Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
icsIndustrial Control Systems Cyber Emergency Response TeamAA22-321A
HistoryNov 25, 2022 - 12:00 p.m.

#StopRansomware: Hive Ransomware

2022-11-2512:00:00
Industrial Control Systems Cyber Emergency Response Team
www.cisa.gov
70
ransomware
hive
multi-factor authentication
vulnerabilities
cyber threats
fbi
cisa
hhs
mitigations
mitre att&ck
tactics
techniques
healthcare
phishing
microsoft exchange
cve-2020-12812
remote desktop protocol
cve-2021-31207
cve-2021-34473

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.973

Percentile

99.9%

JSON

Actions to Take Today to Mitigate Cyber Threats from Ransomware:

  1. Prioritize remediating known exploited vulnerabilities.
  2. Enable and enforce multifactor authentication with strong passwords.
  3. Close unused ports and remove any application not deemed necessary for day-to-day operations.

References

Related

thn 19
rapid7blog 9
malwarebytes 7
packetstorm 3
githubexploit 15
cisa 3
attackerkb 9
hivepro 9
pentestpartners 1
threatpost 14
trellix 2
zdt 3
fireeye 1
metasploit 2
qualysblog 11
securelist 4
checkpoint_advisories 3
ics 7
mmpc 3
msrc 2
cve 5
nessus 5
nvd 5
zdi 3
prion 5
fortinet 1
cisa_kev 5
cvelist 5
cnvd 1
mscve 4
avleonov 3
kaspersky 3
mskb 3
krebs 2
impervablog 1
nuclei 1
kitploit 1
mssecure 2
googleprojectzero 1
thn
thn
New Incident Report Reveals How Hive Ransomware Targets Organizations
2022-04-21 10:00:00
MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks
2024-05-22 07:41:00
WARNING: Microsoft Exchange Under Attack With ProxyShell Flaws
2021-08-22 09:51:00
rapid7blog
rapid7blog
For Microsoft Exchange Server Vulnerabilities, Patching Remains Patchy
2021-10-06 14:07:12
ProxyShell: More Widespread Exploitation of Microsoft Exchange Servers
2021-08-12 21:08:43
Metasploit Wrap-Up
2021-08-20 19:12:00
malwarebytes
malwarebytes
Patch now! Microsoft Exchange is being attacked via ProxyShell
2021-08-23 13:21:08
IIS extensions are on the rise as backdoors to servers
2022-07-27 13:58:06
AvosLocker ransomware uses Microsoft Exchange Server vulnerabilities, says FBI
2022-03-21 21:09:12
packetstorm
packetstorm
Microsoft Exchange ProxyShell Remote Code Execution
2021-08-20 00:00:00
Microsoft Exchange Server Remote Code Execution
2022-02-25 00:00:00
Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution
2022-08-22 00:00:00
githubexploit
githubexploit
Exploit for Vulnerability in Microsoft
2021-10-02 07:29:24
Exploit for Unrestricted Upload of File with Dangerous Type in Microsoft
2021-09-04 15:34:03
Exploit for Server-Side Request Forgery in Microsoft
2022-06-29 12:37:31
cisa
cisa
Urgent: Protect Against Active Exploitation of ProxyShell Vulnerabilities
2021-08-21 00:00:00
FBI-CISA Joint Advisory on Exploitation of Fortinet FortiOS Vulnerabilities
2021-04-02 00:00:00
CISA Adds Four Known Exploited Vulnerabilities to Catalog
2021-11-17 00:00:00
attackerkb
attackerkb
ProxyShell Exploit Chain
2023-12-28 00:00:00
CVE-2021-42321
2021-11-10 00:00:00
CVE-2021-34523
2021-07-14 00:00:00
hivepro
hivepro
BlackByte ransomware exploits Microsoft Servers ProxyShell Vulnerabilities
2021-12-07 13:24:49
Magic Hound Exploiting Old Microsoft Exchange ProxyShell Vulnerabilities
2022-03-25 04:05:09
Hive Ransomware targets organizations with ProxyShell exploit
2022-04-22 14:34:47
pentestpartners
pentestpartners
Hive Ransomware is on the rise. How should you deal with it?
2022-11-18 06:44:42
threatpost
threatpost
Microsoft Breaks Silence on Barrage of ProxyShell Attacks
2021-08-26 12:39:54
ProxyShell Attacks Pummel Unpatched Exchange Servers
2021-08-23 18:54:29
‘Tortilla’ Wraps Exchange Servers in ProxyShell Attacks
2021-11-03 18:16:37
trellix
trellix
Trellix Global Defenders: Analysis and Protections for BlackByte Ransomware
2022-02-28 00:00:00
Trellix Global Defenders: Analysis and Protections for BlackByte Ransomware
2022-02-28 00:00:00
zdt
zdt
Microsoft Exchange ProxyShell Remote Code Execution Exploit
2021-08-21 00:00:00
Microsoft Exchange Server Remote Code Execution Exploit
2022-02-26 00:00:00
Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution Exploit
2022-08-22 00:00:00
fireeye
fireeye
PST, Want a Shell? ProxyShell Exploiting Microsoft Exchange Servers
2021-09-03 10:00:00
metasploit
metasploit
Microsoft Exchange ProxyShell RCE
2021-08-18 14:50:34
Microsoft Exchange Server ChainedSerializationBinder RCE
2022-08-09 17:32:09
qualysblog
qualysblog
AvosLocker Ransomware Behavior Examined on Windows & Linux
2022-03-07 05:18:46
In-Depth Look Into Data-Driven Science Behind Qualys TruRisk
2022-10-10 14:32:29
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities
2023-08-24 19:07:05
securelist
securelist
Tropic Trooper spies on government entities in the Middle East
2024-09-05 08:00:12
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
2022-12-19 16:15:49
From Caribbean shores to your devices: analyzing Cuba ransomware
2023-09-11 10:00:26
checkpoint_advisories
checkpoint_advisories
Microsoft Exchange Server Remote Code Execution (CVE-2021-34473; CVE-2021-34523)
2021-07-14 00:00:00
Microsoft Exchange Server Remote Code Execution (CVE-2021-42321)
2021-11-23 00:00:00
Microsoft Exchange Server Security Feature Authentication Bypass (CVE-2021-31207)
2021-12-16 00:00:00
ics
ics
People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action
2024-07-08 12:00:00
Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities
2021-11-19 12:00:00
Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations
2022-09-14 12:00:00
mmpc
mmpc
The five-day job: A BlackByte ransomware intrusion case study
2023-07-06 17:00:00
Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability
2021-12-12 05:29:03
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
2022-05-09 13:00:00
msrc
msrc
April 2021 Update Tuesday packages now available
2021-04-13 07:00:00
April 2021 Update Tuesday packages now available
2021-04-13 07:00:00
cve
cve
CVE-2020-12812
2020-07-24 23:15:12
CVE-2021-42321
2021-11-10 01:19:50
CVE-2021-34523
2021-07-14 18:15:12
nessus
nessus
Fortinet FortiOS < 6.0.10 / 6.2.x < 6.2.4 / 6.4.x < 6.4.1 Improper Authentication (FG-IR-19-283)
2020-10-02 00:00:00
Security Updates for Microsoft Exchange Server (April 2021)
2021-04-13 00:00:00
Security Updates for Exchange (November 2021) (Remote)
2021-12-09 00:00:00
nvd
nvd
CVE-2020-12812
2020-07-24 23:15:12
CVE-2021-34473
2021-07-14 18:15:11
CVE-2021-42321
2021-11-10 01:19:50
zdi
zdi
(Pwn2Own) Microsoft Exchange Server PowerShell Improper Authentication Remote Code Execution Vulnerability
2021-07-19 00:00:00
(Pwn2Own) Microsoft Exchange Server Autodiscover Server Side Request Forgery Authentication Bypass Vulnerability
2021-07-19 00:00:00
(Pwn2Own) Microsoft Exchange Server Arbitrary File Write Remote Code Execution Vulnerability
2021-07-19 00:00:00
prion
prion
Security feature bypass
2021-05-11 19:15:00
Authentication flaw
2020-07-24 23:15:00
Remote code execution
2021-11-10 01:19:00
fortinet
fortinet
Protect
2020-07-13 00:00:00
cisa_kev
cisa_kev
Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
2021-11-03 00:00:00
Microsoft Exchange Server Remote Code Execution Vulnerability
2021-11-17 00:00:00
Microsoft Exchange Server Privilege Escalation Vulnerability
2021-11-03 00:00:00
cvelist
cvelist
CVE-2020-12812
2020-07-24 22:28:43
CVE-2021-42321 Microsoft Exchange Server Remote Code Execution Vulnerability
2021-11-10 00:47:43
CVE-2021-34523 Microsoft Exchange Server Elevation of Privilege Vulnerability
2021-07-14 17:54:38
cnvd
cnvd
Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2021-90307)
2021-11-12 00:00:00
mscve
mscve
Microsoft Exchange Server Remote Code Execution Vulnerability
2021-11-09 08:00:00
Microsoft Exchange Server Elevation of Privilege Vulnerability
2021-07-13 07:00:00
Microsoft Exchange Server Security Feature Bypass Vulnerability
2021-05-11 07:00:00
avleonov
avleonov
Security News: Exchange ProxyShell, Zoom RCE, Citrix Canceled PT Acknowledgments, Cisco No Patch Router RCEs
2021-08-31 23:16:51
Vulnerability Management news and publications #2
2022-08-14 11:30:44
Vulristics Command Line Interface, improved Product & Vuln. Type Detections and Microsoft Patch Tuesday November 2021
2021-11-30 20:30:48
kaspersky
kaspersky
KLA12224 Multiple vulnerabilities in Microsoft Exchange Server
2021-07-13 00:00:00
KLA12342 Multiple vulnerabilities in Microsoft Server Software
2021-11-09 00:00:00
KLA12169 Multiple vulnerabilities in Microsoft Exchange Server
2021-05-11 00:00:00
mskb
mskb
Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: April 13, 2021 (KB5001779)
2021-07-13 07:00:00
Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: November 9, 2021 (KB5007409)
2021-11-09 08:00:00
Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: May 11, 2021 (KB5003435)
2021-05-11 07:00:00
krebs
krebs
Microsoft Patch Tuesday, July 2021 Edition
2021-07-13 21:41:47
Microsoft Patch Tuesday, November 2021 Edition
2021-11-09 20:39:07
impervablog
impervablog
Microsoft Exchange Server Vulnerabilities CVE-2022-41040 and CVE-2022-41082
2022-09-30 16:47:34
nuclei
nuclei
Exchange Server - Remote Code Execution
2021-08-10 07:59:06
kitploit
kitploit
Heyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types
2022-05-12 21:30:00
mssecure
mssecure
Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability
2021-12-12 05:29:03
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
2022-05-09 13:00:00
googleprojectzero
googleprojectzero
The More You Know, The More You Know You Don’t Know
2022-04-19 00:00:00

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.973

Percentile

99.9%

JSON
Related for AA22-321A
thn19rapid7blog9malwarebytes7packetstorm3githubexploit15cisa3attackerkb9hivepro9pentestpartners1threatpost14trellix2zdt3fireeye1metasploit2qualysblog11securelist4checkpoint_advisories3ics7mmpc3msrc2cve5nessus5nvd5zdi3prion5fortinet1cisa_kev5cvelist5cnvd1mscve4avleonov3kaspersky3mskb3krebs2impervablog1nuclei1kitploit1mssecure2googleprojectzero1