PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2023-38831] Cảnh báo chiến dịch tấn công của nhóm APT Darkpink nhắm vào các nước Đông Nam Á

blog.viettelcybersecurity.com | vulnerability | CVE-2023-38831 | #apt | #malware-analysis | #winrar | #dll-sideloading | #darkpink | #cve-2023-38831
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Viettel links a Vietnamese-language decoy campaign to Darkpink: it abuses WinRAR CVE-2023-38831 with DLL sideloading and persists PowerShell payloads via registry and shortcut persistence.
CVE
CVE-2023-38831
Published
Collected

Related coverage

blog · blog.viettelcybersecurity.com
Chiến dịch tấn công mới của nhóm Lotus Blossom: Kỹ thuật Domain Fronting và Lợi dụng các hệ thống quản trị tập trung (Phần 3)
Vietnamese Part 3 of Viettel's Lotus Blossom series analyzes the SignLoader malware: DLL sideloading via a Bitdefender module, anti-analysis tricks (API hashing, junk code), and payload decryption.
blog · blog.viettelcybersecurity.com
Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 3)
Part 3 of Viettel's Lotus Blossom series dissects SignLoader: DLL sideloading via a Bitdefender module, anti-analysis (junk code, exception abuse, Carbanak API hashing), and payload decryption.
vulnerability · swarm.ptsecurity.com
WinRAR’s vulnerable trialware: when free software isn’t free
A chance find in WinRAR 5.70: its expired-trial notification window loads remote content through the legacy IE engine over HTTPS, so an attacker who can intercept traffic or spoof DNS can return a malicious redirect and achieve RCE. Tracked as CVE-2021-35052.
vulnerability · volexity.com
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
Volexity frequently works with individuals and organizations heavily targeted by sophisticated, motivated, and well-equipped threat actors from around the world. Some of these individuals or organizations are attacked infrequently or […]
vulnerability · volexity.com
Zero-Day Exploitation of Atlassian Confluence
UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to […]
vulnerability · volexity.com
Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
[UPDATE] On February 4, 2022, Zimbra provided an update regarding this zero-day exploit vulnerability and reported that a hotfix for 8.8.15 P30 would be available on February 5, 2022. This vulnerability […]
Back