MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-27 01:07:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #400 from Delta-Sierra/master

Browse source 
add Sodinokibi
This commit is contained in:
Deborah Servili 2019-05-13 08:50:26 +02:00 committed by GitHub
commit f8e356e042
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
clusters/ransomware.json
View file

@ -13139,7 +13139,17 @@
}, },
"uuid": "8cfa554a-1e1b-328a-606f-026d771870b1", "uuid": "8cfa554a-1e1b-328a-606f-026d771870b1",
"value": "Cr1ptT0r" "value": "Cr1ptT0r"
},
{
"description": "Attackers are actively exploiting a recently disclosed vulnerability in Oracle WebLogic to install a new variant of ransomware called \"Sodinokibi.\" Sodinokibi attempts to encrypt data in a user's directory and delete shadow copy backups to make data recovery more difficult. Oracle first patched the issue on April 26, outside of their normal patch cycle, and assigned it CVE-2019-2725. This vulnerability is easy for attackers to exploit, as anyone with HTTP access to the WebLogic server could carry out an attack. Because of this, the bug has a CVSS score of 9.8/10. Attackers have been making use of this exploit in the wild since at least April 17. Cisco's Incident Response (IR) team, along with Cisco Talos, are actively investigating these attacks and Sodinokibi.",
"meta": {
"refs": [
"https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html"
]
},
"uuid": "24bd9a4b-2b66-428b-8e1c-6b280b056c00",
"value": "Sodinokibi"
} }
], ],
"version": 61 "version": 62
} }