PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Phát hiện chiến dịch tấn công mới của nhóm APT vào các máy chủ IIS sử dụng mã độc IIS Raid

blog.viettelcybersecurity.com | blog | #incident-response | #apt | #proxylogon | #exchange | #iis-raid | #iis-backdoor
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Viettel's IR team details an APT campaign on a construction firm: ProxyLogon exploitation of Exchange, then the IIS Raid backdoor harvesting OWA credentials and persisting via malicious IIS modules.
Published
Collected

Related coverage

vulnerability · volexity.com
Microsoft Exchange Control Panel (ECP) Vulnerability CVE-2020-0688 Exploited
On February 11, 2020, as part of Patch Tuesday, Microsoft released cumulative updates and a service pack that addressed a remote code execution vulnerability found in Microsoft Exchange 2010, 2013, […]
blog · blog.viettelcybersecurity.com
The OWASSRF + TabShell exploit chain
Viettel details two MSRC-reported Exchange bugs: OWASSRF, an authenticated SSRF via the X-OWA-ExplicitLogonUser header reaching backend /powershell, chained with TabShell for RCE in the wild.
blog · blog.viettelcybersecurity.com
Pwn2Own 2021 Microsoft Exchange Exploit Chain
A Viettel researcher recounts his Pwn2Own 2021 Exchange chain: unauthenticated Autodiscover SSRF, PowerShell backend auth bypass, and OAB file write for RCE - the first two duplicated ProxyShell.
blog · aikido.dev
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
# LiteLLM compromised again: infostealer and RAT found in version 1.107.0 Written by Ilyas Makari Published on: Oct 21, 2026 On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source...
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · crowdstrike.com
CrowdStrike Achieves NCSC CIR Enhanced Level Assurance
# CrowdStrike Achieves NCSC CIR Enhanced Level Assurance ## The Enhanced assurance is government-backed proof that our incident response practice is built for the UK's most serious breaches....
Back