a0ransomware attack where they saw them exploiting the ProxyShell vulnerabilities to install web shells on a compromised Microsoft Exchange server.\n\nWeb Shells are small scripts uploaded to web servers that allow a threat actor to gain persistence to a device and remotely execute commands or upload additional files to the server.\nhttps://www.bleepstatic.com/images/news/security/webshell-example.jpg \nBlackByte is still a severe threatWhen conducting ransomware attacks, threat actors commonly use third-party tools to gain elevated privileges or deploy the ransomware on a network.\n\nHowever, the actual BlackByte ransomware executable plays a central role as it handles both privilege escalation and the ability to worm, or perform lateral movement, within the compromised environment.\n\nThe malware sets three registry values, one for local privilege elevation, one for enabling network connection sharing between all privilege levels, and one to allow long path values for file paths, names, and namespaces.\n\nBefore encryption, the malware deletes the \u201cRaccine Rules Updater\u201d scheduled task to prevent last-minute interceptions and also wipes shadow copies directly through WMI objects using an obfuscated PowerShell command.\n\nFinally, stolen files are exfiltrated using WinRAR to archive files and anonymous file-sharing platforms such as \u201cfile.io\u201d or \u201canonymfiles.com.\u201d\n\nAlthough Trustwave released a decryptor\u00a0for BlackByte ransomware in October 2021, it is unlikely that the operators are still using the same encryption tactics that allowed victims to restore their files for free.\n\nAs such, you may or may not be able to restore your files using that decryptor, depending on what key wa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:32.843991Z"}, {"uuid": "03ab20a9-1069-4c3c-ab3e-c79b18d88614", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/cissp/7266", "content": "#DiyakoSecureBow\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\nWhy incident response is so critical:\nRansomware is overtaking money theft and other impacts as a more\nconvenient monetization scheme with much broader industry coverage \n(not just the Financial sector). We can confidently classify most incidents with\ncauses before impact (suspicious events, tool alerts, etc.) as ransomware.\n\nVulnerability Exploitation:\nIn all cases when exploiting vulnerabilities was used as the initial vector, \nthe main damage is data encryption.The most prevalent vulnerability in our data set is the list of vulnerabilities related to Microsoft Exchange Server ( CVE-2021-26855 , CVE-2021-34523 , CVE-2021-26855 ,CVE-2021-34523 )\n\nTop initial compromise vectors and how long the attack went unnoticed:\nIn most cases where initial access wasn\u2019t identified, the attack lasted for\nmore than a year before being detected by the organization, by which time\n\nno artefacts were left to analyze due to log rotation policies. More than\nhalf of all attacks that started with malicious e-mails, stolen credentials\nor external application exploitation were detected in hours or days.\n\nLegitimate tools in MITRE ATT&CK\u00ae\nIn most cases, security teams can mitigate the initial vector of attack with\nprevention solutions. The most prevalent vectors of attack (exploitation \nof public-facing applications, compromised accounts, malicious e-mail) could\nhave been mitigated - with timely patch management and implementation \nof multifactor authentication, solutions with anti-phishing software to defend\nagainst phishing attacks, and implementation of security awareness training \nfor employees.\n\n\n-Business Secure Continuity-\n1402.07.23\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\n#MDR #NDR #EDR #Malware\n#BusinessSecureContinuity\n\nhttps://www.linkedin.com/feed/update/activity:7119244412445933568", "creation_timestamp": "2026-09-02T01:03:53.651905Z"}, {"uuid": "b690f0cf-753d-4201-b0b9-847812c0f0cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/hacking_Attack/82154", "content": "Black Hat Ethical Hacking\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection Vulnerabilities\n\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection VulnerabilitiesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Cybersecurity analysts at Prodraft\u2019s threat intelligence team detected\u00a0that the hacker group FIN7 was actively exploiting vulnerabilities in Microsoft Exchange and SQL injection through an automated attack system in an attempt to perform the following illicit activities:* Infiltrate corporate networks in order to steal information.\n* Data theft.\n* Adaptive ransomware attacks based on the financial size of the networks.\n\nFor years now, this security organization has closely followed the operations of FIN7. There are a number of details revealed by Prodaft about FIN7\u2019s behind-the-scenes:-\n\n* The hierarchy at the internal level.\n* Affiliations with a variety of ransomware projects.\n* A new SSH backdoor system.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Attack Modes and Auto-attackingFIN7 is a Russian-speaking threat group that has been active at least since 2012, and its motivations seem to be financial. \n\nA number of attacks have been linked to this threat group including:-\n\n* Attacks on ATMs.\n* The use of teddy bears to conceal malware-carrying USB drives.\n* Hiring pentesters to analyze ransomware attacks by setting up a false cybersecurity firm.\n* \nhttps://lh6.googleusercontent.com/bxGOUHzyqt1-qg7Uq2jsUnRi1HV_TyXD8GskpkUj8FCiC0GcPWtjfi1GMoJ-uOXsAZfvxua6L2oUgzkvxxELVUGQ2UjGfe91LwMwV280f0XKIkkr4TtLr72lNqOC0B11-KSzNN_roFQhJ-iK1PsO5AxGzJHFdVXCeJJ3oYQIowsVpWt1QF7TR92MaYZJZw \n<figcaptionAttack Modes \nThere is a system for automatic attacks called Checkmarks that has been discovered by Prodaft. So, in this scenario Checkmarks works as a scanner that scans for vulnerabilities that could result in remote code execution or privilege elevation in Microsoft Exchange, including:-\n\n* CVE-2021-34473\n* CVE-2021-34523\n* CVE-2021-31207\n\nSince June 2021 it\u2019s actively using Checkmarks for finding the corporate networks\u2019 vulnerable endpoints and exploiting them by using PowerShell to drop web shells which enabled FIN7 to gain access to corporate networks.\nhttps://lh5.googleusercontent.com/uIhqkcqkv5Fd4OCX_BWdGS6STKMeUdYYmhw9uRj__fsVqBI7uAhuNZHgOhZhXV_2An9pGMP4hb5CddH9eIejslPtDCRRpadLboahh3o-3DL3d5Ai92zpEY4yKqlriuK9MNXxCCiMAjJXcYTq0qC3BrITuQAUajMTQETbMuX6a7hAcHpuKxHPYxoHZaosXw \nAs part of its attack, FIN7 used multiple exploits, including its own custom code and publicly available Proof Of Concepts, to gain access to the target networks.\n\nThere are some other vulnerabilities that can be exploited with the Checkmarks attack platform in addition to the MS Exchange flaws. There is also a SQL injection module that uses SQLMap to scan for potential vulnerabilities on a website that may be exploited.\n\nFollowing the scanning of over 1.8 million targets with FIN7\u2019s Checkmarks platform, 8,147 companies have already been infiltrated. Here the most interesting thing is that all these companies are mainly based in the United States. \nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Digital Forensics Tool: Email Analyzer Communications With the C&C ServerApart from this, from the retrieved Jabber logs, the security analysts also found extensive evidence that multiple ransomware groups were in communication with FIN7, including:-\n\n* Darkside\n* REvil\n* LockBit\n\nThere is one particular det[...]", "creation_timestamp": "2026-09-05T00:00:09.027010Z"}, {"uuid": "0352537b-2817-4011-a421-c2ccf9f9d644", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/hacking_Attack/83430", "content": "code execution and privilege elevation vulnerabilities, such as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.\n\nFIN7\u2019s new platform has already been used to infiltrate 8,147 companies, primarily located in the United States (16.7%), after scanning over 1.8 million targets.\nTrending: Operation OpRussia \u2013 Anonymous attacks on Russia Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-3-300x150.png PyTorch Framework compromised with dependency confusion attackJanuary 3, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-9-300x150.png New Linux malware uses 30 plugin exploits to backdoor WordPress sitesJanuary 2, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-8-300x150.png Google Home speakers allowed hackers to snoop on conversationsDecember 30, 2022\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-7-300x150.png Hackers abuse Google Ads to spread malware in legit softwareDecember 29, 2022\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Over 60,000 Exchange servers vulnerable to ProxyNotShell attacks first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-05T00:00:09.864748Z"}, {"uuid": "02f34ddd-d72d-41ed-a6cf-fb3737c2d03d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/hacking_Attack/33374", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange servers hacked to deploy BlackByte ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange servers hacked to deploy BlackByte ransomwarePost Views: 118 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe BlackByte ransomware gang is now breaching corporate networks by exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities.\nProxyShell is the name for a set of three Microsoft Exchange vulnerabilities that allow unauthenticated, remote code execution on the server when chained together.\n\nThese vulnerabilities are listed below and were fixed by security updates released in April and May 2021:\n\n* CVE-2021-34473\u00a0\u2013 Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)\n* CVE-2021-34523\u00a0\u2013 Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)\n* CVE-2021-31207\u00a0\u2013 Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)\n\nSince researchers disclosed the vulnerabilities, threat actors have begun to exploit them\u00a0to breach servers and install web shells, coin miners, and ransomware.\nSee Also: Complete Offensive Security and Ethical Hacking Course BlackByte\u00a0begins exploiting ProxyShellIn a detailed report by Red Canary, researchers analyzed a BlackByte\u00a0ransomware attack where they saw them exploiting the ProxyShell vulnerabilities to install web shells on a compromised Microsoft Exchange server.\n\nWeb Shells are small scripts uploaded to web servers that allow a threat actor to gain persistence to a device and remotely execute commands or upload additional files to the server.\nhttps://www.bleepstatic.com/images/news/security/webshell-example.jpg \nBlackByte is still a severe threatWhen conducting ransomware attacks, threat actors commonly use third-party tools to gain elevated privileges or deploy the ransomware on a network.\n\nHowever, the actual BlackByte ransomware executable plays a central role as it handles both privilege escalation and the ability to worm, or perform lateral movement, within the compromised environment.\n\nThe malware sets three registry values, one for local privilege elevation, one for enabling network connection sharing between all privilege levels, and one to allow long path values for file paths, names, and namespaces.\n\nBefore encryption, the malware deletes the \u201cRaccine Rules Updater\u201d scheduled task to prevent last-minute interceptions and also wipes shadow copies directly through WMI objects using an obfuscated PowerShell command.\n\nFinally, stolen files are exfiltrated using WinRAR to archive files and anonymous file-sharing platforms such as \u201cfile.io\u201d or \u201canonymfiles.com.\u201d\n\nAlthough Trustwave released a decryptor\u00a0for BlackByte ransomware in October 2021, it is unlikely that the operators are still using the same encryption tactics that allowed victims to restore their files for free.\n\nAs such, you may or may not be able to restore your files using that decryptor, depending on what key wa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T03:00:53.457724Z"}, {"uuid": "05162d02-e675-4f1d-a200-b7bb4408bd0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "exploited", "source": "https://t.me/hacking_Attack/33374", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange servers hacked to deploy BlackByte ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange servers hacked to deploy BlackByte ransomwarePost Views: 118 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe BlackByte ransomware gang is now breaching corporate networks by exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities.\nProxyShell is the name for a set of three Microsoft Exchange vulnerabilities that allow unauthenticated, remote code execution on the server when chained together.\n\nThese vulnerabilities are listed below and were fixed by security updates released in April and May 2021:\n\n* CVE-2021-34473\u00a0\u2013 Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)\n* CVE-2021-34523\u00a0\u2013 Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)\n* CVE-2021-31207\u00a0\u2013 Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)\n\nSince researchers disclosed the vulnerabilities, threat actors have begun to exploit them\u00a0to breach servers and install web shells, coin miners, and ransomware.\nSee Also: Complete Offensive Security and Ethical Hacking Course BlackByte\u00a0begins exploiting ProxyShellIn a detailed report by Red Canary, researchers analyzed a BlackByte\u00a0ransomware attack where they saw them exploiting the ProxyShell vulnerabilities to install web shells on a compromised Microsoft Exchange server.\n\nWeb Shells are small scripts uploaded to web servers that allow a threat actor to gain persistence to a device and remotely execute commands or upload additional files to the server.\nhttps://www.bleepstatic.com/images/news/security/webshell-example.jpg \nBlackByte is still a severe threatWhen conducting ransomware attacks, threat actors commonly use third-party tools to gain elevated privileges or deploy the ransomware on a network.\n\nHowever, the actual BlackByte ransomware executable plays a central role as it handles both privilege escalation and the ability to worm, or perform lateral movement, within the compromised environment.\n\nThe malware sets three registry values, one for local privilege elevation, one for enabling network connection sharing between all privilege levels, and one to allow long path values for file paths, names, and namespaces.\n\nBefore encryption, the malware deletes the \u201cRaccine Rules Updater\u201d scheduled task to prevent last-minute interceptions and also wipes shadow copies directly through WMI objects using an obfuscated PowerShell command.\n\nFinally, stolen files are exfiltrated using WinRAR to archive files and anonymous file-sharing platforms such as \u201cfile.io\u201d or \u201canonymfiles.com.\u201d\n\nAlthough Trustwave released a decryptor\u00a0for BlackByte ransomware in October 2021, it is unlikely that the operators are still using the same encryption tactics that allowed victims to restore their files for free.\n\nAs such, you may or may not be able to restore your files using that decryptor, depending on what key wa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:01:03.090696Z"}, {"uuid": "dfb3c16f-d794-4b0e-8ac2-0d0b20077b39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x64, x86, cmd\", \"author\": [\"Orange Tsai\", \"Jang ( \", \"PeterJson\", \"brandonshi123\", \"mekhalleh (RAMELLA S\\u00e9bastien)\", \"Donny Maasland\", \"Rich Warren\", \"Spencer McIntyre\", \"wvu \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability on Microsoft Exchange Server that\\n          allows an attacker to bypass the authentication (CVE-2021-31207), impersonate an\\n          arbitrary user (CVE-2021-34523) and write an arbitrary file (CVE-2021-34473) to achieve\\n          the RCE (Remote Code Execution).\\n\\n          By taking advantage of this vulnerability, you can execute arbitrary\\n          commands on the remote Microsoft Exchange Server.\\n\\n          This vulnerability affects Exchange 2013 CU23 < 15.0.1497.15,\\n          Exchange 2016 CU19 < 15.1.2176.12, Exchange 2016 CU20 < 15.1.2242.5,\\n          Exchange 2019 CU8 < 15.2.792.13, Exchange 2019 CU9 < 15.2.858.9.\\n\\n          All components are vulnerable by default.\", \"disclosure_date\": \"2021-04-06\", \"fullname\": \"exploit/windows/http/exchange_proxyshell_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"Microsoft Exchange ProxyShell RCE\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"ProxyShell\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/exchange_proxyshell_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/exchange_proxyshell_rce\", \"references\": [\"CVE-2021-34473\", \"CVE-2021-34523\", \"CVE-2021-31207\", \"URL-https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1\", \"URL-https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf\", \"URL-https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/\", \"URL-https://github.com/dmaasland/proxyshell-poc\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Windows Powershell\", \"Windows Dropper\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:47.661310Z"}, {"uuid": "cce6abcd-6104-4187-b4f1-ba9772ab2274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/cissp/7266", "content": "#DiyakoSecureBow\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\nWhy incident response is so critical:\nRansomware is overtaking money theft and other impacts as a more\nconvenient monetization scheme with much broader industry coverage \n(not just the Financial sector). We can confidently classify most incidents with\ncauses before impact (suspicious events, tool alerts, etc.) as ransomware.\n\nVulnerability Exploitation:\nIn all cases when exploiting vulnerabilities was used as the initial vector, \nthe main damage is data encryption.The most prevalent vulnerability in our data set is the list of vulnerabilities related to Microsoft Exchange Server ( CVE-2021-26855 , CVE-2021-34523 , CVE-2021-26855 ,CVE-2021-34523 )\n\nTop initial compromise vectors and how long the attack went unnoticed:\nIn most cases where initial access wasn\u2019t identified, the attack lasted for\nmore than a year before being detected by the organization, by which time\n\nno artefacts were left to analyze due to log rotation policies. More than\nhalf of all attacks that started with malicious e-mails, stolen credentials\nor external application exploitation were detected in hours or days.\n\nLegitimate tools in MITRE ATT&CK\u00ae\nIn most cases, security teams can mitigate the initial vector of attack with\nprevention solutions. The most prevalent vectors of attack (exploitation \nof public-facing applications, compromised accounts, malicious e-mail) could\nhave been mitigated - with timely patch management and implementation \nof multifactor authentication, solutions with anti-phishing software to defend\nagainst phishing attacks, and implementation of security awareness training \nfor employees.\n\n\n-Business Secure Continuity-\n1402.07.23\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\n#MDR #NDR #EDR #Malware\n#BusinessSecureContinuity\n\nhttps://www.linkedin.com/feed/update/activity:7119244412445933568", "creation_timestamp": "2026-09-09T20:00:06.842477Z"}, {"uuid": "60560e65-728f-4138-859e-e43086ceb91d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34523", "type": "seen", "source": "https://t.me/cissp/7266", "content": "#DiyakoSecureBow\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\nWhy incident response is so critical:\nRansomware is overtaking money theft and other impacts as a more\nconvenient monetization scheme with much broader industry coverage \n(not just the Financial sector). We can confidently classify most incidents with\ncauses before impact (suspicious events, tool alerts, etc.) as ransomware.\n\nVulnerability Exploitation:\nIn all cases when exploiting vulnerabilities was used as the initial vector, \nthe main damage is data encryption.The most prevalent vulnerability in our data set is the list of vulnerabilities related to Microsoft Exchange Server ( CVE-2021-26855 , CVE-2021-34523 , CVE-2021-26855 ,CVE-2021-34523 )\n\nTop initial compromise vectors and how long the attack went unnoticed:\nIn most cases where initial access wasn\u2019t identified, the attack lasted for\nmore than a year before being detected by the organization, by which time\n\nno artefacts were left to analyze due to log rotation policies. More than\nhalf of all attacks that started with malicious e-mails, stolen credentials\nor external application exploitation were detected in hours or days.\n\nLegitimate tools in MITRE ATT&CK\u00ae\nIn most cases, security teams can mitigate the initial vector of attack with\nprevention solutions. The most prevalent vectors of attack (exploitation \nof public-facing applications, compromised accounts, malicious e-mail) could\nhave been mitigated - with timely patch management and implementation \nof multifactor authentication, solutions with anti-phishing software to defend\nagainst phishing attacks, and implementation of security awareness training \nfor employees.\n\n\n-Business Secure Continuity-\n1402.07.23\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\n#MDR #NDR #EDR #Malware\n#BusinessSecureContinuity\n\nhttps://www.linkedin.com/feed/update/activity:7119244412445933568", "creation_timestamp": "2026-09-10T00:00:22.497091Z"}]}