{"vulnerability": "CVE-2021-40444", "sightings": [{"uuid": "1fec4c74-6ba1-4e7e-b525-296d001adbb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/c6250a7a-63b1-4996-8734-3ab181e12e3e", "content": "", "creation_timestamp": "2021-09-17T13:28:19.000000Z"}, {"uuid": "536ef7cc-bc43-4d15-9105-1ff066f9a37b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "54baf3ea-f807-4578-8192-2b2f2a9ae629", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/0e364a41-87ba-499f-9fdb-431db5d5904b", "content": "", "creation_timestamp": "2021-10-20T11:54:14.000000Z"}, {"uuid": "a755b1c6-0fc0-4ab6-8b55-a26cf73bf764", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "9467ee8b-dc28-4a2e-a1e8-c0a7d628439a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/08b73391-3313-43b2-ba79-75bcbf606936", "content": "", "creation_timestamp": "2021-09-09T06:22:30.000000Z"}, {"uuid": "e7743fbe-7dce-4a1e-aa26-f51e33acb552", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:32:43.000000Z"}, {"uuid": "758c455d-47a9-4871-8d67-995dff4ed8cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/3c9fa790-f4b2-44e5-bd3c-593bd7113bef", "content": "", "creation_timestamp": "2024-02-28T11:10:03.000000Z"}, {"uuid": "9b473eff-b3ea-43a0-b166-6f5394eb904e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971008", "content": "", "creation_timestamp": "2024-12-24T20:22:59.062226Z"}, {"uuid": "b2a8cb3a-dd44-4461-a334-03d071f1e047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "a5c075a8-299c-4f63-9247-cf86b09595b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:40.000000Z"}, {"uuid": "6b03ec48-3136-41b1-953d-3f5ea9ec4abd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://infosec.exchange/users/saltmyhash/statuses/114039171548967342", "content": "", "creation_timestamp": "2025-02-21T01:01:38.398488Z"}, {"uuid": "65e7a9d3-b865-4456-868d-ab2623e615b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:57.000000Z"}, {"uuid": "b5f48b4c-3028-4fed-854b-da78a50868f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/0e364a41-87ba-499f-9fdb-431db5d5904b", "content": "", "creation_timestamp": "2025-11-07T14:52:33.000000Z"}, {"uuid": "b2e481a9-1ab2-4fd3-a3ba-c1f61d0f06cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:57.000000Z"}, {"uuid": "cd61ee3a-c192-471d-9728-4fb8768280e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/word_mshtml_rce.rb", "content": "", "creation_timestamp": "2021-12-08T23:05:35.000000Z"}, {"uuid": "07ff6efd-eb50-46b9-8b47-157cc0c49721", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://gist.github.com/emdnaia/e847d2f0ccf8257f8934004fa0206ab3", "content": "", "creation_timestamp": "2026-01-29T17:21:28.000000Z"}, {"uuid": "7c269797-9ed9-40ab-80ed-c804c1ace1e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://gist.github.com/RakhithJK/c314170d725c0b6601300e898456a04e", "content": "", "creation_timestamp": "2026-02-20T15:52:08.000000Z"}, {"uuid": "d85e88f0-8f96-4c1e-81f2-476ef4488324", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://gist.github.com/semarainc/c058d1b57e5d6cd814be5ed74607bcc0", "content": "", "creation_timestamp": "2026-02-03T09:28:54.000000Z"}, {"uuid": "b5a64a62-75d2-43ec-9cbc-68e2d4b1f855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://gist.github.com/onlypwns/be8b24417fad709634f0b88d49d7bfb9", "content": "", "creation_timestamp": "2026-02-21T09:31:45.000000Z"}, {"uuid": "8d31c434-3ef5-4583-9b3c-b19c5c49493e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=649", "content": "", "creation_timestamp": "2021-09-15T04:00:00.000000Z"}, {"uuid": "5d0069d5-e27e-48aa-902d-bf461b126a90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=641", "content": "", "creation_timestamp": "2021-09-08T04:00:00.000000Z"}, {"uuid": "4808050d-b9c8-4760-9090-590f1c4567c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/fdda4963-0aa7-4d15-8a8f-969db8f304ca", "content": "", "creation_timestamp": "2025-02-28T23:49:13.272798Z"}, {"uuid": "89815a79-7ee0-419c-9167-1a9a7ce4b547", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bdc4327f-58b2-466a-ae76-b26643cb37fe", "content": "", "creation_timestamp": "2026-02-02T12:28:52.858004Z"}, {"uuid": "5473fce6-d4c5-4656-9c46-d0fa4bfb4fdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/524", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aMalicious document builder for CVE-2021-40444 \nURL\uff1ahttps://github.com/amartinsec/MSHTMHell", "creation_timestamp": "2021-09-14T13:51:10.000000Z"}, {"uuid": "6697871f-df64-4e15-b2b6-2737aebde51f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/676", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aThis repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit\nURL\uff1ahttps://github.com/Sirius-RJ/FullstackAcademy-Printernightmare-writeup-2105-E.C.A.R.", "creation_timestamp": "2021-10-11T21:47:47.000000Z"}, {"uuid": "be60c6fe-0a5a-45cc-86fd-8008357cd28c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/702", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aTIC4301 Project - CVE-2021-40444\nURL\uff1ahttps://github.com/factionsypho/TIC4301_Project", "creation_timestamp": "2021-10-16T08:55:46.000000Z"}, {"uuid": "d9081132-d9da-4149-8351-3d7e5c2f3874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/614", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aMicrosoft MSHTML Remote Code Execution Vulnerability CVE-2021-40444\nURL\uff1ahttps://github.com/ozergoker/CVE-2021-40444", "creation_timestamp": "2021-09-29T11:45:16.000000Z"}, {"uuid": "0f7ca9cb-59d3-441d-aba7-64e25ba99894", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/613", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aThis docx exploit uses res files inside Microsoft .docx file to execute malicious files. This exploit is related to CVE-2021-40444\nURL\uff1ahttps://github.com/LazarusReborn/Docx-Exploit-2021", "creation_timestamp": "2021-09-29T10:47:44.000000Z"}, {"uuid": "68512f4d-4f14-432a-a5bb-6e0a8aaab8ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/781", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aTIC4301 Project - CVE-2021-40444\nURL\uff1ahttps://github.com/factionsypho/TIC4301_Project", "creation_timestamp": "2021-10-31T06:39:06.000000Z"}, {"uuid": "276c99a2-dd68-475b-b044-02de64aa1592", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7061", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 Mapping and Pivoting from Cobalt Strike C2 Infrastructure Attributed to CVE-2021-40444.\n\nhttps://michaelkoczwara.medium.com/mapping-and-pivoting-cobalt-strike-c2-infrastructure-attributed-to-cve-2021-40444-438786fcd68a", "creation_timestamp": "2021-09-13T05:53:59.000000Z"}, {"uuid": "d90472f0-5259-48a4-a44c-cc05e284da7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cKure/7059", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2021-40444: Windows MSHTML zero-day exploits shared on hacking forums.\n\nhttps://www.bleepingcomputer.com/news/microsoft/windows-mshtml-zero-day-exploits-shared-on-hacking-forums/", "creation_timestamp": "2021-09-12T23:12:57.000000Z"}, {"uuid": "35556488-f061-4474-9359-84b7b725b4fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7039", "content": "CVE-2021-40444 PoC\n\nhttps://github.com/lockedbyte/CVE-2021-40444", "creation_timestamp": "2021-09-11T09:01:03.000000Z"}, {"uuid": "9da272b4-3311-4209-8835-52188335e387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cKure/6992", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 Microsoft on Tuesday warned of an actively exploited zero-day flaw impacting Internet Explorer that's being used to hijack vulnerable Windows systems by leveraging weaponized Office documents.\nTracked as CVE-2021-40444 (CVSS score: 8.8), the remote code execution flaw is rooted in MSHTML (aka Trident), a proprietary browser engine for the now-discontinued Internet Explorer and which is used in Office to render web content inside Word, Excel, and PowerPoint documents.\n\nhttps://thehackernews.com/2021/09/new-0-day-attack-targeting-windows.html", "creation_timestamp": "2021-09-08T06:14:03.000000Z"}, {"uuid": "20f52baf-fc20-4fb7-a0f6-a485bf9780e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cKure/7037", "content": "CVE-2021-40444; a Half-Click exploit.", "creation_timestamp": "2021-09-11T07:29:52.000000Z"}, {"uuid": "11b3f820-9847-418e-9cc3-b58fde092482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7035", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 CVE-2021-40444\n\nhttps://blog.nviso.eu/2021/09/09/kusto-hunting-query-for-cve-2021-40444", "creation_timestamp": "2021-09-11T05:58:37.000000Z"}, {"uuid": "b23a3595-fc58-4ccf-aea5-cea4817dfbec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7027", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 CVE-2021-40444 Sample\n\nhttps://github.com/Udyz/CVE-2021-40444-Sample/blob/main/poc.html", "creation_timestamp": "2021-09-10T16:04:08.000000Z"}, {"uuid": "80d73a2d-9275-41a9-a146-4e42b621d7f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cKure/7007", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability\n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444", "creation_timestamp": "2021-09-09T08:15:52.000000Z"}, {"uuid": "6ea1100b-d1a3-4b14-a16b-c370582cfbac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7058", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Zero-Day technical analysis: Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs.\n\nhttps://www.trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html", "creation_timestamp": "2021-09-12T23:10:01.000000Z"}, {"uuid": "57042f98-b8d9-4ca9-a587-19f3a05b59bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cKure/7136", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 CVE-2021-40444 exploitation: Researchers find connections to previous attacks.\n\nhttps://www.helpnetsecurity.com/2021/09/16/cve-2021-40444-exploitation/", "creation_timestamp": "2021-09-16T16:44:04.000000Z"}, {"uuid": "bd70d72a-748c-428f-95be-a586596acf95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cKure/7126", "content": "Fully Weaponized CVE-2021-40444\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution), works with arbitrary DLL files.\n\nhttps://github.com/klezVirus/CVE-2021-40444", "creation_timestamp": "2021-09-16T10:41:49.000000Z"}, {"uuid": "14d005ae-9214-4011-9511-b57b53d86343", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cKure/7113", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability.\n\nhttps://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/", "creation_timestamp": "2021-09-16T06:17:30.000000Z"}, {"uuid": "ad917073-d1fe-4a4b-8962-b654e0cac027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cKure/8450", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 CVE-2021-40444 exploit.\n\nhttps://github.com/34zY/Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit", "creation_timestamp": "2021-12-20T15:16:37.000000Z"}, {"uuid": "13fa2075-e754-4417-9817-9e4c7c7449b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cKure/8448", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 Update on CVE-2021-40444 aka Log4shell.\n\nhttps://blogs.juniper.net/en-us/threat-research/log4j-vulnerability-attackers-shift-focus-from-ldap-to-rmi", "creation_timestamp": "2021-12-19T06:16:58.000000Z"}, {"uuid": "61aed7aa-7bbc-4ee3-a84c-7a2ff7ed3fab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1170", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-40444\nURL\uff1ahttps://github.com/34zY/Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit", "creation_timestamp": "2021-12-19T08:20:15.000000Z"}, {"uuid": "adbbc404-bc38-445f-a0b5-9757c86111cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/toolslounge/480", "content": "zero-day exploit for CVE-2021-40444\nhttps://github.com/lockedbyte/CVE-2021-40444", "creation_timestamp": "2021-09-16T18:46:22.000000Z"}, {"uuid": "05ca37af-65ba-48f3-aa00-ef874c8e38ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/secmedia/24", "content": "\u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SafeBreach Labs \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u0438\u0440\u0430\u043d\u0441\u043a\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-40444 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0442 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 Google \u0438 Instagram. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0430\u0442\u0430\u043a\u0443\u044e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0433\u043e\u0432\u043e\u0440\u044f\u0449\u0438\u0445 \u043d\u0430 \u0444\u0430\u0440\u0441\u0438.", "creation_timestamp": "2021-11-26T09:07:36.000000Z"}, {"uuid": "7be88e9d-016a-4d8f-9134-04649dc5df5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/5180856b-d3c5-4036-9201-94693724365c", "content": "", "creation_timestamp": "2026-04-19T22:25:33.000000Z"}, {"uuid": "b96ebe50-9c27-4271-9ee1-42aabc1c2ab4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/innostage_group/72", "content": "PHDays 11: \u0433\u0434\u0435 \u043d\u0430\u0439\u0442\u0438 \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u044f \u0441\u043f\u0438\u043a\u0435\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \ud83e\uddd0\n\n\u041f\u0440\u0435\u0441\u0441-\u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u044f \u00ab\u041a\u0438\u0431\u0435\u0440\u0431\u0435\u0437 \u0432 \u043d\u043e\u0432\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u044f\u0445: \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442 \u0434\u0430\u043b\u044c\u0448\u0435\u00bb \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0435\u043c \u0410\u0439\u0434\u0430\u0440\u0430 \u0413\u0443\u0437\u0430\u0438\u0440\u043e\u0432\u0430 \ud83d\udc49\ud83c\udffc https://youtu.be/nQFQyUvCgAM\n\n\u042d\u0444\u0438\u0440 \u0432 \u0440\u0430\u0434\u0438\u043e\u0440\u0443\u0431\u043a\u0435. \u0410\u0439\u0434\u0430\u0440 \u0413\u0443\u0437\u0430\u0438\u0440\u043e\u0432 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0443\u0447\u0430\u0441\u0442\u0438\u0435 \u0432 \u0431\u0435\u0441\u0435\u0434\u0435 \u043d\u0430 \u0442\u0435\u043c\u0443 \u0438\u043c\u043f\u043e\u0440\u0442\u043e\u0437\u0430\u043c\u0435\u0449\u0435\u043d\u0438\u044f \ud83d\udc49\ud83c\udffc https://youtu.be/23V0Q8yxG0k\n\n\u041f\u0430\u043d\u0435\u043b\u044c\u043d\u0430\u044f \u0434\u0438\u0441\u043a\u0443\u0441\u0441\u0438\u044f \u00ab\u041e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438\u00bb \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0435\u043c \u0421\u0435\u0440\u0433\u0435\u044f \u041a\u0438\u043a\u0438\u043b\u043e \ud83d\udc49\ud83c\udffc https://youtu.be/FrQX1_lsAjk\n\n\u042d\u043a\u0441\u043a\u0443\u0440\u0441\u0438\u044f \u0432 SOC Innostage, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u043b \u0410\u043d\u0442\u043e\u043d \u041a\u0443\u0437\u044c\u043c\u0438\u043d \ud83d\udc49\ud83c\udffc https://youtu.be/LcEVPV-K6qk\n\n\u041f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0442\u043e\u0433\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0438\u0442\u0432\u044b \u0441 \u0410\u043b\u0435\u043a\u0441\u0435\u043c \u041b\u043e\u0431\u0437\u0438\u043d\u044b\u043c \ud83d\udc49\ud83c\udffc https://youtu.be/c4U5ELOvWEo\n\n\u0425\u0440\u0430\u043d\u0435\u043d\u0438\u0435 API-\u043a\u043b\u044e\u0447\u0435\u0439 - \u0434\u043e\u043a\u043b\u0430\u0434 \u0418\u043b\u044c\u0441\u0430\u0444\u0430 \u041d\u0430\u0431\u0438\u0443\u043b\u043b\u0438\u043d\u0430 \ud83d\udc49\ud83c\udffc https://youtu.be/jVoq2pJznpk\n\nCVE-2021-40444: \u043f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e - \u0434\u043e\u043a\u043b\u0430\u0434 \u0410\u043b\u0435\u043a\u0441\u0430\u043d\u0434\u0440\u0430 \u0413\u043e\u043d\u0447\u0430\u0440\u043e\u0432\u0430 \ud83d\udc49\ud83c\udffc https://youtu.be/8e-VRSzRHVg\n\n#Innostage\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b", "creation_timestamp": "2022-09-27T12:56:39.000000Z"}, {"uuid": "7593bbde-d67a-4a31-a676-e6b7085a4ff4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/innostage_group/45", "content": "\u0414\u043e\u043a\u043b\u0430\u0434\u044b PHDays - \u044d\u0442\u043e \u0432\u0441\u0435\u0433\u0434\u0430 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0438 \u043e\u0447\u0435\u043d\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\ud83d\udca5 \n\n\u041d\u0430 PHDays \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u043e \u0431\u0443\u0434\u0435\u0442 \u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043e\u0442\u0440\u0430\u0441\u043b\u0438. \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0413\u041a Innostage \u0433\u043e\u0442\u043e\u0432\u044f\u0442 \u0434\u043e\u043a\u043b\u0430\u0434\u044b. \n\n\ud83d\ude0e\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0418\u043b\u044c\u0441\u0430\u0444 \u041d\u0430\u0431\u0438\u0443\u043b\u043b\u0438\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u0442 \u043e \u0442\u043e\u043c, \u043f\u043e\u0447\u0435\u043c\u0443 \u043d\u0435 \u0441\u0442\u043e\u0438\u0442 \u0445\u0440\u0430\u043d\u0438\u0442\u044c API \u043a\u043b\u044e\u0447\u0438 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435, \u0432\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0432 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u0442\u044c \u043d\u0430 GitHub. \n\n\ud83d\ude0e\u0410\u043b\u0435\u043a\u0441\u0430\u043d\u0434\u0440 \u0413\u043e\u043d\u0447\u0430\u0440\u043e\u0432, \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0413\u041a Innostage \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0442\u0435\u043c\u0443 \"CVE-2021-40444: \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e\".  \n\n\u0417\u0434\u0435\u0441\u044c \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u043e\u043a\u043b\u0430\u0434\u0447\u0438\u043a\u043e\u0432", "creation_timestamp": "2022-05-06T13:03:30.000000Z"}, {"uuid": "a6771c09-c9ad-4682-a290-360832cc10b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/codeby_sec/5002", "content": "\u200b\u200b\u0412\u0437\u043b\u043e\u043c \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c CVE-2021-40444\n\n\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0445\u043e\u0447\u0443 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e CVE-2021-40444. \u0415\u0441\u043b\u0438 \u043a\u043e\u0440\u043e\u0442\u043a\u043e, \u0442\u043e \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MSHTML (\u0434\u0432\u0438\u0436\u043e\u043a Internet Explorer \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0432\u043e\u0440\u0434\u0435) \u043e\u043d\u0430 \u0434\u0430\u0451\u0442 \u043d\u0430\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0436\u0435\u0440\u0442\u0432\u044b. \u0421\u0430\u043c\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043e\u0445\u043e\u0436\u0430 \u043d\u0430 CVE-2017-11882, \u043f\u0440\u043e \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0443\u0436\u0435 \u043f\u0438\u0441\u0430\u043b\u0438 \u043d\u0430 Codeby.\n\n\u0427\u0438\u0442\u0430\u0442\u044c: https://codeby.net/threads/vzlom-posredstvom-cve-2021-40444.78576/?amp=1\n\n#cve #word #hacking", "creation_timestamp": "2021-09-15T18:20:53.000000Z"}, {"uuid": "406ee3a6-3b2d-4c4e-867c-72d7cfc8134d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/R0_Crew/2020", "content": "CVE-2021-40444 Analysis / Exploit \n\nhttps://forum.reverse4you.org/t/cve-2021-40444-analysis-exploit/17118\n\n#expdev #windows #cve #office #rce #exploit #hottabych", "creation_timestamp": "2022-03-25T18:56:01.000000Z"}, {"uuid": "51896112-5dbf-4b35-9b4e-fc8333ea4daf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/ckuRED/16", "content": "Fully Weaponized CVE-2021-40444\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution), works with arbitrary DLL files.\n\nhttps://github.com/klezVirus/CVE-2021-40444", "creation_timestamp": "2021-09-16T10:41:36.000000Z"}, {"uuid": "2d26fe6d-7bb5-4ceb-b730-58036cdd2d43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/ckuRED/11", "content": "CVE-2021-40444 PoC\n\nhttps://github.com/lockedbyte/CVE-2021-40444", "creation_timestamp": "2021-09-11T09:00:53.000000Z"}, {"uuid": "22f7c540-691b-42b1-913e-5d6cdedc1540", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ckuRED/9", "content": "CVE-2021-40444; a Half-Click exploit.", "creation_timestamp": "2021-09-11T07:29:31.000000Z"}, {"uuid": "5c5e2846-9d35-4ad9-a868-f33f0fc476ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cyberfreek/1514", "content": "IT-\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u0424\u0421\u0411 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c (\u041d\u041a\u0426\u041a\u0418) \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043e\u0431 \u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \"\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f\" \u0432 \u041f\u041e Microsoft, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u043c\u0443 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u043c\u0438 \u0432\u0438\u0440\u0443\u0441\u0430\u043c\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-40444 \u0432 Microsoft MSHTML \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Microsoft Windows \u0432\u0435\u0440\u0441\u0438\u0439 7, 8.1, 10 \u0438 Microsoft Windows Server \u0432\u0435\u0440\u0441\u0438\u0439 2008, 2012, 2016, 2019, 2022. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0435\u0435, \u0432\u043d\u0435\u0434\u0440\u044f\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0432 \u0445\u043e\u0434\u0435 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0445 \u0430\u0442\u0430\u043a.", "creation_timestamp": "2021-09-13T13:16:01.000000Z"}, {"uuid": "b40a57cc-b7c3-4adc-99ed-14555f27a558", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/orderofsixangles/1589", "content": "\u0412\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443 \u0441\u0435\u0431\u044f \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u043a\u0435 CVE-2021-40444\n\nhttps://xret2pwn.github.io/CVE-2021-40444-Analysis-and-Exploit/\n\nhttps://github.com/felixweyne/imaginaryC2/tree/master/examples/use-case-10-CVE-2021-40444", "creation_timestamp": "2021-09-13T08:17:35.000000Z"}, {"uuid": "da142953-ad3a-430e-b628-4a31d8e9101f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/541", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-40444 - Custom CAB templates from MakeCAB\nURL\uff1ahttps://github.com/Udyz/CVE-2021-40444-CAB", "creation_timestamp": "2021-09-16T10:19:46.000000Z"}, {"uuid": "5a77dee5-a68d-409a-9983-797927bcafe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/538", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-40444 - MS Office Word RCE Exploit\nURL\uff1ahttps://github.com/klezVirus/CVE-2021-40444", "creation_timestamp": "2021-09-16T07:20:18.000000Z"}, {"uuid": "6ebb55b1-cc13-4e95-b920-38499bd92a29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/BleepingComputer/10474", "content": "Windows MSHTML zero-day exploits shared on hacking forums\n\nThreat actors are sharing working Windows CVE-2021-40444 MSHTML zero-day exploits on hacking forums, allowing other hackers to start exploiting the new vulnerability in their own attacks. [...]\n\nhttps://www.bleepingcomputer.com/news/microsoft/windows-mshtml-zero-day-exploits-shared-on-hacking-forums/", "creation_timestamp": "2021-09-12T17:09:28.000000Z"}, {"uuid": "8e83e79a-561b-4f13-b606-a48b7f75a741", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/BleepingComputer/10470", "content": "Windows MSHTML zero-day defenses bypassed as new info emerges\n\nNew details have emerged about the recent Windows CVE-2021-40444 zero-day vulnerability, how it is being exploited in attacks, and the threat actor's ultimate goal of taking over corporate networks. [...]\n\nhttps://www.bleepingcomputer.com/news/microsoft/windows-mshtml-zero-day-defenses-bypassed-as-new-info-emerges/", "creation_timestamp": "2021-09-10T06:42:24.000000Z"}, {"uuid": "5d64eae1-f9e6-452a-b01d-0a748e623c18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/BleepingComputer/10489", "content": "Microsoft fixes Windows CVE-2021-40444 MSHTML zero-day bug\n\nMicrosoft today fixed a high severity\u00a0zero-day vulnerability actively exploited in targeted attacks against Microsoft Office and Office 365 on Windows 10 computers. [...]\n\nhttps://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-cve-2021-40444-mshtml-zero-day-bug/", "creation_timestamp": "2021-09-14T21:39:44.000000Z"}, {"uuid": "8f7953ff-902d-4403-bb7b-7f3eacbca288", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/YouPentest/3327", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 Microsoft MSHTML, \u0447\u0442\u043e\u0431\u044b \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0443\u0447\u0435\u0442\u043a\u0438 Google \u0438 Instagram. \n\n\u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0438\u043b\u0435\u0440 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 PowerShell, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 PowerShortShell. \n\n\u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Windows \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Winword, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) Microsoft MSHTML CVE-2021-40444.", "creation_timestamp": "2021-11-25T06:46:06.000000Z"}, {"uuid": "53c3bfdf-00d5-4333-8578-5428313e393e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/YouPentest/3114", "content": "\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f CVE-2021-40444 \u0447\u0435\u0440\u0435\u0437 (Microsoft Office Word Remote Code Execution)\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a:\nhttps://codeby.net/media/ehkspluatacija-cve-2021-40444-cherez-microsoft-office-word-remote-code-execution.327/\n\n\u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b:\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\n#\u0432\u0438\u0434\u0435\u043e #pentest #guide #cve #metasploit #office #windows #exploit", "creation_timestamp": "2021-11-07T05:55:39.000000Z"}, {"uuid": "942ed508-be7e-4d1f-84bf-92d22575cf9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/CherepawwkaChannel/178", "content": "\u0423\u0440\u043e\u043a\u0438 \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438. \u0418\u0449\u0435\u043c \u0443\u043b\u0438\u043a\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u0435\nhttps://telegra.ph/Haker---Uroki-forenziki-Ishchem-uliki-v-setevom-trafike-07-11\n\n\u041e\u0447\u0435\u043d\u044c \u0445\u043e\u0440\u043e\u0448\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f, \u0432\u0437\u044f\u0442\u0430\u044f \u043e\u0442\u0441\u044e\u0434\u0430. \u0410\u0432\u0442\u043e\u0440 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (\u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u0434\u0438\u0437\u0435\u0441\u0441\u0435\u043c\u0431\u043b\u0435\u0440, \u0443\u0442\u0438\u043b\u0438\u0442\u0430 \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u043e\u0432 \u0438 \u0442.\u0434.) \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u044d\u0442\u0430\u043f\u044b \u0430\u0442\u0430\u043a\u0438, \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u044b\u0439 \u0448\u0430\u0433 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f.\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e \u043a \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044e \u0441\u0438\u043d\u0438\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u043c.\n#DRIF #\u0431\u043b\u044e\u0442\u0438\u043c", "creation_timestamp": "2023-07-30T00:43:31.000000Z"}, {"uuid": "1d163e08-d754-4600-a763-81a58e0b7ac4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/purple_medved/253", "content": "\u0410\u043d\u0430\u043b\u0438\u0437 TTPs APT \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 TI \u043e\u0442\u0447\u0435\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0430\u0442\u043e\u043c\u0430\u0440\u043d\u044b\u0445 \u0442\u0435\u0441\u0442-\u043a\u0435\u0439\u0441\u043e\u0432 \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u0432\u0441\u0435\u0433\u0434\u0430 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0430 \u044d\u0442\u0430\u043f\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438 \u043a \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044e Purple Teaming. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u044b \u0432\u0441\u0435\u0433\u0434\u0430 \u0441\u0442\u0430\u0440\u0430\u0435\u043c\u0441\u044f \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0443 \u0441 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u043c\u0438, \u0431\u0435\u0437 \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433\u043e\u0432\u043e\u0439 \u0432\u043e\u0434\u044b \u0438 \"highly sophisticated\" \u0444\u043e\u0440\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u043e\u043a\ud83d\ude0e \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043c\u043d\u0435 \u043d\u0430 \u0433\u043b\u0430\u0437\u0430 \u043f\u043e\u043f\u0430\u043b\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0439 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u0442\u044c \u0432 \u044d\u0442\u043e\u0439 \u0437\u0430\u043c\u0435\u0442\u043a\u0435.\n\n\u0410\u0432\u0442\u043e\u0440 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u0442 \u043e\u0442\u0447\u0435\u0442\u044b \u0438 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u043f\u043b\u0430\u043d \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 Purple Teaming. \n\u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e - Fancy Bear APT28 Adversary Simulation:\n\n\ud83d\udfe3 Create dll downloads files through base64, This is to download two files the first is (dfsvc.dll) the second is (Stager.dll)\n\ud83d\udfe3 Exploiting CVE-2021-40444 to inject the DLL file into Word File and create an execution for DLL by opening Word File\n\ud83d\udfe3 Word File is running and the actual payload is downloaded through DLLDownloader.dll and we have two files Stager.dll and dfsvc.dll\n\ud83d\udfe3 The Stager decrypts the actual payload and runs it which in turn is responsible for command and control\n\ud83d\udfe3 Data exfiltration over OneDrive API C2. This integrates OneDrive API functionality to facilitate communication between the compromised system and the attacker-controlled server thereby potentially hiding the traffic within legitimate OneDrive communication\n\ud83d\udfe3 Get Command and Control through payload uses the OneDrive API to upload data including command output to OneDrive, the payload calculates the CRC32 checksum of the MachineGuid and includes it in the communication with the server for identification purposes\n\n\u0412 \u0438\u0442\u043e\u0433\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043a\u0430\u0441\u0442\u043e\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f Purple Teaming.", "creation_timestamp": "2024-06-13T10:28:01.000000Z"}, {"uuid": "0180ac19-b3a6-4ffb-8448-f342e8c4b4c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/deeptoweb/1806", "content": "\u0424\u0421\u0411 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Windows \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \n\n\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043f\u043e \u043f\u0440\u0438\u043a\u0430\u0437\u0443 \u0424\u0421\u0411, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Windows \u043e\u0431 \u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043e \u0432\u0441\u0435\u0445 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\u0412 \u0434\u0432\u0438\u0436\u043a\u0435 Internet Explorer \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-40444. \u0421 \u0435\u0451 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.\n\u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0447\u0435\u0440\u0435\u0437 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0443 \u043f\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0412 \u0444\u0430\u0439\u043b \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u044d\u043b\u0435\u043c\u0435\u043d\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f ActiveX, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a\u043e\u0434.\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Windows 7, 8.1, 10 \u0438 Windows Server 2008, 2012, 2016, 2019 \u0438 2022.\nMicrosoft \u0437\u043d\u0430\u0435\u0442 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0438 \u0443\u0436\u0435 \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0435\u0451 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\u041f\u043e\u043a\u0430 \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043d\u043e\u0432\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f ActiveX.", "creation_timestamp": "2021-09-13T13:28:04.000000Z"}, {"uuid": "c4a18db0-f383-4bcb-acd8-489ee11b43b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/536", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aThis repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit\nURL\uff1ahttps://github.com/aslitsecurity/CVE-2021-40444_builders", "creation_timestamp": "2021-09-15T16:38:42.000000Z"}, {"uuid": "1de74162-a2c3-4dd5-ae5f-a1a82ebbe186", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/CherepawwkaChannel/255", "content": "\u0410\u043d\u0430\u043b\u0438\u0437 TTPs APT \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 TI \u043e\u0442\u0447\u0435\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0430\u0442\u043e\u043c\u0430\u0440\u043d\u044b\u0445 \u0442\u0435\u0441\u0442-\u043a\u0435\u0439\u0441\u043e\u0432 \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u0432\u0441\u0435\u0433\u0434\u0430 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0430 \u044d\u0442\u0430\u043f\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438 \u043a \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044e Purple Teaming. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u044b \u0432\u0441\u0435\u0433\u0434\u0430 \u0441\u0442\u0430\u0440\u0430\u0435\u043c\u0441\u044f \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0443 \u0441 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u043c\u0438, \u0431\u0435\u0437 \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433\u043e\u0432\u043e\u0439 \u0432\u043e\u0434\u044b \u0438 \"highly sophisticated\" \u0444\u043e\u0440\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u043e\u043a\ud83d\ude0e \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043c\u043d\u0435 \u043d\u0430 \u0433\u043b\u0430\u0437\u0430 \u043f\u043e\u043f\u0430\u043b\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0439 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u0442\u044c \u0432 \u044d\u0442\u043e\u0439 \u0437\u0430\u043c\u0435\u0442\u043a\u0435.\n\n\u0410\u0432\u0442\u043e\u0440 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u0442 \u043e\u0442\u0447\u0435\u0442\u044b \u0438 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u043f\u043b\u0430\u043d \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 Purple Teaming. \n\u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e - Fancy Bear APT28 Adversary Simulation:\n\n\ud83d\udfe3 Create dll downloads files through base64, This is to download two files the first is (dfsvc.dll) the second is (Stager.dll)\n\ud83d\udfe3 Exploiting CVE-2021-40444 to inject the DLL file into Word File and create an execution for DLL by opening Word File\n\ud83d\udfe3 Word File is running and the actual payload is downloaded through DLLDownloader.dll and we have two files Stager.dll and dfsvc.dll\n\ud83d\udfe3 The Stager decrypts the actual payload and runs it which in turn is responsible for command and control\n\ud83d\udfe3 Data exfiltration over OneDrive API C2. This integrates OneDrive API functionality to facilitate communication between the compromised system and the attacker-controlled server thereby potentially hiding the traffic within legitimate OneDrive communication\n\ud83d\udfe3 Get Command and Control through payload uses the OneDrive API to upload data including command output to OneDrive, the payload calculates the CRC32 checksum of the MachineGuid and includes it in the communication with the server for identification purposes\n\n\u0412 \u0438\u0442\u043e\u0433\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u043a\u0430\u0441\u0442\u043e\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f Purple Teaming.", "creation_timestamp": "2024-06-13T10:28:37.000000Z"}, {"uuid": "4bbac7d1-6c31-41ba-bfe7-73c0fc5ca77e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cyberbannews_ir/3886", "content": "\ud83d\uded1\u0647\u0634\u062f\u0627\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631 \u0645\u0648\u0631\u062f \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0628\u0627 \u062e\u0637\u0631 \u0628\u0627\u0644\u0627\n\n \u0645\u0631\u06a9\u0632 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0627\u0633\u062a\u0631\u0627\u0644\u06cc\u0627 (ACSC) \u0646\u0633\u0628\u062a \u0628\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0631\u06cc\u0633\u06a9 \u0628\u0627\u0644\u0627 \u062f\u0631 \u0645\u0624\u0644\u0641\u0647 \u0645\u0648\u062c\u0648\u062f \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u00abMicrosoft Windows\u00bb\u060c \u06a9\u0647 \u0634\u0627\u06cc\u062f \u0628\u0647\u200c\u0648\u0633\u06cc\u0644\u0647 \u0639\u0648\u0627\u0645\u0644 \u0633\u0627\u06cc\u0628\u0631\u06cc \u0645\u062e\u0631\u0628 \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u060c \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u060c \u06a9\u0647 \u00abCVE-2021-40444\u00bb \u0646\u0627\u0645 \u062f\u0627\u0631\u062f\u060c \u0628\u0647 \u0627\u06cc\u0646 \u0645\u0639\u0646\u06cc \u0627\u0633\u062a \u06a9\u0647 \u06cc\u06a9 \u0639\u0627\u0645\u0644 \u0633\u0627\u06cc\u0628\u0631\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06cc\u06a9 \u0633\u0646\u062f \u0645\u062e\u0631\u0628 \u0627\u06cc\u062c\u0627\u062f \u0648 \u06a9\u0627\u0631\u0628\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u06cc\u0646\u062f\u0648\u0632 \u0631\u0627 \u0645\u062a\u0642\u0627\u0639\u062f \u06a9\u0646\u062f \u06a9\u0647 \u0622\u0646 \u0631\u0627 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u06a9\u0645\u067e\u06cc\u0646 \u0627\u0633\u067e\u06cc\u0631 \u0641\u06cc\u0634\u06cc\u0646\u06af \u0628\u0627\u0632 \u06a9\u0646\u062f.\n\n\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0647\u062f\u0641\u0645\u0646\u062f \u0628\u0631\u0627\u06cc \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0622\u06af\u0627\u0647 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0641\u0639\u0644\u0627\u064b \u0647\u06cc\u0686 \u067e\u0686\u06cc \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0646\u062f\u0627\u0631\u062f.\n\n\u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0631\u062e\u06cc \u06a9\u0627\u0647\u0634\u200c\u0647\u0627\u06cc \u0645\u0648\u0642\u062a \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u06a9\u0647 \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0622\u0646\u0647\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0628\u0647 \u06a9\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f. \u0645\u0631\u06a9\u0632 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0627\u0633\u062a\u0631\u0627\u0644\u06cc\u0627 \u0628\u0647 \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u062a\u0648\u0635\u06cc\u0647 \u06a9\u0631\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0631\u0627\u0647\u200c\u062d\u0644\u200c\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0645\u06a9\u0627\u0646 \u0622\u0646\u0647\u0627 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f.\n\n\u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0627\u06cc\u062f \u0628\u0647 \u062a\u0648\u0635\u06cc\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631\u0645\u0648\u0631\u062f \u0627\u0646\u062a\u0634\u0627\u0631 \u067e\u0686 \u0628\u0631\u0627\u06cc \u0631\u0641\u0639 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u062c\u0647 \u06a9\u0646\u0646\u062f.\n\n#\u0627\u0645\u0646\u06cc\u062a_\u0633\u0627\u06cc\u0628\u0631\u06cc\n\n@cyberbannews_ir", "creation_timestamp": "2021-09-09T05:21:47.000000Z"}, {"uuid": "b0cd9870-f4af-4900-9b7c-94a269b0699a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cyberbannews_ir/3892", "content": "\ud83d\uded1\u0647\u0634\u062f\u0627\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631 \u0645\u0648\u0631\u062f \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0628\u0627 \u062e\u0637\u0631 \u0628\u0627\u0644\u0627\n\n\u0645\u0631\u06a9\u0632 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0627\u0633\u062a\u0631\u0627\u0644\u06cc\u0627 (ACSC) \u0646\u0633\u0628\u062a \u0628\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0631\u06cc\u0633\u06a9 \u0628\u0627\u0644\u0627 \u062f\u0631 \u0645\u0624\u0644\u0641\u0647 \u0645\u0648\u062c\u0648\u062f \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u00abMicrosoft Windows\u00bb\u060c \u06a9\u0647 \u0634\u0627\u06cc\u062f \u0628\u0647\u200c\u0648\u0633\u06cc\u0644\u0647 \u0639\u0648\u0627\u0645\u0644 \u0633\u0627\u06cc\u0628\u0631\u06cc \u0645\u062e\u0631\u0628 \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u060c \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u060c \u06a9\u0647 \u00abCVE-2021-40444\u00bb \u0646\u0627\u0645 \u062f\u0627\u0631\u062f\u060c \u0628\u0647 \u0627\u06cc\u0646 \u0645\u0639\u0646\u06cc \u0627\u0633\u062a \u06a9\u0647 \u06cc\u06a9 \u0639\u0627\u0645\u0644 \u0633\u0627\u06cc\u0628\u0631\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06cc\u06a9 \u0633\u0646\u062f \u0645\u062e\u0631\u0628 \u0627\u06cc\u062c\u0627\u062f \u0648 \u06a9\u0627\u0631\u0628\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u06cc\u0646\u062f\u0648\u0632 \u0631\u0627 \u0645\u062a\u0642\u0627\u0639\u062f \u06a9\u0646\u062f \u06a9\u0647 \u0622\u0646 \u0631\u0627 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u06a9\u0645\u067e\u06cc\u0646 \u0627\u0633\u067e\u06cc\u0631 \u0641\u06cc\u0634\u06cc\u0646\u06af \u0628\u0627\u0632 \u06a9\u0646\u062f.\n\n\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0647\u062f\u0641\u0645\u0646\u062f \u0628\u0631\u0627\u06cc \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0622\u06af\u0627\u0647 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0641\u0639\u0644\u0627\u064b \u0647\u06cc\u0686 \u067e\u0686\u06cc \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0646\u062f\u0627\u0631\u062f.\n\n\u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0631\u062e\u06cc \u06a9\u0627\u0647\u0634\u200c\u0647\u0627\u06cc \u0645\u0648\u0642\u062a \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u06a9\u0647 \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0622\u0646\u0647\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0628\u0647 \u06a9\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f. \u0645\u0631\u06a9\u0632 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0627\u0633\u062a\u0631\u0627\u0644\u06cc\u0627 \u0628\u0647 \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u062a\u0648\u0635\u06cc\u0647 \u06a9\u0631\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0631\u0627\u0647\u200c\u062d\u0644\u200c\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0645\u06a9\u0627\u0646 \u0622\u0646\u0647\u0627 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f.\n\n\u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0627\u06cc\u062f \u0628\u0647 \u062a\u0648\u0635\u06cc\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631\u0645\u0648\u0631\u062f \u0627\u0646\u062a\u0634\u0627\u0631 \u067e\u0686 \u0628\u0631\u0627\u06cc \u0631\u0641\u0639 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u062c\u0647 \u06a9\u0646\u0646\u062f.\n\n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc\n\n@cyberbannews_ir", "creation_timestamp": "2021-09-11T02:02:58.000000Z"}, {"uuid": "47766072-f4ed-448a-9c2b-71e690beff2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/alexmakus/4291", "content": "\u0422\u0430\u043a, \u0447\u0442\u043e \u043b\u0438, \u0442\u043e\u043b\u044c\u043a\u043e Apple \u0430\u043f\u0434\u0435\u0439\u0442\u044b \u0441 \u0444\u0438\u043a\u0441\u0430\u043c\u0438 \u0432\u044b\u043a\u0430\u0442\u044b\u0432\u0430\u0442\u044c? \u0412\u0447\u0435\u0440\u0430 patch Tuesday \u0443 Microsoft, \u043a\u0443\u0447\u0430 \u0444\u0438\u043a\u0441\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0430\u043a\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f:\n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444\n\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36965\n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38639\n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36975\n\n\u0412\u044b \u0437\u043d\u0430\u0435\u0442\u0435, \u0432\u043e\u0442 \u044d\u0442\u043e \u0432\u0441\u0451.", "creation_timestamp": "2021-09-15T03:57:10.000000Z"}, {"uuid": "7cb880cf-ff74-4318-94e0-a16a30725263", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/alexmakus/4280", "content": "\u041d\u043e \u043b\u0430\u0434\u043d\u043e \u043f\u0440\u043e Apple, \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Windows 10 \u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Windows Server. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MSHTL \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Internet Explorer, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u0438\u043b\u0438\u0432\u0430\u044e\u0442, \u043d\u043e \u044d\u0442\u043e\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 Microsoft Office \u0434\u043b\u044f \u043e\u0442\u0440\u0438\u0441\u043e\u0432\u043a\u0438 \u0432\u0435\u0431-\u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u044d\u043b\u0435\u043c\u0435\u043d\u0442 ActiveX, \u0438 \u0432\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0435\u0433\u043e \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Office, \u0437\u0430\u0442\u0435\u043c \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0443\u0431\u0435\u0434\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0444\u0430\u0439\u043b (\u0447\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u043e \u043d\u0435 \u0441\u043b\u043e\u0436\u043d\u043e). \u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e, \u0435\u0441\u043b\u0438 \u044e\u0437\u0435\u0440 \u0441 \u0430\u0434\u043c\u0438\u043d\u0441\u043a\u0438\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438, \u0442\u043e \u00ab\u0437\u0430\u0445\u043e\u0434\u0438, \u043a\u0442\u043e \u0445\u043e\u0447\u0435\u0442\u00bb. \u041f\u0430\u0442\u0447\u0430 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043a\u0430 \u043d\u0435 , \u043d\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 ActiveX \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Internet Explorer. \n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444\n\nhttps://us-cert.cisa.gov/ncas/current-activity/2021/09/07/microsoft-releases-mitigations-and-workarounds-cve-2021-40444", "creation_timestamp": "2021-09-10T05:27:14.000000Z"}, {"uuid": "7a954b26-5267-477f-b6ad-47a9eac4f234", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/HackingPublicoficial/351", "content": "North Korea-related Malicious Document Files Using CVE-2021-40444 Vulnerability\n\nhttps://malware.news/t/north-korea-related-malicious-document-files-using-cve-2021-40444-vulnerability/54781", "creation_timestamp": "2021-12-13T21:29:03.000000Z"}, {"uuid": "54d54200-ce8e-4098-9dd4-73a82a6b7764", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/ctinow/44356", "content": "Crooks bypass a Microsoft Office patch for CVE-2021-40444 to spread Formbook malware\n\nhttps://ift.tt/3pvPdAR", "creation_timestamp": "2021-12-23T15:56:30.000000Z"}, {"uuid": "b460cf0b-680c-4ab5-986b-c675b6f20b6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ctinow/39629", "content": "Windows CVE-2021-40444 defenses bypassed as new info emerges\n\nhttps://ift.tt/3lengtX", "creation_timestamp": "2021-09-09T22:41:33.000000Z"}, {"uuid": "21af0a89-6d49-4f04-b359-c21f2d332cc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ctinow/39577", "content": "Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs\n\nhttps://ift.tt/3zYkcIv", "creation_timestamp": "2021-09-09T07:11:30.000000Z"}, {"uuid": "49f896d9-d6d5-4eae-93f3-caf1c7116bb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ctinow/40543", "content": "FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal\n\nhttps://ift.tt/3un288J", "creation_timestamp": "2021-09-29T15:16:30.000000Z"}, {"uuid": "4951fd0d-d0e7-42c0-b00a-c1ad7fef85f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ctinow/39948", "content": "Exploitation of the CVE-2021-40444 vulnerability in MSHTML\n\nhttps://ift.tt/3kfHMLm", "creation_timestamp": "2021-09-17T12:11:46.000000Z"}, {"uuid": "feadd708-8084-403e-b6a4-fa374ca93cb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ctinow/39947", "content": "Exploitation of the CVE-2021-40444 vulnerability in MSHTML\n\nhttps://ift.tt/3kfHMLm", "creation_timestamp": "2021-09-17T12:11:44.000000Z"}, {"uuid": "72f738f4-6447-48dc-84f9-b46c5b172a53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ctinow/39916", "content": "Microsoft warns of attacks exploiting recently patched Windows MSHTML CVE-2021-40444 bug\n\nhttps://ift.tt/3kicJ1e", "creation_timestamp": "2021-09-16T19:31:45.000000Z"}, {"uuid": "bf5478b4-a8ab-4e23-bf20-daf07e6cea48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ctinow/39871", "content": "Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability\n\nhttps://ift.tt/3tINhVX", "creation_timestamp": "2021-09-16T01:46:18.000000Z"}, {"uuid": "fc954d3a-c291-4e70-8b94-10dd88dd27ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ctinow/39821", "content": "Microsoft Patch Tuesday fixes CVE-2021-40444 MSHTML zero-day\n\nhttps://ift.tt/2XiETRr", "creation_timestamp": "2021-09-15T07:11:08.000000Z"}, {"uuid": "3d63f820-5064-4494-b65b-4c047e193335", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/ctinow/39807", "content": "Microsoft fixes Windows CVE-2021-40444 MSHTML zero-day bug\n\nhttps://ift.tt/2YYwUt5", "creation_timestamp": "2021-09-14T22:21:32.000000Z"}, {"uuid": "7f12381b-975f-418d-9fe5-f2a0288f0e71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/7XG3Qhyveq0sd-sorvBusAou1bYnK4tFO-cr4qbsp7Vd2w0", "content": "", "creation_timestamp": "2024-08-28T07:50:25.000000Z"}, {"uuid": "aaf0d1b9-34c2-4302-9c14-e07304ea8d0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/BearC2/91", "content": "\u0421\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u044f \u0430\u0442\u0430\u043a\u0438 APT28 Fancy Bear\n\n\u042d\u0442\u043e \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0433\u0440\u0443\u043f\u043f\u044b Fancy Bear (APT28), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043d\u043e\u0432\u043d\u0438\u043a\u043e\u0432 \u0417\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u0410\u0437\u0438\u0438 \u0438 \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u044b. \u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u0441 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u043f\u043e \u043d\u043e\u044f\u0431\u0440\u044c 2021 \u0433\u043e\u0434\u0430. \u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Excel-\u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0436\u0435\u0440\u0442\u0432\u0435 \u043f\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 MSHTML (CVE-2021-40444) \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438.\n\n\u0420\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0430 GitHub: https://github.com/S3N4T0R-0X0/APT-Attack-Simulation/tree/main/Russian%20APT/APT28-Adversary-Simulation", "creation_timestamp": "2024-09-28T00:16:26.000000Z"}, {"uuid": "7d6b3c66-fc23-4182-aab8-d809b6e3ad37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/arpsyndicate/912", "content": "#ExploitObserverAlert\n\nCVE-2021-40444\n\nDESCRIPTION: Exploit Observer has 223 entries related to CVE-2021-40444. Microsoft MSHTML Remote Code Execution Vulnerability\n\nFIRST-EPSS: 0.971910000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-03T01:43:57.000000Z"}, {"uuid": "c1784a33-d08d-48c5-904d-f7b3226618e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "Telegram/koX5CCK3-22_AwfYow_LNHD0nolV-ApG6ZwF09Ra5-Yk", "content": "", "creation_timestamp": "2021-11-25T23:34:42.000000Z"}, {"uuid": "471c86a7-8507-4815-8acd-f914ab7ba904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/breachdetector/49884", "content": "\u26a0 Detectada filtraci\u00f3n \u26a0\n{\n  \"site\": \"Raidforums\",\n  \"Threat Actor\": \"f41r3r79x0r\",\n  \"Content\": \"MACRO MALDOC FUD + CVE-2021-40444 ( FREE REFUD WITHIN 1 WEEK)\u201d,\n  \"Detection Date\": \"20 Feb 2022 15:46\",\n  \"Type\": \"Data Leak\"\n}", "creation_timestamp": "2022-02-20T15:58:52.000000Z"}, {"uuid": "9e7950c1-3250-4c48-8bb1-0065f60f3a57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/breachdetector/49598", "content": "\u26a0 Detectada filtraci\u00f3n \u26a0\n{\n  \"site\": \"Raidforums\",\n  \"Threat Actor\": \"f41r3r79x0r\",\n  \"Content\": \"MACRO MALDOC CVE-2021-40444 FUD ( FREE REFUD WITHIN 1 WEEK)\u201d,\n  \"Detection Date\": \"19 Feb 2022 20:24\",\n  \"Type\": \"Data Leak\"\n}", "creation_timestamp": "2022-02-19T20:32:37.000000Z"}, {"uuid": "9206ecfc-0a8f-4a42-923b-a18c7cc2dc9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/breachdetector/49595", "content": "\u26a0 Detectada filtraci\u00f3n \u26a0\n{\n  \"site\": \"Raidforums\",\n  \"Threat Actor\": \"f41r3r79x0r\",\n  \"Content\": \"MACRO MALDOC CVE-2021-40444 FUD ( FREE REFUD WITHIN 1 WEEK)\u201d,\n  \"Detection Date\": \"19 Feb 2022 20:14\",\n  \"Type\": \"Data Leak\"\n}", "creation_timestamp": "2022-02-19T20:32:31.000000Z"}, {"uuid": "376f7697-58e3-44e0-8b13-2e8f114dc040", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/vJIjzeK0cH5875gB7rg6VyGjiFZNrcUl0Nu_Q8n9T_Yj2g", "content": "", "creation_timestamp": "2021-12-03T19:39:06.000000Z"}, {"uuid": "7771661f-57ba-4c00-8101-c51d1ecd34b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/cyberguerre/1394", "content": "\ud83d\udc41 \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b PT Expert Security Center \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0443 Dark River, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0443\u044e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u043e-\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0433\u043e MataDoor. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u043c \u043d\u043e\u0432\u043e\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438.\n\n\u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439.\n\n\ud83e\udd77 \u0421\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u043e\u0442\u043b\u0438\u0447\u043d\u043e \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u0442\u0441\u044f: \n\u2022 \u0438\u043c\u0435\u043d\u0430 \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u0445\u043e\u0436\u0438 \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u041f\u041e, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445;\n\u2022 \u0440\u044f\u0434 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0438\u043c\u0435\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0446\u0438\u0444\u0440\u043e\u0432\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c;\n\u2022 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u044b-\u043f\u0440\u043e\u0442\u0435\u043a\u0442\u043e\u0440\u044b, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0435\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437.\n\n\u041d\u0430\u0448\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0434\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 MataDoor \u043f\u043e\u043f\u0430\u043b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u043a\u0443\u0434\u0430 \u0431\u044b\u043b \u0432\u043b\u043e\u0436\u0435\u043d \u0444\u0430\u0439\u043b \u0444\u043e\u0440\u043c\u0430\u0442\u0430 DOCX. \u0412 \u043d\u0435\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430.\n\n\u041f\u043e\u0445\u043e\u0436\u0438\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u041e\u041f\u041a \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435-\u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u0437\u0430 \u0432\u0441\u0435\u043c\u0438 \u0442\u043e\u0447\u0435\u0447\u043d\u044b\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0441\u0442\u043e\u0438\u0442 \u043e\u0434\u043d\u0430 \u0438 \u0442\u0430 \u0436\u0435 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430. \u041c\u044b \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u0435\u0435 Dark River \u2014 \u043f\u043e \u0438\u043c\u0435\u043d\u0438 River, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u043f\u043e\u043b\u0435 \u00ab\u0410\u0432\u0442\u043e\u0440\u00bb \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\ud83d\udcac \u00ab\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0438\u043c\u0435\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443, \u2014 \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u043b \u041c\u0430\u043a\u0441\u0438\u043c \u0410\u043d\u0434\u0440\u0435\u0435\u0432, \u0441\u0442\u0430\u0440\u0448\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043e\u0442\u0434\u0435\u043b\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0418\u0411 Positive Technologies. \u2014 \u042d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e \u043f\u0440\u043e\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441, \u0441 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432 \u043f\u043b\u0430\u043d\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430, \u0441\u043a\u0440\u044b\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b. \u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u0436\u0435 \u0432 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u044f\u0445, \u0432\u044b\u0442\u0430\u0441\u043a\u0438\u0432\u0430\u0442\u044c \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442\u043a\u0443\u0434\u0430 \u0443\u0433\u043e\u0434\u043d\u043e\u00bb.\n\n\ud83d\udd10 \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Positive Technologies \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u0440\u043e\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043c\u0435\u0440\u044b. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 PT Sandbox \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 PT Network Attack Discovery (PT NAD).\n\n@Positive_Technologies\n#Positive\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b", "creation_timestamp": "2023-09-27T17:10:31.000000Z"}, {"uuid": "57710c6a-7cf8-49e6-9a8f-71a8694371ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/210", "content": "#CVE-2021-40444--CABless\nModified code so that we don\u00b4t need to rely on CAB archives\nhttps://github.com/Edubr2020/CVE-2021-40444--CABless\n\n#CVE-2021-22005 \nVMWare-CVE-Check\n\nhttps://github.com/X1pe0/VMWare-CVE-Check", "creation_timestamp": "2021-09-23T23:56:55.000000Z"}, {"uuid": "685e75f7-2eca-4c2d-b488-0781d0da238f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/186", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-18T23:06:09.000000Z"}, {"uuid": "7ddd9d7b-98f3-4a6c-8382-776cbd07f112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/183", "content": "1_ Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nhttps://github.com/lockedbyte/CVE-2021-40444\n\nhttps://github.com/Udyz/CVE-2021-40444\n\nhttps://github.com/Udyz/CVE-2021-40444-Sample\n\n2_ Atlassian Confluence Pre-Auth RCE\n\nhttps://github.com/Udyz/CVE-2021-26084", "creation_timestamp": "2021-09-11T17:05:40.000000Z"}, {"uuid": "aca591fa-096e-4351-8b42-8f58fafc19ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/sxcteam/742", "content": "CVE-2021-40444 PoC:-- Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution).\n\nCreation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)\n\nDisclaimer:- This project was created for educational purposes and should not be used in environments without legal authorization.\n\n#Download #Link:-\n\nhttps://github.com/lockedbyte/CVE-2021-40444\n\n#cybersecurity #CyberSecurityNews #infosec #infosecurity #cybersecurityawareness #informationsecurity #Pentesting #cybersecuritytraining #informationtechnology #bugbounty #ethicalhacking #EthicalHackingOnlineTraining #hacking #hackers #kalilinux  #onlinetraining #onlineclasses #AWS #cloudcomputing", "creation_timestamp": "2022-08-07T14:14:05.000000Z"}, {"uuid": "80a18091-f711-4455-b3ec-bebd7639737f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "Telegram/9IkYRUSVAjNVZ3U5W60Yral5GvyToi8S0jPvpwWQQpLMsoQQ", "content": "", "creation_timestamp": "2024-04-20T20:39:22.000000Z"}, {"uuid": "f438ebfe-bd73-4049-bec6-e48607215696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "Telegram/_AGyd-jb8oHAAHKrYs_GCuAeltlnS2ecVTYz98b6pGCuvOaO", "content": "", "creation_timestamp": "2022-05-29T17:34:20.000000Z"}, {"uuid": "0098b03e-84e8-4526-9a2f-232b5edc6472", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/N3Dhtx86f5FloDusKLtwRjvF9l_DjB6egAEuwsrKtAXc", "content": "", "creation_timestamp": "2021-10-04T19:22:01.000000Z"}, {"uuid": "f9bf5909-9961-4e2b-897b-33ce0e1f3a2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "Telegram/NPG3KQ-G54-q68Z6VtRJ2n-qkwTdCfmP-7G4ZGlo_OVq", "content": "", "creation_timestamp": "2021-10-03T15:17:27.000000Z"}, {"uuid": "b47517b9-451b-47a6-b3bd-b7b212a3c016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/Cr0xCr0/304", "content": "zero-day exploit for CVE-2021-40444\nhttps://github.com/lockedbyte/CVE-2021-40444", "creation_timestamp": "2021-09-17T07:44:32.000000Z"}, {"uuid": "742c9fe5-f672-40bc-b3b9-9e6e4868ed41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/D7-iC4UtRP-JTXX1FzkdRhRqg3vcBBeoatell7seT7TA", "content": "", "creation_timestamp": "2021-10-05T03:51:01.000000Z"}, {"uuid": "ff4e3f28-09d6-49ff-be1b-b799ecec0f18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/P4B5ZiaoHRUwp70T1Ir79kbmXwRPX55y9lgSjflVfDR-", "content": "", "creation_timestamp": "2021-10-05T03:50:29.000000Z"}, {"uuid": "cefd4f41-cc52-43bc-ab9d-870240dec05d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/sxcteam/657", "content": "Alright - so I also managed to reproduce the CVE-2021-40444  and I have tried it on a Big Sur x86_64 MacOS and MS Word for Mac (ver 16.47)  - I have just used a dummy call  back to my internet facing Linux server in the word/_rels/document.xml.rels and it indeed works", "creation_timestamp": "2021-09-11T16:49:24.000000Z"}, {"uuid": "2e862f05-21b9-4402-bbd1-7f88c30f794d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/sxcteam/646", "content": "We have to say there are many unseen tricks in the entire of exploit\uff0cnow it's time for full chain code execution (#CVE-2021-40444)!!!", "creation_timestamp": "2021-09-11T05:55:01.000000Z"}, {"uuid": "d9397b2a-c6aa-40d6-9e07-d708a6723332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/true_secator/6124", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0443 \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2024 \u0433\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043d\u0430\u0441\u044b\u0449\u0435\u043d\u043d\u044b\u043c \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043d\u043e\u0432\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\u0412 \u043d\u043e\u0432\u043e\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0440\u0435\u0437\u044b \u043f\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c.\n\n\u041e\u0431\u0449\u0435\u0435 \u0447\u0438\u0441\u043b\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0435\u0432\u044b\u0441\u0438\u043b\u043e \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0438 \u0437\u0430 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0439 \u043f\u0435\u0440\u0438\u043e\u0434 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044f \u0434\u0438\u043d\u0430\u043c\u0438\u043a\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430.\n\n\u0414\u043e\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 PoC \u0438 \u043e\u0442\u043d\u043e\u0441\u044f\u0449\u0438\u0445\u0441\u044f \u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043d\u0438\u0437\u0438\u043b\u0430\u0441\u044c \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e 2023 \u0433\u043e\u0434\u0430. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e \u0442\u0438\u043f\u0443 \u043f\u043e\u0434\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0442\u0441\u0442\u043e\u044f\u0442\u0441\u044f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c.\n\n\u0422\u0430\u043a\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438, \u0442\u0430\u043a \u043a\u0430\u043a \u043a \u0447\u0438\u0441\u043b\u0443 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u041f\u041e \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c: \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u043a\u043e\u043d\u0441\u043e\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0447\u0435\u0440\u0435\u0437 VPN, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c\u0438 \u0438 IoT-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u0445 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 \u041b\u041a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u043b\u044f Windows \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0437\u0430 \u0441\u0447\u0435\u0442 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u0438 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0443\u0442\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u041a \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Microsoft Office (CVE-2018-0802, CVE-2017-11882\u00a0, CVE-2017-0199\u00a0 \u0438 CVE-2021-40444\u00a0).\n\n\u041d\u0430\u0431\u0438\u0440\u0430\u044e\u0449\u0430\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 Linux \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0440\u043e\u0441\u0442, \u043e\u0434\u043d\u0430\u043a\u043e \u0432 \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0432\u0435\u0441 Windows \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u044f\u0434\u0440\u043e (CVE-2022-0847, CVE-2023-2640 \u0438 CVE-2021-4034), \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044f EoP.\n\n\u0422\u043e\u043f-10 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0441\u044f \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u00a0\u043f\u0435\u0440\u0432\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430, \u043d\u043e \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0442\u0435\u0445 \u0436\u0435 \u0442\u0438\u043f\u043e\u0432: \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043e\u0444\u0438\u0441\u043d\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f.\n\n\u0411\u043e\u043b\u044c\u0448\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c Bring You Own Vulnerable Driver (BYOVD). \u041f\u0440\u0438\u0447\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u0441\u0432\u0435\u0436\u0435\u0439, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u0430\u043c\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\n\n2023 \u0433\u043e\u0434 \u0441\u0442\u0430\u043b \u0441\u0430\u043c\u044b\u043c \u0431\u043e\u0433\u0430\u0442\u044b\u043c \u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c BYOVD. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430 \u043f\u0435\u0440\u0432\u0443\u044e \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0443 2024-\u0433\u043e \u0438\u0445 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u0437\u0430 2021 \u0438 2022 \u0433\u043e\u0434\u044b, \u0432\u043c\u0435\u0441\u0442\u0435 \u0432\u0437\u044f\u0442\u044b\u0435. \u0412\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0440\u043e\u0441\u0442\u043e\u043c \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f.\n\n\u041d\u0430\u0433\u043b\u044f\u0434\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2024 \u0433\u043e\u0434\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2024-08-22T19:40:05.000000Z"}, {"uuid": "0ca6fae2-695d-4d97-a2fe-9d01e0b59b3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/true_secator/5974", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Trend Micro \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 APT Void Banshee, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Microsoft MHTML \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043d\u0443\u043b\u044f \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f Atlantida Stealer.\n\n\u0417\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 CVE-2024-38112 \u0432 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u044f\u0440\u043b\u044b\u043a\u043e\u0432 (URL) \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0431\u044b\u043b\u043e \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043e \u043a \u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 \u043c\u0430\u044f 2024 \u0433\u043e\u0434\u0430 \u043d\u0430\u0440\u044f\u0434\u0443 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u043c\u0438 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 Atlantida.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0440\u0430\u043d\u0435\u0435 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043f\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0438\u043d\u0444\u043e\u0441\u0442\u0438\u043b\u043b\u0435\u0440\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u043e\u0433\u043e \u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432 Check Point.\n\n\u0421\u0430\u043c\u0430 CVE-2024-38112 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 Microsoft \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 Patch Tuesday \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430 (\u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c ZDI - \u044d\u0442\u043e RCE) \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 MSHTML (\u043e\u043d \u0436\u0435 Trident), \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 Internet Explorer.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0444\u0430\u0439\u043b\u044b ZIP-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0444\u0430\u0439\u043b\u043e\u043e\u0431\u043c\u0435\u043d\u043d\u0438\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 URL-\u0444\u0430\u0439\u043b\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2024-38112 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0436\u0435\u0440\u0442\u0432\u044b \u043d\u0430 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 HTML-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 (HTA).\n\n\u041e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u0444\u0430\u0439\u043b\u0430 HTA \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0441\u043a\u0440\u0438\u043f\u0442\u0430 Visual Basic (VBS), \u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u043a\u0440\u0438\u043f\u0442 PowerShell, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0439 \u0437\u0430 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 .NET, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442 \u0448\u0435\u043b\u043b\u043a\u043e\u0434\u0430 Donut \u0434\u043b\u044f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Atlantida \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 RegAsm.exe.\n\nAtlantida, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u0430\u044f \u043f\u043e \u043e\u0431\u0440\u0430\u0437\u0446\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c NecroStealer \u0438 PredatorTheStealer, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0430 \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0430 \u0441\u043d\u0438\u043c\u043a\u043e\u0432 \u044d\u043a\u0440\u0430\u043d\u0430, \u0441\u043d\u044f\u0442\u0438\u044f \u0433\u0435\u043e\u043b\u043e\u043a\u0430\u0446\u0438\u0438 \u0438 \u043a\u0440\u0430\u0436\u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Telegram, Steam, FileZilla, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043e\u0448\u0435\u043b\u044c\u043a\u043e\u0432.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0435 URL-\u0444\u0430\u0439\u043b\u044b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 MHTML \u0438 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0443 x-usc!, Void Banshee \u043c\u043e\u0433\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c HTML-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 (HTA) \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0438\u0445 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 IE.\n\n\u042d\u0442\u043e\u0442 \u043c\u0435\u0442\u043e\u0434 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d CVE-2021-40444, \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 MSHTML, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 0-day.\n\n\u041f\u0440\u043e Void Banshee \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043d\u0435\u043c\u043d\u043e\u0433\u043e\u0435, \u043a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0433\u0440\u0443\u043f\u043f\u0430 \u0443\u0441\u043f\u0435\u043b\u0430 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u0433\u0438\u043e\u043d\u044b \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0438, \u0415\u0432\u0440\u043e\u043f\u044b \u0438 \u042e\u0433\u043e-\u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0410\u0437\u0438\u0438 \u0441 \u0446\u0435\u043b\u044c\u044e \u043a\u0440\u0430\u0436\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0439 \u0432\u044b\u0433\u043e\u0434\u044b.", "creation_timestamp": "2024-07-16T16:23:38.000000Z"}, {"uuid": "03f747f8-b119-44df-8c5c-c32aff799833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/crackcodes/707", "content": "https://github.com/klezVirus/CVE-2021-40444", "creation_timestamp": "2022-06-18T21:12:21.000000Z"}, {"uuid": "359647d4-2e4f-465a-80a6-5ab090857bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/true_secator/3129", "content": "\u041d\u0430\u0441\u0442\u0443\u043f\u0430\u0442\u044c \u043d\u0430 \u0442\u0435 \u0436\u0435 \u0433\u0440\u0430\u0431\u043b\u0438 \u0432 \u043c\u0438\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0430, \u0430 \u201c\u043b\u0430\u0442\u0430\u0442\u044c \u0434\u044b\u0440\u044b\u201d \u043f\u043e\u0440\u043e\u0439, \u0441\u0442\u043e\u0438\u0442 \u0431\u043e\u043b\u0435\u0435 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e. \n\n\u0421\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043e \u0447\u0435\u043c \u0440\u0435\u0447\u044c, \u0430 \u0432\u043e\u0442 \u043e \u0447\u0435\u043c: \u043f\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0430\u043c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 Google Project Zero \u0437\u0430 \u043f\u0435\u0440\u0432\u0443\u044e \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0443 2022 \u0433\u043e\u0434\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 18 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0431\u044b\u043b\u0438 \u0434\u043e\u043b\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b.\n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u0430 \u041c\u044d\u0434\u0434\u0438 \u0421\u0442\u043e\u0443\u043d\u0430 9 \u0438\u0437 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 0-day, \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443, \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0442\u0438\u0442\u044c, \u0435\u0441\u043b\u0438 \u0431\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0430 4 \u043e\u0448\u0438\u0431\u043a\u0438 2022 \u0433\u043e\u0434\u0430 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430\u043c\u0438 \u043d\u0443\u043b\u0435\u0432\u044b\u0445 \u0434\u043d\u0435\u0439 2021 \u0433\u043e\u0434\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n\n\u0421\u0430\u043c\u0430\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0438\u0437 \u044d\u0442\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Follina \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043a\u0430\u043a CVE-2022-30190, \u043f\u043e \u0441\u0443\u0442\u0438 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f MSHTML, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043a\u0430\u043a CVE-2021-40444.\n\nCVE-2022-21882 \u2014 \u044d\u0442\u043e \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Windows, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0431\u043e\u0439 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e CVE-2021-1732 .\n\n\u041e\u0448\u0438\u0431\u043a\u0430 iOS IOMobileFrameBuffer (CVE-2022-22587) \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435\u0439 \u0442\u0438\u043f\u043e\u0432 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 Chrome V8 (CVE-2022-1096) \u2014 \u044d\u0442\u043e \u0434\u0432\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u2014 CVE-2021-30983 \u0438 CVE-2021-30551 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e.\n\n\u0414\u0440\u0443\u0433\u0438\u043c\u0438 0-day 2022 \u0433\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430\u043c\u0438 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f CVE-2022-1364 (Chrome), CVE-2022-22620 (WebKit), CVE-2021-39793 (Google Pixel), CVE-2022-26134 (Atlassian Confluence) \u0438 CVE-2022-26925 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Windows \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a PetitPotam).\n\n\u0412 \u043e\u0431\u0449\u0435\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0442\u0430\u043a, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u0435\u0440\u043d\u0443\u0442\u044c\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u0443\u0442\u0435\u043c \u043b\u0438\u0431\u043e \u0441\u043d\u043e\u0432\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442\u0435 \u0436\u0435 \u043e\u0448\u0438\u0431\u043a\u0438.\n\n\u042d\u0442\u043e \u0432\u0441\u0435\u0433\u0434\u0430 \u0433\u0440\u043e\u043c\u043a\u043e \u0438 \u0431\u043e\u043b\u044c\u043d\u043e, \u043d\u043e \u043e\u0442\u0447\u0430\u0441\u0442\u0438 \u0445\u043e\u0440\u043e\u0448\u043e \u043a\u043e\u0433\u0434\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b 0-day \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u0442\u0430\u043a \u043a\u0430\u043a \u044d\u0442\u043e \u043d\u0435\u0443\u0434\u0430\u0447\u0430 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u0430 \u0434\u043b\u044f \u0438\u043d\u0444\u043e\u0441\u0435\u043a \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 \u044d\u0442\u043e \u043f\u043e\u0434\u0430\u0440\u043e\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0437\u043d\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u0438 \u043f\u0440\u0438\u043d\u044f\u0442\u044c \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b, \u0447\u0442\u043e\u0431\u044b \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0447\u0442\u043e \u044d\u0442\u043e\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 \u043d\u0435\u043b\u044c\u0437\u044f \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 \u0431\u0443\u0434\u0443\u0449\u0435\u043c.\n\n\u0427\u0442\u043e\u0431\u044b \u0434\u043e\u043b\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Google \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0432\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 \u0430\u043d\u0430\u043b\u0438\u0437 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u0438\u0447\u0438\u043d \u0438 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a, \u0430\u043d\u0430\u043b\u0438\u0437 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f.", "creation_timestamp": "2022-07-04T20:00:05.000000Z"}, {"uuid": "de8cde69-5be2-4876-96c5-59e1212c1bf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/fQ4WVfD21fuxR0LrU5acosB0VqMSGGUlGzpr-Py_SWM_JQ", "content": "", "creation_timestamp": "2021-09-23T20:58:38.000000Z"}, {"uuid": "95d47782-dcb8-4929-b525-7b536a58d24d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/pW6qd0UFGaFYh1_MGKVi0bWIQjAJc4K90ksGatKVJL8noQ", "content": "", "creation_timestamp": "2021-09-11T19:02:48.000000Z"}, {"uuid": "64ee8aa3-81d2-412e-8ab6-c4018391fbbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/true_secator/2094", "content": "\u041d\u0435 \u043f\u0440\u043e\u0448\u043b\u043e \u0438 \u043d\u0435\u0434\u0435\u043b\u0438, \u043a\u0430\u043a \u043d\u0430 \u0442\u0435\u043d\u0435\u0432\u044b\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043c\u0430\u043d\u0443\u0430\u043b \u0434\u043b\u044f \u043c\u0430\u043c\u043a\u0438\u043d\u044b\u0445 \u0445\u0430\u0446\u043a\u0435\u0440\u043e\u0432 \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u0435\u0440\u043e\u0434\u0435\u044f \u0432 Windows MSHTML, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043c\u044b \u043f\u0438\u0441\u0430\u043b\u0438 \u0440\u0430\u043d\u0435\u0435. \u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 \u043f\u043e\u0434\u043f\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u043d\u0434\u0435\u0433\u0440\u0430\u0443\u043d\u0434\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0434\u0435\u043b\u044f\u0442\u0441\u044f \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2021-40444, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u0440\u0443\u0433\u0438\u043c \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0432\u043e\u0438\u0445 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u041d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u043c, \u0447\u0442\u043e \u0432 \u043f\u0440\u043e\u0448\u043b\u044b\u0439 \u0432\u0442\u043e\u0440\u043d\u0438\u043a Microsoft \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 Windows MSHTML, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b Office \u0438 RTF, \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0436\u0435\u0440\u0442\u0432\u044b. Microsoft \u043d\u0430 \u0441\u043a\u043e\u0440\u0443\u044e \u0440\u0443\u043a\u0443 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043c\u0435\u0440\u044b \u043f\u043e \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \u042d\u0442\u0438 \u043c\u0435\u0440\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u043f\u0443\u0442\u0435\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f ActiveX \u0438 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 Word / RTF \u0432 \u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0438\u043a\u0435 Windows.\n\n\u041e\u0434\u043d\u0430\u043a\u043e, \u0445\u0430\u043a\u0435\u0440\u044b \u0443\u0436\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0442\u0430\u043a, \u0447\u0442\u043e\u0431\u044b \u043e\u043d \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b ActiveX, \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043e\u0431\u0445\u043e\u0434\u044f \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 Microsoft. \u0420\u0435\u0431\u044f\u0442\u0430 \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u0432\u044b\u0434\u0430\u044e\u0449\u0438\u0435\u0441\u044f, \u0440\u0430\u0437 \u0442\u0430\u043a \u0431\u044b\u0441\u0442\u0440\u043e \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u043c\u0438 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043d\u0430 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445.\n\n\u0412\u0441\u043f\u043b\u0435\u0441\u043a \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043e\u0447\u0435\u0432\u0438\u0434\u0435\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u0435\u0439 Microsoft \u043c\u0435\u0440\u044b \u0443\u0436\u0435 \u043d\u0435 \u043e\u0441\u043e\u0431\u043e \u0442\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b.", "creation_timestamp": "2021-09-13T13:45:49.000000Z"}, {"uuid": "b011e42a-f1fb-47ed-9b1c-ecb81b1f11ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/true_secator/2084", "content": "\u200b\u200b\u041e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 zeroday \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Windows.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2021-40444 (CVSS: 8,8) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Windows MSHTML. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442\u00a0 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f ActiveX, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u043c Microsoft Office (Word, Excel \u0438 PowerPoint), \u0433\u0434\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430. \u0414\u0430, \u0434\u0430, \u0442\u043e\u0433\u043e \u0441\u0430\u043c\u043e\u0433\u043e \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 - Internet Explorer. \u041a\u043e\u043d\u0435\u0447\u043d\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0443\u0436\u043d\u043e \u0443\u0431\u0435\u0434\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u043d\u043e \u044d\u0442\u043e \u0443\u0436\u0435 \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0434\u0435\u043b\u043e \u0442\u0435\u0445\u043d\u0438\u043a\u0438.\n\n\u0425\u043e\u0442\u044f \u043f\u0430\u0442\u0447 \u0435\u0449\u0435 \u043d\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d, Microsoft \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e Office \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0438\u0437 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0438\u043b\u0438 Application Guard \u0434\u043b\u044f Office, \u0447\u0442\u043e \u043f\u043e \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044e \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0435\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0434\u043e\u043b\u0436\u043d\u043e \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0442\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443. \u041e\u0434\u043d\u0430\u043a\u043e \u0443\u0436\u0435 \u043f\u0440\u043e\u0441\u043e\u0447\u0438\u043b\u0438\u0441\u044c \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f, \u0447\u0442\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u0440\u043e\u0442\u0438\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 Microsoft 365 \u0438 Office 2019 \u0432 Windows 10.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CISA \u0443\u0436\u0435 \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u043c\u0435\u0440\u044b \u0437\u0430\u0449\u0438\u0442\u044b, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 Microsoft \u0432 \u0446\u0435\u043b\u044f\u0445 \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u0430.", "creation_timestamp": "2021-09-09T09:21:50.000000Z"}, {"uuid": "6e8577e4-94fc-4da0-867f-882374f0bfea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/true_secator/2118", "content": "\u041f\u043e\u0434 \u0433\u043d\u0435\u0442\u043e\u043c \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u0438 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u043e\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 Microsoft \u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u043b\u0438\u043b\u0438 \u0441\u0432\u0435\u0442 \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0444\u0438\u0448\u0438\u043d\u0433-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 MSHTML. Microsoft Threat Intelligence Center \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-40444 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c Cobalt Strike Beacon \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows.\n \n\u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0445 \u043f\u0438\u0441\u0435\u043c, \u0432\u044b\u0434\u0430\u044e\u0449\u0438\u0445 \u0441\u0435\u0431\u044f \u0437\u0430 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u044b \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u043e\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u044f, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445 \u043e\u0431\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u0430\u043c\u0438. \u041e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430, \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e, \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0444\u0430\u0439\u043b\u0430 \u0430\u0440\u0445\u0438\u0432\u0430 \u043a\u0430\u0431\u0438\u043d\u0435\u0442\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e DLL \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435\u043c \u0444\u0430\u0439\u043b\u0430 INF, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0432 \u044d\u0442\u043e\u0439 DLL. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0439 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 - \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a Cobalt Strike Beacon - \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0435\u0433\u043e \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0438\u043c\u043f\u043e\u0440\u0442\u0430 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 Microsoft. \u041d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f ActiveX, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 Office.\n \n\u0421\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 \u0447\u0442\u043e \u044d\u0442\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0441 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439, \u043a\u043e\u0442\u043e\u0440\u0443\u044e Microsoft \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u0442 \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u044b\u043c\u0438 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f ransomware. \u0412 \u0445\u043e\u0434\u0435 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u0447\u0435\u0440\u043d\u044f\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft RiskIQ \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043a \u0430\u0442\u0430\u043a\u0430\u043c \u043f\u0440\u0438\u0447\u0430\u0441\u0442\u0435\u043d \u0441\u0438\u043d\u0434\u0438\u043a\u0430\u0442 Wizard Spider, \u043e\u0442\u043c\u0435\u0442\u0438\u0432, \u0447\u0442\u043e \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 BazaLoader \u0438 Trickbot, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u043e\u0434\u0443\u043b\u044f\u043c\u0438 Cobalt Strike Beacon \u0438 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 200 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n \n\u041d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0441\u043c\u0435\u043b\u044b\u043c \u0441\u0442\u0430\u043b\u043e \u0438 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0433\u043e\u0442\u043e\u0432\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444 \u043d\u0430\u0448\u043b\u0438 \u0441\u0432\u043e\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0443 \u0410\u0420\u0422, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0448\u043f\u0438\u043e\u043d\u0430\u0436, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u0447\u0442\u043e\u0431\u044b \u0432\u0432\u0435\u0441\u0442\u0438 \u0432 \u0437\u0430\u0431\u043b\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u0438 \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u0438\u0442\u044c \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u044e.", "creation_timestamp": "2021-09-17T18:14:11.000000Z"}, {"uuid": "96fee6f6-8bab-49eb-8f1b-3e1e579e7d66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/true_secator/2104", "content": "\u041d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u0432\u044b\u0448\u0435\u043b \u0434\u043e\u043b\u0433\u043e\u0436\u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u043e\u0442 Microsoft, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 60 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 2 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f.\u00a0\n\n\u041a\u0430\u043c\u043d\u0435\u043c \u043f\u0440\u0435\u0442\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043b\u0430 \u0431\u0430\u0433\u0430 \u0432 Windows MSHTML, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a CVE-2021-40444, \u043c\u0430\u043d\u0443\u0430\u043b \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0441\u0442\u0430\u043b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u043d\u0430 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0430\u0445, \u0447\u0442\u043e \u0432\u044b\u0437\u0432\u0430\u043b\u043e \u0432\u043e\u043b\u043d\u0443 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0412\u0442\u043e\u0440\u043e\u0439 zeroday CVE-2021-36968 \u0441\u0432\u044f\u0437\u0430\u043d \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Windows DNS \u0438\u043c\u0435\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438 \u0434\u043b\u044f \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043e\u0431\u044b\u0432\u0430\u0442\u0435\u043b\u044f \u043d\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, Microsoft \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Windows MSHTML, \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u0442\u0430\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0432 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u042d\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b Word \u0441 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439 CVE-2021-40444 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 DLL, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u043b Cobalt Strike \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b, \u0447\u0442\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0434\u0430\u0432\u0430\u043b\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443.\n\n\u0412\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Microsoft \u0437\u0430\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u043c \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0430\u0447\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445. \u0421\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435, \u0447\u0442\u043e \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 Microsoft \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043a\u0438, \u0447\u0442\u043e \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u043e\u043a\u0430 \u043d\u0435\u044f\u0441\u043d\u043e - \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u0441\u0435 \u043c\u0435\u0442\u043e\u0434\u044b. \n\n\u041a\u0430\u043a \u043c\u044b \u0437\u043d\u0430\u0435\u043c Microsoft \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u043b\u0438 \u043e\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u0435\u0437 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430 \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u043e\u043a\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u0443\u0433\u0440\u043e\u0437\u044b \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0433\u0430\u0434\u0430\u0442\u044c, \u043d\u043e \u043f\u0440\u0435\u043d\u0435\u0431\u0440\u0435\u0433\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0432\u0441\u0435 \u0436\u0435 \u043d\u0435 \u0441\u0442\u043e\u0438\u0442.\n\n\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u0444\u0430\u043a\u0442 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e Microsoft \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u043e \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0438\u043b\u0438 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043c\u043e\u0447\u044c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c \u0438\u043d\u0444\u043e\u0441\u0435\u043a\u0430 \u043d\u0430\u0439\u0442\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \n\n\u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435 \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f Microsoft \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432, \u043f\u043e \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430 APT-\u0441\u0443\u0431\u044a\u0435\u043a\u0442\u043e\u0432, \u0430 \u044d\u0442\u043e \u0443\u0436\u0435 \u0441\u043e\u0432\u0441\u0435\u043c \u0434\u0440\u0443\u0433\u0430\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0438 \u043d\u0435 \u043f\u0440\u043e \u043c\u0430\u043c\u043a\u0438\u043d\u044b\u0445 \u0445\u0430\u0446\u043a\u0435\u0440\u043e\u0432.", "creation_timestamp": "2021-09-15T13:29:06.000000Z"}, {"uuid": "2ae757e4-4fe4-46a1-bc9f-332f6b7675af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/true_secator/2559", "content": "\u041a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0435 \u0438\u043d\u0442\u0440\u0438\u0433\u0438 \u043d\u0435 \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u044e\u0442 \u0443\u0434\u0438\u0432\u043b\u044f\u0442\u044c \u0441\u0432\u043e\u0435\u0439 \u0438\u0437\u043e\u0449\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u0432\u044b\u0441\u043e\u043a\u0438\u043c \u0441\u0430\u043a\u0440\u0430\u043b\u044c\u043d\u044b\u043c \u0441\u043c\u044b\u0441\u043b\u043e\u043c \u0432 \u0443\u043c\u0430\u0445 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u044e\u0449\u0438\u0445 \u0437\u0430 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u043c.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Trellix (\u0434\u0435\u0442\u0438\u0449\u0435 McAfee Enterprise \u0438 FireEye) \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u043e\u0439 \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043d\u043e\u0432\u043d\u0438\u043a\u043e\u0432, \u0434\u043e\u043b\u0436\u043d\u043e\u0441\u0442\u043d\u044b\u0445 \u043b\u0438\u0446, \u043a\u0443\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0442\u0440\u0430\u043d\u0430\u0445 \u0417\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u0410\u0437\u0438\u0438.\n\n\u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MSHTML, \u0447\u0442\u043e\u0431\u044b \u0448\u043f\u0438\u043e\u043d\u0438\u0442\u044c \u0437\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u0446\u0435\u043b\u044f\u043c\u0438. \u0410\u0442\u0430\u043a\u0430 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Microsoft OneDrive \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f (C2) \u0438 \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0448\u0435\u0441\u0442\u044c \u044d\u0442\u0430\u043f\u043e\u0432, \u0447\u0442\u043e\u0431\u044b \u043e\u0441\u0442\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u2014 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 Trellix. \u0422\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u043c \u043e\u0441\u0442\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u043d\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044e\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u043c \u0434\u043e\u043c\u0435\u043d\u0430\u043c Microsoft \u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0435 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u044e\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0442\u0440\u0430\u0444\u0438\u043a.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441\u043e \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c 18 \u0438\u044e\u043d\u044f 2021 \u0433\u043e\u0434\u0430, \u0430 21 \u0438 29 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0431\u044b\u043b\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u0443\u0436\u0435 \u0434\u0432\u0435 \u0436\u0435\u0440\u0442\u0432\u044b. \u0417\u0430\u0442\u0435\u043c \u0435\u0449\u0435 17 \u0437\u0430 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 6 \u043f\u043e 8 \u043e\u043a\u0442\u044f\u0431\u0440\u044f.\n\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u043b\u0441\u044f \u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u0430 Microsoft Excel, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 MSHTML (CVE-2021-40444), \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442, \u043a\u0430\u043a \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0441\u0442\u0430\u0434\u0438\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Graphite. \u0418\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 DLL-\u0444\u0430\u0439\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 OneDrive \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 C2-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 API Microsoft Graph \u0432 \u0446\u0435\u043b\u044f\u0445 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u0445\u0430\u0446\u043a\u0435\u0440\u0441\u043a\u0438\u0439 \u0444\u0440\u0435\u0439\u043c\u0444\u043e\u0440\u043a Empire, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439.\n\n\u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a MSTHML \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c Microsoft \u0438 SafeBreach Labs \u0443\u0436\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u043e\u0432 Cobalt Strike Beacon, \u043e \u0447\u0435\u043c \u0438 \u043c\u044b \u0442\u0430\u043a\u0436\u0435 \u043f\u0438\u0441\u0430\u043b\u0438 \u0440\u0430\u043d\u0435\u0435.\n\n\u041d\u0435 \u043c\u0443\u0434\u0440\u0441\u0442\u0432\u0443\u044f \u043b\u0443\u043a\u0430\u0432\u043e, \u043d\u043e \u0441 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0434\u043e\u043b\u0435\u0439 \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 Trellix \u043f\u0440\u0438\u043f\u0438\u0441\u0430\u043b \u0438\u0437\u043e\u0449\u0440\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0435 APT28, \u0431\u043e\u043b\u044c\u0448\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u043a\u0430\u043a Fancy Bear.\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u0442\u0430\u043a\u043e\u0435 \u0437\u0430\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0445\u043e\u0434\u0441\u0442\u0432\u0430 \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435, \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u0445 \u0430\u0442\u0430\u043a \u0438 \u0433\u0435\u043e\u043f\u043e\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0446\u0435\u043b\u044f\u0445. \u0414\u043e\u0441\u043b\u043e\u0432\u043d\u043e \u044d\u0442\u043e \u0437\u0432\u0443\u0447\u0438\u0442 \u0442\u0430\u043a: with a low and moderate confidence, we believe, \u0441\u043e\u043a\u0440\u0430\u0449\u0430\u044f \u0434\u043e \u0430\u0431\u0431\u0440\u0435\u0432\u0438\u0430\u0442\u0443\u0440\u044b \u043f\u0435\u0440\u0432\u044b\u0445 \u0431\u0443\u043a\u0432 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u00abf..ck off\u00bb, \u043f\u0440\u043e\u0441\u0442\u0438\u0442\u0435 \u0437\u0430 \u043d\u0430\u0448 \u0430\u043d\u0433\u043b\u0438\u0439\u0441\u043a\u0438\u0439.\n\n\u0410 - \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u044f.", "creation_timestamp": "2022-01-26T17:27:41.000000Z"}, {"uuid": "2b40b322-12ec-485c-a3be-ea7723e612dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/true_secator/2478", "content": "\u041d\u0438\u043a\u0442\u043e \u0438 \u043d\u0435 \u0441\u043e\u043c\u043d\u0435\u0432\u0430\u043b\u0441\u044f, \u0437\u043d\u0430\u044f \u043a\u0430\u043a Microsoft \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u0432\u043e\u0438 \u043a\u043e\u0441\u044f\u043a\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044f \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u0443\u0447\u0443 \u0434\u0440\u0443\u0433\u0438\u0445.\n \n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c Sophos, \u0445\u0430\u043a\u0435\u0440\u044b \u043d\u0430\u0448\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Microsoft Office \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0435\u0433\u043e \u0434\u043b\u044f \u043a\u0440\u0430\u0442\u043a\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e Formbook.\n \n\u041e\u0448\u0438\u0431\u043a\u0430 CVE-2021-40444 (\u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS 8,8) \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f MSHTML \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0436\u0435\u0440\u0442\u0432\u043e\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430.\n \n\u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e 7 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0435\u0440\u0438\u0438 \u0430\u0442\u0430\u043a, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e \u043e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u043c Patch Tuesday. \u0422\u0430\u043a\u0436\u0435 \u0431\u044b\u043b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC, \u0432\u044b\u0437\u0432\u0430\u0432\u0448\u0438\u0439 \u0440\u0435\u0437\u043a\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n \n\u041f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 Microsoft \u043f\u0430\u0442\u0447 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0430\u0440\u0445\u0438\u0432\u0430 Microsoft Cabinet (CAB), \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u0445\u043e\u0436\u0435, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0448\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0430\u0442\u0447, \u0432\u043a\u043b\u044e\u0447\u0438\u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Word \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u0430\u0440\u0445\u0438\u0432 RAR.\n \nSophos \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 \u0430\u0440\u0445\u0438\u0432\u044b \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0435 \u0441\u043f\u0430\u043c\u0430 \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 24 - 25 \u043e\u043a\u0442\u044f\u0431\u0440\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0431\u044b\u043b\u0430 \u0431\u044b\u0441\u0442\u0440\u043e \u0441\u0432\u0435\u0440\u043d\u0443\u0442\u0430, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u00ab\u043f\u0440\u043e\u0431\u043d\u044b\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u00bb. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043b\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 Word \u0432 \u0430\u0440\u0445\u0438\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f PowerShell, \u0438 \u043a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0430 \u0435\u0433\u043e \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0443, \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0441\u044f, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u043e \u043a \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e Formbook.\n \n\u0412\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043e\u0431\u043e\u0439 \u044d\u0441\u043a\u0430\u043b\u0430\u0446\u0438\u044e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 -40444 \u0438 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u0447\u0442\u043e \u0434\u0430\u0436\u0435 \u043f\u0430\u0442\u0447 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u043c\u043e\u0436\u0435\u0442 \u0441\u043c\u044f\u0433\u0447\u0438\u0442\u044c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043c\u043e\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430.\n \n\u041f\u043e \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0430\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0442\u0447 \u0431\u044b\u043b \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0443\u0437\u043a\u043e\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0438 \u043d\u0435 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u043b \u0434\u043e \u043a\u043e\u043d\u0446\u0430 \u0432\u0441\u0435\u0445 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 WinRAR \u0444\u0430\u0439\u043b\u043e\u0432.\n \n\u0427\u0435\u0433\u043e \u0438 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u043e \u043e\u0436\u0438\u0434\u0430\u0442\u044c.", "creation_timestamp": "2021-12-24T19:05:00.000000Z"}, {"uuid": "99589209-3130-4311-9687-dd669a99366d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/NeKaspersky/1726", "content": "\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043d\u043e\u0432\u043e\u043c\u0443 \u043e\u0442\u0447\u0435\u0442\u0443 Trellix, \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 OneDrive \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 C2 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043d\u043e\u0432\u043d\u0438\u043a\u043e\u0432 \u0432 \u0417\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u0410\u0437\u0438\u0438.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0439 \u0438\u043c\u044f \u00abGraphite\u00bb \u0438\u0437-\u0437\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Microsoft Graph API \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 OneDrive (\u0442\u043e\u043a\u0435\u043d, \u043a\u0441\u0442\u0430\u0442\u0438, \u0437\u0430\u0445\u0430\u0440\u0434\u043a\u043e\u0434\u0438\u043b\u0438), \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 RCE \u0432 MSHTML (CVE-2021-40444) \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0422\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0439 \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u0442.\u043a. \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 Microsoft. Trellix \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 ZDNet, \u0447\u0442\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0432\u0434\u043e\u0445\u043d\u043e\u0432\u043b\u044f\u043b\u0438\u0441\u044c Empire OneDrive Stager, \u0442.\u043a. \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u0430\u044f \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u0443 \u043d\u0438\u0445 \u0441\u0445\u043e\u0436\u0438.\n\n\u041a\u0440\u0438\u0441\u0442\u0438\u0430\u043d \u0411\u0438\u043a, \u0432\u0435\u0434\u0443\u0449\u0438\u0439 \u043d\u0430\u0443\u0447\u043d\u044b\u0439 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a Trellix Threat Labs, \u043e\u0442\u043c\u0435\u0442\u0438\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0448\u043b\u0430 \u0443\u0441\u043f\u0435\u0448\u043d\u043e, \u043d\u043e \u043d\u0435 \u0441\u0442\u0430\u043b \u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e \u0446\u0435\u043b\u044f\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u0437\u0430\u044f\u0432\u0438\u0432, \u0447\u0442\u043e \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0441\u0435 \u0435\u0449\u0435 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 Trellix, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 \u043a \u0430\u0442\u0430\u043a\u0435 \u0432\u0435\u043b\u0430\u0441\u044c \u0432 \u0438\u044e\u043b\u0435 2021 \u0433\u043e\u0434\u0430, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441\u0430\u043c\u0430 \u0430\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430 \u0441 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u043f\u043e 5 \u043d\u043e\u044f\u0431\u0440\u044f.\n\n\u041f\u0435\u0440\u0432\u044b\u0439 \u044d\u0442\u0430\u043f \u0430\u0442\u0430\u043a\u0438, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0432\u043a\u043b\u044e\u0447\u0430\u043b \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u0443\u044e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0443 \u043f\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435, \u0446\u0435\u043b\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0439 - \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0436\u0435\u0440\u0442\u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0444\u0430\u0439\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 Excel-\u0444\u0430\u0439\u043b \u00abparliament_rew.xlsx\u00bb. \u041f\u043e\u043c\u0438\u043c\u043e \u0433\u043e\u0441. \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043f\u043e\u043b\u043e\u0436\u0438\u043b\u0438 \u0433\u043b\u0430\u0437 \u043d\u0430 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u044c, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u0440\u0443\u0433\u043e\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 - \u00abMissions Budget.xlsx\u00bb - \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b \u0442\u0435\u043a\u0441\u0442 \u00ab\u0412\u043e\u0435\u043d\u043d\u044b\u0435 \u0438 \u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0441\u043a\u0438\u0435 \u043c\u0438\u0441\u0441\u0438\u0438 \u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438\u00bb \u0438 \u0431\u044e\u0434\u0436\u0435\u0442\u044b \u0432 \u0434\u043e\u043b\u043b\u0430\u0440\u0430\u0445 \u043d\u0430 \u0432\u043e\u0435\u043d\u043d\u044b\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0430\u0445 \u043d\u0430 2022 \u0438 2023 \u0433\u043e\u0434\u044b.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0437\u0430\u044f\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u0445\u043e\u0442\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u0445\u0441\u044f \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043f\u0440\u0438\u043f\u0438\u0441\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0442\u043e\u0439 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0435 \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043f\u0440\u0443\u0444\u044b \u043a\u043e\u0441\u0432\u0435\u043d\u043d\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 APT28. \u0412 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043d\u0430\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043e\u0441\u0442\u0440\u0435\u043d\u0438\u044f \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0439 \u043c\u0435\u0436\u0434\u0443 \u0410\u0440\u043c\u0435\u043d\u0438\u0435\u0439 \u0438 \u0410\u0437\u0435\u0440\u0431\u0430\u0439\u0434\u0436\u0430\u043d\u043e\u043c. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Trellix, \u0445\u0430\u043a\u0435\u0440\u044b, \u0441\u0442\u043e\u044f\u0432\u0448\u0438\u0435 \u0437\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c, \u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u0441 \u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a\u0430 \u043f\u043e \u043f\u044f\u0442\u043d\u0438\u0446\u0443, \u0430 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043a\u0438 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u0447\u0430\u0441\u044b \u0432 \u0447\u0430\u0441\u043e\u0432\u043e\u043c \u043f\u043e\u044f\u0441\u0435 GMT+3, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 (\u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u0435 \u0432\u0440\u0435\u043c\u044f, \u0422\u0443\u0440\u0446\u0438\u044f, \u0410\u0440\u0430\u0432\u0438\u044f, \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u0430\u044f \u0410\u0444\u0440\u0438\u043a\u0430). \u0415\u0449\u0435 \u043e\u0434\u043d\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0432 \u0445\u043e\u0434\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u0430\u043b CLSID-\u043a\u043b\u044e\u0447 D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0442.\u043a. \u043e\u043d \u0440\u0430\u043d\u0435\u0435 \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 ESET, \u0433\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u043b\u0438 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0443\u044e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044e, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u044b \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u044b. \u0412 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u044d\u0442\u043e\u043c\u0443, \u0430\u043d\u0430\u043b\u0438\u0437 \u043a\u043e\u0434\u0430 \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0432\u044b\u044f\u0432\u0438\u043b \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0441 \u043e\u0431\u0440\u0430\u0437\u0446\u0430\u043c\u0438, \u043f\u043e\u0439\u043c\u0430\u043d\u043d\u044b\u043c\u0438 \u0432 2018 \u0433\u043e\u0434\u0443 \u0438 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0438\u043c\u0438 APT28.\n@NeKaspersky", "creation_timestamp": "2022-01-25T17:08:24.000000Z"}, {"uuid": "0c04575a-5ad9-4e08-a0ce-35304cb8bc68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "Telegram/t4gtokn8SpAMOCEn2HexTTtzMwSyrDM6ap-Kp2XCmg3aXg", "content": "", "creation_timestamp": "2021-11-04T14:49:58.000000Z"}, {"uuid": "2527f9ff-5743-4f01-8ff2-04e72a4f6a1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/NeKaspersky/1592", "content": "\u041d\u043e\u0432\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f MSHTML\n \n\u0415\u0449\u0435 \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 Microsoft \u043e\u0448\u0430\u0440\u0430\u0448\u0438\u043b\u0430 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u0441\u0432\u043e\u0435\u0433\u043e \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-40444. \u0421 \u0435\u0451 \u043f\u043e\u043c\u043e\u0449\u044c\u044e, \u043a\u0430\u043a \u0432\u044b \u043f\u043e\u043c\u043d\u0438\u0442\u0435, \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u041d\u0430 \u0442\u043e\u0442 \u043c\u043e\u043c\u0435\u043d\u0442 \u043b\u0430\u0437\u0435\u0439\u043a\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432\u0441\u044f\u043a\u0438\u043c\u0438 \u0448\u0430\u043b\u0430\u043f\u0430\u044f\u043c\u0438, \u0430 Microsoft \u0441\u0442\u0430\u0440\u0430\u043b\u0438\u0441\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u0441\u0442\u0440\u0435\u0435 \u043e\u0442 \u043d\u0435\u0451 \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f. \n \n\u0414\u044b\u0440\u0443, \u043a \u0441\u043b\u043e\u0432\u0443, \u043d\u0430\u0448\u043b\u0438 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435 \u0434\u043b\u044f Microsoft Internet Explorer (MSHTML). (\u041d\u0443 \u0434\u0430, \u043d\u0443 \u0434\u0430. \u041c\u0430\u043b\u043e \u0442\u043e\u0433\u043e, \u0447\u0442\u043e Internet Explorer \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u043c \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c(\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445), \u0442\u0430\u043a \u0435\u0433\u043e \u0434\u0432\u0438\u0436\u043e\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0435\u0449\u0451 \u0438 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b Microsoft Office).\n \n\u041d\u0435 \u0431\u0443\u0434\u0435\u043c \u043b\u0438\u0442\u044c \u0432\u043e\u0434\u0443, \u043f\u0435\u0440\u0435\u0439\u0434\u0451\u043c \u043a \u0441\u0443\u0442\u0438. \u041f\u0440\u0438\u043d\u0446\u0438\u043f \u0440\u0430\u0431\u043e\u0442\u044b \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u043b\u0441\u044f \u0432\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0435 ActiveX, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434. \u0415\u0433\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u043b\u0438 \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Microsoft Office \u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0438 \u043f\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u0430\u043c. \u0414\u0430\u043b\u044c\u0448\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0443\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u044c \u0438\u0437 \u0442\u0435\u043c\u043d\u0438\u043a\u043e\u0432 \u0432\u0441\u0435 \u0441\u0432\u043e\u0438 \u043d\u0430\u0432\u044b\u043a\u0438 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438 \u0438 \u0443\u0431\u0435\u0434\u0438\u0442\u044c \u043b\u043e\u0445\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0444\u0430\u0439\u043b.\n \n\u0418 \u0432\u043e\u0442 \u043e\u0431\u043b\u0435\u0433\u0447\u0435\u043d\u0438\u0435. Microsoft \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u0438 \u0440\u0435\u0448\u0430\u0435\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041d\u043e Microsoft \u043d\u0435 \u0431\u044b\u043b\u0430 \u0431\u044b \u0441\u043e\u0431\u043e\u0439, \u0435\u0441\u043b\u0438 \u0431\u044b \u043d\u0435 \u043d\u0430\u0448\u0451\u043b\u0441\u044f \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u043b\u043e \u0443\u0431\u0440\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 CVE-2021-40444 \u0432 RAR-\u0444\u0430\u0439\u043b. \n \n \u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0432\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0441\u043a\u0440\u0438\u043f\u0442 Windows Script Host, \u0430 RAR-\u0444\u0430\u0439\u043b \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 OLE-\u043e\u0431\u044a\u0435\u043a\u0442. \u0418 \u043a\u0430\u043a \u0432\u044b \u043f\u043e\u043d\u044f\u043b\u0438, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 CAB-\u0444\u0430\u0439\u043b\u0435, \u043a\u0430\u043a \u044d\u0442\u043e \u0431\u044b\u043b\u043e \u0440\u0430\u043d\u0435\u0435, \u0430 \u0432 \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u0438\u0441\u043a\u0440\u0438\u0432\u043b\u0435\u043d\u043d\u043e\u043c \u0430\u0440\u0445\u0438\u0432\u0435. \u041f\u0440\u0438 \u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u0434\u0435\u043b\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u043f\u0430\u0445\u043d\u0443\u0442\u044c \u043d\u0435 \u0446\u0432\u0435\u0442\u0430\u043c\u0438. \n\u041d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 PoC-\u043a\u043e\u0434 \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u043d\u0430\u0439\u0442\u0438 \u043d\u0430 GitHub. \n \n \u041e\u0434\u043d\u0430\u043a\u043e \u043d\u0435 \u0432\u0441\u0435 \u0442\u0430\u043a \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u043e. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441 \u043c\u043e\u0433\u0443\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 WinRAR 6.10 beta 3, \u0430 \u0443 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u0441\u0442\u0430\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u0430\u0436\u0435 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u0441\u044f \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0430\u0440\u0445\u0438\u0432\u043d\u044b\u0439 \u0444\u0430\u0439\u043b.\n@NeKaspersky", "creation_timestamp": "2022-02-04T18:39:32.000000Z"}, {"uuid": "58044b6c-64bb-479f-a857-dc0063c413f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/NeKaspersky/2007", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0443, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e Conti \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0435\u0442\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u0439\n\n\u0421 \u0442\u0430\u043a\u0438\u043c \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432\u0447\u0435\u0440\u0430 \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u0412\u043b\u0430\u0434 \u0421\u0442\u043e\u043b\u044f\u0440\u043e\u0432 \u0438 Benoit Sevens \u0438\u0437 \u0433\u0443\u0433\u043b\u043e\u0432\u0441\u043a\u043e\u0439 Threat Analysis Group (TAG). \u041f\u043e \u0438\u0445 \u0441\u043b\u043e\u0432\u0430\u043c, \u042d\u043a\u0437\u043e\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u041b\u0438\u043b\u0438\u044f (Exotic Lily) \u2014 \u0442\u0430\u043a \u0432 TAG \u043e\u043a\u0440\u0435\u0441\u0442\u0438\u043b\u0438 \u044d\u0442\u0438\u0445 \u0431\u0440\u043e\u043a\u0435\u0440\u043e\u0432 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u2014 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-40444) \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 MSHTML \u0437\u0430 \u0430\u0432\u0442\u043e\u0440\u0441\u0442\u0432\u043e\u043c Microsoft \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439: \u0435\u0436\u0435\u0434\u043d\u0435\u0432\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 5\u043a+ email-\u043e\u0432 \u0441 \u00ab\u0434\u0435\u043b\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438\u00bb 650 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\n\u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0430\u0441\u0442\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u0431\u044f\u0442 \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438 \u0435\u0449\u0435 \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u0442\u0435 \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0432 \u0434\u0435\u043f\u043b\u043e\u0435 \u0440\u0430\u043d\u0441\u043e\u043c\u0432\u0430\u0440\u0438 Conti \u0438 Diavol. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u0435\u043c\u044b\u0439 \u0438\u043c\u0438 \u0441\u043f\u0430\u043c \u0431\u044b\u043b \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c (\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 \u0438\u0437 \u0441\u0435\u043a\u0442\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439, \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0434\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f), \u043d\u043e \u0443\u0436\u0435 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f \u0442\u043e\u0433\u043e \u0436\u0435 \u0433\u043e\u0434\u0430 \u043e\u043d\u0438 \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0438 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043a\u0443\u0434\u0430 \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0442\u0441\u044b\u043b\u0430\u043b\u0438\u0441\u044c \u043e\u0442 \u043b\u0438\u0446\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439. \u0414\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0447\u0430\u0441\u0442\u043e, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u0442\u0432\u043e\u0440\u044f\u043b\u0438\u0441\u044c \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u043c\u0438 Amazon, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u044f \u0432 LinkedIn \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0444\u0438\u043b\u0438, \u0430\u0432\u0430\u0442\u0430\u0440\u043a\u0438 \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043d\u0435\u0439\u0440\u043e\u043d\u043e\u043a. \u0412 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432, \u0432\u044b\u0442\u044f\u0433\u0438\u0432\u0430\u044f \u0438\u0445 \u0438\u0437 \u043f\u0440\u043e\u0444\u0438\u043b\u044c\u043d\u044b\u0445 \u0431\u0430\u0437 \u0434\u0430\u043d\u043d\u044b\u0445, \u0432\u0440\u043e\u0434\u0435 Rocketreach \u0438 CrunchBase.\n\n\u041a\u043e\u0433\u0434\u0430 \u0434\u0438\u0430\u043b\u043e\u0433 \u0441 \u0436\u0435\u0440\u0442\u0432\u043e\u0439 \u0443\u0436\u0435 \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d, Exotic Lily \u043d\u0435 \u0441\u0442\u0435\u0441\u043d\u044f\u044f\u0441\u044c \u0433\u0440\u0443\u0437\u0438\u043b\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0432\u043e \u0432\u043f\u043e\u043b\u043d\u0435 \u0441\u0435\u0431\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u043e\u043e\u0431\u043c\u0435\u043d\u043d\u0438\u043a\u0438, \u0432\u0440\u043e\u0434\u0435 WeTransfer, Transfernow \u0438\u043b\u0438 OneDrive, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u0444\u0430\u0439\u043b\u043e\u043c, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f. \u0421\u043c\u044b\u0441\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0438\u0441\u044c\u043c\u043e, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0435 \u0441\u0441\u044b\u043b\u043a\u0443, \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u043d\u0435 \u0441 \u0440\u0430\u043d\u0434\u043e\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e 1.5 \u0434\u043d\u044f \u043d\u0430\u0437\u0430\u0434, \u043d\u043e \u043e\u0442 \u043b\u0438\u0446\u0430 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0440\u0435\u043f\u0443\u0442\u0430\u0446\u0438\u0435\u0439, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0441\u044b\u043f\u0438\u0442\u044c \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0430\u043d\u0442\u0438-\u0441\u043f\u0430\u043c \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 MSHTML \u0434\u0435\u043b\u0430\u043b\u0438 \u0441\u043b\u0435\u0433\u043a\u0430 \u0438\u043d\u0430\u0447\u0435: \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u0441 \u043a\u0435\u043c-\u0442\u043e \u043f\u043e \u043f\u043e\u0447\u0442\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f, \u0442\u0430\u043a \u0447\u0442\u043e \u043f\u0440\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0438\u0445 \u043f\u0440\u0435\u043b\u044e\u0434\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438 Bumblebee \u2014 \u043a\u0430\u0441\u0442\u043e\u043c\u043d\u044b\u0439 \u0434\u0440\u043e\u043f\u043f\u0435\u0440, \u0432 \u0437\u0430\u0434\u0430\u0447\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0445\u043e\u0434\u0438\u0442 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0430 \u0435\u0435 \u0434\u043e\u043c\u043e\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043e\u0442\u0442\u0443\u0434\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u043e\u0439 \u0432 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u043c.\n\n\u0417\u0430\u0431\u0430\u0432\u043d\u043e \u0438 \u0442\u043e, \u0447\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0437 \u0442\u0430\u0439\u043c\u043b\u0430\u0439\u043d\u0430 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u0439 TAG, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0435\u0435 \u0447\u043b\u0435\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0441 9 \u0434\u043e 5 \u043f\u043e \u0431\u0443\u0434\u043d\u044f\u043c, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044f \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u0430\u043b\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435 (\u043c\u043e\u0436\u0435\u0442 \u0435\u0449\u0435 \u0438 \u0432 \u043e\u0444\u0438\u0441 \u0445\u043e\u0434\u044f\u0442?), \u0438, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u0432 \u0447\u0430\u0441\u043e\u0432\u043e\u043c \u043f\u043e\u044f\u0441\u0435 \u0426\u0435\u043d\u0442\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043b\u0438 \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u044b.\n@NeKaspersky", "creation_timestamp": "2022-03-18T14:53:23.000000Z"}, {"uuid": "1dcaed54-ccba-406e-9dc9-0636d01c47aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/NeKaspersky/1224", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0442\u0443\u0442\u043e\u0440\u0438\u0430\u043b \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day \u0432 Windows MSHTML. \n\n\u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u044d\u0442\u043e\u043c\u0443 \u043c\u043d\u043e\u0433\u0438\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-40444 \u0432 \u0441\u0432\u043e\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \n\nMicrosoft \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u041e\u043d\u0430 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f RCI. \n\nMicrosoft \u043f\u043e-\u0431\u044b\u0441\u0442\u0440\u043e\u043c\u0443 \u043f\u043e\u0434\u043e\u0433\u043d\u0430\u043b\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043c\u043e\u0433\u0430\u044e\u0442 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043e\u0442 \u0430\u0442\u0430\u043a \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u0438\u043c\u0447\u0438\u0432\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0431\u044b\u0441\u0442\u0440\u043e \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0442\u0430\u043a, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043c\u0435\u0440\u044b \u0437\u0430\u0449\u0438\u0442\u044b Microsoft. \n\n2021 \u0433\u043e\u0434 \u043c\u043e\u0436\u043d\u043e \u0441\u043c\u0435\u043b\u043e \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u0438\u0441\u0442\u043e\u0440\u0438\u044e, \u043a\u0430\u043a \u0433\u043e\u0434 \u043a\u0438\u0431\u0435\u0440\u0441\u0442\u0430\u0445\u0430\u043d\u043e\u0432\u0446\u0435\u0432. \u041f\u0440\u043e\u0434\u0443\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0443 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043d\u0430 \u043f\u0438\u043a\u0435.", "creation_timestamp": "2021-09-13T18:24:38.000000Z"}, {"uuid": "2f264f90-9485-496c-99c5-b827c7e193ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/reconshell/1140", "content": "Microsoft Office Word Exploit\n\n#MSHTML #RCE #Exploit #Microsoft\n#CVE-2021-40444 #RemoteCodeExecution\n\nhttps://reconshell.com/microsoft-word-exploit/", "creation_timestamp": "2021-12-20T19:48:01.000000Z"}, {"uuid": "cc337832-baad-4c78-a686-162a23464865", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "Telegram/smWrD73nCHhVL4jR2xa9FEpaSa_Ke6qKJtMu55OxAme9AtU", "content": "", "creation_timestamp": "2021-09-28T08:56:06.000000Z"}, {"uuid": "e5f2466e-a9b0-48b1-8822-a36517d203cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/TamdMsi24WImky6H5uIqsJY8yfD4MhSC9MVjjy5jHRaSunA", "content": "", "creation_timestamp": "2021-10-01T09:10:09.000000Z"}, {"uuid": "23d1dd34-ef06-4aeb-a39b-f4664f004775", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1657", "content": "CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit https://github.com/klezVirus/CVE-2021-40444", "creation_timestamp": "2026-07-30T01:01:58.839659Z"}, {"uuid": "861b847a-110c-4b4c-8c90-2d51cf0027e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/theninjaway1337/1246", "content": "Hackers use PowerPoint files for 'mouseover' malware delivery\n\nThis article was updated on 9/29/22 with new information that Microsoft fixed a vulnerability in 2021 tracked as CVE-2021-40444 that also prevents this PowerPoint exploit from working. If you have installed Windows Updates since then, your device is secure.\nHackers believed to work for Russia have started using a new code execution technique that relies on mouse movement in Microsoft PowerPoint presentations to trigger a malicious PowerShell script.\n\nhttps://www.bleepingcomputer.com/news/security/hackers-use-powerpoint-files-for-mouseover-malware-delivery/", "creation_timestamp": "2023-02-10T22:15:06.000000Z"}, {"uuid": "d9521bae-f6d1-4830-b626-48070aba226a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/HackerOne/3173", "content": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444", "creation_timestamp": "2021-09-10T08:36:10.000000Z"}, {"uuid": "261a27c2-6c1a-41c0-afd0-1f320410330c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/HackerOne/3177", "content": "https://www.trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html", "creation_timestamp": "2021-09-13T17:25:39.000000Z"}, {"uuid": "c562e5e3-f1c2-44e9-8b2c-2e345f402a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/thehackernews/1496", "content": "Microsoft has issued an advisory WARNING its users about a new actively exploited ZERO-DAY vulnerability (CVE-2021-40444 // CVSS score: 8.8) that attackers are using to hijack Windows systems by leveraging weaponized Office documents.\n\nDetails: https://thehackernews.com/2021/09/new-0-day-attack-targeting-windows.html", "creation_timestamp": "2021-09-08T05:43:45.000000Z"}, {"uuid": "2241cf6f-7b45-4141-a385-f020936253c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/thehackernews/3605", "content": "Cybercriminals are leveraging exploits for CVE-2021-40444 and CVE-2022-30190 to execute code through malicious Word files. Once opened, LokiBot malware is downloaded, logging keystrokes, capturing screenshots, and stealing data.  \n \nRead: https://thehackernews.com/2023/07/cybercriminals-exploit-microsoft-word.html", "creation_timestamp": "2023-07-17T11:34:30.000000Z"}, {"uuid": "9f577a63-d93d-4f0c-87eb-50d33cb4e490", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/BlueRedTeam/1093", "content": "Mapping and Pivoting from Cobalt Strike C2 Infrastructure Attributed to CVE-2021-40444\nhttps://michaelkoczwara.medium.com/mapping-and-pivoting-cobalt-strike-c2-infrastructure-attributed-to-cve-2021-40444-438786fcd68a\n\n#Blue_Team_Techniques\n#Blue_Team \n@BlueRedTeam", "creation_timestamp": "2021-12-12T08:21:43.000000Z"}, {"uuid": "b8801a0b-6531-47af-9726-376cebbb97be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/xakep_ru/11630", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Microsoft MSHTML \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 Google \u0438 Instagram\n\n\u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SafeBreach Labs \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u0438\u0440\u0430\u043d\u0441\u043a\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-40444 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0442 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 Google \u0438 Instagram. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0430\u0442\u0430\u043a\u0443\u044e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0433\u043e\u0432\u043e\u0440\u044f\u0449\u0438\u0445 \u043d\u0430 \u0444\u0430\u0440\u0441\u0438.\n\nhttps://xakep.ru/2021/11/25/cve-2021-40444-powershortshell/", "creation_timestamp": "2021-11-25T15:04:09.000000Z"}, {"uuid": "414c3bf6-d1c0-4533-b9d4-821fc33ef43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/xakep_ru/11283", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Windows MSHTML \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0435\u0435, \u0447\u0435\u043c \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c\n\n\u041f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043d\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u043e\u0439 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-40444 \u0438 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043e\u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\nhttps://xakep.ru/2021/09/10/cve-2021-40444/", "creation_timestamp": "2022-12-21T07:43:57.000000Z"}, {"uuid": "b9fabe4c-572d-4d14-8714-0b533bf77971", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/xakep_ru/11291", "content": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows MSHTML\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0436\u0435 \u0434\u0435\u043b\u044f\u0442\u0441\u044f \u043d\u0430 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445 \u0442\u0443\u0442\u043e\u0440\u0438\u0430\u043b\u0430\u043c\u0438 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430\u043c\u0438 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u0435\u043c\u0443 \u0447\u0438\u0441\u043b\u0443 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0432\u043e\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\nhttps://xakep.ru/2021/09/13/cve-2021-40444-exploits/", "creation_timestamp": "2021-09-13T17:33:48.000000Z"}, {"uuid": "98f9b536-ba28-47ea-9e1d-0a0361ec593a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1607", "content": "#exploit\n1. Unpacking CVE-2021-40444:\nA Deep Technical Analysis of an Office RCE Exploit\nhttps://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce\n\n2. CVE-2021-38000:\nChrome Intents Logic Flaw\nhttps://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-38000.html\n\n@BlueRedTeam", "creation_timestamp": "2022-01-09T08:11:33.000000Z"}, {"uuid": "4a66ae2e-4416-4819-854a-9b153111032e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/SecLabNews/14344", "content": "\u0421\u043a\u0440\u044b\u0442\u043d\u044b\u0439 \u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0439: \u043a\u0430\u043a \u0431\u044d\u043a\u0434\u043e\u0440 MataDoor \u043f\u0440\u043e\u043d\u0438\u043a\u0430\u0435\u0442 \u0432 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b\n\n\ud83d\udd24\u0411\u044d\u043a\u0434\u043e\u0440 MataDoor \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u043c \u043d\u043e\u0432\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Dark River, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0446\u0435\u043b\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u0430 \u0441 \u0446\u0435\u043b\u044c\u044e \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430 \u0438 \u043a\u0440\u0430\u0436\u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\ud83d\udd24\u0411\u044d\u043a\u0434\u043e\u0440  \u0438\u043c\u0435\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443 \u0438 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0435\u043c\u0443 \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u0430\u0436\u0435 \u0438\u0437 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439.\n\n\ud83d\udd24 MataDoor \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444, \u0438 \u0445\u043e\u0440\u043e\u0448\u043e \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0435\u0433\u0430\u043b\u044c\u043d\u043e\u0435 \u041f\u041e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0443\u043f\u0430\u043a\u043e\u0432\u0449\u0438\u043a\u0438 \u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0438.\n\n#MataDoor #DarkRiver #\u041e\u041f\u041a @SecLabNews", "creation_timestamp": "2023-09-27T08:18:54.000000Z"}, {"uuid": "595034fd-840f-4181-b1c2-44ba6cf74916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/SecLabNews/10928", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0439 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0440\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u0438 \u041c\u0412\u0414\n\n\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ( CVE-2021-40444 ) \u0432 Microsoft MHTML (Trident) \u2014 \u043f\u0440\u043e\u043f\u0440\u0438\u0435\u0442\u0430\u0440\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Internet Explorer.\n\n\u041f\u0435\u0440\u0432\u043e\u0435 \u0442\u0438\u043f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u043e\u0434 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043e\u0442\u0434\u0435\u043b\u0430 \u043a\u0430\u0434\u0440\u043e\u0432 \u0410\u041e \u00ab\u0413\u0420\u0426 \u041c\u0430\u043a\u0435\u0435\u0432\u0430\u00bb - \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0445\u043e\u043b\u0434\u0438\u043d\u0433 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u043e-\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u0430 \u0441\u0442\u0440\u0430\u043d\u044b \u0432 \u0440\u0430\u043a\u0435\u0442\u043d\u043e-\u043a\u043e\u0441\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u0440\u0430\u0441\u043b\u0438.\n\n\u0412\u0442\u043e\u0440\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e \u0431\u044b\u043b\u043e \u044f\u043a\u043e\u0431\u044b \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0438\u0437 \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0434\u0435\u043b \u0432 \u041c\u043e\u0441\u043a\u0432\u0435.\n\n\u0412 \u043e\u0431\u043e\u0438\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043f\u0440\u043e\u0441\u044f\u0442 \u0437\u0430\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0444\u043e\u0440\u043c\u0443 \u0438\u043b\u0438 \u043e\u0442\u0432\u0435\u0442\u0438\u0442\u044c \u043d\u0430 \u043f\u0438\u0441\u044c\u043c\u043e.\n\nhttps://www.securitylab.ru/news/524957.php", "creation_timestamp": "2021-09-23T16:30:41.000000Z"}, {"uuid": "7f4b661a-8a0f-47db-abfc-b0735ede87cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/St0rM66/450", "content": "\u0627\u064a\u0645\u064a\u0644 \u0635\u063a\u064a\u0631 \u0628\u064a\u062d\u062a\u0648\u064a \u0639\u0644\u0649 \u0645\u0644\u0641 Word \u0645\u0645\u0643\u0646 \u064a\u062a\u0628\u0639\u062a \u0644\u0627\u064a \u0634\u062e\u0635, \u0648\u0628\u0645\u062c\u0631\u062f \u062a\u0646\u0632\u064a\u0644 \u0648\u0641\u062a\u062d \u0645\u0644\u0641 \u0627\u0644\u0640 Word, \u0627\u0644\u0637\u0631\u0641 \u0627\u0644\u0627\u062e\u0631 \u0628\u064a\u0627\u062e\u062f Access \u0643\u0627\u0645\u0644 \u0639\u0644\u0649 \u062c\u0647\u0627\u0632\u0643, \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0645\u0627 \u064a\u0639\u0631\u0641 \u0628\u0625\u0633\u0645 \u0627\u0644\u0640 Macros.\n\n\u062b\u063a\u0631\u0629 \u062c\u062f\u064a\u062f\u0629 \u0645\u0639\u0631\u0648\u0641\u0629 \u0628\u0625\u0633\u0645 CVE-2021-40444.\n\n\u0627\u0644\u0640 Attack \u0628\u064a\u062d\u0635\u0644 \u0643\u0627\u0644\u0623\u062a\u064a:-\n\n- \u0645\u0644\u0641 Word \u0628\u064a\u062a\u0628\u0639\u062a \u0641\u064a \u0627\u064a\u0645\u064a\u0644.\n- \u0627\u0644\u0645\u0644\u0641 \u0628\u064a\u062a\u0645 \u062a\u0646\u0632\u064a\u0644\u0647 \u0648\u062a\u0634\u063a\u064a\u0644\u0647 \u0648\u0628\u0633\u0628\u0628 \u0627\u0646\u0647\u0627 \u062b\u063a\u0631\u0629 \u062c\u062f\u064a\u062f\u0629 \u0641\u0627 \u0628\u062a\u0643\u0648\u0646 \u063a\u064a\u0631 \u0645\u0639\u0631\u0648\u0641\u0629 \u0644\u0644\u0640 Antivirus.\n- \u0645\u0644\u0641 \u0627\u0644\u0640 Word \u0628\u064a\u0646\u0632\u0644 \u0645\u0644\u0641 \u0627\u062e\u0631 \u0628\u064a\u062d\u062a\u0648\u064a \u0639\u0644\u0649 \u0643\u0648\u062f Javascript.\n- \u0643\u0648\u062f \u0627\u0644\u0640 Javascript \u0628\u064a\u0646\u0632\u0644 \u0645\u0644\u0641 \u0627\u062e\u0631 \u0628\u064a\u062d\u062a\u0648\u0649 \u0639\u0644\u0649 DLL File.\n- \u0627\u0644\u0640 DLL File \u0628\u062f\u0648\u0631\u0647 \u0628\u064a\u0641\u062a\u062d \u0627\u062a\u0635\u0627\u0644 \u0645\u0639 \u0627\u0644\u0640 Attacker \u0645\u0646 \u062e\u0644\u0627\u0644 \u062a\u0648\u0644 \u0627\u0633\u0645\u0647\u0627 Cobalt Strike.\n\n\u062d\u0627\u0644\u064a\u0627 \u0634\u0631\u0643\u0629 \u0645\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0646\u0632\u0644\u062a \u0628\u0627\u062a\u0634 \u0644\u0644\u062b\u063a\u0631\u0629 \u062f\u064a.\n\nhttps://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/", "creation_timestamp": "2021-09-19T15:46:26.000000Z"}, {"uuid": "95c1bb99-886a-4490-831f-381457a01d66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/S_E_Reborn/1554", "content": "\u041d\u0438\u043a\u0442\u043e \u0438 \u043d\u0435 \u0441\u043e\u043c\u043d\u0435\u0432\u0430\u043b\u0441\u044f, \u0437\u043d\u0430\u044f \u043a\u0430\u043a Microsoft \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u0432\u043e\u0438 \u043a\u043e\u0441\u044f\u043a\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044f \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u0443\u0447\u0443 \u0434\u0440\u0443\u0433\u0438\u0445.\n \n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c Sophos, \u0445\u0430\u043a\u0435\u0440\u044b \u043d\u0430\u0448\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Microsoft Office \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0435\u0433\u043e \u0434\u043b\u044f \u043a\u0440\u0430\u0442\u043a\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e Formbook.\n \n\u041e\u0448\u0438\u0431\u043a\u0430 CVE-2021-40444 (\u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS 8,8) \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f MSHTML \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0436\u0435\u0440\u0442\u0432\u043e\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430.\n \n\u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e 7 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0435\u0440\u0438\u0438 \u0430\u0442\u0430\u043a, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e \u043e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u043c Patch Tuesday. \u0422\u0430\u043a\u0436\u0435 \u0431\u044b\u043b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC, \u0432\u044b\u0437\u0432\u0430\u0432\u0448\u0438\u0439 \u0440\u0435\u0437\u043a\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n \n\u041f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 Microsoft \u043f\u0430\u0442\u0447 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0430\u0440\u0445\u0438\u0432\u0430 Microsoft Cabinet (CAB), \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u0445\u043e\u0436\u0435, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0448\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0430\u0442\u0447, \u0432\u043a\u043b\u044e\u0447\u0438\u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Word \u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u0430\u0440\u0445\u0438\u0432 RAR.\n \nSophos \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 \u0430\u0440\u0445\u0438\u0432\u044b \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0435 \u0441\u043f\u0430\u043c\u0430 \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 24 - 25 \u043e\u043a\u0442\u044f\u0431\u0440\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0431\u044b\u043b\u0430 \u0431\u044b\u0441\u0442\u0440\u043e \u0441\u0432\u0435\u0440\u043d\u0443\u0442\u0430, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u00ab\u043f\u0440\u043e\u0431\u043d\u044b\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u00bb. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043b\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 Word \u0432 \u0430\u0440\u0445\u0438\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f PowerShell, \u0438 \u043a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0430 \u0435\u0433\u043e \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0443, \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0441\u044f, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u043e \u043a \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e Formbook.\n \n\u0412\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043e\u0431\u043e\u0439 \u044d\u0441\u043a\u0430\u043b\u0430\u0446\u0438\u044e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 -40444 \u0438 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u0447\u0442\u043e \u0434\u0430\u0436\u0435 \u043f\u0430\u0442\u0447 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u043c\u043e\u0436\u0435\u0442 \u0441\u043c\u044f\u0433\u0447\u0438\u0442\u044c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043c\u043e\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430.\n \n\u041f\u043e \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0430\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0442\u0447 \u0431\u044b\u043b \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0443\u0437\u043a\u043e\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0438 \u043d\u0435 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u043b \u0434\u043e \u043a\u043e\u043d\u0446\u0430 \u0432\u0441\u0435\u0445 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 WinRAR \u0444\u0430\u0439\u043b\u043e\u0432.\n \n\u0427\u0435\u0433\u043e \u0438 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u043e \u043e\u0436\u0438\u0434\u0430\u0442\u044c.", "creation_timestamp": "2021-12-26T12:47:42.000000Z"}, {"uuid": "7f688ed6-e460-4cdd-8794-1a528d1f2267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/S_E_Reborn/1019", "content": "\u0412\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443 \u0441\u0435\u0431\u044f \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u043a\u0435 CVE-2021-40444\n\nhttps://xret2pwn.github.io/CVE-2021-40444-Analysis-and-Exploit/\n\nhttps://github.com/felixweyne/imaginaryC2/tree/master/examples/use-case-10-CVE-2021-40444", "creation_timestamp": "2021-09-13T20:27:27.000000Z"}, {"uuid": "fb62ed4a-8454-4061-b115-467cac1da9d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1985", "content": "Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/", "creation_timestamp": "2026-08-03T03:02:14.074443Z"}, {"uuid": "583ceaa9-d302-4049-90ba-12354f5e2380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/arvin_club/4644", "content": "New Cool vulnerability in MS Office which triggers without macro\nSo whole magic in this exploit happens while oppening the document, it loads html file which contains obfuscated JS\nhttps://vx-underground.org/tmp/CVE-2021-40444.rar\n\nhttps://www.youtube.com/watch?v=oM6UaaXJ46I", "creation_timestamp": "2021-09-10T22:43:07.000000Z"}, {"uuid": "c3ac933c-e607-46e2-8a88-5dc9da3462cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "Telegram/NFyFM27lNghIndaR6CImOqIbIX6WFvDPAqNbMXoU0V9ZOOkW", "content": "", "creation_timestamp": "2021-11-22T03:08:33.000000Z"}, {"uuid": "f85970cc-86aa-4174-b21d-c44cfc2d605e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "Telegram/KIyepJj8ukD7DOqiNQyDI3uN8pScILVadywWv9k-RpHrXgsC", "content": "", "creation_timestamp": "2021-10-15T06:39:17.000000Z"}, {"uuid": "d410f247-a6f0-4f06-8d33-d22156857c34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/Y8QMGzgEoUfdiP36vJGMZhOkREdfYUIJqZ1jIRdkQSGZ6zbc", "content": "", "creation_timestamp": "2021-10-04T06:06:56.000000Z"}, {"uuid": "52424175-2d3e-4823-bf08-c6aa87776ce2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/arvin_club/4636", "content": "#threatleak \n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444", "creation_timestamp": "2021-09-09T10:41:24.000000Z"}, {"uuid": "21222c4e-44c3-4774-89b9-547c8e8f9635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/arvin_club/4652", "content": "#threatleak \n\nhttps://www.trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html", "creation_timestamp": "2021-09-13T07:35:14.000000Z"}, {"uuid": "49afa76c-86d2-4ac8-82ba-361082d889d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/5324", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Jan 1-31)\n\nCVE-2021-44228 - Apache Log4j2\nCVE-2021-40444 - Microsoft MSHTML RCE\nCVE-2021-4034 - LPE vuln was found on polkit's pkexec utility\nCVE-2022-0185 - Linux Kernel Container Escape in Kubernetes\nCVE-2022-21907 - HTTP Protocol Stack RCE\nCVE-2022-21882 - Win32k Window Object Type Confusion\nCVE-2021-20038 - SonicWall SMA-100 Unauth RCE\nCVE-2021-45467 - CWP CentOS Web Panel preauth RCE\nCVE-2021-42392 - Unauth RCE in H2 Database Console\nCVE-2022-21658 - Vulnerability in Rust", "creation_timestamp": "2024-10-15T10:29:54.000000Z"}, {"uuid": "8490b6ea-e5c3-4b0b-bb32-59a98d64a861", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5161", "content": "#exploit\n1. Unpacking CVE-2021-40444:\nA Deep Technical Analysis of an Office RCE Exploit\nhttps://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce\n\n2. CVE-2021-38000:\nChrome Intents Logic Flaw\nhttps://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-38000.html", "creation_timestamp": "2022-01-09T12:07:01.000000Z"}, {"uuid": "5f79dc83-0832-40f6-a987-b70233d2941f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/4276", "content": "#exploit\nFull PoC with cab creation for CVE-2021-40444\nhttps://github.com/lockedbyte/CVE-2021-40444\n]-> https://github.com/Udyz/CVE-2021-40444-Sample/blob/main/poc.html", "creation_timestamp": "2021-09-11T13:27:29.000000Z"}, {"uuid": "450bfed4-b101-4e0d-8a61-8d42e28a406d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4303", "content": "#Blue_Team_Techniques\nMapping and Pivoting from Cobalt Strike C2 Infrastructure Attributed to CVE-2021-40444\nhttps://michaelkoczwara.medium.com/mapping-and-pivoting-cobalt-strike-c2-infrastructure-attributed-to-cve-2021-40444-438786fcd68a", "creation_timestamp": "2021-09-15T11:03:01.000000Z"}, {"uuid": "d54c8f70-e849-412b-bcaa-cfbfdc963065", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4416", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Sep 1-30)\nCVE-2021-40444 - Microsoft MSHTML RCE\nhttps://t.me/cybersecuritytechnologies/4276\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nhttps://t.me/cybersecuritytechnologies/4202\nCVE-2021-22005 - vCenter Server contains - arbitrary file upload\nhttps://t.me/cybersecuritytechnologies/4401\nCVE-2021-30860 - Zero-Click iPhone Exploit\nhttps://t.me/cybersecuritytechnologies/4318\nCVE-2021-38647 - OMIGOD RCE Vuln in Multiple Azure Linux Deployments\nhttps://t.me/cybersecuritytechnologies/4315\nCVE-2021-30632 - Out of bounds write in V8\nhttps://t.me/cybersecuritytechnologies/4342\nCVE-2021-33035 - Code Execution in Apache OpenOffice\nhttps://t.me/cybersecuritytechnologies/4329\nCVE-2021-38112 - AWS WorkSpaces Desktop Client RCE\nhttps://t.me/cybersecuritytechnologies/4358\nCVE-2021-30740 / CVE-2021-30768 - A malicious application may be able to execute arbitrary code with kernel privileges\nhttps://mobile.twitter.com/infinityABCDE/status/1437596340222038017", "creation_timestamp": "2021-10-01T11:01:01.000000Z"}, {"uuid": "3b7d5293-6acc-49d6-9bdf-8d362527e62d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/10767", "content": "#Malware_analysis\n1. InnoSetup Malware\nhttps://asec.ahnlab.com/en/67502\n2. MerkSpy Spyware:  Exploiting CVE-2021-40444 to Infiltrate Systems\nhttps://www.fortinet.com/blog/threat-research/merkspy-exploiting-cve-2021-40444-to-infiltrate-systems", "creation_timestamp": "2024-07-01T15:27:36.000000Z"}, {"uuid": "f6ba53e0-9e2b-4bf3-bd08-8ede1f3782c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "Telegram/2MDyunBXcR_HsSE0q8PYgYVVhJF9rJCOJw8UjsBCVmAhPdI", "content": "", "creation_timestamp": "2021-09-09T16:31:32.000000Z"}, {"uuid": "9e089439-96a4-42a1-8987-bafe15573f37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/cyber0iq/18", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-25T02:14:31.000000Z"}, {"uuid": "c5d31788-c306-4b44-84cf-55ff712373f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/cyber0iq/19", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-25T02:15:23.000000Z"}, {"uuid": "34afb09b-b9d9-49ec-9be9-512e388dce6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/club31337/670", "content": "On CVE-2021-40444, a clear PoC which is called via mhmtl element on 'word/_rels/document.xml.rels' of a modified docx file.\n\n#PoC #cve\n\nhttps://github.com/Udyz/CVE-2021-40444-Sample/blob/main/poc.html", "creation_timestamp": "2024-11-09T01:34:01.000000Z"}, {"uuid": "9da7e9ed-7d85-466f-971d-99afab96ab76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/club31337/675", "content": "CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\n\n#exploit #xpl #CVE\n\nhttps://github.com/klezVirus/CVE-2021-40444", "creation_timestamp": "2024-11-09T01:34:01.000000Z"}, {"uuid": "4694c3ad-b6bb-4e90-b213-418a7e2e1bac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/Rootsec_2/390", "content": "\ud83e\udd37\ud83c\udffc\u200d\u2642\ufe0fCVE-2023-36884 - \u043d\u0435 \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u043a\u0430\u043a\u0430\u044f-\u0442\u043e \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0434\u0430\u043d\u043d\u0430\u044f \u0431\u0430\u0433\u0430 \u0432 Office/Windows HTML \u043f\u043e\u0445\u043e\u0436\u0430 \u043d\u0430 \u0440\u0430\u043d\u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0431\u0430\u0433\u0443 \u0432 Microsoft MSHTML(CVE-2021-40444, RCE), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0442\u043e\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0440\u0430\u043d\u0435\u0435 \u0432 \"\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0439\" \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n\u041d\u0438\u0436\u0435 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e \u0441\u043f\u0438\u0441\u043e\u043a \u0441\u0441\u044b\u043b\u043e\u043a \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c/\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 CVE-2021-40444, \u0434\u043b\u044f \u0442\u0435\u0445 \u043a\u0442\u043e \u0432\u0434\u0440\u0443\u0433 \u0437\u0430\u0431\u044b\u043b:\n\ud83d\udcbeUnpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit\n\ud83d\udcbeAnalyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability\n\ud83d\udcbeCVE-2021-40444 Analysis/Exploit\n\ud83d\udcbeMicrosoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit\n\ud83d\udcbeCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit \n\ud83d\udcbeMalicious docx generator to exploit CVE-2021-40444\n\ud83d\udcbeFull exploit (RCE w/ sandbox escape) only using 6 lines of javascript code(\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043a \u043f\u0440\u043e\u0447\u0442\u0435\u043d\u0438\u044e)", "creation_timestamp": "2024-08-16T08:08:29.000000Z"}, {"uuid": "b80dcd6c-d419-4b85-835a-8abda42ec3f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1610", "content": "CVE-2021-40444 PoC https://github.com/lockedbyte/CVE-2021-40444", "creation_timestamp": "2026-08-03T06:00:02.996641Z"}, {"uuid": "53830dfb-412f-46bb-83d8-790b51d7a66d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1637", "content": "Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/", "creation_timestamp": "2026-08-03T06:00:03.050476Z"}, {"uuid": "e30aa09a-6ae8-464c-b32a-368f03e26a4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1657", "content": "CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit https://github.com/klezVirus/CVE-2021-40444", "creation_timestamp": "2026-08-03T06:06:33.701256Z"}, {"uuid": "1b305dbb-7fc2-44cd-bb87-9656dd2b13c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1599", "content": "Very efficient exploit for CVE-2021-40444. Just 6 lines of JavaScript \ud83d\ude02 https://twitter.com/j00sean/status/1437390861499838466?s=09", "creation_timestamp": "2026-08-03T07:08:45.765445Z"}, {"uuid": "65792e62-5594-4162-8a91-1fa601566b01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1598", "content": "Good write-up >> CVE-2021-40444 Analysis/Exploit https://xret2pwn.github.io/CVE-2021-40444-Analysis-and-Exploit/", "creation_timestamp": "2026-08-03T07:08:45.843147Z"}, {"uuid": "6fd4dd97-477b-4fc5-b71e-f14d7a0fc17c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1607", "content": "Cybersecurity Advisory: Hackers Are Exploiting CVE-2021-40444 https://www.huntress.com/blog/cybersecurity-advisory-hackers-are-exploiting-cve-2021-40444", "creation_timestamp": "2026-08-03T07:10:55.985005Z"}, {"uuid": "8810198f-0a61-4b1b-a179-4e892486ae8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/REDTalk_base/96", "content": "\u041f\u0440\u0438\u0432\u0435\u0442, \u0434\u0440\u0443\u0437\u044c\u044f! \ud83d\udc4b\n\n\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043e\u0442 \u043a\u043e\u043b\u043b\u0435\u0433 \u0438\u0437 Kaspersky \u043e \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u0445 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2024 \u0433\u043e\u0434\u0430.\n\n\u0417\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438: \n\n1\ufe0f\u20e3SQL Injection\n\n2\ufe0f\u20e3Command Injection\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 \u043b\u0438\u0434\u0435\u0440\u044b \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438\u0441\u044c:\n\n1\ufe0f\u20e3Unrestricted Upload of File with Dangerous Type\n\n2\ufe0f\u20e3SQL Injection\n\n3\ufe0f\u20e3Path Traversal\n\n\u0418\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 CVE \u0434\u043b\u044f Windows:\n\n1\ufe0f\u20e3RCE: \n        CVE-2018-0802, CVE-2017-11882 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b ms office\n\n        CVE-2021-40444 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MSHTML\n\n2\ufe0f\u20e3LPE: CVE-2017-0199 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MS office \u0438 WordPad\n\n\u0414\u043b\u044f Linux:\n\n1\ufe0f\u20e3LPE:\n        CVE-2022-0847, CVE-2023-2640 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux\n\n        CVE-2021-4034 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pkexec\n\n\ud83d\ude0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0437\u0434\u0435\u0441\u044c: vulnerability-exploit-report-q2-2024\n\n\u0413\u043b\u0430\u0432\u043d\u043e\u0435, \u0434\u0440\u0443\u0437\u044c\u044f, \u0431\u0435\u0437 \u043f\u0430\u043d\u0438\u043a\u0438 \ud83d\ude0a!  \u0413\u0440\u0430\u043c\u043e\u0442\u043d\u044b\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0441\u0435\u0442\u0438, \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0442\u0447-\u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0437\u0430\u0449\u0438\u0442\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043c \u0418\u0411, \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u0430\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0441\u043f\u043e\u043a\u043e\u0439\u0441\u0442\u0432\u0438\u0435 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c.\n\n\u0412\u0441\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u0438 \u0431\u0443\u0434\u044c\u0442\u0435 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438! \ud83d\udee1\n\n#blueteam", "creation_timestamp": "2026-08-04T13:00:18.619772Z"}, {"uuid": "faef1c95-2d28-4543-b860-cd32978e249c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1602", "content": "Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs https://www.trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html", "creation_timestamp": "2026-08-03T08:00:06.176004Z"}, {"uuid": "9b5f9ad3-ca8f-4216-af4e-f85607b8741c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1598", "content": "Good write-up >> CVE-2021-40444 Analysis/Exploit https://xret2pwn.github.io/CVE-2021-40444-Analysis-and-Exploit/", "creation_timestamp": "2026-08-04T00:00:47.372904Z"}, {"uuid": "b339acc5-6db3-4f2a-a0cb-6b351bc1cccf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1607", "content": "Cybersecurity Advisory: Hackers Are Exploiting CVE-2021-40444 https://www.huntress.com/blog/cybersecurity-advisory-hackers-are-exploiting-cve-2021-40444", "creation_timestamp": "2026-08-04T00:00:47.423657Z"}, {"uuid": "bdeae998-60cd-4235-a5f4-dbee446d6c07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1602", "content": "Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs https://www.trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html", "creation_timestamp": "2026-08-04T00:00:47.475273Z"}, {"uuid": "c29175a1-a143-4f91-a7a6-7d654d182b4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1610", "content": "CVE-2021-40444 PoC https://github.com/lockedbyte/CVE-2021-40444", "creation_timestamp": "2026-08-04T00:00:47.663184Z"}, {"uuid": "3680e856-bfd1-4c61-826f-f05dab70e4ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1637", "content": "Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/", "creation_timestamp": "2026-08-04T00:00:47.708571Z"}, {"uuid": "32e02c42-21ed-48db-8746-a79c717fb97c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1657", "content": "CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit https://github.com/klezVirus/CVE-2021-40444", "creation_timestamp": "2026-08-04T00:00:48.109686Z"}, {"uuid": "ff2ce275-e7fa-4c5d-ab40-016c9b7a205b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1985", "content": "Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/", "creation_timestamp": "2026-08-04T00:00:52.308073Z"}, {"uuid": "ebd85b9d-7c0e-469a-ab9d-d6523a5dde4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/reverseame/1599", "content": "Very efficient exploit for CVE-2021-40444. Just 6 lines of JavaScript \ud83d\ude02 https://twitter.com/j00sean/status/1437390861499838466?s=09", "creation_timestamp": "2026-08-04T01:00:24.066947Z"}, {"uuid": "b33930b5-fd86-4909-b158-ead2804422d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/REDTalk_base/96", "content": "\u041f\u0440\u0438\u0432\u0435\u0442, \u0434\u0440\u0443\u0437\u044c\u044f! \ud83d\udc4b\n\n\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043e\u0442 \u043a\u043e\u043b\u043b\u0435\u0433 \u0438\u0437 Kaspersky \u043e \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u0445 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2024 \u0433\u043e\u0434\u0430.\n\n\u0417\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438: \n\n1\ufe0f\u20e3SQL Injection\n\n2\ufe0f\u20e3Command Injection\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 \u043b\u0438\u0434\u0435\u0440\u044b \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438\u0441\u044c:\n\n1\ufe0f\u20e3Unrestricted Upload of File with Dangerous Type\n\n2\ufe0f\u20e3SQL Injection\n\n3\ufe0f\u20e3Path Traversal\n\n\u0418\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 CVE \u0434\u043b\u044f Windows:\n\n1\ufe0f\u20e3RCE: \n        CVE-2018-0802, CVE-2017-11882 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b ms office\n\n        CVE-2021-40444 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MSHTML\n\n2\ufe0f\u20e3LPE: CVE-2017-0199 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MS office \u0438 WordPad\n\n\u0414\u043b\u044f Linux:\n\n1\ufe0f\u20e3LPE:\n        CVE-2022-0847, CVE-2023-2640 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux\n\n        CVE-2021-4034 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pkexec\n\n\ud83d\ude0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0437\u0434\u0435\u0441\u044c: vulnerability-exploit-report-q2-2024\n\n\u0413\u043b\u0430\u0432\u043d\u043e\u0435, \u0434\u0440\u0443\u0437\u044c\u044f, \u0431\u0435\u0437 \u043f\u0430\u043d\u0438\u043a\u0438 \ud83d\ude0a!  \u0413\u0440\u0430\u043c\u043e\u0442\u043d\u044b\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0441\u0435\u0442\u0438, \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0442\u0447-\u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0437\u0430\u0449\u0438\u0442\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043c \u0418\u0411, \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u0430\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0441\u043f\u043e\u043a\u043e\u0439\u0441\u0442\u0432\u0438\u0435 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c.\n\n\u0412\u0441\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u0438 \u0431\u0443\u0434\u044c\u0442\u0435 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438! \ud83d\udee1\n\n#blueteam", "creation_timestamp": "2026-08-05T00:00:35.095548Z"}, {"uuid": "3d4164c5-a23c-45db-856f-5bbda53ed92d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/toolslounge/64", "content": "zero-day exploit for CVE-2021-40444\nhttps://github.com/lockedbyte/CVE-2021-40444", "creation_timestamp": "2021-09-16T18:45:16.000000Z"}, {"uuid": "77a4922c-5286-4fbc-98cf-4a31979b781d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/onelab1337/2078", "content": "#exploit\n1. Unpacking CVE-2021-40444:\nA Deep Technical Analysis of an Office RCE Exploit\n\ud83d\udd17 See on Billdemirkapi\n\n2. CVE-2021-38000:\nChrome Intents Logic Flaw\n\ud83d\udd17 See on Github\n\nShare and support us \u2764\ufe0f\n@zero0lab", "creation_timestamp": "2026-08-09T04:51:10.900951Z"}, {"uuid": "cc2f4f7f-9fef-4677-9a69-f8aacf97880d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/onelab1337/1386", "content": "https://github.com/Udyz/CVE-2021-40444-Sample", "creation_timestamp": "2026-08-09T05:02:33.079787Z"}, {"uuid": "b7e1951a-032a-4c2d-9403-ca69ee49d9da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/onelab1337/1394", "content": "On CVE-2021-40444, a clear PoC which is called via mhmtl element on 'word/_rels/document.xml.rels' of a modified docx file.\n\n#PoC #cve\n\nhttps://github.com/Udyz/CVE-2021-40444-Sample/blob/main/poc.html\n\nvideo : https://www.youtube.com/watch?v=Oz16xte5UeU", "creation_timestamp": "2026-08-09T05:02:33.120983Z"}, {"uuid": "4d7537cf-6030-4e88-8306-ecd01a7a8afe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/onelab1337/1469", "content": "Microsoft Patch Tuesday fixes CVE-2021-40444 MSHTML zero-day\n\nMicrosoft Patch Tuesday security updates for September 2021 addressed a high severity\u00a0zero-day flaw actively exploited in targeted attacks. Microsoft Patch Tuesday security updates for September 2021 addressed a high severity\u00a0zero-day RCE actively exploited in targeted attacks aimed at Microsoft Office and Office 365 on Windows 10 computers. The flaw, tracked as\u00a0CVE-2021-40444, resides in the MSHTML, [\u2026]\nThe post Microsoft Patch Tuesday fixes CVE-2021-40444 MSHTML zero-day\n\nhttps://securityaffairs.co/wordpress/122224/security/microsoft-patch-tuesday-sept-21.html", "creation_timestamp": "2026-08-09T05:02:32.850270Z"}, {"uuid": "98431187-d210-4dd2-b8f1-25b3acc59c6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/onelab1337/1375", "content": "#threatleak \n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444", "creation_timestamp": "2026-08-09T05:02:33.022497Z"}, {"uuid": "e0896b30-076c-4f10-bf64-4e7923e2d70e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/AOeZvnTwdp-h7vBhVGIe5aWk4Y0OhJzxhwFW4ECiJCOVSTY", "content": "", "creation_timestamp": "2026-08-12T17:00:04.906570Z"}, {"uuid": "d1f9e040-2299-4d12-8b3f-1c76c4c79846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/REDTalk_base/96", "content": "\u041f\u0440\u0438\u0432\u0435\u0442, \u0434\u0440\u0443\u0437\u044c\u044f! \ud83d\udc4b\n\n\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043e\u0442 \u043a\u043e\u043b\u043b\u0435\u0433 \u0438\u0437 Kaspersky \u043e \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u0445 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2024 \u0433\u043e\u0434\u0430.\n\n\u0417\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438: \n\n1\ufe0f\u20e3SQL Injection\n\n2\ufe0f\u20e3Command Injection\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 \u043b\u0438\u0434\u0435\u0440\u044b \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438\u0441\u044c:\n\n1\ufe0f\u20e3Unrestricted Upload of File with Dangerous Type\n\n2\ufe0f\u20e3SQL Injection\n\n3\ufe0f\u20e3Path Traversal\n\n\u0418\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 CVE \u0434\u043b\u044f Windows:\n\n1\ufe0f\u20e3RCE: \n        CVE-2018-0802, CVE-2017-11882 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b ms office\n\n        CVE-2021-40444 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MSHTML\n\n2\ufe0f\u20e3LPE: CVE-2017-0199 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MS office \u0438 WordPad\n\n\u0414\u043b\u044f Linux:\n\n1\ufe0f\u20e3LPE:\n        CVE-2022-0847, CVE-2023-2640 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux\n\n        CVE-2021-4034 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pkexec\n\n\ud83d\ude0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0437\u0434\u0435\u0441\u044c: vulnerability-exploit-report-q2-2024\n\n\u0413\u043b\u0430\u0432\u043d\u043e\u0435, \u0434\u0440\u0443\u0437\u044c\u044f, \u0431\u0435\u0437 \u043f\u0430\u043d\u0438\u043a\u0438 \ud83d\ude0a!  \u0413\u0440\u0430\u043c\u043e\u0442\u043d\u044b\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0441\u0435\u0442\u0438, \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0442\u0447-\u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0437\u0430\u0449\u0438\u0442\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043c \u0418\u0411, \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u0430\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0441\u043f\u043e\u043a\u043e\u0439\u0441\u0442\u0432\u0438\u0435 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c.\n\n\u0412\u0441\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u0438 \u0431\u0443\u0434\u044c\u0442\u0435 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438! \ud83d\udee1\n\n#blueteam", "creation_timestamp": "2026-08-06T00:00:59.451348Z"}, {"uuid": "a4387a65-d3d3-4719-9027-289b710dd9d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/onelab1337/1394", "content": "On CVE-2021-40444, a clear PoC which is called via mhmtl element on 'word/_rels/document.xml.rels' of a modified docx file.\n\n#PoC #cve\n\nhttps://github.com/Udyz/CVE-2021-40444-Sample/blob/main/poc.html\n\nvideo : https://www.youtube.com/watch?v=Oz16xte5UeU", "creation_timestamp": "2026-08-10T00:00:10.672731Z"}, {"uuid": "750965a3-1036-4864-b095-ed918fb0e531", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/onelab1337/1469", "content": "Microsoft Patch Tuesday fixes CVE-2021-40444 MSHTML zero-day\n\nMicrosoft Patch Tuesday security updates for September 2021 addressed a high severity\u00a0zero-day flaw actively exploited in targeted attacks. Microsoft Patch Tuesday security updates for September 2021 addressed a high severity\u00a0zero-day RCE actively exploited in targeted attacks aimed at Microsoft Office and Office 365 on Windows 10 computers. The flaw, tracked as\u00a0CVE-2021-40444, resides in the MSHTML, [\u2026]\nThe post Microsoft Patch Tuesday fixes CVE-2021-40444 MSHTML zero-day\n\nhttps://securityaffairs.co/wordpress/122224/security/microsoft-patch-tuesday-sept-21.html", "creation_timestamp": "2026-08-10T00:00:10.890928Z"}, {"uuid": "2ee60eab-c4a0-4991-877f-f2ad4db07337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/1386", "content": "https://github.com/Udyz/CVE-2021-40444-Sample", "creation_timestamp": "2026-08-10T00:00:10.720189Z"}, {"uuid": "a5c32fb0-42a9-422e-b39c-088658c4b77a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/onelab1337/1375", "content": "#threatleak \n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444", "creation_timestamp": "2026-08-10T00:00:10.758453Z"}, {"uuid": "5718c6c6-13fb-4744-9582-9fff75bdbc5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/2078", "content": "#exploit\n1. Unpacking CVE-2021-40444:\nA Deep Technical Analysis of an Office RCE Exploit\n\ud83d\udd17 See on Billdemirkapi\n\n2. CVE-2021-38000:\nChrome Intents Logic Flaw\n\ud83d\udd17 See on Github\n\nShare and support us \u2764\ufe0f\n@zero0lab", "creation_timestamp": "2026-08-10T00:00:12.673096Z"}, {"uuid": "9e1b109f-fd4c-44e6-9bdb-aa51ea2f3c5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "Telegram/-K1LCqY1zC4TyR7pWLlrXVjJ4Kl-w9syZjodEXfmp9eVsm3u", "content": "", "creation_timestamp": "2022-01-14T13:53:53.000000Z"}, {"uuid": "435153c9-d962-467e-a66e-c91fc6e7ee2e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/14a49a56-2d21-4f5c-a6aa-4712f4bae8b2", "content": "", "creation_timestamp": "2026-06-19T12:47:51.452013Z"}, {"uuid": "9afdbeb7-0635-480f-8a3a-d999deafd92c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/AOeZvnTwdp-h7vBhVGIe5aWk4Y0OhJzxhwFW4ECiJCOVSTY", "content": "", "creation_timestamp": "2026-08-13T00:00:08.235074Z"}, {"uuid": "a02d37df-972a-4bb5-b763-0df6517db702", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c2162eb6-c692-40e4-98fe-4116e3fa768e", "content": "", "creation_timestamp": "2026-06-23T14:04:36.034894Z"}, {"uuid": "609ebf51-c701-496e-9072-dd61e02e8d51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23974", "content": "Black Hat Ethical Hacking\nMicrosoft Patches Actively Exploited Windows Zero-Day Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Patches Actively Exploited Windows Zero-Day BugPost Views: 286 \nReading Time: 2 Minutes\nIn September\u2019s Patch Tuesday\u00a0crop of security fixes, Microsoft released patches for 66 CVEs, three of which are rated critical, and one of which \u2013 the Windows MSHTML zero-day \u2013 has been under active attack for nearly two weeks.\nOne other bug is listed as publicly known but isn\u2019t (yet) being exploited. Immersive Labs\u2019 Kevin Breen, director of cyber threat research, observed that with only one CVE under active attack in the wild, it\u2019s \u201cquite a light Patch Tuesday\u201d \u2013 at least on the surface, that is.\n\nThe flaws were found in Microsoft Windows and Windows components, Microsoft Edge (Chromium, iOS, and Android), Azure, Office and Office Components, SharePoint Server, Microsoft Windows DNS and the Windows Subsystem for Linux.\n\nOf the 66 new CVEs patched today, three are rated critical, 62 are rated important, and one is rated moderate in severity.\n\nOver the past nine months of 2021, this is the seventh month in which Microsoft patched fewer than 100 CVEs, in stark contrast to 2020, when Redmond spent eight months gushing out more than 100 CVE patches per month. But while the overall number of vulnerabilities is lighter, the severity ratings have ticked up, as the Zero Day Initiative\u00a0noted.\n\nSome observers pegged the top patching priority in this month\u2019s batch as being a fix for CVE-2021-40444: An important-rated vulnerability in Microsoft\u2019s MSHTML (Trident) engine that rates 8.8 out of 10 on the CVSS scale.\n\nDisclosed on Sept. 7, it\u2019s a painfully throbbing sore thumb, given that researchers developed a number of proof-of-concept (PoC) exploits showing how drop-dead simple it is to exploit, and attackers have been sharing guides on how to do just that.\nSee Also: Complete Offensive Security and Ethical Hacking Course Under Active Attack: CVE-2021-40444It\u2019s been nearly two weeks since this serious, simple to exploit bug has been under active attack, and it\u2019s been nearly a week since attackers started to share blueprints on how to carry out an exploit.\n\nMicrosoft said last week that the flaw could let an attacker \u201ccraft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine,\u201d after which \u201cthe attacker would then have to convince the user to open the malicious document.\u201d Unfortunately, malicious macro attacks continue to be prevalent: In July, for example, legacy users of Microsoft Excel were being targeted in a malware campaign that used a novel malware-obfuscation technique\u00a0to disable malicious macro warnings and deliver the ZLoader trojan.\n\nAn attacker would need to convince a user to open a specially crafted Microsoft Office document containing the exploit code.\n\nSatnam Narang, staff research engineer at Tenable, noted via email that there have been warnings that this vulnerability will be incorporated into malware payloads and used to distribute ransomware: A solid reason to put the patch at the top of your priority list.\n\n\u201cThere are no indications that this has happened yet, but with the patch now available, organizations should prioritize updating their systems as soon as possible,\u201d Narang told Threatpost.\n\nLast Wednesday, Sept. 8, Kevin Beaumont\u00a0\u2013 head of the security operations center for U.K. fashion retailer Arcadia Group and a past senior threat intelligence analyst at Microsoft \u2013 noted\u00a0that the exploit had been in the wild for about a week or more.\n\nIt got worse: Last Thursday, Sept. 9, threat actors began sharing exploit h[...]", "creation_timestamp": "2026-09-01T20:02:23.080674Z"}, {"uuid": "16034265-1b36-4d06-8b23-056d21731b18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23975", "content": "ow-tos\u00a0and PoCs for the Windows MSHTML zero-day. BleepingComputer gave it a try and found that the guides are \u201csimple to follow and [allow] anyone to create their own working version\u201d of the exploit, \u201cincluding a Python server to distribute the malicious documents and CAB files.\u201d\n\nIt took the publication all of 15 minutes to recreate the exploit.\n\nA week ago, on Tuesday, Sept. 7, Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) had urged mitigations\u00a0of the remote-code execution (RCE) flaw, which is found in all modern Windows operating systems.\n\nLast week, the company didn\u2019t say much about the bug in MSHTML, aka Trident, which is the HTML engine built into Windows since Internet Explorer debuted more than 20 years ago and which allows Windows to read and display HTML files.\n\nMicrosoft did say, however, that it was aware of targeted attacks trying to exploit it via specially crafted Microsoft Office documents.\n\nIn spite of there being no security updates available for the vulnerability at that time, MIcrosoft went ahead and disclosed it, along with mitigations meant to help prevent exploitation.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges Mitigations That Don\u2019t MitigateTracked as CVE-2021-40444, the flaw is serious enough that CISA sent its own advisory, alerting users and administrators and recommending that they use the mitigations and workarounds Microsoft recommended \u2013 mitigations that try to prevent exploitation by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nEmphasis on \u201ctry to:\u201d Unfortunately, those mitigations proved to be less than foolproof, as researchers, including Beaumont, managed to modify the exploit\u00a0so that it didn\u2019t use ActiveX, effectively skirting Microsoft\u2019s mitigations.\n\nThe Zero Day Initiative said that\u00a0for now, the most-effective defense is \u201cto apply the patch and avoid Office docs you aren\u2019t expecting to receive.\u201d\n\nBe sure to carefully review and install all the needed patches\u00a0for your setup: There\u2019s a long list of updates for specific platforms, and it\u2019s important not to slather on too thin a layer of protection.\n\nCredit for finding this bug goes to Rick Cole of MSTIC; Bryce Abdo, Dhanesh Kizhakkinan and Genwei Jiang, all from Mandiant; and Haifei Li of EXPMON. Baddest Bug AwardThe award for baddest bug \u2013 or at least, the one with the highest severity rating, with a CVSS score of 9.8 \u2013 goes to CVE-2021-38647: a critical remote-code execution (RCE) vulnerability in Open Management Infrastructure. OMI is an open-source project\u00a0to further the development of a production-quality implementation of the DMTF CIM/WBEM\u00a0standards.\n\n\u201cThis vulnerability requires no user interaction or privileges, so an attacker can run their code on an affected system just by sending a specially crafted message to an affected system,\u201d the Zero Day Initiatve explained. That makes it high priority: ZDI recommended that OMI users test and deploy this one quickly.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Yet More PrintNightmare PatchesMicrosoft also patched three elevation of privilege vulnerabilities in Windows Print Spooler (CVE-2021-38667, CVE-2021-38671\u00a0and CVE-2021-40447), all rated important.\n\nThese are the three latest fixes in a steady stream\u00a0of patches\u00a0for flaws in Windows Print Spooler that followed the disclosure of PrintNightmare\u00a0in June. This probably won\u2019t be the last patch in that parade: Tenable\u2019s Narang told Threatpost that \u201cresearchers continue to discover ways to exploit Print Spooler\u201d and that the firm expects \u201ccontinued research in this area.\u201d\n\nOnly one \u2013 CVE-2021-38671 \u2013 of today\u2019s patch trio is rated as \u201cexploitation more likely.\u201d Regardless, organizations should prioritize patching these flaws as \u201cthey are extremely valuable to attackers in post-exploitation scenarios,\u201d Narang observed. More \u2018Exploitation More Likely\u2019Immersive\u2019s Breen told Thre[...]", "creation_timestamp": "2026-09-01T20:02:23.126821Z"}, {"uuid": "158f828c-3a41-459c-b151-ae85a284db0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mstcqzfa2l2y", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-40444: Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Wind\u2026\nCVSS 8.8 \u00b7 EPSS 97.5% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2021-40444\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T19:07:18.595777Z"}, {"uuid": "47b2d5ba-fa9d-44e7-aa81-30200d0214af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/pleyades_it/9420", "content": "\u2757\ufe0fEl #ransomware Magniber est\u00e1 aprovechando dos #vulnerabilidades de Internet Explorer (CVE-2021-26411 y CVE-2021-40444)  para infectar dispositivos.\nhttps://bit.ly/3C7xS47", "creation_timestamp": "2026-07-12T22:00:16.447165Z"}, {"uuid": "16c3ebb2-40eb-4973-8b25-76229fd6fa90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/pleyades_it/9420", "content": "\u2757\ufe0fEl #ransomware Magniber est\u00e1 aprovechando dos #vulnerabilidades de Internet Explorer (CVE-2021-26411 y CVE-2021-40444)  para infectar dispositivos.\nhttps://bit.ly/3C7xS47", "creation_timestamp": "2026-07-13T00:00:40.283558Z"}, {"uuid": "7dfff7a2-b7d7-47cf-9fb2-241fdaee806c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/pleyades_it/9420", "content": "\u2757\ufe0fEl #ransomware Magniber est\u00e1 aprovechando dos #vulnerabilidades de Internet Explorer (CVE-2021-26411 y CVE-2021-40444)  para infectar dispositivos.\nhttps://bit.ly/3C7xS47", "creation_timestamp": "2026-07-14T00:00:52.111514Z"}, {"uuid": "93e3484b-220a-4af2-97a0-6ef3cdf8c481", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/bitbaanlab/669", "content": "\u2b55\ufe0f \u0648\u0635\u0644\u0647\u200c\u06cc \u0646\u0627\u0642\u0635 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a | \u0628\u062f\u0627\u0641\u0632\u0627\u0631 Word \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0645\u0627\u06a9\u0631\u0648\n\n\u26a0\ufe0f \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 \u0627\u0645\u0633\u0627\u0644\u060c \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2021-40444 \u0631\u0627 \u06a9\u0647 \u0627\u0645\u06a9\u0627\u0646 \u062f\u0627\u0646\u0644\u0648\u062f CAB \u0648 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u060c \u0648 \u062f\u0631 \u0646\u0647\u0627\u06cc\u062a \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0627 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062f\u0627\u062f \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f.\n\n\ud83d\udd3a\u0627\u0645\u0627 \u0628\u0647 \u0639\u0644\u062a \u0646\u0627\u0642\u0635 \u0628\u0648\u062f\u0646 \u0648\u0635\u0644\u0647\u060c \u0647\u06a9\u0631\u0647\u0627 \u0645\u0648\u0641\u0642 \u0634\u062f\u0646\u062f \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0647\u0645\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0648 \u0627\u0644\u0628\u062a\u0647 \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u060c \u062d\u0645\u0644\u0627\u062a \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u062a\u0631\u062a\u06cc\u0628 \u062f\u0647\u0646\u062f.\n\n\ud83d\udd38 \u0637\u0631\u062d \u06a9\u0644\u06cc \u062d\u0645\u0644\u0647\n\n\u0627\u0631\u0633\u0627\u0644 \u0627\u06cc\u0645\u06cc\u0644 \u062c\u0639\u0644\u06cc \u0628\u0627 \u067e\u06cc\u0648\u0633\u062a \u0641\u0627\u06cc\u0644 RAR > \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u0641\u0627\u06cc\u0644 \u0648\u0631\u062f > \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0627 \u06cc\u06a9 \u0635\u0641\u062d\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062d\u0627\u0648\u06cc \u062c\u0627\u0648\u0627\u0627\u0633\u06a9\u0631\u06cc\u067e\u062a > \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u067e\u0627\u0648\u0631\u0634\u0644 > \u062f\u0627\u0646\u0644\u0648\u062f \u0628\u062f\u0627\u0641\u0632\u0627\u0631\n\n\ud83e\udd16 \u0627\u0639\u0645\u0627\u0644 \u0645\u062e\u0631\u0628 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\n\n\u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0646\u0645\u0648\u0646\u0647\u200c\u0627\u06cc \u0627\u0632 \u062e\u0627\u0646\u0648\u0627\u062f\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc Formbook \u0627\u0633\u062a \u06a9\u0647 \u0627\u0639\u0645\u0627\u0644 \u0645\u062e\u0631\u0628 \u0632\u06cc\u0631 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u062f:\n\n> \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n> \u06af\u0631\u0641\u062a\u0646 \u0627\u0633\u06a9\u0631\u06cc\u0646\u200c\u0634\u0627\u062a\n> \u0636\u0628\u0637 \u0645\u0648\u0627\u0631\u062f \u062a\u0627\u06cc\u067e \u0634\u062f\u0647 (Keystroke logging)\n> \u062f\u0627\u0646\u0644\u0648\u062f \u0648 \u0627\u062c\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 \u0627\u0632 C&C\n\n\ud83c\udf10 \u0631\u0648\u0634 \u062f\u0648\u0631 \u0632\u062f\u0646 \u0648\u0635\u0644\u0647 \u0648 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc", "creation_timestamp": "2026-08-22T14:00:15.556075Z"}, {"uuid": "0abcbde9-f3de-4e39-8a47-4b6b87478aa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/bitbaanlab/669", "content": "\u2b55\ufe0f \u0648\u0635\u0644\u0647\u200c\u06cc \u0646\u0627\u0642\u0635 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a | \u0628\u062f\u0627\u0641\u0632\u0627\u0631 Word \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0645\u0627\u06a9\u0631\u0648\n\n\u26a0\ufe0f \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 \u0627\u0645\u0633\u0627\u0644\u060c \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2021-40444 \u0631\u0627 \u06a9\u0647 \u0627\u0645\u06a9\u0627\u0646 \u062f\u0627\u0646\u0644\u0648\u062f CAB \u0648 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u060c \u0648 \u062f\u0631 \u0646\u0647\u0627\u06cc\u062a \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0627 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062f\u0627\u062f \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f.\n\n\ud83d\udd3a\u0627\u0645\u0627 \u0628\u0647 \u0639\u0644\u062a \u0646\u0627\u0642\u0635 \u0628\u0648\u062f\u0646 \u0648\u0635\u0644\u0647\u060c \u0647\u06a9\u0631\u0647\u0627 \u0645\u0648\u0641\u0642 \u0634\u062f\u0646\u062f \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0647\u0645\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0648 \u0627\u0644\u0628\u062a\u0647 \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u060c \u062d\u0645\u0644\u0627\u062a \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u062a\u0631\u062a\u06cc\u0628 \u062f\u0647\u0646\u062f.\n\n\ud83d\udd38 \u0637\u0631\u062d \u06a9\u0644\u06cc \u062d\u0645\u0644\u0647\n\n\u0627\u0631\u0633\u0627\u0644 \u0627\u06cc\u0645\u06cc\u0644 \u062c\u0639\u0644\u06cc \u0628\u0627 \u067e\u06cc\u0648\u0633\u062a \u0641\u0627\u06cc\u0644 RAR > \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u0641\u0627\u06cc\u0644 \u0648\u0631\u062f > \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0627 \u06cc\u06a9 \u0635\u0641\u062d\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062d\u0627\u0648\u06cc \u062c\u0627\u0648\u0627\u0627\u0633\u06a9\u0631\u06cc\u067e\u062a > \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u067e\u0627\u0648\u0631\u0634\u0644 > \u062f\u0627\u0646\u0644\u0648\u062f \u0628\u062f\u0627\u0641\u0632\u0627\u0631\n\n\ud83e\udd16 \u0627\u0639\u0645\u0627\u0644 \u0645\u062e\u0631\u0628 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\n\n\u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0646\u0645\u0648\u0646\u0647\u200c\u0627\u06cc \u0627\u0632 \u062e\u0627\u0646\u0648\u0627\u062f\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc Formbook \u0627\u0633\u062a \u06a9\u0647 \u0627\u0639\u0645\u0627\u0644 \u0645\u062e\u0631\u0628 \u0632\u06cc\u0631 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u062f:\n\n> \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n> \u06af\u0631\u0641\u062a\u0646 \u0627\u0633\u06a9\u0631\u06cc\u0646\u200c\u0634\u0627\u062a\n> \u0636\u0628\u0637 \u0645\u0648\u0627\u0631\u062f \u062a\u0627\u06cc\u067e \u0634\u062f\u0647 (Keystroke logging)\n> \u062f\u0627\u0646\u0644\u0648\u062f \u0648 \u0627\u062c\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 \u0627\u0632 C&C\n\n\ud83c\udf10 \u0631\u0648\u0634 \u062f\u0648\u0631 \u0632\u062f\u0646 \u0648\u0635\u0644\u0647 \u0648 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc", "creation_timestamp": "2026-08-23T00:00:37.921642Z"}, {"uuid": "9fc59a7e-aeec-41ab-9058-a3664d7d61ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "MISP/c6250a7a-63b1-4996-8734-3ab181e12e3e", "content": "", "creation_timestamp": "2026-07-24T00:15:02.574265Z"}, {"uuid": "dd053302-2afc-4604-950a-910850463b77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/Positive_Technologies/1898", "content": "\ud83d\udc41 \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b PT Expert Security Center \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0443 Dark River, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0443\u044e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u043e-\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0433\u043e MataDoor. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u043c \u043d\u043e\u0432\u043e\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438.\n\n\u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439.\n\n\ud83e\udd77 \u0421\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u043e\u0442\u043b\u0438\u0447\u043d\u043e \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u0442\u0441\u044f: \n\u2022 \u0438\u043c\u0435\u043d\u0430 \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u0445\u043e\u0436\u0438 \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u041f\u041e, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445;\n\u2022 \u0440\u044f\u0434 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0438\u043c\u0435\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0446\u0438\u0444\u0440\u043e\u0432\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c;\n\u2022 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u044b-\u043f\u0440\u043e\u0442\u0435\u043a\u0442\u043e\u0440\u044b, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0435\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437.\n\n\u041d\u0430\u0448\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0434\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 MataDoor \u043f\u043e\u043f\u0430\u043b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u043a\u0443\u0434\u0430 \u0431\u044b\u043b \u0432\u043b\u043e\u0436\u0435\u043d \u0444\u0430\u0439\u043b \u0444\u043e\u0440\u043c\u0430\u0442\u0430 DOCX. \u0412 \u043d\u0435\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430.\n\n\u041f\u043e\u0445\u043e\u0436\u0438\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u041e\u041f\u041a \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435-\u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u0437\u0430 \u0432\u0441\u0435\u043c\u0438 \u0442\u043e\u0447\u0435\u0447\u043d\u044b\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0441\u0442\u043e\u0438\u0442 \u043e\u0434\u043d\u0430 \u0438 \u0442\u0430 \u0436\u0435 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430. \u041c\u044b \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u0435\u0435 Dark River \u2014 \u043f\u043e \u0438\u043c\u0435\u043d\u0438 River, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u043f\u043e\u043b\u0435 \u00ab\u0410\u0432\u0442\u043e\u0440\u00bb \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\ud83d\udcac \u00ab\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0438\u043c\u0435\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443, \u2014 \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u043b \u041c\u0430\u043a\u0441\u0438\u043c \u0410\u043d\u0434\u0440\u0435\u0435\u0432, \u0441\u0442\u0430\u0440\u0448\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043e\u0442\u0434\u0435\u043b\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0418\u0411 Positive Technologies. \u2014 \u042d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e \u043f\u0440\u043e\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441, \u0441 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432 \u043f\u043b\u0430\u043d\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430, \u0441\u043a\u0440\u044b\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b. \u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u0436\u0435 \u0432 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u044f\u0445, \u0432\u044b\u0442\u0430\u0441\u043a\u0438\u0432\u0430\u0442\u044c \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442\u043a\u0443\u0434\u0430 \u0443\u0433\u043e\u0434\u043d\u043e\u00bb.\n\n\ud83d\udd10 \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Positive Technologies \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u0440\u043e\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043c\u0435\u0440\u044b. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 PT Sandbox \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 PT Network Attack Discovery (PT NAD).\n\n@Positive_Technologies\n#Positive\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b", "creation_timestamp": "2026-07-26T07:01:24.061410Z"}, {"uuid": "1c786ecf-59fe-4dea-8848-853961c0b02b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/Positive_Technologies/1898", "content": "\ud83d\udc41 \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b PT Expert Security Center \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0443 Dark River, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0443\u044e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u043e-\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0433\u043e MataDoor. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u043c \u043d\u043e\u0432\u043e\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438.\n\n\u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439.\n\n\ud83e\udd77 \u0421\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u043e\u0442\u043b\u0438\u0447\u043d\u043e \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u0442\u0441\u044f: \n\u2022 \u0438\u043c\u0435\u043d\u0430 \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u0445\u043e\u0436\u0438 \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u041f\u041e, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445;\n\u2022 \u0440\u044f\u0434 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0438\u043c\u0435\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0446\u0438\u0444\u0440\u043e\u0432\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c;\n\u2022 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u044b-\u043f\u0440\u043e\u0442\u0435\u043a\u0442\u043e\u0440\u044b, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0435\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437.\n\n\u041d\u0430\u0448\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0434\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 MataDoor \u043f\u043e\u043f\u0430\u043b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u043a\u0443\u0434\u0430 \u0431\u044b\u043b \u0432\u043b\u043e\u0436\u0435\u043d \u0444\u0430\u0439\u043b \u0444\u043e\u0440\u043c\u0430\u0442\u0430 DOCX. \u0412 \u043d\u0435\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430.\n\n\u041f\u043e\u0445\u043e\u0436\u0438\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u041e\u041f\u041a \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435-\u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u0437\u0430 \u0432\u0441\u0435\u043c\u0438 \u0442\u043e\u0447\u0435\u0447\u043d\u044b\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0441\u0442\u043e\u0438\u0442 \u043e\u0434\u043d\u0430 \u0438 \u0442\u0430 \u0436\u0435 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430. \u041c\u044b \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u0435\u0435 Dark River \u2014 \u043f\u043e \u0438\u043c\u0435\u043d\u0438 River, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u043f\u043e\u043b\u0435 \u00ab\u0410\u0432\u0442\u043e\u0440\u00bb \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\ud83d\udcac \u00ab\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0438\u043c\u0435\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443, \u2014 \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u043b \u041c\u0430\u043a\u0441\u0438\u043c \u0410\u043d\u0434\u0440\u0435\u0435\u0432, \u0441\u0442\u0430\u0440\u0448\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043e\u0442\u0434\u0435\u043b\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0418\u0411 Positive Technologies. \u2014 \u042d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e \u043f\u0440\u043e\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441, \u0441 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432 \u043f\u043b\u0430\u043d\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430, \u0441\u043a\u0440\u044b\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b. \u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u0436\u0435 \u0432 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u044f\u0445, \u0432\u044b\u0442\u0430\u0441\u043a\u0438\u0432\u0430\u0442\u044c \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442\u043a\u0443\u0434\u0430 \u0443\u0433\u043e\u0434\u043d\u043e\u00bb.\n\n\ud83d\udd10 \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Positive Technologies \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u0440\u043e\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043c\u0435\u0440\u044b. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 PT Sandbox \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 PT Network Attack Discovery (PT NAD).\n\n@Positive_Technologies\n#Positive\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b", "creation_timestamp": "2026-07-27T00:01:27.130561Z"}, {"uuid": "1c83153e-6863-43de-919d-cd642c4fe41c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/Positive_Technologies/1898", "content": "\ud83d\udc41 \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b PT Expert Security Center \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0443 Dark River, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0443\u044e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u043e-\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0433\u043e MataDoor. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u043c \u043d\u043e\u0432\u043e\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438.\n\n\u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439.\n\n\ud83e\udd77 \u0421\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u043e\u0442\u043b\u0438\u0447\u043d\u043e \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u0442\u0441\u044f: \n\u2022 \u0438\u043c\u0435\u043d\u0430 \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u0445\u043e\u0436\u0438 \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u041f\u041e, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445;\n\u2022 \u0440\u044f\u0434 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0438\u043c\u0435\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0446\u0438\u0444\u0440\u043e\u0432\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c;\n\u2022 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u044b-\u043f\u0440\u043e\u0442\u0435\u043a\u0442\u043e\u0440\u044b, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0435\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437.\n\n\u041d\u0430\u0448\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0434\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 MataDoor \u043f\u043e\u043f\u0430\u043b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u043a\u0443\u0434\u0430 \u0431\u044b\u043b \u0432\u043b\u043e\u0436\u0435\u043d \u0444\u0430\u0439\u043b \u0444\u043e\u0440\u043c\u0430\u0442\u0430 DOCX. \u0412 \u043d\u0435\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430.\n\n\u041f\u043e\u0445\u043e\u0436\u0438\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u041e\u041f\u041a \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435-\u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u0437\u0430 \u0432\u0441\u0435\u043c\u0438 \u0442\u043e\u0447\u0435\u0447\u043d\u044b\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0441\u0442\u043e\u0438\u0442 \u043e\u0434\u043d\u0430 \u0438 \u0442\u0430 \u0436\u0435 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430. \u041c\u044b \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u0435\u0435 Dark River \u2014 \u043f\u043e \u0438\u043c\u0435\u043d\u0438 River, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u043f\u043e\u043b\u0435 \u00ab\u0410\u0432\u0442\u043e\u0440\u00bb \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\ud83d\udcac \u00ab\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0438\u043c\u0435\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443, \u2014 \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u043b \u041c\u0430\u043a\u0441\u0438\u043c \u0410\u043d\u0434\u0440\u0435\u0435\u0432, \u0441\u0442\u0430\u0440\u0448\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043e\u0442\u0434\u0435\u043b\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0418\u0411 Positive Technologies. \u2014 \u042d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e \u043f\u0440\u043e\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441, \u0441 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432 \u043f\u043b\u0430\u043d\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430, \u0441\u043a\u0440\u044b\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b. \u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u0436\u0435 \u0432 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u044f\u0445, \u0432\u044b\u0442\u0430\u0441\u043a\u0438\u0432\u0430\u0442\u044c \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442\u043a\u0443\u0434\u0430 \u0443\u0433\u043e\u0434\u043d\u043e\u00bb.\n\n\ud83d\udd10 \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Positive Technologies \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u0440\u043e\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043c\u0435\u0440\u044b. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 PT Sandbox \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 PT Network Attack Discovery (PT NAD).\n\n@Positive_Technologies\n#Positive\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b", "creation_timestamp": "2026-07-28T18:00:05.987078Z"}, {"uuid": "ee14125a-1674-404c-b37c-8175a3bf98cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/Positive_Technologies/1898", "content": "\ud83d\udc41 \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b PT Expert Security Center \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0443 Dark River, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0443\u044e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u043e-\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0433\u043e MataDoor. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u043c \u043d\u043e\u0432\u043e\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438.\n\n\u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439.\n\n\ud83e\udd77 \u0421\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u043e\u0442\u043b\u0438\u0447\u043d\u043e \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u0442\u0441\u044f: \n\u2022 \u0438\u043c\u0435\u043d\u0430 \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u0445\u043e\u0436\u0438 \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u041f\u041e, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445;\n\u2022 \u0440\u044f\u0434 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0438\u043c\u0435\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0446\u0438\u0444\u0440\u043e\u0432\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c;\n\u2022 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u044b-\u043f\u0440\u043e\u0442\u0435\u043a\u0442\u043e\u0440\u044b, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u0435\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437.\n\n\u041d\u0430\u0448\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0434\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 MataDoor \u043f\u043e\u043f\u0430\u043b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u043a\u0443\u0434\u0430 \u0431\u044b\u043b \u0432\u043b\u043e\u0436\u0435\u043d \u0444\u0430\u0439\u043b \u0444\u043e\u0440\u043c\u0430\u0442\u0430 DOCX. \u0412 \u043d\u0435\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40444, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430.\n\n\u041f\u043e\u0445\u043e\u0436\u0438\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u041e\u041f\u041a \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435-\u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u0437\u0430 \u0432\u0441\u0435\u043c\u0438 \u0442\u043e\u0447\u0435\u0447\u043d\u044b\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0441\u0442\u043e\u0438\u0442 \u043e\u0434\u043d\u0430 \u0438 \u0442\u0430 \u0436\u0435 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430. \u041c\u044b \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u0435\u0435 Dark River \u2014 \u043f\u043e \u0438\u043c\u0435\u043d\u0438 River, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u043f\u043e\u043b\u0435 \u00ab\u0410\u0432\u0442\u043e\u0440\u00bb \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\ud83d\udcac \u00ab\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0438\u043c\u0435\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443, \u2014 \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u043b \u041c\u0430\u043a\u0441\u0438\u043c \u0410\u043d\u0434\u0440\u0435\u0435\u0432, \u0441\u0442\u0430\u0440\u0448\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043e\u0442\u0434\u0435\u043b\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0418\u0411 Positive Technologies. \u2014 \u042d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e \u043f\u0440\u043e\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441, \u0441 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432 \u043f\u043b\u0430\u043d\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430, \u0441\u043a\u0440\u044b\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b. \u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u0436\u0435 \u0432 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u044f\u0445, \u0432\u044b\u0442\u0430\u0441\u043a\u0438\u0432\u0430\u0442\u044c \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442\u043a\u0443\u0434\u0430 \u0443\u0433\u043e\u0434\u043d\u043e\u00bb.\n\n\ud83d\udd10 \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MataDoor \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Positive Technologies \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u0440\u043e\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043c\u0435\u0440\u044b. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 PT Sandbox \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 PT Network Attack Discovery (PT NAD).\n\n@Positive_Technologies\n#Positive\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b", "creation_timestamp": "2026-07-29T00:00:29.467162Z"}, {"uuid": "1a43def7-fbe6-45fb-8e34-79c646cb9c97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1985", "content": "Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/", "creation_timestamp": "2026-07-29T12:02:49.499589Z"}, {"uuid": "871d4259-60d3-4541-b359-6542f997cb02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1607", "content": "Cybersecurity Advisory: Hackers Are Exploiting CVE-2021-40444 https://www.huntress.com/blog/cybersecurity-advisory-hackers-are-exploiting-cve-2021-40444", "creation_timestamp": "2026-07-29T12:02:53.841139Z"}, {"uuid": "4b3338fd-8f1b-4805-accf-9810710b3d82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1657", "content": "CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit https://github.com/klezVirus/CVE-2021-40444", "creation_timestamp": "2026-07-29T12:02:53.173471Z"}, {"uuid": "758bfbc9-8efe-4184-ab80-09f5fcecfa4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1598", "content": "Good write-up >> CVE-2021-40444 Analysis/Exploit https://xret2pwn.github.io/CVE-2021-40444-Analysis-and-Exploit/", "creation_timestamp": "2026-07-29T12:02:53.894254Z"}, {"uuid": "f8dc0b99-6c83-4b32-a647-067ca35d6b83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1637", "content": "Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/", "creation_timestamp": "2026-07-29T12:02:53.602585Z"}, {"uuid": "558e09da-aeb6-46ef-b24e-6d8423cd8984", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1610", "content": "CVE-2021-40444 PoC https://github.com/lockedbyte/CVE-2021-40444", "creation_timestamp": "2026-07-29T12:02:53.645614Z"}, {"uuid": "b2c8b3ce-95bd-4bdd-bdc2-db3952c7bf90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1602", "content": "Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs https://www.trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html", "creation_timestamp": "2026-07-29T12:02:53.793240Z"}, {"uuid": "2624a28c-2677-4ae9-a9df-5daedb904943", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1599", "content": "Very efficient exploit for CVE-2021-40444. Just 6 lines of JavaScript \ud83d\ude02 https://twitter.com/j00sean/status/1437390861499838466?s=09", "creation_timestamp": "2026-07-29T12:02:53.941923Z"}, {"uuid": "2cd1f28e-7203-404a-b5e9-a96ddfbd3b81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1599", "content": "Very efficient exploit for CVE-2021-40444. Just 6 lines of JavaScript \ud83d\ude02 https://twitter.com/j00sean/status/1437390861499838466?s=09", "creation_timestamp": "2026-07-30T00:02:44.252375Z"}, {"uuid": "c568106a-63ff-4a6b-b35d-07e9231493eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1985", "content": "Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/", "creation_timestamp": "2026-07-30T00:02:40.391448Z"}, {"uuid": "7f77374d-a91e-45b9-89d5-00647e9d8cbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1602", "content": "Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs https://www.trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html", "creation_timestamp": "2026-07-30T00:02:44.124412Z"}, {"uuid": "c11be776-5c8b-4bcb-b658-429657fe9743", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1637", "content": "Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/", "creation_timestamp": "2026-07-30T00:02:43.954361Z"}, {"uuid": "f4723a60-2b9b-4887-9ba1-06c242a99656", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1610", "content": "CVE-2021-40444 PoC https://github.com/lockedbyte/CVE-2021-40444", "creation_timestamp": "2026-07-30T00:02:43.998423Z"}, {"uuid": "767581a6-9f80-427b-b3ec-cb618abc2c58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1607", "content": "Cybersecurity Advisory: Hackers Are Exploiting CVE-2021-40444 https://www.huntress.com/blog/cybersecurity-advisory-hackers-are-exploiting-cve-2021-40444", "creation_timestamp": "2026-07-30T00:02:44.169490Z"}, {"uuid": "a8dce328-1b34-47c8-a7d9-7578955f04ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/reverseame/1598", "content": "Good write-up >> CVE-2021-40444 Analysis/Exploit https://xret2pwn.github.io/CVE-2021-40444-Analysis-and-Exploit/", "creation_timestamp": "2026-07-30T00:02:44.205646Z"}, {"uuid": "96b43f3c-66aa-4b28-8de7-a53e625a9683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/7029", "content": "Cybercriminals are leveraging exploits for CVE-2021-40444 and CVE-2022-30190 to execute code through malicious Word files. Once opened, LokiBot malware is downloaded, logging keystrokes, capturing screenshots, and stealing data.   \nRead: https://thehackernews.com/2023/07/cybercriminals-exploit-microsoft-word.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1402.04.26", "creation_timestamp": "2026-09-01T17:00:19.503458Z"}, {"uuid": "edd77619-5c78-4b6f-8692-527115b44559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/5363", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "creation_timestamp": "2026-09-01T17:00:32.535582Z"}, {"uuid": "5979542e-3a51-4149-af5d-0f2caf30b278", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/5362", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "creation_timestamp": "2026-09-01T17:00:32.847600Z"}, {"uuid": "071e0fa4-3e46-419e-8e30-dd507e54004d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/4310", "content": "As part of an ongoing campaign, cybercriminals are using traffic exchange networks as a broad and fast way to distribute malware (click fraud bots, information stealers, ransomware) disguised as cracked versions of popular applications.\nRead: https://thehackernews.com/2021/09/traffic-exchange-networks-distributing.html\n\nMicrosoft has issued an advisory WARNING its users about a new actively exploited ZERO-DAY vulnerability (CVE-2021-40444 // CVSS score: 8.8) that attackers are using to hijack Windows systems by leveraging weaponized Office documents.\nDetails: https://thehackernews.com/2021/09/new-0-day-attack-targeting-windows.html\n\nHackers exploited a recently disclosed vulnerability in Atlassian's Confluence to break into a Jenkins project infrastructure server.\nhttps://thehackernews.com/2021/09/latest-atlassian-confluence-flaw.html\n\n\"At this time we have no reason to believe that any Jenkins releases, plugins, or source code have been affected\"\nDespite \"no log\" policy, ProtonMail shares an activist's IP address and device type with law enforcement agencies.\nhttps://thehackernews.com/2021/09/protonmail-shares-activists-ip-address.html\nIf Swiss authorities agree to assist foreign agencies, the company has to comply, and it could even be forced to hand over data.", "creation_timestamp": "2026-09-01T17:00:41.003157Z"}, {"uuid": "76de6299-f8d9-49e8-9d48-1193cc01160a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/4361", "content": "WLAN Security\nThe SSID Stripping Vulnerability:\nNew Method for Tricking Users Into Connecting to Rogue APs\ud83d\ude28\nhttps://aireye.tech/2021/09/13/the-ssid-stripping-vulnerability-when-you-dont-see-what-you-get\n]-> PoC for CVE-2021-30800:\nhttps://www.redpacketsecurity.com/cve-2021-30800-apple-multiple-unspecified\n\nBlue Team Techniques\nMapping and Pivoting from Cobalt Strike C2 Infrastructure Attributed to CVE-2021-40444\nhttps://michaelkoczwara.medium.com/mapping-and-pivoting-cobalt-strike-c2-infrastructure-attributed-to-cve-2021-40444-438786fcd68a\n\nOffensive security\nPentesting Active Directory\nhttps://www.xmind.net/m/5dypm8\n\nRed Team Tactics\n1. Kerberoast with ACL abuse capabilities\nhttps://github.com/ShutdownRepo/targetedKerberoast\n2. A collection of Windows print spooler exploits containerized with other utilities for practical exploitation\nhttps://github.com/BeetleChunks/SpoolSploit#create-and-access-the-spoolsploit-docker-container", "creation_timestamp": "2026-09-01T17:00:40.609358Z"}, {"uuid": "fa469e01-20a2-49c1-a914-cbcab1678be8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/4341", "content": "Cloud Security\n1. Azurescape - Cross-Account Container Takeover\nin Azure Container Instances\nhttps://unit42.paloaltonetworks.com/azure-container-instances\n2. IAM Vulnerable - An AWS IAM Privilege Escalation Playground\nhttps://labs.bishopfox.com/tech-blog/iam-vulnerable-an-aws-iam-privilege-escalation-playground\n\nRed Team Tactics\n1. JDBC Connection URL Attack\nhttps://su18.org/post/jdbc-connection-url-attack\n2. IP-Board Stored XSS to RCE Chain\nhttps://ssd-disclosure.com/ssd-advisory-ip-board-stored-xss-to-rce-chain\n3. Attacking Google Chrome's Strict Site Isolation via Speculative Execution and Type Confusion\nhttps://www.spookjs.com\n\nOffensive security\nA proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization\ud83d\ude01\nhttps://github.com/frohoff/ysoserial\n\nexploit\nFull PoC with cab creation for CVE-2021-40444\nhttps://github.com/lockedbyte/CVE-2021-40444\n]-> https://github.com/Udyz/CVE-2021-40444-Sample/blob/main/poc.html", "creation_timestamp": "2026-09-01T17:00:40.932511Z"}, {"uuid": "f2bbd8af-7954-4b6a-9633-59aa7eba1dc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/4344", "content": "0.https://m.youtube.com/watch?v=oM6UaaXJ46I\n\n1. Bypassing GCP Org Policy with Custom Metadata\nhttps://kattraxler.github.io/gcp/hacking/2021/09/10/gcp-org-policy-bypass-ai-notebooks.html\n\n2. Deanonymizing LinkedIn Users\nhttps://blog.h3xstream.com/2021/04/deanonymizing-linkedin-users.html\n// Privacy issues with some of LinkedIn\u2019s external APIs\n\n3.https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/\n\n4. https://github.com/Udyz/CVE-2021-40444-Sample\n\n5. https://thehackernews.com/2021/08/bahraini-activists-targeted-using-new.html?m=1", "creation_timestamp": "2026-09-01T17:00:40.778720Z"}, {"uuid": "4910e747-d905-44f8-abd1-c71fc3238399", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/37922", "content": "Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit\nhttps://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/)   [comments] (https://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:00.820241Z"}, {"uuid": "677b2ae7-61a1-4496-9535-c8447e094cbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/32653", "content": "d makes it easy for anyone to create their own working version of a CVE-2021-40444 exploit, including a Python server that can distribute malicious documents and CAB files to compromised systems.\n\nUsing this info, BleepingComputer\u00a0could also successfully reproduce the exploit in about 15 minutes, as demonstrated in this video demo.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-2-90x90.jpg Microsoft Exchange servers hacked in internal reply-chain attacks3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/slembunk-android-banking-trojan-targets-31-banks-across-the-world-497808-3-90x90.jpg Android malware BrazKing returns as a stealthier banking trojan6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/redcurl-90x90.jpg RedCurl corporate espionage hackers resume attacks with updated tools7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-1-90x90.jpg WordPress sites are being hacked in fake ransomware attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ECS-Instance-Types-90x90.png Alibaba ECS instances actively hijacked by cryptomining malware1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-90x90.jpg QBot returns for a new wave of infections using Squirrelwaffle1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/face-malware-virus-infected-red-network-90x90.jpg BotenaGo botnet targets millions of IoT devices with 33 exploits2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-90x90.jpg Microsoft patches Excel zero-day used in attacks, asks Mac users to wait2 weeks ago\nThe post Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:02:08.444791Z"}, {"uuid": "40ef6b49-bbcf-4ba9-a820-523b336cfae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/32652", "content": "Black Hat Ethical Hacking\nHackers exploit Microsoft MSHTML bug to steal Google, Instagram creds\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers exploit Microsoft MSHTML bug to steal Google, Instagram credsPost Views: 118 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nA newly discovered Iranian threat actor is stealing Google and Instagram credentials belonging to Farsi-speaking targets worldwide using a new PowerShell-based stealer dubbed PowerShortShell by security researchers at SafeBreach Labs.\nThe info stealer is also used for Telegram surveillance and collecting system information from compromised devices that get sent to attacker-controlled servers together with the stolen credentials.\n\nAs SafeBreach Labs discovered, the attacks (publicly reported in September\u00a0on Twitter by the Shadow Chaser Group) started in July as spear-phishing emails.\n\nThey target Windows users with malicious Winword attachments that exploit a Microsoft MSHTML remote code execution (RCE) bug tracked as CVE-2021-40444.\n\nThe PowerShortShell stealer payload is executed by a DLL downloaded on compromised systems. Once launched, the PowerShell script starts collecting data and screen snapshots, exfiltrating it to the attacker\u2019s command-and-control server.\n\n\u201cAlmost half of the victims are located in the United States. Based on the Microsoft Word document content \u2013 which blames Iran\u2019s leader for the \u2018Corona massacre\u2019 and the nature of the collected data, we assume that the victims might be Iranians who live abroad and might be seen as a threat to Iran\u2019s Islamic regime,\u201d said\u00a0Tomer Bar, Director of Security Research at SafeBreach Labs.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cThe adversary might be tied to Iran\u2019s Islamic regime since the Telegram surveillance usage is typical of Iran\u2019s threat actors like Infy, Ferocious Kitten, and Rampant Kitten.\u201d\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Victim_heat_map.png \n<figcaptionVictims heat map (SafeBreach Labs) \nThe CVE-2021-40444 RCE bug impacting IE\u2019s MSTHML rendering engine has been exploited in the wild as a zero-day starting with August 18, more than two weeks before Microsoft issued a security advisory with a partial workaround, and three weeks before a patch was released.\n\nMost recently, it was exploited in conjunction with malicious advertisements by the Magniber ransomware gang\u00a0to infect targets with malware and encrypt their devices. Microsoft also said multiple threat actors, including ransomware affiliates, targeted\u00a0this\u00a0Windows MSHTML\u00a0RCE bug using\u00a0maliciously crafted Office documents delivered via phishing attacks.\nSee Also: New Windows zero-day with public exploit lets you become an admin These attacks abused the CVE-2021-40444 flaw \u201cas part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders.\u201d\n\nThe deployed beacons communicated with malicious infrastructure connected with several cybercrime campaigns, including but not limited to human-operated ransomware.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/CVE-2021-40444-attack-chain%20.png \n<figcaptionCVE-2021-40444 attack-chain (Microsoft)\u200b\u200b\u200b\u200b \nIt\u2019s not surprising that more and more attackers are using CVE-2021-40444 exploits since threat actors started sharing tutorials and proof-of-concept exploits on hacking forums even before the bug was patched.\n\nThis likely allowed other threat actors and groups to start exploiting the security flaw in their own attacks.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools The information shared online is simple to follow an[...]", "creation_timestamp": "2026-09-01T20:02:08.390994Z"}, {"uuid": "c8b74720-dcdd-4dc5-929b-4efb1e5ae71d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/24290", "content": "Exploit Collector\nMicrosoft Windows MSHTML Overview\n\n\nThis article discusses the CVE-2021-40444 vulnerability and an alternative path that reduces the lines of JS code to trigger the issue and does not require CAB archives.\n\nMD5 | adb871524d9737af0fef53123fa0b931\n\nDownload\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:21.870338Z"}, {"uuid": "8b034ebd-eeb7-426a-9c3b-4dbd933275c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23872", "content": "Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog\nhttps://www.reddit.com/r/redteamsec/comments/pp7su1/analyzing_attacks_that_exploit_the_cve202140444/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/)   [comments] (https://www.reddit.com/r/redteamsec/comments/pp7su1/analyzing_attacks_that_exploit_the_cve202140444/)", "creation_timestamp": "2026-09-01T20:02:24.516848Z"}, {"uuid": "a6d9abec-b542-43a4-bb79-d4492038a2f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/25022", "content": "Kali Linux Tutorials\nCVE-2021-40444 PoC : Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nCVE-2021-40444 PoC is a Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nCreation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)\n\nYou need to install lcab first (sudo apt-get install lcab)\n\nCheck REPRODUCE.mdfor manual reproduce steps\n\nIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\n\nUsing\n\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dllwhich just pops a calc.exefrom a call to system()\n\npython3 exploit.py generate test/calc.dll http://<srv\nhttps://1.bp.blogspot.com/-q4Qrx7Kd10w/YUSYEQDTIKI/AAAAAAAAK3w/rWAn8dYhzeo9G7J7CS_SIsi7AHjsGyrAACLcBGAsYHQ/s1007/1.png \nOnce you generate the malicious docx (will be at out/) you can setup the server:\n\nsudo python3 exploit.py host 80\nhttps://1.bp.blogspot.com/-M4bM8mj9wHQ/YUSZE58fPgI/AAAAAAAAK34/yfSeOeg_uPUFIO7r09C6jWuwUp5VJdzyACLcBGAsYHQ/s866/2.png \nFinally try the docx in a Windows Virtual Machine:\nhttps://1.bp.blogspot.com/-W1O2pPuOcdc/YUSZXkgQ8UI/AAAAAAAAK4A/OejDX89jfsEjS6K9u5kHcyYmKCg30TKqwCLcBGAsYHQ/s1473/3.png \n\nDownload", "creation_timestamp": "2026-09-01T20:02:20.799114Z"}, {"uuid": "7521b5e2-a0d3-4a43-92ab-d55ac1d9ad40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23907", "content": "Malicious docx generator (https://www.kitploit.com/search/label/Generator) to exploit CVE-2021-40444 (Microsoft Office Word Remote (https://www.kitploit.com/search/label/Remote) Code Execution)\nCreation of this Script is based on some reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\nUsing\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://", "creation_timestamp": "2026-09-01T20:02:24.074476Z"}, {"uuid": "fec5a7cb-b95c-485e-b742-a2d4ad51c565", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23913", "content": "\u00a0\nDownload CVE-2021-40444 (https://github.com/lockedbyte/CVE-2021-40444)", "creation_timestamp": "2026-09-01T20:02:24.120257Z"}, {"uuid": "6e63f5ae-e4d6-414c-8dea-58e74f72335c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23918", "content": "KitPloit - PenTest Tools!CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution) \n\n\n\n\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\n\n\n\nCreation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)\n\nYou need to install lcab first (sudo apt-get install lcab)\n\nCheck REPRODUCE.mdfor manual reproduce steps\n\nIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\n\nUsing\n\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dllwhich just pops a calc.exefrom a call to system()\n\npython3 exploit.py generate test/calc.dll http://\n\n\n\n\n\n\n\n\n\nOnce you generate the malicious docx (will be at out/) you can setup the server:\n\nsudo python3 exploit.py host 80\n\n\n\n\n\n\n\n\n\nFinally try the docx in a Windows Virtual Machine:\n\n\n\n \n\n\nDownload CVE-2021-40444", "creation_timestamp": "2026-09-01T20:02:24.165019Z"}, {"uuid": "91c26dbc-707b-4d40-a826-6cc39bbaddbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23976", "content": "atpost that a trio of local privilege-escalation vulnerabilities in the Windows Common Log File System Driver (CVE-2021-36955, CVE-2021-36963, CVE-2021-38633) are also noteworthy, all of them being listed as \u201cexploitation more likely.\u201d\n\n\u201cLocal priv-esc vulnerabilities are a key component of almost every successful cyberattack, especially for the likes of ransomware operators who abuse this kind of exploit to gain the highest level of access,\u201d Breen said via email. \u201cThis allows them to disable antivirus, delete backups and ensure their encryptors can reach even the most sensitive of files.\u201d\n\nOne glaring example of that emerged in May, when hundreds of millions of Dell users were found to be at risk\u00a0from kernel-privilege bugs. The bugs lurked undisclosed for 12 years, and could have allowed attackers to bypass security products, execute code and pivot to other parts of the network for lateral movement.\n\nThe three exploits Microsoft patched on Tuesday aren\u2019t remote, meaning that attackers need to have achieved code execution by other means. One such way would be via CVE-2021-40444.\n\nTwo other vulnerabilities \u2013 CVE-2021-38639\u00a0and CVE-2021-36975, both Win32k escalation of privilege flaws \u2013 have also been listed as \u201cexploitation more likely\u201d and, together, cover the full range of supported Windows versions.\n\nBreen said that he\u2019s starting to feel like a broken record when it comes to privilege escalation vulnerabilities. They\u2019re not rated as high a severity risk as RCE bugs, but \u201cthese local exploits can be the linchpin in the post-exploitation phases of an experienced attacker,\u201d he asserted. \u201cIf you can block them here you have the potential to significantly limit their damage.\u201d\n\nhe added, \u201cIf we assume a determined attacker will be able to infect a victim\u2019s device through social engineering or other techniques, I would argue that patching priv-esc vulnerabilities is even more important than patching some other remote code-execution vulns,\u201d Breen said. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerStill, This RCE Is Pretty ImportantDanny Kim, a principal architect at Virsec who spent time at Microsoft during his graduate work on the OS security development team, wants security teams to pay attention to CVE-2021-36965\u00a0\u2013 an important-rated Windows WLAN AutoConfig Service RCE vulnerability \u2013 given its combination of severity (with a CVSS:3.0 base score of 8.8); no requirement for privilege escalation/user interaction to exploit; and breadth of affected Windows versions.\n\nThe WLAN AutoConfig Service is part of the mechanism that Windows 10 uses to choose the wireless network a computer will connect to, and to the Windows Scripting Engine, respectively.\n\nThe patch fixes a flaw that could allow network-adjacent attackers to run their code on affected systems at system level.\n\nAs the Zero Day Initiative explained, that means an attacker could \u201ccompletely take over the target \u2013 provided they are on an adjacent network.\u201d That would come in quite handy in a coffee-shop attack, where multiple people use an unsecured Wi-Fi network.\n\nThis one \u201cis especially alarming,\u201d Kim said: Think SolarWinds\u00a0and PrintNightmare.\n\n\u201cAs recent trends have shown, remote code execution-based attacks are the most critical vulnerabilities that can lead to the largest negative impact on an enterprise, as we have seen in the Solarwinds and PrintNightmare attacks,\u201d he said in an email.\n\nKim said that in spite of the exploit code maturity being currently unproven, the vulnerability has been confirmed to exist, leaving an opening for attackers.\n\n\u201cIt specifically relies on the attacker being located in the same network, so it would not be surprising to see this vulnerability used in combination with another CVE/attack to achieve an attacker\u2019s end goal,\u201d he predicted. \u201cRemote code execution attacks can lead to unverified processes running on the server workload, only highlighting the need for constant, deter[...]", "creation_timestamp": "2026-09-01T20:02:22.759288Z"}, {"uuid": "779b558b-be11-4546-9c2a-9ce4375838cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23879", "content": "Fully Weaponized CVE-2021-40444: Malicious docx generator using arbitrary DLL\nhttps://www.reddit.com/r/redteamsec/comments/ppa935/fully_weaponized_cve202140444_malicious_docx/\n\n  submitted by    /u/0xDangerous_bit  (https://www.reddit.com/user/0xDangerous_bit) \n [link] (https://github.com/klezVirus/CVE-2021-40444)   [comments] (https://www.reddit.com/r/redteamsec/comments/ppa935/fully_weaponized_cve202140444_malicious_docx/)", "creation_timestamp": "2026-09-01T20:02:24.253040Z"}, {"uuid": "61144745-4772-4408-a12d-07e837cb5f9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23903", "content": "CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cabUsingFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://Once you generate the malicious docx (will be at out/) you can setup the server:sudo python3 exploit.py host 80Finally try the docx in a Windows Virtual Machine: Download CVE-2021-40444\nRead more...", "creation_timestamp": "2026-09-01T20:02:24.307401Z"}, {"uuid": "57d7eccb-88ed-4cb4-9f98-787616d91ebd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23905", "content": "CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\nhttp://www.kitploit.com/2021/09/cve-2021-40444-poc-malicious-docx.html", "creation_timestamp": "2026-09-01T20:02:24.353831Z"}, {"uuid": "3193a372-8eef-4ce0-bddc-619ab4117fe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23352", "content": "Malicious docx generator to exploit CVE-2021-40444\nhttps://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/\n\n  submitted by    /u/0xDangerous_bit  (https://www.reddit.com/user/0xDangerous_bit) \n [link] (https://github.com/lockedbyte/CVE-2021-40444)   [comments] (https://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.733559Z"}, {"uuid": "b96cd147-a879-4c0e-ae7e-d0c1b93565c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23538", "content": "Black Hat Ethical Hacking\nWindows MSHTML zero-day exploits shared on hacking forums\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day exploits shared on hacking forumsPost Views: 101 \nReading Time: 2 Minutes\nThreat actors are sharing Windows MSHTML zero-day\u00a0(CVE-2021-40444) tutorials\u00a0and exploits on hacking forums, allowing other hackers to start exploiting the new vulnerability in their own attacks.\nLast Tuesday, Microsoft disclosed a new zero-day vulnerability in Windows MSHTML\u00a0that allows threat actors to create malicious documents, including Office and RTF docs, to execute commands on a victim\u2019s computer remotely.\n\nEven though there are no security updates available for the CVE-2021-40444 vulnerability, as it was discovered used in active attacks by EXPMON\u00a0and Mandiant, Microsoft decided to disclose the vulnerability and provide mitigations to help prevent its exploitation.\n\nThese mitigations work by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nHowever, researchers have been able to modify the exploit\u00a0not to use ActiveX, effectively bypassing Microsoft\u2019s mitigations. Guides and PoCs shared on hacking forumsWhen Microsoft first disclosed the Windows MSHTML zero-day, tracked as CVE-2021-40444, security researchers quickly found the malicious documents used in attacks.\n\nWhile they soon reproduced the exploits, modified\u00a0them for further capabilities, and discovered a new document preview vector, the researchers did not disclose details for fear other threat actors would abuse it.\n\nUnfortunately, threat actors have been able to reproduce the exploit on their own from information, and malicious document samples posted online and have begun sharing detailed guides and information on hacking forums.\n\nStarting on Thursday, threat actors began sharing public information about the HTML component of the exploit and how to create the malicious document. On Friday, more instructions were posted on generating the payload and a CAB file that included the path traversal vulnerability component.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/forum-post.jpg \nDefending against the CVE-2021-40444 MSHTML vulnerability The good news is that since the vulnerability was disclosed, Microsoft Defender and other security programs can detect and block malicious documents and CAB files used in this attack.\n\nFor example, you can see below Microsoft Defender blocking the exploit as\u00a0\u2018Trojan:Win32/CplLoader.a\u2019 and \u2018TrojanDownloader:HTML/Donoff.SA\u2019 detections.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/defender-detecting.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.779422Z"}, {"uuid": "da56e52b-a874-43e8-ae2a-ebefddd96248", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23539", "content": "e following mitigations to block ActiveX controls in Internet Explorer, the default handler for the MSHTML protocol, and block document preview in Windows Explorer. Disable ActiveX controls in Internet ExplorerTo disable ActiveX controls, please follow these steps:\n\n1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled\u00a0to properly create the Registry file.\n\n \nAlternatively, you can download the registry file from here. Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3]\n\"1001\"=dword:00000003\n\"1004\"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a\u00a0UAC prompt is displayed, click on the Yes\u00a0button to import the Registry entries.\n3. Reboot your computer to apply the new configuration.\n\nOnce you reboot your computer, ActiveX controls will be disabled in Internet Explorer.\n\nYou can enable ActiveX controls again by deleting the above Registry keys or using this Registry file.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Disable document preview in Windows ExplorerSecurity researchers have also found that this vulnerability can be exploited by viewing a malicious document using the Windows Explorer preview feature.\nCVE-2021-40444 is so bad\ud83e\udd26\u200d\u2642\ufe0f pic.twitter.com/3Gu9ahwmHd\n\n\u2014 jq0904 (@jq0904) September 10, 2021\nSince this was discovered, Microsoft has added the following mitigation to disable previewing of RTF and Word documents:\n\n1. In the Registry Editor (regedit.exe), navigate to the appropriate registry key: \nFor Word documents, navigate to these keys:\n\n* HKEY_CLASSES_ROOT.docx\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.doc\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.docm\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\nFor rich text files (RTF), navigate to this key:\n\n* HKEY_CLASSES_ROOT.rtf\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\n2. Export a copy of the Registry key as a backup.\n3. Now double-click Name\u00a0and in the Edit String\u00a0dialog box, delete the Value Data.\n4. Click OK, See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWord document and RTF file previews are now disabled in Windows Explorer.\n\nTo enable Windows Explorer preview for these documents, double-click on the backup .reg file you created in step 2 above.\n\nWhile these mitigations will help, as the exploit has been modified not to use ActiveX controls, users are still at risk until an official security update is released.\n\nUntil Microsoft releases a security update, everyone should treat all Word and RTF attachments suspiciously and their source manually verified before opening them.\nSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.826823Z"}, {"uuid": "d913d87c-353b-42ac-98ac-4e65b25f245f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23248", "content": "Black Hat Ethical Hacking\nWindows MSHTML zero-day defenses bypassed as new info emerges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day defenses bypassed as new info emergesPost Views: 39 \nReading Time: 1 Minute\nThis Internet Explorer MSHTML remote code execution vulnerability, tracked as CVE-2021-40444, was disclosed by Microsoft on Tuesday\u00a0but with few details as it has not been patched yet.\nThe only information shared by Microsoft was that the vulnerability uses malicious ActiveX controls to exploit Office 365 and Office 2019 on Windows 10 to download and install malware on an affected computer.\n\nSince then, researchers have found the malicious Word documents used in the attacks and have learned new information about how the vulnerability is exploited. Why the\u00a0CVE-2021-40444 zero-day is so criticalSince the release of this vulnerability, security researchers have taken to Twitter to warn how dangerous it is even though Microsoft Office\u2019s \u2018Protected View\u2019 feature will block the exploit.\n\nWhen Office opens a document it checks if it is tagged with a \u201cMark of the Web\u201d (MoTW), which means it originated from the Internet.\n\nIf this tag exists, Microsoft will open the document in read-only mode, effectively blocking the exploit unless a user clicks on the \u2018Enable Editing\u2019 buttons.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/protected-view-maldoc.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.873200Z"}, {"uuid": "dc1bc458-bb7d-47f0-ac41-5ecf75fabd00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23249", "content": "ility.\n\nWith these bypasses and additional use cases, CVE-2021-40444 has become even more severe than initially thought. How CVE-2021-40444 is currently used in attacksWhile we do not have the actual phishing emails used in the attacks, Beaumont has analyzed the malicious Word document to understand better how the exploit works.\nLooks like this has been in the wild for a week or more.  Uses the daft as F feature that allows Word to load a template from internet, that spawns IE and then trusts JS and ActiveX controls, then uses ../.. (yes it's 1999) to spawn .cpl file https://t.co/mOvaN9YLj6 pic.twitter.com/xLf2jVWyY5\n\n\u2014 Kevin Beaumont (@GossiTheDog) September 8, 2021\nSee Also: Offensive Security Tool: Pegasus Spyware \u2013 Decompiled One of the known malicious Word attachments used in the attacks is named \u2018A Letter before court 4.docx\u2019 [VirusTotal] and claims to be a letter from an attorney.\n\nSince the file was downloaded from the Internet, it will be tagged with the \u2018Mark of the Web\u2019 and opened in Protected View, as shown below.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/malicious-word-document.jpg \nSee Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hackerhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/side_html-file.jpg \n(Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.920103Z"}, {"uuid": "56fb58c9-0f32-4d7d-9604-b4cc6d8f0815", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23137", "content": "Black Hat Ethical Hacking\nMicrosoft shares temp fix for ongoing Office 365 zero-day attacks\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft shares temp fix for ongoing Office 365 zero-day attacksPost Views: 83 \nReading Time: 1 Minute\nMicrosoft shared yesterday a mitigation for\u00a0a remote code execution vulnerability in Windows that is being exploited in targeted attacks against Office 365 and Office 2019 on Windows 10.\nThe flaw is in MSHTML, the browser rendering engine that is also used by Microsoft Office documents. Ongoing attacks against Office 365Identified as CVE-2021-40444, the security issue affects Windows Server 2008 through 2019 and Windows 8.1 through 10 and has a severity level of 8.8 out of the maximum 10.\n\nMicrosoft is aware of targeted attacks that try to exploit the vulnerability by sending specially-crafted Microsoft Office documents to potential victims, the company says in an advisory\u00a0today.\n\u201cAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document\u201d \u2013 Microsoft\nHowever, the attack is thwarted if Microsoft Office runs with the default configuration, where documents from the web are opened in Protected View mode or Application Guard for Office 365.\n\nProtected View is a read-only mode that has most of the editing functions disabled, while Application Guard isolates untrusted documents, denying them access to corporate resources, the intranet, or other files on the system.\n\nSystems with active Microsoft\u2019s Defender Antivirus and Defender for Endpoint (build 1.349.22.0 and above) benefit from protection against attempts to exploit CVE-2021-40444.\n\nMicrosoft\u2019s enterprise security platform will display alerts about this attack as \u201cSuspicious Cpl File Execution.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Researchers from multiple cybersecurity companies are credited for finding and reporting the vulnerability: Haifei Li of EXPMON, Dhanesh Kizhakkinan, Bryce Abdo, and Genwei Jiang \u2013 all three\u00a0of Mandiant, and Rick Cole of Microsoft Security Intelligence.\n\nIn a tweet today, EXPMON (exploit monitor)\u00a0says that they found the vulnerability after detecting a \u201chighly sophisticated zero-day attack\u201d aimed at Microsoft Office users.\nhttps://www.bleepstatic.com/images/news/u/1100723/2021/EXPMONBug-40444.jpg \n<figcaptionsource: EXPMON \nEXPMON researchers reproduced the attack on the latest\u00a0Office 2019 / Office 365 on Windows 10.\n\nIn a reply to BleepingComputer, Haifei Li\u00a0of EXPMON said that the attackers used a .DOCX file. Upon opening it, the document loaded the Internet Explorer engine to render a remote web page from the threat actor.\n\nMalware is then downloaded by using a specific ActiveX control in the web page. Executing the threat is done using \u201ca trick called \u2018Cpl File Execution\u2019,\u201d referenced in Microsoft\u2019s advisory.\n\nThe researcher told us that the attack method is 100% reliable, which makes it very dangerous. He reported the vulnerability\u00a0to Microsoft early Sunday morning.\nSee Also: Bluetooth Bugs Open Billions of Devices to DoS, Code Execution Workaround for CVE-2021-40444 zero-day attacksAs there is no security update available at this time, Microsoft has provided the following workaround \u2013 disable the installation of all ActiveX controls in Internet Explorer.\n\nA Windows registry update ensures that ActiveX is rendered inactive for all sites, while already available ActiveX controls will keep functioning.\n\nUsers should save the file below with the .REG extension and execute it t[...]", "creation_timestamp": "2026-09-01T20:02:25.021128Z"}, {"uuid": "08c9c03c-b7fc-4ffb-9130-b4f617dda2a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23138", "content": "o apply it to the Policy hive. After a system reboot, the new configuration should be applied.\n\nAs updates are not available yet for the CVE-2021-40444, they have released the following workaround that prevents ActiveX controls from running in Internet Explorer and applications that embed the browser.\n\nTo disable ActiveX controls, please follow these steps:\n\n1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled\u00a0to properly create the Registry file.\n\n \nAlternatively, you can download the registry file from here. Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3]\n\"1001\"=dword:00000003\n\"1004\"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a\u00a0UAC prompt is displayed, click on the Yes\u00a0button to import the Registry entries.\n\n3. Reboot your computer to apply the new configuration.\nSee Also: Offensive Security Tool: Pegasus Spyware \u2013 Decompiled Once you reboot your computer, ActiveX controls will be disabled in Internet Explorer.\n\nWhen Microsoft provides\u00a0an official security update for this vulnerability, you can remove this temporary Registry fix by manually deleting the created Registry keys.\n\nAlternatively, you can utilize this reg file\u00a0to automatically delete the entries.\n\nUpdate: Added comment received after publication from Haifei Li of EXPMON, one of the researchers that reported the vulnerability to Microsoft. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_plugin_vuln-90x90.jpg Gutenberg Template Library & Redux Framework Bugs Plague WordPress Sites1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ransomware-cpu-90x90.jpg LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Windows-Abstract-90x90.jpg Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/F5-Big-IP-e1619725870974-90x90.jpg F5 Bug Could Lead to Complete System Takeover2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/steel-series-e1629915533369-90x90.jpg Win10 Admin Rights Tossed Off by Yet Another Plug-In2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/white-pegasus-e1626804896117-90x90.jpg Pegasus Spyware Uses iPhone Zero-Click iMessage Zero-Day2 weeks ago\nstyle=\"displa[...]", "creation_timestamp": "2026-09-01T20:02:25.069467Z"}, {"uuid": "5653cb08-eb8d-4ee0-a36a-87ee65753242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/37922", "content": "Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit\nhttps://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/)   [comments] (https://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:22.736397Z"}, {"uuid": "f34ac01b-955f-4e3a-ba2e-1d2eb38e9c87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/32652", "content": "Black Hat Ethical Hacking\nHackers exploit Microsoft MSHTML bug to steal Google, Instagram creds\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers exploit Microsoft MSHTML bug to steal Google, Instagram credsPost Views: 118 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nA newly discovered Iranian threat actor is stealing Google and Instagram credentials belonging to Farsi-speaking targets worldwide using a new PowerShell-based stealer dubbed PowerShortShell by security researchers at SafeBreach Labs.\nThe info stealer is also used for Telegram surveillance and collecting system information from compromised devices that get sent to attacker-controlled servers together with the stolen credentials.\n\nAs SafeBreach Labs discovered, the attacks (publicly reported in September\u00a0on Twitter by the Shadow Chaser Group) started in July as spear-phishing emails.\n\nThey target Windows users with malicious Winword attachments that exploit a Microsoft MSHTML remote code execution (RCE) bug tracked as CVE-2021-40444.\n\nThe PowerShortShell stealer payload is executed by a DLL downloaded on compromised systems. Once launched, the PowerShell script starts collecting data and screen snapshots, exfiltrating it to the attacker\u2019s command-and-control server.\n\n\u201cAlmost half of the victims are located in the United States. Based on the Microsoft Word document content \u2013 which blames Iran\u2019s leader for the \u2018Corona massacre\u2019 and the nature of the collected data, we assume that the victims might be Iranians who live abroad and might be seen as a threat to Iran\u2019s Islamic regime,\u201d said\u00a0Tomer Bar, Director of Security Research at SafeBreach Labs.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cThe adversary might be tied to Iran\u2019s Islamic regime since the Telegram surveillance usage is typical of Iran\u2019s threat actors like Infy, Ferocious Kitten, and Rampant Kitten.\u201d\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Victim_heat_map.png \n<figcaptionVictims heat map (SafeBreach Labs) \nThe CVE-2021-40444 RCE bug impacting IE\u2019s MSTHML rendering engine has been exploited in the wild as a zero-day starting with August 18, more than two weeks before Microsoft issued a security advisory with a partial workaround, and three weeks before a patch was released.\n\nMost recently, it was exploited in conjunction with malicious advertisements by the Magniber ransomware gang\u00a0to infect targets with malware and encrypt their devices. Microsoft also said multiple threat actors, including ransomware affiliates, targeted\u00a0this\u00a0Windows MSHTML\u00a0RCE bug using\u00a0maliciously crafted Office documents delivered via phishing attacks.\nSee Also: New Windows zero-day with public exploit lets you become an admin These attacks abused the CVE-2021-40444 flaw \u201cas part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders.\u201d\n\nThe deployed beacons communicated with malicious infrastructure connected with several cybercrime campaigns, including but not limited to human-operated ransomware.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/CVE-2021-40444-attack-chain%20.png \n<figcaptionCVE-2021-40444 attack-chain (Microsoft)\u200b\u200b\u200b\u200b \nIt\u2019s not surprising that more and more attackers are using CVE-2021-40444 exploits since threat actors started sharing tutorials and proof-of-concept exploits on hacking forums even before the bug was patched.\n\nThis likely allowed other threat actors and groups to start exploiting the security flaw in their own attacks.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools The information shared online is simple to follow an[...]", "creation_timestamp": "2026-09-02T01:02:33.919112Z"}, {"uuid": "cfbdf2ec-74c2-4afb-bdcb-42fa0548aa68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/32653", "content": "d makes it easy for anyone to create their own working version of a CVE-2021-40444 exploit, including a Python server that can distribute malicious documents and CAB files to compromised systems.\n\nUsing this info, BleepingComputer\u00a0could also successfully reproduce the exploit in about 15 minutes, as demonstrated in this video demo.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-2-90x90.jpg Microsoft Exchange servers hacked in internal reply-chain attacks3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/slembunk-android-banking-trojan-targets-31-banks-across-the-world-497808-3-90x90.jpg Android malware BrazKing returns as a stealthier banking trojan6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/redcurl-90x90.jpg RedCurl corporate espionage hackers resume attacks with updated tools7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-1-90x90.jpg WordPress sites are being hacked in fake ransomware attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ECS-Instance-Types-90x90.png Alibaba ECS instances actively hijacked by cryptomining malware1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-90x90.jpg QBot returns for a new wave of infections using Squirrelwaffle1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/face-malware-virus-infected-red-network-90x90.jpg BotenaGo botnet targets millions of IoT devices with 33 exploits2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-90x90.jpg Microsoft patches Excel zero-day used in attacks, asks Mac users to wait2 weeks ago\nThe post Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:02:33.975006Z"}, {"uuid": "ec726696-e1af-4db4-bf79-1f45c1cf9495", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23138", "content": "o apply it to the Policy hive. After a system reboot, the new configuration should be applied.\n\nAs updates are not available yet for the CVE-2021-40444, they have released the following workaround that prevents ActiveX controls from running in Internet Explorer and applications that embed the browser.\n\nTo disable ActiveX controls, please follow these steps:\n\n1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled\u00a0to properly create the Registry file.\n\n \nAlternatively, you can download the registry file from here. Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3]\n\"1001\"=dword:00000003\n\"1004\"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a\u00a0UAC prompt is displayed, click on the Yes\u00a0button to import the Registry entries.\n\n3. Reboot your computer to apply the new configuration.\nSee Also: Offensive Security Tool: Pegasus Spyware \u2013 Decompiled Once you reboot your computer, ActiveX controls will be disabled in Internet Explorer.\n\nWhen Microsoft provides\u00a0an official security update for this vulnerability, you can remove this temporary Registry fix by manually deleting the created Registry keys.\n\nAlternatively, you can utilize this reg file\u00a0to automatically delete the entries.\n\nUpdate: Added comment received after publication from Haifei Li of EXPMON, one of the researchers that reported the vulnerability to Microsoft. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_plugin_vuln-90x90.jpg Gutenberg Template Library & Redux Framework Bugs Plague WordPress Sites1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ransomware-cpu-90x90.jpg LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Windows-Abstract-90x90.jpg Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/F5-Big-IP-e1619725870974-90x90.jpg F5 Bug Could Lead to Complete System Takeover2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/steel-series-e1629915533369-90x90.jpg Win10 Admin Rights Tossed Off by Yet Another Plug-In2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/white-pegasus-e1626804896117-90x90.jpg Pegasus Spyware Uses iPhone Zero-Click iMessage Zero-Day2 weeks ago\nstyle=\"displa[...]", "creation_timestamp": "2026-09-02T01:02:56.888081Z"}, {"uuid": "0b386a10-521e-476d-93c2-eaedf0a3257f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23974", "content": "Black Hat Ethical Hacking\nMicrosoft Patches Actively Exploited Windows Zero-Day Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Patches Actively Exploited Windows Zero-Day BugPost Views: 286 \nReading Time: 2 Minutes\nIn September\u2019s Patch Tuesday\u00a0crop of security fixes, Microsoft released patches for 66 CVEs, three of which are rated critical, and one of which \u2013 the Windows MSHTML zero-day \u2013 has been under active attack for nearly two weeks.\nOne other bug is listed as publicly known but isn\u2019t (yet) being exploited. Immersive Labs\u2019 Kevin Breen, director of cyber threat research, observed that with only one CVE under active attack in the wild, it\u2019s \u201cquite a light Patch Tuesday\u201d \u2013 at least on the surface, that is.\n\nThe flaws were found in Microsoft Windows and Windows components, Microsoft Edge (Chromium, iOS, and Android), Azure, Office and Office Components, SharePoint Server, Microsoft Windows DNS and the Windows Subsystem for Linux.\n\nOf the 66 new CVEs patched today, three are rated critical, 62 are rated important, and one is rated moderate in severity.\n\nOver the past nine months of 2021, this is the seventh month in which Microsoft patched fewer than 100 CVEs, in stark contrast to 2020, when Redmond spent eight months gushing out more than 100 CVE patches per month. But while the overall number of vulnerabilities is lighter, the severity ratings have ticked up, as the Zero Day Initiative\u00a0noted.\n\nSome observers pegged the top patching priority in this month\u2019s batch as being a fix for CVE-2021-40444: An important-rated vulnerability in Microsoft\u2019s MSHTML (Trident) engine that rates 8.8 out of 10 on the CVSS scale.\n\nDisclosed on Sept. 7, it\u2019s a painfully throbbing sore thumb, given that researchers developed a number of proof-of-concept (PoC) exploits showing how drop-dead simple it is to exploit, and attackers have been sharing guides on how to do just that.\nSee Also: Complete Offensive Security and Ethical Hacking Course Under Active Attack: CVE-2021-40444It\u2019s been nearly two weeks since this serious, simple to exploit bug has been under active attack, and it\u2019s been nearly a week since attackers started to share blueprints on how to carry out an exploit.\n\nMicrosoft said last week that the flaw could let an attacker \u201ccraft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine,\u201d after which \u201cthe attacker would then have to convince the user to open the malicious document.\u201d Unfortunately, malicious macro attacks continue to be prevalent: In July, for example, legacy users of Microsoft Excel were being targeted in a malware campaign that used a novel malware-obfuscation technique\u00a0to disable malicious macro warnings and deliver the ZLoader trojan.\n\nAn attacker would need to convince a user to open a specially crafted Microsoft Office document containing the exploit code.\n\nSatnam Narang, staff research engineer at Tenable, noted via email that there have been warnings that this vulnerability will be incorporated into malware payloads and used to distribute ransomware: A solid reason to put the patch at the top of your priority list.\n\n\u201cThere are no indications that this has happened yet, but with the patch now available, organizations should prioritize updating their systems as soon as possible,\u201d Narang told Threatpost.\n\nLast Wednesday, Sept. 8, Kevin Beaumont\u00a0\u2013 head of the security operations center for U.K. fashion retailer Arcadia Group and a past senior threat intelligence analyst at Microsoft \u2013 noted\u00a0that the exploit had been in the wild for about a week or more.\n\nIt got worse: Last Thursday, Sept. 9, threat actors began sharing exploit h[...]", "creation_timestamp": "2026-09-02T01:02:53.036456Z"}, {"uuid": "ee3a573c-0a83-46f0-9c0e-c004b661c647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23975", "content": "ow-tos\u00a0and PoCs for the Windows MSHTML zero-day. BleepingComputer gave it a try and found that the guides are \u201csimple to follow and [allow] anyone to create their own working version\u201d of the exploit, \u201cincluding a Python server to distribute the malicious documents and CAB files.\u201d\n\nIt took the publication all of 15 minutes to recreate the exploit.\n\nA week ago, on Tuesday, Sept. 7, Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) had urged mitigations\u00a0of the remote-code execution (RCE) flaw, which is found in all modern Windows operating systems.\n\nLast week, the company didn\u2019t say much about the bug in MSHTML, aka Trident, which is the HTML engine built into Windows since Internet Explorer debuted more than 20 years ago and which allows Windows to read and display HTML files.\n\nMicrosoft did say, however, that it was aware of targeted attacks trying to exploit it via specially crafted Microsoft Office documents.\n\nIn spite of there being no security updates available for the vulnerability at that time, MIcrosoft went ahead and disclosed it, along with mitigations meant to help prevent exploitation.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges Mitigations That Don\u2019t MitigateTracked as CVE-2021-40444, the flaw is serious enough that CISA sent its own advisory, alerting users and administrators and recommending that they use the mitigations and workarounds Microsoft recommended \u2013 mitigations that try to prevent exploitation by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nEmphasis on \u201ctry to:\u201d Unfortunately, those mitigations proved to be less than foolproof, as researchers, including Beaumont, managed to modify the exploit\u00a0so that it didn\u2019t use ActiveX, effectively skirting Microsoft\u2019s mitigations.\n\nThe Zero Day Initiative said that\u00a0for now, the most-effective defense is \u201cto apply the patch and avoid Office docs you aren\u2019t expecting to receive.\u201d\n\nBe sure to carefully review and install all the needed patches\u00a0for your setup: There\u2019s a long list of updates for specific platforms, and it\u2019s important not to slather on too thin a layer of protection.\n\nCredit for finding this bug goes to Rick Cole of MSTIC; Bryce Abdo, Dhanesh Kizhakkinan and Genwei Jiang, all from Mandiant; and Haifei Li of EXPMON. Baddest Bug AwardThe award for baddest bug \u2013 or at least, the one with the highest severity rating, with a CVSS score of 9.8 \u2013 goes to CVE-2021-38647: a critical remote-code execution (RCE) vulnerability in Open Management Infrastructure. OMI is an open-source project\u00a0to further the development of a production-quality implementation of the DMTF CIM/WBEM\u00a0standards.\n\n\u201cThis vulnerability requires no user interaction or privileges, so an attacker can run their code on an affected system just by sending a specially crafted message to an affected system,\u201d the Zero Day Initiatve explained. That makes it high priority: ZDI recommended that OMI users test and deploy this one quickly.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Yet More PrintNightmare PatchesMicrosoft also patched three elevation of privilege vulnerabilities in Windows Print Spooler (CVE-2021-38667, CVE-2021-38671\u00a0and CVE-2021-40447), all rated important.\n\nThese are the three latest fixes in a steady stream\u00a0of patches\u00a0for flaws in Windows Print Spooler that followed the disclosure of PrintNightmare\u00a0in June. This probably won\u2019t be the last patch in that parade: Tenable\u2019s Narang told Threatpost that \u201cresearchers continue to discover ways to exploit Print Spooler\u201d and that the firm expects \u201ccontinued research in this area.\u201d\n\nOnly one \u2013 CVE-2021-38671 \u2013 of today\u2019s patch trio is rated as \u201cexploitation more likely.\u201d Regardless, organizations should prioritize patching these flaws as \u201cthey are extremely valuable to attackers in post-exploitation scenarios,\u201d Narang observed. More \u2018Exploitation More Likely\u2019Immersive\u2019s Breen told Thre[...]", "creation_timestamp": "2026-09-02T01:02:53.074297Z"}, {"uuid": "2526edec-07f6-4679-9367-317db66038c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23907", "content": "Malicious docx generator (https://www.kitploit.com/search/label/Generator) to exploit CVE-2021-40444 (Microsoft Office Word Remote (https://www.kitploit.com/search/label/Remote) Code Execution)\nCreation of this Script is based on some reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\nUsing\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://", "creation_timestamp": "2026-09-02T01:02:55.319278Z"}, {"uuid": "7ec8dd4b-9dac-416d-bf7e-733486faf605", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23913", "content": "\u00a0\nDownload CVE-2021-40444 (https://github.com/lockedbyte/CVE-2021-40444)", "creation_timestamp": "2026-09-02T01:02:55.358156Z"}, {"uuid": "2068f465-7a67-44ba-9618-afb22df8da97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23918", "content": "KitPloit - PenTest Tools!CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution) \n\n\n\n\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\n\n\n\nCreation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)\n\nYou need to install lcab first (sudo apt-get install lcab)\n\nCheck REPRODUCE.mdfor manual reproduce steps\n\nIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\n\nUsing\n\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dllwhich just pops a calc.exefrom a call to system()\n\npython3 exploit.py generate test/calc.dll http://\n\n\n\n\n\n\n\n\n\nOnce you generate the malicious docx (will be at out/) you can setup the server:\n\nsudo python3 exploit.py host 80\n\n\n\n\n\n\n\n\n\nFinally try the docx in a Windows Virtual Machine:\n\n\n\n \n\n\nDownload CVE-2021-40444", "creation_timestamp": "2026-09-02T01:02:55.396194Z"}, {"uuid": "6eaf1c54-6301-44ca-94ce-e451d952c948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23879", "content": "Fully Weaponized CVE-2021-40444: Malicious docx generator using arbitrary DLL\nhttps://www.reddit.com/r/redteamsec/comments/ppa935/fully_weaponized_cve202140444_malicious_docx/\n\n  submitted by    /u/0xDangerous_bit  (https://www.reddit.com/user/0xDangerous_bit) \n [link] (https://github.com/klezVirus/CVE-2021-40444)   [comments] (https://www.reddit.com/r/redteamsec/comments/ppa935/fully_weaponized_cve202140444_malicious_docx/)", "creation_timestamp": "2026-09-02T01:02:55.470096Z"}, {"uuid": "caecd44b-af06-405e-8ba6-df25adddf104", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23903", "content": "CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cabUsingFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://Once you generate the malicious docx (will be at out/) you can setup the server:sudo python3 exploit.py host 80Finally try the docx in a Windows Virtual Machine: Download CVE-2021-40444\nRead more...", "creation_timestamp": "2026-09-02T01:02:56.075619Z"}, {"uuid": "54353cd7-f3ca-4ab5-a2ed-316d890c45fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23905", "content": "CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\nhttp://www.kitploit.com/2021/09/cve-2021-40444-poc-malicious-docx.html", "creation_timestamp": "2026-09-02T01:02:56.118535Z"}, {"uuid": "cd5ef83d-538d-40e6-88b0-f8e853abb4ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/24290", "content": "Exploit Collector\nMicrosoft Windows MSHTML Overview\n\n\nThis article discusses the CVE-2021-40444 vulnerability and an alternative path that reduces the lines of JS code to trigger the issue and does not require CAB archives.\n\nMD5 | adb871524d9737af0fef53123fa0b931\n\nDownload\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:50.550224Z"}, {"uuid": "ae94d1b2-f6f7-4297-8057-8415100691c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/25022", "content": "Kali Linux Tutorials\nCVE-2021-40444 PoC : Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nCVE-2021-40444 PoC is a Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nCreation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)\n\nYou need to install lcab first (sudo apt-get install lcab)\n\nCheck REPRODUCE.mdfor manual reproduce steps\n\nIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\n\nUsing\n\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dllwhich just pops a calc.exefrom a call to system()\n\npython3 exploit.py generate test/calc.dll http://<srv\nhttps://1.bp.blogspot.com/-q4Qrx7Kd10w/YUSYEQDTIKI/AAAAAAAAK3w/rWAn8dYhzeo9G7J7CS_SIsi7AHjsGyrAACLcBGAsYHQ/s1007/1.png \nOnce you generate the malicious docx (will be at out/) you can setup the server:\n\nsudo python3 exploit.py host 80\nhttps://1.bp.blogspot.com/-M4bM8mj9wHQ/YUSZE58fPgI/AAAAAAAAK34/yfSeOeg_uPUFIO7r09C6jWuwUp5VJdzyACLcBGAsYHQ/s866/2.png \nFinally try the docx in a Windows Virtual Machine:\nhttps://1.bp.blogspot.com/-W1O2pPuOcdc/YUSZXkgQ8UI/AAAAAAAAK4A/OejDX89jfsEjS6K9u5kHcyYmKCg30TKqwCLcBGAsYHQ/s1473/3.png \n\nDownload", "creation_timestamp": "2026-09-02T01:02:50.136064Z"}, {"uuid": "e1bb1afd-a77b-422e-b714-6148859622a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23872", "content": "Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog\nhttps://www.reddit.com/r/redteamsec/comments/pp7su1/analyzing_attacks_that_exploit_the_cve202140444/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/)   [comments] (https://www.reddit.com/r/redteamsec/comments/pp7su1/analyzing_attacks_that_exploit_the_cve202140444/)", "creation_timestamp": "2026-09-02T01:02:56.281178Z"}, {"uuid": "ac8c0bd0-e080-48ec-b28a-5fe10d649f51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23352", "content": "Malicious docx generator to exploit CVE-2021-40444\nhttps://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/\n\n  submitted by    /u/0xDangerous_bit  (https://www.reddit.com/user/0xDangerous_bit) \n [link] (https://github.com/lockedbyte/CVE-2021-40444)   [comments] (https://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:56.525354Z"}, {"uuid": "d1f6829a-c08c-4c41-848c-8a728f459857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23538", "content": "Black Hat Ethical Hacking\nWindows MSHTML zero-day exploits shared on hacking forums\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day exploits shared on hacking forumsPost Views: 101 \nReading Time: 2 Minutes\nThreat actors are sharing Windows MSHTML zero-day\u00a0(CVE-2021-40444) tutorials\u00a0and exploits on hacking forums, allowing other hackers to start exploiting the new vulnerability in their own attacks.\nLast Tuesday, Microsoft disclosed a new zero-day vulnerability in Windows MSHTML\u00a0that allows threat actors to create malicious documents, including Office and RTF docs, to execute commands on a victim\u2019s computer remotely.\n\nEven though there are no security updates available for the CVE-2021-40444 vulnerability, as it was discovered used in active attacks by EXPMON\u00a0and Mandiant, Microsoft decided to disclose the vulnerability and provide mitigations to help prevent its exploitation.\n\nThese mitigations work by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nHowever, researchers have been able to modify the exploit\u00a0not to use ActiveX, effectively bypassing Microsoft\u2019s mitigations. Guides and PoCs shared on hacking forumsWhen Microsoft first disclosed the Windows MSHTML zero-day, tracked as CVE-2021-40444, security researchers quickly found the malicious documents used in attacks.\n\nWhile they soon reproduced the exploits, modified\u00a0them for further capabilities, and discovered a new document preview vector, the researchers did not disclose details for fear other threat actors would abuse it.\n\nUnfortunately, threat actors have been able to reproduce the exploit on their own from information, and malicious document samples posted online and have begun sharing detailed guides and information on hacking forums.\n\nStarting on Thursday, threat actors began sharing public information about the HTML component of the exploit and how to create the malicious document. On Friday, more instructions were posted on generating the payload and a CAB file that included the path traversal vulnerability component.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/forum-post.jpg \nDefending against the CVE-2021-40444 MSHTML vulnerability The good news is that since the vulnerability was disclosed, Microsoft Defender and other security programs can detect and block malicious documents and CAB files used in this attack.\n\nFor example, you can see below Microsoft Defender blocking the exploit as\u00a0\u2018Trojan:Win32/CplLoader.a\u2019 and \u2018TrojanDownloader:HTML/Donoff.SA\u2019 detections.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/defender-detecting.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:56.577772Z"}, {"uuid": "33090cf5-a513-48bf-841d-d0a7771a5097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23539", "content": "e following mitigations to block ActiveX controls in Internet Explorer, the default handler for the MSHTML protocol, and block document preview in Windows Explorer. Disable ActiveX controls in Internet ExplorerTo disable ActiveX controls, please follow these steps:\n\n1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled\u00a0to properly create the Registry file.\n\n \nAlternatively, you can download the registry file from here. Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3]\n\"1001\"=dword:00000003\n\"1004\"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a\u00a0UAC prompt is displayed, click on the Yes\u00a0button to import the Registry entries.\n3. Reboot your computer to apply the new configuration.\n\nOnce you reboot your computer, ActiveX controls will be disabled in Internet Explorer.\n\nYou can enable ActiveX controls again by deleting the above Registry keys or using this Registry file.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Disable document preview in Windows ExplorerSecurity researchers have also found that this vulnerability can be exploited by viewing a malicious document using the Windows Explorer preview feature.\nCVE-2021-40444 is so bad\ud83e\udd26\u200d\u2642\ufe0f pic.twitter.com/3Gu9ahwmHd\n\n\u2014 jq0904 (@jq0904) September 10, 2021\nSince this was discovered, Microsoft has added the following mitigation to disable previewing of RTF and Word documents:\n\n1. In the Registry Editor (regedit.exe), navigate to the appropriate registry key: \nFor Word documents, navigate to these keys:\n\n* HKEY_CLASSES_ROOT.docx\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.doc\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.docm\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\nFor rich text files (RTF), navigate to this key:\n\n* HKEY_CLASSES_ROOT.rtf\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\n2. Export a copy of the Registry key as a backup.\n3. Now double-click Name\u00a0and in the Edit String\u00a0dialog box, delete the Value Data.\n4. Click OK, See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWord document and RTF file previews are now disabled in Windows Explorer.\n\nTo enable Windows Explorer preview for these documents, double-click on the backup .reg file you created in step 2 above.\n\nWhile these mitigations will help, as the exploit has been modified not to use ActiveX controls, users are still at risk until an official security update is released.\n\nUntil Microsoft releases a security update, everyone should treat all Word and RTF attachments suspiciously and their source manually verified before opening them.\nSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:56.624498Z"}, {"uuid": "95d49383-1cbc-4672-bbc8-dbe133b498b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23976", "content": "atpost that a trio of local privilege-escalation vulnerabilities in the Windows Common Log File System Driver (CVE-2021-36955, CVE-2021-36963, CVE-2021-38633) are also noteworthy, all of them being listed as \u201cexploitation more likely.\u201d\n\n\u201cLocal priv-esc vulnerabilities are a key component of almost every successful cyberattack, especially for the likes of ransomware operators who abuse this kind of exploit to gain the highest level of access,\u201d Breen said via email. \u201cThis allows them to disable antivirus, delete backups and ensure their encryptors can reach even the most sensitive of files.\u201d\n\nOne glaring example of that emerged in May, when hundreds of millions of Dell users were found to be at risk\u00a0from kernel-privilege bugs. The bugs lurked undisclosed for 12 years, and could have allowed attackers to bypass security products, execute code and pivot to other parts of the network for lateral movement.\n\nThe three exploits Microsoft patched on Tuesday aren\u2019t remote, meaning that attackers need to have achieved code execution by other means. One such way would be via CVE-2021-40444.\n\nTwo other vulnerabilities \u2013 CVE-2021-38639\u00a0and CVE-2021-36975, both Win32k escalation of privilege flaws \u2013 have also been listed as \u201cexploitation more likely\u201d and, together, cover the full range of supported Windows versions.\n\nBreen said that he\u2019s starting to feel like a broken record when it comes to privilege escalation vulnerabilities. They\u2019re not rated as high a severity risk as RCE bugs, but \u201cthese local exploits can be the linchpin in the post-exploitation phases of an experienced attacker,\u201d he asserted. \u201cIf you can block them here you have the potential to significantly limit their damage.\u201d\n\nhe added, \u201cIf we assume a determined attacker will be able to infect a victim\u2019s device through social engineering or other techniques, I would argue that patching priv-esc vulnerabilities is even more important than patching some other remote code-execution vulns,\u201d Breen said. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerStill, This RCE Is Pretty ImportantDanny Kim, a principal architect at Virsec who spent time at Microsoft during his graduate work on the OS security development team, wants security teams to pay attention to CVE-2021-36965\u00a0\u2013 an important-rated Windows WLAN AutoConfig Service RCE vulnerability \u2013 given its combination of severity (with a CVSS:3.0 base score of 8.8); no requirement for privilege escalation/user interaction to exploit; and breadth of affected Windows versions.\n\nThe WLAN AutoConfig Service is part of the mechanism that Windows 10 uses to choose the wireless network a computer will connect to, and to the Windows Scripting Engine, respectively.\n\nThe patch fixes a flaw that could allow network-adjacent attackers to run their code on affected systems at system level.\n\nAs the Zero Day Initiative explained, that means an attacker could \u201ccompletely take over the target \u2013 provided they are on an adjacent network.\u201d That would come in quite handy in a coffee-shop attack, where multiple people use an unsecured Wi-Fi network.\n\nThis one \u201cis especially alarming,\u201d Kim said: Think SolarWinds\u00a0and PrintNightmare.\n\n\u201cAs recent trends have shown, remote code execution-based attacks are the most critical vulnerabilities that can lead to the largest negative impact on an enterprise, as we have seen in the Solarwinds and PrintNightmare attacks,\u201d he said in an email.\n\nKim said that in spite of the exploit code maturity being currently unproven, the vulnerability has been confirmed to exist, leaving an opening for attackers.\n\n\u201cIt specifically relies on the attacker being located in the same network, so it would not be surprising to see this vulnerability used in combination with another CVE/attack to achieve an attacker\u2019s end goal,\u201d he predicted. \u201cRemote code execution attacks can lead to unverified processes running on the server workload, only highlighting the need for constant, deter[...]", "creation_timestamp": "2026-09-02T01:02:52.781338Z"}, {"uuid": "416f347a-5b66-4998-83ae-dba66c33d0ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23248", "content": "Black Hat Ethical Hacking\nWindows MSHTML zero-day defenses bypassed as new info emerges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day defenses bypassed as new info emergesPost Views: 39 \nReading Time: 1 Minute\nThis Internet Explorer MSHTML remote code execution vulnerability, tracked as CVE-2021-40444, was disclosed by Microsoft on Tuesday\u00a0but with few details as it has not been patched yet.\nThe only information shared by Microsoft was that the vulnerability uses malicious ActiveX controls to exploit Office 365 and Office 2019 on Windows 10 to download and install malware on an affected computer.\n\nSince then, researchers have found the malicious Word documents used in the attacks and have learned new information about how the vulnerability is exploited. Why the\u00a0CVE-2021-40444 zero-day is so criticalSince the release of this vulnerability, security researchers have taken to Twitter to warn how dangerous it is even though Microsoft Office\u2019s \u2018Protected View\u2019 feature will block the exploit.\n\nWhen Office opens a document it checks if it is tagged with a \u201cMark of the Web\u201d (MoTW), which means it originated from the Internet.\n\nIf this tag exists, Microsoft will open the document in read-only mode, effectively blocking the exploit unless a user clicks on the \u2018Enable Editing\u2019 buttons.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/protected-view-maldoc.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:56.679249Z"}, {"uuid": "0b4166c3-1632-44be-8fde-b839ba039b71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23249", "content": "ility.\n\nWith these bypasses and additional use cases, CVE-2021-40444 has become even more severe than initially thought. How CVE-2021-40444 is currently used in attacksWhile we do not have the actual phishing emails used in the attacks, Beaumont has analyzed the malicious Word document to understand better how the exploit works.\nLooks like this has been in the wild for a week or more.  Uses the daft as F feature that allows Word to load a template from internet, that spawns IE and then trusts JS and ActiveX controls, then uses ../.. (yes it's 1999) to spawn .cpl file https://t.co/mOvaN9YLj6 pic.twitter.com/xLf2jVWyY5\n\n\u2014 Kevin Beaumont (@GossiTheDog) September 8, 2021\nSee Also: Offensive Security Tool: Pegasus Spyware \u2013 Decompiled One of the known malicious Word attachments used in the attacks is named \u2018A Letter before court 4.docx\u2019 [VirusTotal] and claims to be a letter from an attorney.\n\nSince the file was downloaded from the Internet, it will be tagged with the \u2018Mark of the Web\u2019 and opened in Protected View, as shown below.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/malicious-word-document.jpg \nSee Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hackerhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/side_html-file.jpg \n(Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:56.731507Z"}, {"uuid": "737a1c2c-a2a3-43a4-8014-936d34de0ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23137", "content": "Black Hat Ethical Hacking\nMicrosoft shares temp fix for ongoing Office 365 zero-day attacks\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft shares temp fix for ongoing Office 365 zero-day attacksPost Views: 83 \nReading Time: 1 Minute\nMicrosoft shared yesterday a mitigation for\u00a0a remote code execution vulnerability in Windows that is being exploited in targeted attacks against Office 365 and Office 2019 on Windows 10.\nThe flaw is in MSHTML, the browser rendering engine that is also used by Microsoft Office documents. Ongoing attacks against Office 365Identified as CVE-2021-40444, the security issue affects Windows Server 2008 through 2019 and Windows 8.1 through 10 and has a severity level of 8.8 out of the maximum 10.\n\nMicrosoft is aware of targeted attacks that try to exploit the vulnerability by sending specially-crafted Microsoft Office documents to potential victims, the company says in an advisory\u00a0today.\n\u201cAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document\u201d \u2013 Microsoft\nHowever, the attack is thwarted if Microsoft Office runs with the default configuration, where documents from the web are opened in Protected View mode or Application Guard for Office 365.\n\nProtected View is a read-only mode that has most of the editing functions disabled, while Application Guard isolates untrusted documents, denying them access to corporate resources, the intranet, or other files on the system.\n\nSystems with active Microsoft\u2019s Defender Antivirus and Defender for Endpoint (build 1.349.22.0 and above) benefit from protection against attempts to exploit CVE-2021-40444.\n\nMicrosoft\u2019s enterprise security platform will display alerts about this attack as \u201cSuspicious Cpl File Execution.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Researchers from multiple cybersecurity companies are credited for finding and reporting the vulnerability: Haifei Li of EXPMON, Dhanesh Kizhakkinan, Bryce Abdo, and Genwei Jiang \u2013 all three\u00a0of Mandiant, and Rick Cole of Microsoft Security Intelligence.\n\nIn a tweet today, EXPMON (exploit monitor)\u00a0says that they found the vulnerability after detecting a \u201chighly sophisticated zero-day attack\u201d aimed at Microsoft Office users.\nhttps://www.bleepstatic.com/images/news/u/1100723/2021/EXPMONBug-40444.jpg \n<figcaptionsource: EXPMON \nEXPMON researchers reproduced the attack on the latest\u00a0Office 2019 / Office 365 on Windows 10.\n\nIn a reply to BleepingComputer, Haifei Li\u00a0of EXPMON said that the attackers used a .DOCX file. Upon opening it, the document loaded the Internet Explorer engine to render a remote web page from the threat actor.\n\nMalware is then downloaded by using a specific ActiveX control in the web page. Executing the threat is done using \u201ca trick called \u2018Cpl File Execution\u2019,\u201d referenced in Microsoft\u2019s advisory.\n\nThe researcher told us that the attack method is 100% reliable, which makes it very dangerous. He reported the vulnerability\u00a0to Microsoft early Sunday morning.\nSee Also: Bluetooth Bugs Open Billions of Devices to DoS, Code Execution Workaround for CVE-2021-40444 zero-day attacksAs there is no security update available at this time, Microsoft has provided the following workaround \u2013 disable the installation of all ActiveX controls in Internet Explorer.\n\nA Windows registry update ensures that ActiveX is rendered inactive for all sites, while already available ActiveX controls will keep functioning.\n\nUsers should save the file below with the .REG extension and execute it t[...]", "creation_timestamp": "2026-09-02T01:02:56.833926Z"}, {"uuid": "e9335ce0-a7e5-485a-bce3-34b00267f450", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/7029", "content": "Cybercriminals are leveraging exploits for CVE-2021-40444 and CVE-2022-30190 to execute code through malicious Word files. Once opened, LokiBot malware is downloaded, logging keystrokes, capturing screenshots, and stealing data.   \nRead: https://thehackernews.com/2023/07/cybercriminals-exploit-microsoft-word.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1402.04.26", "creation_timestamp": "2026-09-02T01:03:58.315837Z"}, {"uuid": "e6a595fe-858e-495a-aa3f-c02e1a0f34d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/4344", "content": "0.https://m.youtube.com/watch?v=oM6UaaXJ46I\n\n1. Bypassing GCP Org Policy with Custom Metadata\nhttps://kattraxler.github.io/gcp/hacking/2021/09/10/gcp-org-policy-bypass-ai-notebooks.html\n\n2. Deanonymizing LinkedIn Users\nhttps://blog.h3xstream.com/2021/04/deanonymizing-linkedin-users.html\n// Privacy issues with some of LinkedIn\u2019s external APIs\n\n3.https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/\n\n4. https://github.com/Udyz/CVE-2021-40444-Sample\n\n5. https://thehackernews.com/2021/08/bahraini-activists-targeted-using-new.html?m=1", "creation_timestamp": "2026-09-02T01:04:26.367161Z"}, {"uuid": "607a8a5d-979f-4fe6-823d-3eb5b2dea2ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/5362", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "creation_timestamp": "2026-09-02T01:04:15.689728Z"}, {"uuid": "8aa3d44b-e418-43a1-a165-9369b77f79d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/5363", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "creation_timestamp": "2026-09-02T01:04:14.695347Z"}, {"uuid": "0ed7543f-d125-4c6b-b49e-bec58ded7d68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/4361", "content": "WLAN Security\nThe SSID Stripping Vulnerability:\nNew Method for Tricking Users Into Connecting to Rogue APs\ud83d\ude28\nhttps://aireye.tech/2021/09/13/the-ssid-stripping-vulnerability-when-you-dont-see-what-you-get\n]-> PoC for CVE-2021-30800:\nhttps://www.redpacketsecurity.com/cve-2021-30800-apple-multiple-unspecified\n\nBlue Team Techniques\nMapping and Pivoting from Cobalt Strike C2 Infrastructure Attributed to CVE-2021-40444\nhttps://michaelkoczwara.medium.com/mapping-and-pivoting-cobalt-strike-c2-infrastructure-attributed-to-cve-2021-40444-438786fcd68a\n\nOffensive security\nPentesting Active Directory\nhttps://www.xmind.net/m/5dypm8\n\nRed Team Tactics\n1. Kerberoast with ACL abuse capabilities\nhttps://github.com/ShutdownRepo/targetedKerberoast\n2. A collection of Windows print spooler exploits containerized with other utilities for practical exploitation\nhttps://github.com/BeetleChunks/SpoolSploit#create-and-access-the-spoolsploit-docker-container", "creation_timestamp": "2026-09-02T01:04:26.112757Z"}, {"uuid": "f6aeefd4-4dd7-4afc-b0b2-39ec2b452cbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/4341", "content": "Cloud Security\n1. Azurescape - Cross-Account Container Takeover\nin Azure Container Instances\nhttps://unit42.paloaltonetworks.com/azure-container-instances\n2. IAM Vulnerable - An AWS IAM Privilege Escalation Playground\nhttps://labs.bishopfox.com/tech-blog/iam-vulnerable-an-aws-iam-privilege-escalation-playground\n\nRed Team Tactics\n1. JDBC Connection URL Attack\nhttps://su18.org/post/jdbc-connection-url-attack\n2. IP-Board Stored XSS to RCE Chain\nhttps://ssd-disclosure.com/ssd-advisory-ip-board-stored-xss-to-rce-chain\n3. Attacking Google Chrome's Strict Site Isolation via Speculative Execution and Type Confusion\nhttps://www.spookjs.com\n\nOffensive security\nA proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization\ud83d\ude01\nhttps://github.com/frohoff/ysoserial\n\nexploit\nFull PoC with cab creation for CVE-2021-40444\nhttps://github.com/lockedbyte/CVE-2021-40444\n]-> https://github.com/Udyz/CVE-2021-40444-Sample/blob/main/poc.html", "creation_timestamp": "2026-09-02T01:04:26.601186Z"}, {"uuid": "5856bf69-87b2-4bcc-afb4-bb28cb00d2a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/4310", "content": "As part of an ongoing campaign, cybercriminals are using traffic exchange networks as a broad and fast way to distribute malware (click fraud bots, information stealers, ransomware) disguised as cracked versions of popular applications.\nRead: https://thehackernews.com/2021/09/traffic-exchange-networks-distributing.html\n\nMicrosoft has issued an advisory WARNING its users about a new actively exploited ZERO-DAY vulnerability (CVE-2021-40444 // CVSS score: 8.8) that attackers are using to hijack Windows systems by leveraging weaponized Office documents.\nDetails: https://thehackernews.com/2021/09/new-0-day-attack-targeting-windows.html\n\nHackers exploited a recently disclosed vulnerability in Atlassian's Confluence to break into a Jenkins project infrastructure server.\nhttps://thehackernews.com/2021/09/latest-atlassian-confluence-flaw.html\n\n\"At this time we have no reason to believe that any Jenkins releases, plugins, or source code have been affected\"\nDespite \"no log\" policy, ProtonMail shares an activist's IP address and device type with law enforcement agencies.\nhttps://thehackernews.com/2021/09/protonmail-shares-activists-ip-address.html\nIf Swiss authorities agree to assist foreign agencies, the company has to comply, and it could even be forced to hand over data.", "creation_timestamp": "2026-09-02T01:04:26.673916Z"}, {"uuid": "bd949b9a-0d52-49b7-8bdf-4724cfe71595", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/37922", "content": "Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit\nhttps://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/)   [comments] (https://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T16:00:05.496367Z"}, {"uuid": "eb21b396-c1e9-4678-9651-8f1739e703ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/37922", "content": "Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit\nhttps://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/)   [comments] (https://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:09.963729Z"}, {"uuid": "faadcff6-b560-4f4c-bc33-28ec28e89eca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/32653", "content": "d makes it easy for anyone to create their own working version of a CVE-2021-40444 exploit, including a Python server that can distribute malicious documents and CAB files to compromised systems.\n\nUsing this info, BleepingComputer\u00a0could also successfully reproduce the exploit in about 15 minutes, as demonstrated in this video demo.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-2-90x90.jpg Microsoft Exchange servers hacked in internal reply-chain attacks3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/slembunk-android-banking-trojan-targets-31-banks-across-the-world-497808-3-90x90.jpg Android malware BrazKing returns as a stealthier banking trojan6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/redcurl-90x90.jpg RedCurl corporate espionage hackers resume attacks with updated tools7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-1-90x90.jpg WordPress sites are being hacked in fake ransomware attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ECS-Instance-Types-90x90.png Alibaba ECS instances actively hijacked by cryptomining malware1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-90x90.jpg QBot returns for a new wave of infections using Squirrelwaffle1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/face-malware-virus-infected-red-network-90x90.jpg BotenaGo botnet targets millions of IoT devices with 33 exploits2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-90x90.jpg Microsoft patches Excel zero-day used in attacks, asks Mac users to wait2 weeks ago\nThe post Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-07T03:00:45.781026Z"}, {"uuid": "0df58ca3-a1b9-4cf1-9b28-ff7d29766d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/32652", "content": "Black Hat Ethical Hacking\nHackers exploit Microsoft MSHTML bug to steal Google, Instagram creds\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers exploit Microsoft MSHTML bug to steal Google, Instagram credsPost Views: 118 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nA newly discovered Iranian threat actor is stealing Google and Instagram credentials belonging to Farsi-speaking targets worldwide using a new PowerShell-based stealer dubbed PowerShortShell by security researchers at SafeBreach Labs.\nThe info stealer is also used for Telegram surveillance and collecting system information from compromised devices that get sent to attacker-controlled servers together with the stolen credentials.\n\nAs SafeBreach Labs discovered, the attacks (publicly reported in September\u00a0on Twitter by the Shadow Chaser Group) started in July as spear-phishing emails.\n\nThey target Windows users with malicious Winword attachments that exploit a Microsoft MSHTML remote code execution (RCE) bug tracked as CVE-2021-40444.\n\nThe PowerShortShell stealer payload is executed by a DLL downloaded on compromised systems. Once launched, the PowerShell script starts collecting data and screen snapshots, exfiltrating it to the attacker\u2019s command-and-control server.\n\n\u201cAlmost half of the victims are located in the United States. Based on the Microsoft Word document content \u2013 which blames Iran\u2019s leader for the \u2018Corona massacre\u2019 and the nature of the collected data, we assume that the victims might be Iranians who live abroad and might be seen as a threat to Iran\u2019s Islamic regime,\u201d said\u00a0Tomer Bar, Director of Security Research at SafeBreach Labs.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cThe adversary might be tied to Iran\u2019s Islamic regime since the Telegram surveillance usage is typical of Iran\u2019s threat actors like Infy, Ferocious Kitten, and Rampant Kitten.\u201d\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Victim_heat_map.png \n<figcaptionVictims heat map (SafeBreach Labs) \nThe CVE-2021-40444 RCE bug impacting IE\u2019s MSTHML rendering engine has been exploited in the wild as a zero-day starting with August 18, more than two weeks before Microsoft issued a security advisory with a partial workaround, and three weeks before a patch was released.\n\nMost recently, it was exploited in conjunction with malicious advertisements by the Magniber ransomware gang\u00a0to infect targets with malware and encrypt their devices. Microsoft also said multiple threat actors, including ransomware affiliates, targeted\u00a0this\u00a0Windows MSHTML\u00a0RCE bug using\u00a0maliciously crafted Office documents delivered via phishing attacks.\nSee Also: New Windows zero-day with public exploit lets you become an admin These attacks abused the CVE-2021-40444 flaw \u201cas part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders.\u201d\n\nThe deployed beacons communicated with malicious infrastructure connected with several cybercrime campaigns, including but not limited to human-operated ransomware.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/CVE-2021-40444-attack-chain%20.png \n<figcaptionCVE-2021-40444 attack-chain (Microsoft)\u200b\u200b\u200b\u200b \nIt\u2019s not surprising that more and more attackers are using CVE-2021-40444 exploits since threat actors started sharing tutorials and proof-of-concept exploits on hacking forums even before the bug was patched.\n\nThis likely allowed other threat actors and groups to start exploiting the security flaw in their own attacks.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools The information shared online is simple to follow an[...]", "creation_timestamp": "2026-09-07T03:00:45.829591Z"}, {"uuid": "6f7f247b-ca53-4762-bc03-60f045198119", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/IA4XgtEHd-haIvubTq2mTO_kd0Vg0I8wTENFQqmco9j3ibc", "content": "", "creation_timestamp": "2026-09-07T04:00:04.582456Z"}, {"uuid": "3d4c71d8-c751-45c9-97fc-c561584d37f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24290", "content": "Exploit Collector\nMicrosoft Windows MSHTML Overview\n\n\nThis article discusses the CVE-2021-40444 vulnerability and an alternative path that reduces the lines of JS code to trigger the issue and does not require CAB archives.\n\nMD5 | adb871524d9737af0fef53123fa0b931\n\nDownload\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T14:00:04.865741Z"}, {"uuid": "81ef4d92-c356-4b02-a221-d21abb74d88d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/25022", "content": "Kali Linux Tutorials\nCVE-2021-40444 PoC : Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nCVE-2021-40444 PoC is a Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nCreation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)\n\nYou need to install lcab first (sudo apt-get install lcab)\n\nCheck REPRODUCE.mdfor manual reproduce steps\n\nIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\n\nUsing\n\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dllwhich just pops a calc.exefrom a call to system()\n\npython3 exploit.py generate test/calc.dll http://<srv\nhttps://1.bp.blogspot.com/-q4Qrx7Kd10w/YUSYEQDTIKI/AAAAAAAAK3w/rWAn8dYhzeo9G7J7CS_SIsi7AHjsGyrAACLcBGAsYHQ/s1007/1.png \nOnce you generate the malicious docx (will be at out/) you can setup the server:\n\nsudo python3 exploit.py host 80\nhttps://1.bp.blogspot.com/-M4bM8mj9wHQ/YUSZE58fPgI/AAAAAAAAK34/yfSeOeg_uPUFIO7r09C6jWuwUp5VJdzyACLcBGAsYHQ/s866/2.png \nFinally try the docx in a Windows Virtual Machine:\nhttps://1.bp.blogspot.com/-W1O2pPuOcdc/YUSZXkgQ8UI/AAAAAAAAK4A/OejDX89jfsEjS6K9u5kHcyYmKCg30TKqwCLcBGAsYHQ/s1473/3.png \n\nDownload", "creation_timestamp": "2026-09-07T14:00:05.264449Z"}, {"uuid": "81b2677b-99b7-484f-96bf-4617c83d09cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23974", "content": "Black Hat Ethical Hacking\nMicrosoft Patches Actively Exploited Windows Zero-Day Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Patches Actively Exploited Windows Zero-Day BugPost Views: 286 \nReading Time: 2 Minutes\nIn September\u2019s Patch Tuesday\u00a0crop of security fixes, Microsoft released patches for 66 CVEs, three of which are rated critical, and one of which \u2013 the Windows MSHTML zero-day \u2013 has been under active attack for nearly two weeks.\nOne other bug is listed as publicly known but isn\u2019t (yet) being exploited. Immersive Labs\u2019 Kevin Breen, director of cyber threat research, observed that with only one CVE under active attack in the wild, it\u2019s \u201cquite a light Patch Tuesday\u201d \u2013 at least on the surface, that is.\n\nThe flaws were found in Microsoft Windows and Windows components, Microsoft Edge (Chromium, iOS, and Android), Azure, Office and Office Components, SharePoint Server, Microsoft Windows DNS and the Windows Subsystem for Linux.\n\nOf the 66 new CVEs patched today, three are rated critical, 62 are rated important, and one is rated moderate in severity.\n\nOver the past nine months of 2021, this is the seventh month in which Microsoft patched fewer than 100 CVEs, in stark contrast to 2020, when Redmond spent eight months gushing out more than 100 CVE patches per month. But while the overall number of vulnerabilities is lighter, the severity ratings have ticked up, as the Zero Day Initiative\u00a0noted.\n\nSome observers pegged the top patching priority in this month\u2019s batch as being a fix for CVE-2021-40444: An important-rated vulnerability in Microsoft\u2019s MSHTML (Trident) engine that rates 8.8 out of 10 on the CVSS scale.\n\nDisclosed on Sept. 7, it\u2019s a painfully throbbing sore thumb, given that researchers developed a number of proof-of-concept (PoC) exploits showing how drop-dead simple it is to exploit, and attackers have been sharing guides on how to do just that.\nSee Also: Complete Offensive Security and Ethical Hacking Course Under Active Attack: CVE-2021-40444It\u2019s been nearly two weeks since this serious, simple to exploit bug has been under active attack, and it\u2019s been nearly a week since attackers started to share blueprints on how to carry out an exploit.\n\nMicrosoft said last week that the flaw could let an attacker \u201ccraft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine,\u201d after which \u201cthe attacker would then have to convince the user to open the malicious document.\u201d Unfortunately, malicious macro attacks continue to be prevalent: In July, for example, legacy users of Microsoft Excel were being targeted in a malware campaign that used a novel malware-obfuscation technique\u00a0to disable malicious macro warnings and deliver the ZLoader trojan.\n\nAn attacker would need to convince a user to open a specially crafted Microsoft Office document containing the exploit code.\n\nSatnam Narang, staff research engineer at Tenable, noted via email that there have been warnings that this vulnerability will be incorporated into malware payloads and used to distribute ransomware: A solid reason to put the patch at the top of your priority list.\n\n\u201cThere are no indications that this has happened yet, but with the patch now available, organizations should prioritize updating their systems as soon as possible,\u201d Narang told Threatpost.\n\nLast Wednesday, Sept. 8, Kevin Beaumont\u00a0\u2013 head of the security operations center for U.K. fashion retailer Arcadia Group and a past senior threat intelligence analyst at Microsoft \u2013 noted\u00a0that the exploit had been in the wild for about a week or more.\n\nIt got worse: Last Thursday, Sept. 9, threat actors began sharing exploit h[...]", "creation_timestamp": "2026-09-07T15:00:06.038068Z"}, {"uuid": "a5ac3de7-d679-4098-8973-de687bf9ea7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23975", "content": "ow-tos\u00a0and PoCs for the Windows MSHTML zero-day. BleepingComputer gave it a try and found that the guides are \u201csimple to follow and [allow] anyone to create their own working version\u201d of the exploit, \u201cincluding a Python server to distribute the malicious documents and CAB files.\u201d\n\nIt took the publication all of 15 minutes to recreate the exploit.\n\nA week ago, on Tuesday, Sept. 7, Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) had urged mitigations\u00a0of the remote-code execution (RCE) flaw, which is found in all modern Windows operating systems.\n\nLast week, the company didn\u2019t say much about the bug in MSHTML, aka Trident, which is the HTML engine built into Windows since Internet Explorer debuted more than 20 years ago and which allows Windows to read and display HTML files.\n\nMicrosoft did say, however, that it was aware of targeted attacks trying to exploit it via specially crafted Microsoft Office documents.\n\nIn spite of there being no security updates available for the vulnerability at that time, MIcrosoft went ahead and disclosed it, along with mitigations meant to help prevent exploitation.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges Mitigations That Don\u2019t MitigateTracked as CVE-2021-40444, the flaw is serious enough that CISA sent its own advisory, alerting users and administrators and recommending that they use the mitigations and workarounds Microsoft recommended \u2013 mitigations that try to prevent exploitation by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nEmphasis on \u201ctry to:\u201d Unfortunately, those mitigations proved to be less than foolproof, as researchers, including Beaumont, managed to modify the exploit\u00a0so that it didn\u2019t use ActiveX, effectively skirting Microsoft\u2019s mitigations.\n\nThe Zero Day Initiative said that\u00a0for now, the most-effective defense is \u201cto apply the patch and avoid Office docs you aren\u2019t expecting to receive.\u201d\n\nBe sure to carefully review and install all the needed patches\u00a0for your setup: There\u2019s a long list of updates for specific platforms, and it\u2019s important not to slather on too thin a layer of protection.\n\nCredit for finding this bug goes to Rick Cole of MSTIC; Bryce Abdo, Dhanesh Kizhakkinan and Genwei Jiang, all from Mandiant; and Haifei Li of EXPMON. Baddest Bug AwardThe award for baddest bug \u2013 or at least, the one with the highest severity rating, with a CVSS score of 9.8 \u2013 goes to CVE-2021-38647: a critical remote-code execution (RCE) vulnerability in Open Management Infrastructure. OMI is an open-source project\u00a0to further the development of a production-quality implementation of the DMTF CIM/WBEM\u00a0standards.\n\n\u201cThis vulnerability requires no user interaction or privileges, so an attacker can run their code on an affected system just by sending a specially crafted message to an affected system,\u201d the Zero Day Initiatve explained. That makes it high priority: ZDI recommended that OMI users test and deploy this one quickly.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Yet More PrintNightmare PatchesMicrosoft also patched three elevation of privilege vulnerabilities in Windows Print Spooler (CVE-2021-38667, CVE-2021-38671\u00a0and CVE-2021-40447), all rated important.\n\nThese are the three latest fixes in a steady stream\u00a0of patches\u00a0for flaws in Windows Print Spooler that followed the disclosure of PrintNightmare\u00a0in June. This probably won\u2019t be the last patch in that parade: Tenable\u2019s Narang told Threatpost that \u201cresearchers continue to discover ways to exploit Print Spooler\u201d and that the firm expects \u201ccontinued research in this area.\u201d\n\nOnly one \u2013 CVE-2021-38671 \u2013 of today\u2019s patch trio is rated as \u201cexploitation more likely.\u201d Regardless, organizations should prioritize patching these flaws as \u201cthey are extremely valuable to attackers in post-exploitation scenarios,\u201d Narang observed. More \u2018Exploitation More Likely\u2019Immersive\u2019s Breen told Thre[...]", "creation_timestamp": "2026-09-07T15:00:06.077851Z"}, {"uuid": "fd35ec64-e686-4e1e-bfbc-8fa6e8fd855a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23976", "content": "atpost that a trio of local privilege-escalation vulnerabilities in the Windows Common Log File System Driver (CVE-2021-36955, CVE-2021-36963, CVE-2021-38633) are also noteworthy, all of them being listed as \u201cexploitation more likely.\u201d\n\n\u201cLocal priv-esc vulnerabilities are a key component of almost every successful cyberattack, especially for the likes of ransomware operators who abuse this kind of exploit to gain the highest level of access,\u201d Breen said via email. \u201cThis allows them to disable antivirus, delete backups and ensure their encryptors can reach even the most sensitive of files.\u201d\n\nOne glaring example of that emerged in May, when hundreds of millions of Dell users were found to be at risk\u00a0from kernel-privilege bugs. The bugs lurked undisclosed for 12 years, and could have allowed attackers to bypass security products, execute code and pivot to other parts of the network for lateral movement.\n\nThe three exploits Microsoft patched on Tuesday aren\u2019t remote, meaning that attackers need to have achieved code execution by other means. One such way would be via CVE-2021-40444.\n\nTwo other vulnerabilities \u2013 CVE-2021-38639\u00a0and CVE-2021-36975, both Win32k escalation of privilege flaws \u2013 have also been listed as \u201cexploitation more likely\u201d and, together, cover the full range of supported Windows versions.\n\nBreen said that he\u2019s starting to feel like a broken record when it comes to privilege escalation vulnerabilities. They\u2019re not rated as high a severity risk as RCE bugs, but \u201cthese local exploits can be the linchpin in the post-exploitation phases of an experienced attacker,\u201d he asserted. \u201cIf you can block them here you have the potential to significantly limit their damage.\u201d\n\nhe added, \u201cIf we assume a determined attacker will be able to infect a victim\u2019s device through social engineering or other techniques, I would argue that patching priv-esc vulnerabilities is even more important than patching some other remote code-execution vulns,\u201d Breen said. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerStill, This RCE Is Pretty ImportantDanny Kim, a principal architect at Virsec who spent time at Microsoft during his graduate work on the OS security development team, wants security teams to pay attention to CVE-2021-36965\u00a0\u2013 an important-rated Windows WLAN AutoConfig Service RCE vulnerability \u2013 given its combination of severity (with a CVSS:3.0 base score of 8.8); no requirement for privilege escalation/user interaction to exploit; and breadth of affected Windows versions.\n\nThe WLAN AutoConfig Service is part of the mechanism that Windows 10 uses to choose the wireless network a computer will connect to, and to the Windows Scripting Engine, respectively.\n\nThe patch fixes a flaw that could allow network-adjacent attackers to run their code on affected systems at system level.\n\nAs the Zero Day Initiative explained, that means an attacker could \u201ccompletely take over the target \u2013 provided they are on an adjacent network.\u201d That would come in quite handy in a coffee-shop attack, where multiple people use an unsecured Wi-Fi network.\n\nThis one \u201cis especially alarming,\u201d Kim said: Think SolarWinds\u00a0and PrintNightmare.\n\n\u201cAs recent trends have shown, remote code execution-based attacks are the most critical vulnerabilities that can lead to the largest negative impact on an enterprise, as we have seen in the Solarwinds and PrintNightmare attacks,\u201d he said in an email.\n\nKim said that in spite of the exploit code maturity being currently unproven, the vulnerability has been confirmed to exist, leaving an opening for attackers.\n\n\u201cIt specifically relies on the attacker being located in the same network, so it would not be surprising to see this vulnerability used in combination with another CVE/attack to achieve an attacker\u2019s end goal,\u201d he predicted. \u201cRemote code execution attacks can lead to unverified processes running on the server workload, only highlighting the need for constant, deter[...]", "creation_timestamp": "2026-09-07T15:00:06.483330Z"}, {"uuid": "22e0e5d9-483e-45ce-a292-cbbb4c18fb95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23872", "content": "Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog\nhttps://www.reddit.com/r/redteamsec/comments/pp7su1/analyzing_attacks_that_exploit_the_cve202140444/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/)   [comments] (https://www.reddit.com/r/redteamsec/comments/pp7su1/analyzing_attacks_that_exploit_the_cve202140444/)", "creation_timestamp": "2026-09-07T16:00:05.364240Z"}, {"uuid": "254c7346-330f-43b9-ba80-bedf8dfd0cf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23905", "content": "CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\nhttp://www.kitploit.com/2021/09/cve-2021-40444-poc-malicious-docx.html", "creation_timestamp": "2026-09-07T16:00:05.655314Z"}, {"uuid": "31c6b424-f04b-4534-8d4c-f6a726a1e00a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23913", "content": "\u00a0\nDownload CVE-2021-40444 (https://github.com/lockedbyte/CVE-2021-40444)", "creation_timestamp": "2026-09-07T16:00:05.907820Z"}, {"uuid": "f297efbf-39f6-4d91-becd-cebbe13f9015", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23903", "content": "CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cabUsingFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://Once you generate the malicious docx (will be at out/) you can setup the server:sudo python3 exploit.py host 80Finally try the docx in a Windows Virtual Machine: Download CVE-2021-40444\nRead more...", "creation_timestamp": "2026-09-07T16:00:05.708661Z"}, {"uuid": "c2806307-1854-468f-a661-b98e6fda429b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23879", "content": "Fully Weaponized CVE-2021-40444: Malicious docx generator using arbitrary DLL\nhttps://www.reddit.com/r/redteamsec/comments/ppa935/fully_weaponized_cve202140444_malicious_docx/\n\n  submitted by    /u/0xDangerous_bit  (https://www.reddit.com/user/0xDangerous_bit) \n [link] (https://github.com/klezVirus/CVE-2021-40444)   [comments] (https://www.reddit.com/r/redteamsec/comments/ppa935/fully_weaponized_cve202140444_malicious_docx/)", "creation_timestamp": "2026-09-07T16:00:05.768936Z"}, {"uuid": "73fd318e-6cb7-4b0b-a343-a5268d35e164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23918", "content": "KitPloit - PenTest Tools!CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution) \n\n\n\n\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\n\n\n\nCreation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)\n\nYou need to install lcab first (sudo apt-get install lcab)\n\nCheck REPRODUCE.mdfor manual reproduce steps\n\nIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\n\nUsing\n\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dllwhich just pops a calc.exefrom a call to system()\n\npython3 exploit.py generate test/calc.dll http://\n\n\n\n\n\n\n\n\n\nOnce you generate the malicious docx (will be at out/) you can setup the server:\n\nsudo python3 exploit.py host 80\n\n\n\n\n\n\n\n\n\nFinally try the docx in a Windows Virtual Machine:\n\n\n\n \n\n\nDownload CVE-2021-40444", "creation_timestamp": "2026-09-07T16:00:05.861577Z"}, {"uuid": "2925c8c4-a390-4b10-9c1f-4f129f74ec06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23907", "content": "Malicious docx generator (https://www.kitploit.com/search/label/Generator) to exploit CVE-2021-40444 (Microsoft Office Word Remote (https://www.kitploit.com/search/label/Remote) Code Execution)\nCreation of this Script is based on some reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\nUsing\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://", "creation_timestamp": "2026-09-07T16:00:05.964492Z"}, {"uuid": "477e2ea5-22b7-49df-8a22-0c9139552b91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23138", "content": "o apply it to the Policy hive. After a system reboot, the new configuration should be applied.\n\nAs updates are not available yet for the CVE-2021-40444, they have released the following workaround that prevents ActiveX controls from running in Internet Explorer and applications that embed the browser.\n\nTo disable ActiveX controls, please follow these steps:\n\n1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled\u00a0to properly create the Registry file.\n\n \nAlternatively, you can download the registry file from here. Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3]\n\"1001\"=dword:00000003\n\"1004\"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a\u00a0UAC prompt is displayed, click on the Yes\u00a0button to import the Registry entries.\n\n3. Reboot your computer to apply the new configuration.\nSee Also: Offensive Security Tool: Pegasus Spyware \u2013 Decompiled Once you reboot your computer, ActiveX controls will be disabled in Internet Explorer.\n\nWhen Microsoft provides\u00a0an official security update for this vulnerability, you can remove this temporary Registry fix by manually deleting the created Registry keys.\n\nAlternatively, you can utilize this reg file\u00a0to automatically delete the entries.\n\nUpdate: Added comment received after publication from Haifei Li of EXPMON, one of the researchers that reported the vulnerability to Microsoft. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_plugin_vuln-90x90.jpg Gutenberg Template Library & Redux Framework Bugs Plague WordPress Sites1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ransomware-cpu-90x90.jpg LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Windows-Abstract-90x90.jpg Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/F5-Big-IP-e1619725870974-90x90.jpg F5 Bug Could Lead to Complete System Takeover2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/steel-series-e1629915533369-90x90.jpg Win10 Admin Rights Tossed Off by Yet Another Plug-In2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/white-pegasus-e1626804896117-90x90.jpg Pegasus Spyware Uses iPhone Zero-Click iMessage Zero-Day2 weeks ago\nstyle=\"displa[...]", "creation_timestamp": "2026-09-07T17:00:04.520307Z"}, {"uuid": "3cf9f52e-1064-47a7-8a08-765a48ae357f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23137", "content": "Black Hat Ethical Hacking\nMicrosoft shares temp fix for ongoing Office 365 zero-day attacks\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft shares temp fix for ongoing Office 365 zero-day attacksPost Views: 83 \nReading Time: 1 Minute\nMicrosoft shared yesterday a mitigation for\u00a0a remote code execution vulnerability in Windows that is being exploited in targeted attacks against Office 365 and Office 2019 on Windows 10.\nThe flaw is in MSHTML, the browser rendering engine that is also used by Microsoft Office documents. Ongoing attacks against Office 365Identified as CVE-2021-40444, the security issue affects Windows Server 2008 through 2019 and Windows 8.1 through 10 and has a severity level of 8.8 out of the maximum 10.\n\nMicrosoft is aware of targeted attacks that try to exploit the vulnerability by sending specially-crafted Microsoft Office documents to potential victims, the company says in an advisory\u00a0today.\n\u201cAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document\u201d \u2013 Microsoft\nHowever, the attack is thwarted if Microsoft Office runs with the default configuration, where documents from the web are opened in Protected View mode or Application Guard for Office 365.\n\nProtected View is a read-only mode that has most of the editing functions disabled, while Application Guard isolates untrusted documents, denying them access to corporate resources, the intranet, or other files on the system.\n\nSystems with active Microsoft\u2019s Defender Antivirus and Defender for Endpoint (build 1.349.22.0 and above) benefit from protection against attempts to exploit CVE-2021-40444.\n\nMicrosoft\u2019s enterprise security platform will display alerts about this attack as \u201cSuspicious Cpl File Execution.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Researchers from multiple cybersecurity companies are credited for finding and reporting the vulnerability: Haifei Li of EXPMON, Dhanesh Kizhakkinan, Bryce Abdo, and Genwei Jiang \u2013 all three\u00a0of Mandiant, and Rick Cole of Microsoft Security Intelligence.\n\nIn a tweet today, EXPMON (exploit monitor)\u00a0says that they found the vulnerability after detecting a \u201chighly sophisticated zero-day attack\u201d aimed at Microsoft Office users.\nhttps://www.bleepstatic.com/images/news/u/1100723/2021/EXPMONBug-40444.jpg \n<figcaptionsource: EXPMON \nEXPMON researchers reproduced the attack on the latest\u00a0Office 2019 / Office 365 on Windows 10.\n\nIn a reply to BleepingComputer, Haifei Li\u00a0of EXPMON said that the attackers used a .DOCX file. Upon opening it, the document loaded the Internet Explorer engine to render a remote web page from the threat actor.\n\nMalware is then downloaded by using a specific ActiveX control in the web page. Executing the threat is done using \u201ca trick called \u2018Cpl File Execution\u2019,\u201d referenced in Microsoft\u2019s advisory.\n\nThe researcher told us that the attack method is 100% reliable, which makes it very dangerous. He reported the vulnerability\u00a0to Microsoft early Sunday morning.\nSee Also: Bluetooth Bugs Open Billions of Devices to DoS, Code Execution Workaround for CVE-2021-40444 zero-day attacksAs there is no security update available at this time, Microsoft has provided the following workaround \u2013 disable the installation of all ActiveX controls in Internet Explorer.\n\nA Windows registry update ensures that ActiveX is rendered inactive for all sites, while already available ActiveX controls will keep functioning.\n\nUsers should save the file below with the .REG extension and execute it t[...]", "creation_timestamp": "2026-09-07T17:00:04.552476Z"}, {"uuid": "537d6d1c-5512-4dcc-b6a8-ac80c7384e9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23249", "content": "ility.\n\nWith these bypasses and additional use cases, CVE-2021-40444 has become even more severe than initially thought. How CVE-2021-40444 is currently used in attacksWhile we do not have the actual phishing emails used in the attacks, Beaumont has analyzed the malicious Word document to understand better how the exploit works.\nLooks like this has been in the wild for a week or more.  Uses the daft as F feature that allows Word to load a template from internet, that spawns IE and then trusts JS and ActiveX controls, then uses ../.. (yes it's 1999) to spawn .cpl file https://t.co/mOvaN9YLj6 pic.twitter.com/xLf2jVWyY5\n\n\u2014 Kevin Beaumont (@GossiTheDog) September 8, 2021\nSee Also: Offensive Security Tool: Pegasus Spyware \u2013 Decompiled One of the known malicious Word attachments used in the attacks is named \u2018A Letter before court 4.docx\u2019 [VirusTotal] and claims to be a letter from an attorney.\n\nSince the file was downloaded from the Internet, it will be tagged with the \u2018Mark of the Web\u2019 and opened in Protected View, as shown below.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/malicious-word-document.jpg \nSee Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hackerhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/side_html-file.jpg \n(Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T17:00:04.621735Z"}, {"uuid": "1ea13eff-3c64-424a-b3bc-e99fab008ed0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23248", "content": "Black Hat Ethical Hacking\nWindows MSHTML zero-day defenses bypassed as new info emerges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day defenses bypassed as new info emergesPost Views: 39 \nReading Time: 1 Minute\nThis Internet Explorer MSHTML remote code execution vulnerability, tracked as CVE-2021-40444, was disclosed by Microsoft on Tuesday\u00a0but with few details as it has not been patched yet.\nThe only information shared by Microsoft was that the vulnerability uses malicious ActiveX controls to exploit Office 365 and Office 2019 on Windows 10 to download and install malware on an affected computer.\n\nSince then, researchers have found the malicious Word documents used in the attacks and have learned new information about how the vulnerability is exploited. Why the\u00a0CVE-2021-40444 zero-day is so criticalSince the release of this vulnerability, security researchers have taken to Twitter to warn how dangerous it is even though Microsoft Office\u2019s \u2018Protected View\u2019 feature will block the exploit.\n\nWhen Office opens a document it checks if it is tagged with a \u201cMark of the Web\u201d (MoTW), which means it originated from the Internet.\n\nIf this tag exists, Microsoft will open the document in read-only mode, effectively blocking the exploit unless a user clicks on the \u2018Enable Editing\u2019 buttons.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/protected-view-maldoc.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T17:00:04.657509Z"}, {"uuid": "e1f86b8c-bfec-4fc7-8493-82b7479ac2f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23539", "content": "e following mitigations to block ActiveX controls in Internet Explorer, the default handler for the MSHTML protocol, and block document preview in Windows Explorer. Disable ActiveX controls in Internet ExplorerTo disable ActiveX controls, please follow these steps:\n\n1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled\u00a0to properly create the Registry file.\n\n \nAlternatively, you can download the registry file from here. Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3]\n\"1001\"=dword:00000003\n\"1004\"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a\u00a0UAC prompt is displayed, click on the Yes\u00a0button to import the Registry entries.\n3. Reboot your computer to apply the new configuration.\n\nOnce you reboot your computer, ActiveX controls will be disabled in Internet Explorer.\n\nYou can enable ActiveX controls again by deleting the above Registry keys or using this Registry file.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Disable document preview in Windows ExplorerSecurity researchers have also found that this vulnerability can be exploited by viewing a malicious document using the Windows Explorer preview feature.\nCVE-2021-40444 is so bad\ud83e\udd26\u200d\u2642\ufe0f pic.twitter.com/3Gu9ahwmHd\n\n\u2014 jq0904 (@jq0904) September 10, 2021\nSince this was discovered, Microsoft has added the following mitigation to disable previewing of RTF and Word documents:\n\n1. In the Registry Editor (regedit.exe), navigate to the appropriate registry key: \nFor Word documents, navigate to these keys:\n\n* HKEY_CLASSES_ROOT.docx\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.doc\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.docm\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\nFor rich text files (RTF), navigate to this key:\n\n* HKEY_CLASSES_ROOT.rtf\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\n2. Export a copy of the Registry key as a backup.\n3. Now double-click Name\u00a0and in the Edit String\u00a0dialog box, delete the Value Data.\n4. Click OK, See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWord document and RTF file previews are now disabled in Windows Explorer.\n\nTo enable Windows Explorer preview for these documents, double-click on the backup .reg file you created in step 2 above.\n\nWhile these mitigations will help, as the exploit has been modified not to use ActiveX controls, users are still at risk until an official security update is released.\n\nUntil Microsoft releases a security update, everyone should treat all Word and RTF attachments suspiciously and their source manually verified before opening them.\nSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T17:00:04.702202Z"}, {"uuid": "a92c131a-ec7b-4866-a315-2eda4fb17a2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23538", "content": "Black Hat Ethical Hacking\nWindows MSHTML zero-day exploits shared on hacking forums\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day exploits shared on hacking forumsPost Views: 101 \nReading Time: 2 Minutes\nThreat actors are sharing Windows MSHTML zero-day\u00a0(CVE-2021-40444) tutorials\u00a0and exploits on hacking forums, allowing other hackers to start exploiting the new vulnerability in their own attacks.\nLast Tuesday, Microsoft disclosed a new zero-day vulnerability in Windows MSHTML\u00a0that allows threat actors to create malicious documents, including Office and RTF docs, to execute commands on a victim\u2019s computer remotely.\n\nEven though there are no security updates available for the CVE-2021-40444 vulnerability, as it was discovered used in active attacks by EXPMON\u00a0and Mandiant, Microsoft decided to disclose the vulnerability and provide mitigations to help prevent its exploitation.\n\nThese mitigations work by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nHowever, researchers have been able to modify the exploit\u00a0not to use ActiveX, effectively bypassing Microsoft\u2019s mitigations. Guides and PoCs shared on hacking forumsWhen Microsoft first disclosed the Windows MSHTML zero-day, tracked as CVE-2021-40444, security researchers quickly found the malicious documents used in attacks.\n\nWhile they soon reproduced the exploits, modified\u00a0them for further capabilities, and discovered a new document preview vector, the researchers did not disclose details for fear other threat actors would abuse it.\n\nUnfortunately, threat actors have been able to reproduce the exploit on their own from information, and malicious document samples posted online and have begun sharing detailed guides and information on hacking forums.\n\nStarting on Thursday, threat actors began sharing public information about the HTML component of the exploit and how to create the malicious document. On Friday, more instructions were posted on generating the payload and a CAB file that included the path traversal vulnerability component.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/forum-post.jpg \nDefending against the CVE-2021-40444 MSHTML vulnerability The good news is that since the vulnerability was disclosed, Microsoft Defender and other security programs can detect and block malicious documents and CAB files used in this attack.\n\nFor example, you can see below Microsoft Defender blocking the exploit as\u00a0\u2018Trojan:Win32/CplLoader.a\u2019 and \u2018TrojanDownloader:HTML/Donoff.SA\u2019 detections.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/defender-detecting.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T17:00:04.755182Z"}, {"uuid": "971517e8-7459-4b0a-8bb6-555e067e56d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23352", "content": "Malicious docx generator to exploit CVE-2021-40444\nhttps://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/\n\n  submitted by    /u/0xDangerous_bit  (https://www.reddit.com/user/0xDangerous_bit) \n [link] (https://github.com/lockedbyte/CVE-2021-40444)   [comments] (https://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T17:00:04.793974Z"}, {"uuid": "31d40d1c-c15d-445c-979c-7eeb88b7d1a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23138", "content": "o apply it to the Policy hive. After a system reboot, the new configuration should be applied.\n\nAs updates are not available yet for the CVE-2021-40444, they have released the following workaround that prevents ActiveX controls from running in Internet Explorer and applications that embed the browser.\n\nTo disable ActiveX controls, please follow these steps:\n\n1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled\u00a0to properly create the Registry file.\n\n \nAlternatively, you can download the registry file from here. Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3]\n\"1001\"=dword:00000003\n\"1004\"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a\u00a0UAC prompt is displayed, click on the Yes\u00a0button to import the Registry entries.\n\n3. Reboot your computer to apply the new configuration.\nSee Also: Offensive Security Tool: Pegasus Spyware \u2013 Decompiled Once you reboot your computer, ActiveX controls will be disabled in Internet Explorer.\n\nWhen Microsoft provides\u00a0an official security update for this vulnerability, you can remove this temporary Registry fix by manually deleting the created Registry keys.\n\nAlternatively, you can utilize this reg file\u00a0to automatically delete the entries.\n\nUpdate: Added comment received after publication from Haifei Li of EXPMON, one of the researchers that reported the vulnerability to Microsoft. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_plugin_vuln-90x90.jpg Gutenberg Template Library & Redux Framework Bugs Plague WordPress Sites1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ransomware-cpu-90x90.jpg LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Windows-Abstract-90x90.jpg Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/F5-Big-IP-e1619725870974-90x90.jpg F5 Bug Could Lead to Complete System Takeover2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/steel-series-e1629915533369-90x90.jpg Win10 Admin Rights Tossed Off by Yet Another Plug-In2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/white-pegasus-e1626804896117-90x90.jpg Pegasus Spyware Uses iPhone Zero-Click iMessage Zero-Day2 weeks ago\nstyle=\"displa[...]", "creation_timestamp": "2026-09-08T00:00:39.152101Z"}, {"uuid": "6848ddf9-0744-439f-8a92-a0fd6c0e5e97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23137", "content": "Black Hat Ethical Hacking\nMicrosoft shares temp fix for ongoing Office 365 zero-day attacks\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft shares temp fix for ongoing Office 365 zero-day attacksPost Views: 83 \nReading Time: 1 Minute\nMicrosoft shared yesterday a mitigation for\u00a0a remote code execution vulnerability in Windows that is being exploited in targeted attacks against Office 365 and Office 2019 on Windows 10.\nThe flaw is in MSHTML, the browser rendering engine that is also used by Microsoft Office documents. Ongoing attacks against Office 365Identified as CVE-2021-40444, the security issue affects Windows Server 2008 through 2019 and Windows 8.1 through 10 and has a severity level of 8.8 out of the maximum 10.\n\nMicrosoft is aware of targeted attacks that try to exploit the vulnerability by sending specially-crafted Microsoft Office documents to potential victims, the company says in an advisory\u00a0today.\n\u201cAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document\u201d \u2013 Microsoft\nHowever, the attack is thwarted if Microsoft Office runs with the default configuration, where documents from the web are opened in Protected View mode or Application Guard for Office 365.\n\nProtected View is a read-only mode that has most of the editing functions disabled, while Application Guard isolates untrusted documents, denying them access to corporate resources, the intranet, or other files on the system.\n\nSystems with active Microsoft\u2019s Defender Antivirus and Defender for Endpoint (build 1.349.22.0 and above) benefit from protection against attempts to exploit CVE-2021-40444.\n\nMicrosoft\u2019s enterprise security platform will display alerts about this attack as \u201cSuspicious Cpl File Execution.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Researchers from multiple cybersecurity companies are credited for finding and reporting the vulnerability: Haifei Li of EXPMON, Dhanesh Kizhakkinan, Bryce Abdo, and Genwei Jiang \u2013 all three\u00a0of Mandiant, and Rick Cole of Microsoft Security Intelligence.\n\nIn a tweet today, EXPMON (exploit monitor)\u00a0says that they found the vulnerability after detecting a \u201chighly sophisticated zero-day attack\u201d aimed at Microsoft Office users.\nhttps://www.bleepstatic.com/images/news/u/1100723/2021/EXPMONBug-40444.jpg \n<figcaptionsource: EXPMON \nEXPMON researchers reproduced the attack on the latest\u00a0Office 2019 / Office 365 on Windows 10.\n\nIn a reply to BleepingComputer, Haifei Li\u00a0of EXPMON said that the attackers used a .DOCX file. Upon opening it, the document loaded the Internet Explorer engine to render a remote web page from the threat actor.\n\nMalware is then downloaded by using a specific ActiveX control in the web page. Executing the threat is done using \u201ca trick called \u2018Cpl File Execution\u2019,\u201d referenced in Microsoft\u2019s advisory.\n\nThe researcher told us that the attack method is 100% reliable, which makes it very dangerous. He reported the vulnerability\u00a0to Microsoft early Sunday morning.\nSee Also: Bluetooth Bugs Open Billions of Devices to DoS, Code Execution Workaround for CVE-2021-40444 zero-day attacksAs there is no security update available at this time, Microsoft has provided the following workaround \u2013 disable the installation of all ActiveX controls in Internet Explorer.\n\nA Windows registry update ensures that ActiveX is rendered inactive for all sites, while already available ActiveX controls will keep functioning.\n\nUsers should save the file below with the .REG extension and execute it t[...]", "creation_timestamp": "2026-09-08T00:00:39.197827Z"}, {"uuid": "8a9eefb6-e38b-451f-93e7-abffd4401230", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23249", "content": "ility.\n\nWith these bypasses and additional use cases, CVE-2021-40444 has become even more severe than initially thought. How CVE-2021-40444 is currently used in attacksWhile we do not have the actual phishing emails used in the attacks, Beaumont has analyzed the malicious Word document to understand better how the exploit works.\nLooks like this has been in the wild for a week or more.  Uses the daft as F feature that allows Word to load a template from internet, that spawns IE and then trusts JS and ActiveX controls, then uses ../.. (yes it's 1999) to spawn .cpl file https://t.co/mOvaN9YLj6 pic.twitter.com/xLf2jVWyY5\n\n\u2014 Kevin Beaumont (@GossiTheDog) September 8, 2021\nSee Also: Offensive Security Tool: Pegasus Spyware \u2013 Decompiled One of the known malicious Word attachments used in the attacks is named \u2018A Letter before court 4.docx\u2019 [VirusTotal] and claims to be a letter from an attorney.\n\nSince the file was downloaded from the Internet, it will be tagged with the \u2018Mark of the Web\u2019 and opened in Protected View, as shown below.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/malicious-word-document.jpg \nSee Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hackerhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/side_html-file.jpg \n(Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:39.289086Z"}, {"uuid": "cb252d85-1919-44ac-9591-6ce66feada35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23248", "content": "Black Hat Ethical Hacking\nWindows MSHTML zero-day defenses bypassed as new info emerges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day defenses bypassed as new info emergesPost Views: 39 \nReading Time: 1 Minute\nThis Internet Explorer MSHTML remote code execution vulnerability, tracked as CVE-2021-40444, was disclosed by Microsoft on Tuesday\u00a0but with few details as it has not been patched yet.\nThe only information shared by Microsoft was that the vulnerability uses malicious ActiveX controls to exploit Office 365 and Office 2019 on Windows 10 to download and install malware on an affected computer.\n\nSince then, researchers have found the malicious Word documents used in the attacks and have learned new information about how the vulnerability is exploited. Why the\u00a0CVE-2021-40444 zero-day is so criticalSince the release of this vulnerability, security researchers have taken to Twitter to warn how dangerous it is even though Microsoft Office\u2019s \u2018Protected View\u2019 feature will block the exploit.\n\nWhen Office opens a document it checks if it is tagged with a \u201cMark of the Web\u201d (MoTW), which means it originated from the Internet.\n\nIf this tag exists, Microsoft will open the document in read-only mode, effectively blocking the exploit unless a user clicks on the \u2018Enable Editing\u2019 buttons.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/protected-view-maldoc.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:39.334172Z"}, {"uuid": "6a22f573-8393-4ce3-b4ae-c57d333f9c05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23539", "content": "e following mitigations to block ActiveX controls in Internet Explorer, the default handler for the MSHTML protocol, and block document preview in Windows Explorer. Disable ActiveX controls in Internet ExplorerTo disable ActiveX controls, please follow these steps:\n\n1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled\u00a0to properly create the Registry file.\n\n \nAlternatively, you can download the registry file from here. Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3]\n\"1001\"=dword:00000003\n\"1004\"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a\u00a0UAC prompt is displayed, click on the Yes\u00a0button to import the Registry entries.\n3. Reboot your computer to apply the new configuration.\n\nOnce you reboot your computer, ActiveX controls will be disabled in Internet Explorer.\n\nYou can enable ActiveX controls again by deleting the above Registry keys or using this Registry file.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Disable document preview in Windows ExplorerSecurity researchers have also found that this vulnerability can be exploited by viewing a malicious document using the Windows Explorer preview feature.\nCVE-2021-40444 is so bad\ud83e\udd26\u200d\u2642\ufe0f pic.twitter.com/3Gu9ahwmHd\n\n\u2014 jq0904 (@jq0904) September 10, 2021\nSince this was discovered, Microsoft has added the following mitigation to disable previewing of RTF and Word documents:\n\n1. In the Registry Editor (regedit.exe), navigate to the appropriate registry key: \nFor Word documents, navigate to these keys:\n\n* HKEY_CLASSES_ROOT.docx\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.doc\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.docm\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\nFor rich text files (RTF), navigate to this key:\n\n* HKEY_CLASSES_ROOT.rtf\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\n2. Export a copy of the Registry key as a backup.\n3. Now double-click Name\u00a0and in the Edit String\u00a0dialog box, delete the Value Data.\n4. Click OK, See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWord document and RTF file previews are now disabled in Windows Explorer.\n\nTo enable Windows Explorer preview for these documents, double-click on the backup .reg file you created in step 2 above.\n\nWhile these mitigations will help, as the exploit has been modified not to use ActiveX controls, users are still at risk until an official security update is released.\n\nUntil Microsoft releases a security update, everyone should treat all Word and RTF attachments suspiciously and their source manually verified before opening them.\nSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:39.379238Z"}, {"uuid": "fd785d04-9bdc-45a1-95fe-88753d77e016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23538", "content": "Black Hat Ethical Hacking\nWindows MSHTML zero-day exploits shared on hacking forums\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day exploits shared on hacking forumsPost Views: 101 \nReading Time: 2 Minutes\nThreat actors are sharing Windows MSHTML zero-day\u00a0(CVE-2021-40444) tutorials\u00a0and exploits on hacking forums, allowing other hackers to start exploiting the new vulnerability in their own attacks.\nLast Tuesday, Microsoft disclosed a new zero-day vulnerability in Windows MSHTML\u00a0that allows threat actors to create malicious documents, including Office and RTF docs, to execute commands on a victim\u2019s computer remotely.\n\nEven though there are no security updates available for the CVE-2021-40444 vulnerability, as it was discovered used in active attacks by EXPMON\u00a0and Mandiant, Microsoft decided to disclose the vulnerability and provide mitigations to help prevent its exploitation.\n\nThese mitigations work by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nHowever, researchers have been able to modify the exploit\u00a0not to use ActiveX, effectively bypassing Microsoft\u2019s mitigations. Guides and PoCs shared on hacking forumsWhen Microsoft first disclosed the Windows MSHTML zero-day, tracked as CVE-2021-40444, security researchers quickly found the malicious documents used in attacks.\n\nWhile they soon reproduced the exploits, modified\u00a0them for further capabilities, and discovered a new document preview vector, the researchers did not disclose details for fear other threat actors would abuse it.\n\nUnfortunately, threat actors have been able to reproduce the exploit on their own from information, and malicious document samples posted online and have begun sharing detailed guides and information on hacking forums.\n\nStarting on Thursday, threat actors began sharing public information about the HTML component of the exploit and how to create the malicious document. On Friday, more instructions were posted on generating the payload and a CAB file that included the path traversal vulnerability component.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/forum-post.jpg \nDefending against the CVE-2021-40444 MSHTML vulnerability The good news is that since the vulnerability was disclosed, Microsoft Defender and other security programs can detect and block malicious documents and CAB files used in this attack.\n\nFor example, you can see below Microsoft Defender blocking the exploit as\u00a0\u2018Trojan:Win32/CplLoader.a\u2019 and \u2018TrojanDownloader:HTML/Donoff.SA\u2019 detections.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/defender-detecting.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:39.424099Z"}, {"uuid": "aa751f94-1862-413b-8067-62ab5eae7524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23352", "content": "Malicious docx generator to exploit CVE-2021-40444\nhttps://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/\n\n  submitted by    /u/0xDangerous_bit  (https://www.reddit.com/user/0xDangerous_bit) \n [link] (https://github.com/lockedbyte/CVE-2021-40444)   [comments] (https://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:39.469879Z"}, {"uuid": "5bf5d988-aa40-4000-b28f-2a6b968ad129", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23872", "content": "Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog\nhttps://www.reddit.com/r/redteamsec/comments/pp7su1/analyzing_attacks_that_exploit_the_cve202140444/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/)   [comments] (https://www.reddit.com/r/redteamsec/comments/pp7su1/analyzing_attacks_that_exploit_the_cve202140444/)", "creation_timestamp": "2026-09-08T00:00:39.678339Z"}, {"uuid": "3a49c953-f105-4938-8b98-a7456e0ce5f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23905", "content": "CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\nhttp://www.kitploit.com/2021/09/cve-2021-40444-poc-malicious-docx.html", "creation_timestamp": "2026-09-08T00:00:39.927921Z"}, {"uuid": "4c58bf8f-0c85-4a25-b0b5-378d219726fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23903", "content": "CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cabUsingFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://Once you generate the malicious docx (will be at out/) you can setup the server:sudo python3 exploit.py host 80Finally try the docx in a Windows Virtual Machine: Download CVE-2021-40444\nRead more...", "creation_timestamp": "2026-09-08T00:00:39.974382Z"}, {"uuid": "b161e24c-9970-43c6-b432-5484f08f60eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23879", "content": "Fully Weaponized CVE-2021-40444: Malicious docx generator using arbitrary DLL\nhttps://www.reddit.com/r/redteamsec/comments/ppa935/fully_weaponized_cve202140444_malicious_docx/\n\n  submitted by    /u/0xDangerous_bit  (https://www.reddit.com/user/0xDangerous_bit) \n [link] (https://github.com/klezVirus/CVE-2021-40444)   [comments] (https://www.reddit.com/r/redteamsec/comments/ppa935/fully_weaponized_cve202140444_malicious_docx/)", "creation_timestamp": "2026-09-08T00:00:40.033219Z"}, {"uuid": "c30f31bb-a471-4d14-9cb6-7c1f7bb0eb02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23913", "content": "\u00a0\nDownload CVE-2021-40444 (https://github.com/lockedbyte/CVE-2021-40444)", "creation_timestamp": "2026-09-08T00:00:40.211607Z"}, {"uuid": "dbf8fb4f-13a5-461a-adf2-8e54250d1dec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23907", "content": "Malicious docx generator (https://www.kitploit.com/search/label/Generator) to exploit CVE-2021-40444 (Microsoft Office Word Remote (https://www.kitploit.com/search/label/Remote) Code Execution)\nCreation of this Script is based on some reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\nUsing\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://", "creation_timestamp": "2026-09-08T00:00:40.271044Z"}, {"uuid": "16bcf90a-05e9-41ac-b0d1-324077c9d7b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24290", "content": "Exploit Collector\nMicrosoft Windows MSHTML Overview\n\n\nThis article discusses the CVE-2021-40444 vulnerability and an alternative path that reduces the lines of JS code to trigger the issue and does not require CAB archives.\n\nMD5 | adb871524d9737af0fef53123fa0b931\n\nDownload\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:43.750550Z"}, {"uuid": "f14f336c-f293-47f2-8688-f705d954c065", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23918", "content": "KitPloit - PenTest Tools!CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution) \n\n\n\n\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\n\n\n\nCreation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)\n\nYou need to install lcab first (sudo apt-get install lcab)\n\nCheck REPRODUCE.mdfor manual reproduce steps\n\nIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\n\nUsing\n\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dllwhich just pops a calc.exefrom a call to system()\n\npython3 exploit.py generate test/calc.dll http://\n\n\n\n\n\n\n\n\n\nOnce you generate the malicious docx (will be at out/) you can setup the server:\n\nsudo python3 exploit.py host 80\n\n\n\n\n\n\n\n\n\nFinally try the docx in a Windows Virtual Machine:\n\n\n\n \n\n\nDownload CVE-2021-40444", "creation_timestamp": "2026-09-08T00:00:40.163489Z"}, {"uuid": "b4060787-3ace-4230-a2f4-49ba3a5f04fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23974", "content": "Black Hat Ethical Hacking\nMicrosoft Patches Actively Exploited Windows Zero-Day Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Patches Actively Exploited Windows Zero-Day BugPost Views: 286 \nReading Time: 2 Minutes\nIn September\u2019s Patch Tuesday\u00a0crop of security fixes, Microsoft released patches for 66 CVEs, three of which are rated critical, and one of which \u2013 the Windows MSHTML zero-day \u2013 has been under active attack for nearly two weeks.\nOne other bug is listed as publicly known but isn\u2019t (yet) being exploited. Immersive Labs\u2019 Kevin Breen, director of cyber threat research, observed that with only one CVE under active attack in the wild, it\u2019s \u201cquite a light Patch Tuesday\u201d \u2013 at least on the surface, that is.\n\nThe flaws were found in Microsoft Windows and Windows components, Microsoft Edge (Chromium, iOS, and Android), Azure, Office and Office Components, SharePoint Server, Microsoft Windows DNS and the Windows Subsystem for Linux.\n\nOf the 66 new CVEs patched today, three are rated critical, 62 are rated important, and one is rated moderate in severity.\n\nOver the past nine months of 2021, this is the seventh month in which Microsoft patched fewer than 100 CVEs, in stark contrast to 2020, when Redmond spent eight months gushing out more than 100 CVE patches per month. But while the overall number of vulnerabilities is lighter, the severity ratings have ticked up, as the Zero Day Initiative\u00a0noted.\n\nSome observers pegged the top patching priority in this month\u2019s batch as being a fix for CVE-2021-40444: An important-rated vulnerability in Microsoft\u2019s MSHTML (Trident) engine that rates 8.8 out of 10 on the CVSS scale.\n\nDisclosed on Sept. 7, it\u2019s a painfully throbbing sore thumb, given that researchers developed a number of proof-of-concept (PoC) exploits showing how drop-dead simple it is to exploit, and attackers have been sharing guides on how to do just that.\nSee Also: Complete Offensive Security and Ethical Hacking Course Under Active Attack: CVE-2021-40444It\u2019s been nearly two weeks since this serious, simple to exploit bug has been under active attack, and it\u2019s been nearly a week since attackers started to share blueprints on how to carry out an exploit.\n\nMicrosoft said last week that the flaw could let an attacker \u201ccraft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine,\u201d after which \u201cthe attacker would then have to convince the user to open the malicious document.\u201d Unfortunately, malicious macro attacks continue to be prevalent: In July, for example, legacy users of Microsoft Excel were being targeted in a malware campaign that used a novel malware-obfuscation technique\u00a0to disable malicious macro warnings and deliver the ZLoader trojan.\n\nAn attacker would need to convince a user to open a specially crafted Microsoft Office document containing the exploit code.\n\nSatnam Narang, staff research engineer at Tenable, noted via email that there have been warnings that this vulnerability will be incorporated into malware payloads and used to distribute ransomware: A solid reason to put the patch at the top of your priority list.\n\n\u201cThere are no indications that this has happened yet, but with the patch now available, organizations should prioritize updating their systems as soon as possible,\u201d Narang told Threatpost.\n\nLast Wednesday, Sept. 8, Kevin Beaumont\u00a0\u2013 head of the security operations center for U.K. fashion retailer Arcadia Group and a past senior threat intelligence analyst at Microsoft \u2013 noted\u00a0that the exploit had been in the wild for about a week or more.\n\nIt got worse: Last Thursday, Sept. 9, threat actors began sharing exploit h[...]", "creation_timestamp": "2026-09-08T00:00:41.545732Z"}, {"uuid": "4103b924-e173-4878-a20c-003429aeec8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23975", "content": "ow-tos\u00a0and PoCs for the Windows MSHTML zero-day. BleepingComputer gave it a try and found that the guides are \u201csimple to follow and [allow] anyone to create their own working version\u201d of the exploit, \u201cincluding a Python server to distribute the malicious documents and CAB files.\u201d\n\nIt took the publication all of 15 minutes to recreate the exploit.\n\nA week ago, on Tuesday, Sept. 7, Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) had urged mitigations\u00a0of the remote-code execution (RCE) flaw, which is found in all modern Windows operating systems.\n\nLast week, the company didn\u2019t say much about the bug in MSHTML, aka Trident, which is the HTML engine built into Windows since Internet Explorer debuted more than 20 years ago and which allows Windows to read and display HTML files.\n\nMicrosoft did say, however, that it was aware of targeted attacks trying to exploit it via specially crafted Microsoft Office documents.\n\nIn spite of there being no security updates available for the vulnerability at that time, MIcrosoft went ahead and disclosed it, along with mitigations meant to help prevent exploitation.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges Mitigations That Don\u2019t MitigateTracked as CVE-2021-40444, the flaw is serious enough that CISA sent its own advisory, alerting users and administrators and recommending that they use the mitigations and workarounds Microsoft recommended \u2013 mitigations that try to prevent exploitation by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nEmphasis on \u201ctry to:\u201d Unfortunately, those mitigations proved to be less than foolproof, as researchers, including Beaumont, managed to modify the exploit\u00a0so that it didn\u2019t use ActiveX, effectively skirting Microsoft\u2019s mitigations.\n\nThe Zero Day Initiative said that\u00a0for now, the most-effective defense is \u201cto apply the patch and avoid Office docs you aren\u2019t expecting to receive.\u201d\n\nBe sure to carefully review and install all the needed patches\u00a0for your setup: There\u2019s a long list of updates for specific platforms, and it\u2019s important not to slather on too thin a layer of protection.\n\nCredit for finding this bug goes to Rick Cole of MSTIC; Bryce Abdo, Dhanesh Kizhakkinan and Genwei Jiang, all from Mandiant; and Haifei Li of EXPMON. Baddest Bug AwardThe award for baddest bug \u2013 or at least, the one with the highest severity rating, with a CVSS score of 9.8 \u2013 goes to CVE-2021-38647: a critical remote-code execution (RCE) vulnerability in Open Management Infrastructure. OMI is an open-source project\u00a0to further the development of a production-quality implementation of the DMTF CIM/WBEM\u00a0standards.\n\n\u201cThis vulnerability requires no user interaction or privileges, so an attacker can run their code on an affected system just by sending a specially crafted message to an affected system,\u201d the Zero Day Initiatve explained. That makes it high priority: ZDI recommended that OMI users test and deploy this one quickly.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Yet More PrintNightmare PatchesMicrosoft also patched three elevation of privilege vulnerabilities in Windows Print Spooler (CVE-2021-38667, CVE-2021-38671\u00a0and CVE-2021-40447), all rated important.\n\nThese are the three latest fixes in a steady stream\u00a0of patches\u00a0for flaws in Windows Print Spooler that followed the disclosure of PrintNightmare\u00a0in June. This probably won\u2019t be the last patch in that parade: Tenable\u2019s Narang told Threatpost that \u201cresearchers continue to discover ways to exploit Print Spooler\u201d and that the firm expects \u201ccontinued research in this area.\u201d\n\nOnly one \u2013 CVE-2021-38671 \u2013 of today\u2019s patch trio is rated as \u201cexploitation more likely.\u201d Regardless, organizations should prioritize patching these flaws as \u201cthey are extremely valuable to attackers in post-exploitation scenarios,\u201d Narang observed. More \u2018Exploitation More Likely\u2019Immersive\u2019s Breen told Thre[...]", "creation_timestamp": "2026-09-08T00:00:41.597662Z"}, {"uuid": "46361f45-8dc1-4543-8362-72904ee1b0ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23976", "content": "atpost that a trio of local privilege-escalation vulnerabilities in the Windows Common Log File System Driver (CVE-2021-36955, CVE-2021-36963, CVE-2021-38633) are also noteworthy, all of them being listed as \u201cexploitation more likely.\u201d\n\n\u201cLocal priv-esc vulnerabilities are a key component of almost every successful cyberattack, especially for the likes of ransomware operators who abuse this kind of exploit to gain the highest level of access,\u201d Breen said via email. \u201cThis allows them to disable antivirus, delete backups and ensure their encryptors can reach even the most sensitive of files.\u201d\n\nOne glaring example of that emerged in May, when hundreds of millions of Dell users were found to be at risk\u00a0from kernel-privilege bugs. The bugs lurked undisclosed for 12 years, and could have allowed attackers to bypass security products, execute code and pivot to other parts of the network for lateral movement.\n\nThe three exploits Microsoft patched on Tuesday aren\u2019t remote, meaning that attackers need to have achieved code execution by other means. One such way would be via CVE-2021-40444.\n\nTwo other vulnerabilities \u2013 CVE-2021-38639\u00a0and CVE-2021-36975, both Win32k escalation of privilege flaws \u2013 have also been listed as \u201cexploitation more likely\u201d and, together, cover the full range of supported Windows versions.\n\nBreen said that he\u2019s starting to feel like a broken record when it comes to privilege escalation vulnerabilities. They\u2019re not rated as high a severity risk as RCE bugs, but \u201cthese local exploits can be the linchpin in the post-exploitation phases of an experienced attacker,\u201d he asserted. \u201cIf you can block them here you have the potential to significantly limit their damage.\u201d\n\nhe added, \u201cIf we assume a determined attacker will be able to infect a victim\u2019s device through social engineering or other techniques, I would argue that patching priv-esc vulnerabilities is even more important than patching some other remote code-execution vulns,\u201d Breen said. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerStill, This RCE Is Pretty ImportantDanny Kim, a principal architect at Virsec who spent time at Microsoft during his graduate work on the OS security development team, wants security teams to pay attention to CVE-2021-36965\u00a0\u2013 an important-rated Windows WLAN AutoConfig Service RCE vulnerability \u2013 given its combination of severity (with a CVSS:3.0 base score of 8.8); no requirement for privilege escalation/user interaction to exploit; and breadth of affected Windows versions.\n\nThe WLAN AutoConfig Service is part of the mechanism that Windows 10 uses to choose the wireless network a computer will connect to, and to the Windows Scripting Engine, respectively.\n\nThe patch fixes a flaw that could allow network-adjacent attackers to run their code on affected systems at system level.\n\nAs the Zero Day Initiative explained, that means an attacker could \u201ccompletely take over the target \u2013 provided they are on an adjacent network.\u201d That would come in quite handy in a coffee-shop attack, where multiple people use an unsecured Wi-Fi network.\n\nThis one \u201cis especially alarming,\u201d Kim said: Think SolarWinds\u00a0and PrintNightmare.\n\n\u201cAs recent trends have shown, remote code execution-based attacks are the most critical vulnerabilities that can lead to the largest negative impact on an enterprise, as we have seen in the Solarwinds and PrintNightmare attacks,\u201d he said in an email.\n\nKim said that in spite of the exploit code maturity being currently unproven, the vulnerability has been confirmed to exist, leaving an opening for attackers.\n\n\u201cIt specifically relies on the attacker being located in the same network, so it would not be surprising to see this vulnerability used in combination with another CVE/attack to achieve an attacker\u2019s end goal,\u201d he predicted. \u201cRemote code execution attacks can lead to unverified processes running on the server workload, only highlighting the need for constant, deter[...]", "creation_timestamp": "2026-09-08T00:00:42.048565Z"}, {"uuid": "83b3a323-3bf1-443f-8c17-7b177854334d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/25022", "content": "Kali Linux Tutorials\nCVE-2021-40444 PoC : Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nCVE-2021-40444 PoC is a Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nCreation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)\n\nYou need to install lcab first (sudo apt-get install lcab)\n\nCheck REPRODUCE.mdfor manual reproduce steps\n\nIf your generated cab is not working, try pointing out exploit.html URL to calc.cab\n\nUsing\n\nFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dllwhich just pops a calc.exefrom a call to system()\n\npython3 exploit.py generate test/calc.dll http://<srv\nhttps://1.bp.blogspot.com/-q4Qrx7Kd10w/YUSYEQDTIKI/AAAAAAAAK3w/rWAn8dYhzeo9G7J7CS_SIsi7AHjsGyrAACLcBGAsYHQ/s1007/1.png \nOnce you generate the malicious docx (will be at out/) you can setup the server:\n\nsudo python3 exploit.py host 80\nhttps://1.bp.blogspot.com/-M4bM8mj9wHQ/YUSZE58fPgI/AAAAAAAAK34/yfSeOeg_uPUFIO7r09C6jWuwUp5VJdzyACLcBGAsYHQ/s866/2.png \nFinally try the docx in a Windows Virtual Machine:\nhttps://1.bp.blogspot.com/-W1O2pPuOcdc/YUSZXkgQ8UI/AAAAAAAAK4A/OejDX89jfsEjS6K9u5kHcyYmKCg30TKqwCLcBGAsYHQ/s1473/3.png \n\nDownload", "creation_timestamp": "2026-09-08T00:00:44.227850Z"}, {"uuid": "8b2a76a9-efd5-4e5d-9783-4cc2b95be02a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/32652", "content": "Black Hat Ethical Hacking\nHackers exploit Microsoft MSHTML bug to steal Google, Instagram creds\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers exploit Microsoft MSHTML bug to steal Google, Instagram credsPost Views: 118 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nA newly discovered Iranian threat actor is stealing Google and Instagram credentials belonging to Farsi-speaking targets worldwide using a new PowerShell-based stealer dubbed PowerShortShell by security researchers at SafeBreach Labs.\nThe info stealer is also used for Telegram surveillance and collecting system information from compromised devices that get sent to attacker-controlled servers together with the stolen credentials.\n\nAs SafeBreach Labs discovered, the attacks (publicly reported in September\u00a0on Twitter by the Shadow Chaser Group) started in July as spear-phishing emails.\n\nThey target Windows users with malicious Winword attachments that exploit a Microsoft MSHTML remote code execution (RCE) bug tracked as CVE-2021-40444.\n\nThe PowerShortShell stealer payload is executed by a DLL downloaded on compromised systems. Once launched, the PowerShell script starts collecting data and screen snapshots, exfiltrating it to the attacker\u2019s command-and-control server.\n\n\u201cAlmost half of the victims are located in the United States. Based on the Microsoft Word document content \u2013 which blames Iran\u2019s leader for the \u2018Corona massacre\u2019 and the nature of the collected data, we assume that the victims might be Iranians who live abroad and might be seen as a threat to Iran\u2019s Islamic regime,\u201d said\u00a0Tomer Bar, Director of Security Research at SafeBreach Labs.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cThe adversary might be tied to Iran\u2019s Islamic regime since the Telegram surveillance usage is typical of Iran\u2019s threat actors like Infy, Ferocious Kitten, and Rampant Kitten.\u201d\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Victim_heat_map.png \n<figcaptionVictims heat map (SafeBreach Labs) \nThe CVE-2021-40444 RCE bug impacting IE\u2019s MSTHML rendering engine has been exploited in the wild as a zero-day starting with August 18, more than two weeks before Microsoft issued a security advisory with a partial workaround, and three weeks before a patch was released.\n\nMost recently, it was exploited in conjunction with malicious advertisements by the Magniber ransomware gang\u00a0to infect targets with malware and encrypt their devices. Microsoft also said multiple threat actors, including ransomware affiliates, targeted\u00a0this\u00a0Windows MSHTML\u00a0RCE bug using\u00a0maliciously crafted Office documents delivered via phishing attacks.\nSee Also: New Windows zero-day with public exploit lets you become an admin These attacks abused the CVE-2021-40444 flaw \u201cas part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders.\u201d\n\nThe deployed beacons communicated with malicious infrastructure connected with several cybercrime campaigns, including but not limited to human-operated ransomware.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/CVE-2021-40444-attack-chain%20.png \n<figcaptionCVE-2021-40444 attack-chain (Microsoft)\u200b\u200b\u200b\u200b \nIt\u2019s not surprising that more and more attackers are using CVE-2021-40444 exploits since threat actors started sharing tutorials and proof-of-concept exploits on hacking forums even before the bug was patched.\n\nThis likely allowed other threat actors and groups to start exploiting the security flaw in their own attacks.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools The information shared online is simple to follow an[...]", "creation_timestamp": "2026-09-08T00:01:02.110922Z"}, {"uuid": "2d665260-63ce-47c8-a972-13908e2fc04b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "published-proof-of-concept", "source": "Telegram/IA4XgtEHd-haIvubTq2mTO_kd0Vg0I8wTENFQqmco9j3ibc", "content": "", "creation_timestamp": "2026-09-08T00:01:01.556707Z"}, {"uuid": "d4b6bd6b-8a0b-433e-8288-7891245e14a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/32653", "content": "d makes it easy for anyone to create their own working version of a CVE-2021-40444 exploit, including a Python server that can distribute malicious documents and CAB files to compromised systems.\n\nUsing this info, BleepingComputer\u00a0could also successfully reproduce the exploit in about 15 minutes, as demonstrated in this video demo.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-2-90x90.jpg Microsoft Exchange servers hacked in internal reply-chain attacks3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/slembunk-android-banking-trojan-targets-31-banks-across-the-world-497808-3-90x90.jpg Android malware BrazKing returns as a stealthier banking trojan6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/redcurl-90x90.jpg RedCurl corporate espionage hackers resume attacks with updated tools7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-1-90x90.jpg WordPress sites are being hacked in fake ransomware attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ECS-Instance-Types-90x90.png Alibaba ECS instances actively hijacked by cryptomining malware1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-90x90.jpg QBot returns for a new wave of infections using Squirrelwaffle1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/face-malware-virus-infected-red-network-90x90.jpg BotenaGo botnet targets millions of IoT devices with 33 exploits2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-90x90.jpg Microsoft patches Excel zero-day used in attacks, asks Mac users to wait2 weeks ago\nThe post Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-08T00:01:02.071269Z"}, {"uuid": "7ea5e743-316e-4237-96a4-8f08f96bba70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/word_mshtml_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x64\", \"author\": [\"lockedbyte\", \"klezVirus\", \"thesunRider\", \"mekhalleh (RAMELLA S\\u00e9bastien)\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module creates a malicious docx file that when opened in Word on a vulnerable Windows\\n          system will lead to code execution. This vulnerability exists because an attacker can\\n          craft a malicious ActiveX control to be used by a Microsoft Office document that hosts\\n          the browser rendering engine.\", \"disclosure_date\": \"2021-09-23\", \"fullname\": \"exploit/windows/fileformat/word_mshtml_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"Microsoft Office Word Malicious MSHTML RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unreliable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/fileformat/word_mshtml_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/fileformat/word_mshtml_rce\", \"references\": [\"CVE-2021-40444\", \"URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444\", \"URL-https://www.sentinelone.com/blog/peeking-into-cve-2021-40444-ms-office-zero-day-vulnerability-exploited-in-the-wild/\", \"URL-https://download.microsoft.com/download/4/d/a/4da14f27-b4ef-4170-a6e6-5b1ef85b1baa/%5Bms-cab%5D.pdf\", \"URL-https://github.com/lockedbyte/CVE-2021-40444/blob/master/REPRODUCE.md\", \"URL-https://github.com/klezVirus/CVE-2021-40444\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Hosted\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:34.485246Z"}, {"uuid": "65bec38c-e991-4d69-ad0d-b7e36d4ae2d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cissp/7029", "content": "Cybercriminals are leveraging exploits for CVE-2021-40444 and CVE-2022-30190 to execute code through malicious Word files. Once opened, LokiBot malware is downloaded, logging keystrokes, capturing screenshots, and stealing data.   \nRead: https://thehackernews.com/2023/07/cybercriminals-exploit-microsoft-word.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1402.04.26", "creation_timestamp": "2026-09-09T23:00:06.006053Z"}, {"uuid": "5a5635d9-35e5-4d04-b4a8-9eddcdbd61dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cissp/7029", "content": "Cybercriminals are leveraging exploits for CVE-2021-40444 and CVE-2022-30190 to execute code through malicious Word files. Once opened, LokiBot malware is downloaded, logging keystrokes, capturing screenshots, and stealing data.   \nRead: https://thehackernews.com/2023/07/cybercriminals-exploit-microsoft-word.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1402.04.26", "creation_timestamp": "2026-09-10T00:00:10.296955Z"}, {"uuid": "e2445b4d-8051-4df7-946e-aae2725fcd12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/cissp/5363", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "creation_timestamp": "2026-09-10T11:00:03.838040Z"}, {"uuid": "ae37804f-79c5-4e38-80d5-e0f1d5ee5b7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/cissp/5362", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "creation_timestamp": "2026-09-10T12:00:05.455463Z"}]}