PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2017-11882] Chiến dịch của nhóm APT Goblin Panda lợi dụng đại dịch Covid-19

blog.viettelcybersecurity.com | research | CVE-2017-11882 | #threat-intelligence | #apt | #viettel | #covid-19 | #rat | #plugx | #goblin-panda
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Viettel Threat Intelligence tracks Goblin Panda (aka Hellsing, 1937CN) campaigns exploiting COVID-19 themes, using RTF exploits and PlugX/NewCoreRAT to breach government targets and evade most AVs.
CVE
CVE-2017-11882
Published
Collected

Related coverage

research · hunt.io
Ukraine’s State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell
An exposed open directory revealed a solo operator's full Log4Shell chain against a Graylog host holding Trembita logs, with the access log that proves execution.
research · volexity.com
OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society
In May 2017, Volexity identified and started tracking a very sophisticated and extremely widespread mass digital surveillance and attack campaign targeting several Asian nations, the ASEAN organization, and hundreds of […]
research · volexity.com
Real News, Fake Flash: Mac OS X Users Targeted
Volexity recently identified a breach to the website of a well regarded media outlet in the country of Georgia. As part of this breach, the media organization’s website was being […]
research · volexity.com
PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs
In the wake of the 2016 United States Presidential Election, not even six hours after Donald Trump became the nation’s President-Elect, an advanced persistent threat (APT) group launched a series […]
research · volexity.com
Afghan Government Compromise: Browser Beware
Visiting a wide-ranging number of websites associated with the Government of Afghanistan may yield visitors an unwanted surprise. For the second time this year, malicious code has surfaced on, cdn.afghanistan.af, […]
research · volexity.com
Drupal Vulnerability: Mass Scans & Targeted Exploitation
Yesterday (October 15, 2014), a critical SQL injection vulnerability in version 7 of the popular open source content management system (CMS) Drupal was disclosed by Stefan Horst and detailed in […]
Back