adulau/misp-circl-feed
1
0
Fork 0
Code Issues Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/ffea72a3-7935-4078-b769-b872475c5eae.json

2622 lines
No EOL
170 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--ffea72a3-7935-4078-b769-b872475c5eae",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:59:25.000Z",
"modified": "2024-11-27T08:59:25.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--ffea72a3-7935-4078-b769-b872475c5eae",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:59:25.000Z",
"modified": "2024-11-27T08:59:25.000Z",
"name": "OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions",
"published": "2024-11-27T09:10:57Z",
"object_refs": [
"vulnerability--831c04b8-68ed-4d71-bfa3-52eaa58ce4d8",
"vulnerability--dd05a57a-ed94-4a99-b95f-b6d8a835fa31",
"vulnerability--5596e6e9-b906-4ef4-9831-09226e134d28",
"vulnerability--e6b7864e-38e0-43a5-ac25-051beb63506c",
"vulnerability--669b4001-f63d-4bdf-b9e2-4fb86abba5df",
"vulnerability--df48cd61-c020-49f9-82a2-e0a798183068",
"vulnerability--67d93fff-c91c-41d1-89b2-dced25d651a5",
"vulnerability--a66dce6e-a6ff-4146-9d6a-5d7ffd4b5737",
"indicator--b07e0aa5-d18d-4a91-9e5e-dadb887c88be",
"indicator--a0eeaf5e-f029-427c-931c-c6a22854a6f6",
"indicator--5df65d1e-050c-472c-a95e-6e52e600b2df",
"indicator--744b3c19-afcd-4637-95d6-0852576acef9",
"indicator--f324d9f7-99c6-44ff-90e1-22411a9bae4f",
"indicator--64275dd4-6a4a-446d-af02-822574e7e6c3",
"indicator--fbebda1d-3710-41b7-9af6-8ea87dfc2e64",
"indicator--5e37d0a2-2c7a-4419-8936-0acab03a32c2",
"indicator--6ac0a2e8-c12e-4bf9-94d8-dc1eaa016c53",
"indicator--3509a3db-b2df-4801-838e-d4bc72994cda",
"indicator--0e0b23e7-eb09-440d-89d7-20496b8b6828",
"indicator--78c0410e-d99b-4a79-ba3d-8d431125fa5e",
"indicator--ad898f63-b2f1-4863-8d51-dd8d289fe14c",
"indicator--ecf727ea-f971-4dca-acaf-825667465fc8",
"indicator--cc4a4511-4972-4faa-b269-1978e46a28c5",
"indicator--7c7a26ec-9b9f-4f6f-916a-c7d0e3842ebc",
"indicator--61ae0a0b-bc83-4e96-b144-581f43b90877",
"indicator--7df6b10f-0984-445e-8ec6-88c1d5467e07",
"indicator--051363d5-c2c5-467d-a48c-d2ba6c93b56d",
"indicator--c6bad4e2-3049-4d96-9fe8-284f2f671c9f",
"indicator--792efa82-74b0-4604-85cf-879224d10be4",
"indicator--2ad05ad6-5baa-4525-9d3d-c6fb164acb2b",
"x-misp-object--ded8856b-f754-4b8a-a137-9042433c49b9",
"vulnerability--598166cf-5511-49b0-b406-0754e6ab2440",
"x-misp-object--0691345e-b820-496f-b054-562fef233a3d",
"attack-pattern--df3f8d43-4697-44cb-acf0-0bf24c1f73ed",
"attack-pattern--5342f955-30a8-496a-97b7-52c7904b4ab4",
"attack-pattern--5a1ed979-35ef-4e2d-a9bb-1551f2a52928",
"attack-pattern--2ba27d93-0df1-46b0-ba6a-ed8cfe29bd96",
"attack-pattern--ee77a247-d203-47ad-9e73-537a21646276",
"vulnerability--307fab05-6e48-4d29-aa58-b4ef8ed9d0de",
"vulnerability--804f2152-e97e-48ce-9915-fa298949b955",
"x-misp-object--79ff18f5-0bc3-42c6-9351-030d98f8a125",
"attack-pattern--451d3abd-c6e7-45c3-90c0-e72a24d02f7a",
"vulnerability--cb455add-8385-4a5c-912d-267c7d54b69e",
"x-misp-object--e901580b-1b8a-4af1-8b30-560ab54e6360",
"vulnerability--aef48aac-76e3-426a-a5ec-9ff59fb018a1",
"vulnerability--2311608a-fa79-4786-97d9-b9c71d1b7414",
"vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"x-misp-object--59eda582-0c44-4695-94be-2fc8be45a740",
"attack-pattern--0b8e087d-e807-4737-a91d-a7b23b7dcab2",
"attack-pattern--6d7a3232-2d66-438e-808d-3186176eb00b",
"attack-pattern--a0168d78-1fca-4506-9874-52644df4ef2d",
"attack-pattern--c7044849-01f8-4713-90fe-9ee40ae51ae4",
"attack-pattern--105b6cc6-7686-4912-88bd-3154dbf554bc",
"attack-pattern--b6d47efc-6f91-42a2-be2b-e37b2ece71a7",
"attack-pattern--9578f5a0-9e1c-4e32-a99a-0fa0a48b5f5a",
"indicator--20d3b0fe-91f1-44e7-b4a1-b16d5206d58c",
"indicator--6c8fab68-2138-4c27-9597-9ff6e1a4ffb2",
"indicator--54ae012f-305c-4d09-84af-beacb401288d",
"indicator--abf6c3b8-fe85-436f-90c6-538b9d419ca0",
"indicator--4b7cd1b0-c0e4-45c5-bc6b-7d38b54d7f25",
"indicator--25be932d-b3e2-42df-b5e6-657d82bf1916",
"indicator--bfa7d29f-7f74-4dd9-82ab-1606cf366cfe",
"indicator--e8b5e843-a4e3-434d-9f34-a6ea7a85f9b0",
"indicator--c43cc341-1655-466f-9baa-00a409f5d8f6",
"indicator--8e8cdf20-8235-4dc7-a015-7654010b9e88",
"indicator--da6199b2-b6a7-4cf7-8f81-9a897db8cd09",
"indicator--fc910d5a-983c-45ab-8475-380426288138",
"indicator--0e88a065-9d44-479e-93af-82f834e1dbce",
"note--fe91a5fe-b3b1-41ab-8948-bafb2fab4bd0",
"relationship--6140b82d-b235-475f-a249-55902e25df98",
"relationship--d259e1a4-e18b-4375-b8d3-808a1d76d43b",
"relationship--d0c03e5d-a213-4441-8423-0b1a84704edb",
"relationship--46d2a8a6-1cc8-460b-8109-d6f9f4732fc1",
"relationship--369b81d1-6c88-4a1b-8b4b-1b622289c768",
"relationship--54901cad-d1f3-4e32-92c1-eacf1774f7f4",
"relationship--8e461c5b-8b15-4601-a4a1-1645f3b88564",
"relationship--03f86837-9448-4da5-b4d8-48d09fba1a65",
"relationship--a7eb7354-8e53-418d-9eca-2ac9c0cacf9f",
"relationship--1a6fe442-c210-4ec5-a376-1c78b54e2292",
"relationship--63fa2fed-0da4-4136-9572-5dfc667b1a6b",
"relationship--b2782480-835e-4789-9a4b-cb32c2e53471",
"relationship--d4b9b839-3272-441f-aedf-4b11031724ae",
"relationship--bc829dce-4cda-4e43-bbf4-b205b69734bf",
"relationship--619d7956-64c4-43d4-8a21-0828d86f0246",
"relationship--b75532fe-aea0-4a5e-94f5-a1095300034f",
"relationship--5bf24a8d-7c4c-45f6-9445-9188e8c70502",
"relationship--0606b812-79a2-41ec-9ff9-f42f6c940a0b",
"relationship--dbe0562f-6d2a-4adf-b34e-df8a280545a9",
"relationship--94b867ef-e809-4093-98c0-b3767369d6e5",
"relationship--92458d46-4cf9-4bdf-811e-5b8019e53f70",
"relationship--80d2c6aa-5a2f-41ce-9deb-8088c6502af0",
"relationship--51d1b54b-4bc8-4e73-ac4f-4e8e2dd099b1",
"relationship--c972c2a3-e9a2-429e-8c26-af75828d5ac2",
"relationship--47888cd2-a35b-49d9-aeca-24f05eac78e1",
"relationship--1d938f20-3f0e-4276-a1c0-1f7d72b48fc2",
"relationship--e97976cd-9273-4d87-9fb2-58e57cab9ddf"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"osint:certainty=\"50\"",
"tlp:clear",
"misp-galaxy:country=\"afghanistan\"",
"misp-galaxy:country=\"brazil\"",
"misp-galaxy:country=\"eswatini\"",
"misp-galaxy:country=\"india\"",
"misp-galaxy:country=\"indonesia\"",
"misp-galaxy:country=\"malaysia\"",
"misp-galaxy:country=\"pakistan\"",
"misp-galaxy:country=\"philippines\"",
"misp-galaxy:country=\"south africa\"",
"misp-galaxy:country=\"taiwan\"",
"misp-galaxy:country=\"thailand\"",
"misp-galaxy:country=\"united states of america\"",
"misp-galaxy:country=\"vietnam\"",
"misp-galaxy:threat-actor=\"Earth Estries\"",
"misp-galaxy:sector=\"Consulting\"",
"misp-galaxy:sector=\"Managed Services Provider\"",
"misp-galaxy:sector=\"NGO\"",
"misp-galaxy:sector=\"Telecoms\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--831c04b8-68ed-4d71-bfa3-52eaa58ce4d8",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:28:21.000Z",
"modified": "2024-11-27T08:28:21.000Z",
"name": "CVE-2023-46805",
"labels": [
"misp:type=\"vulnerability\"",
"misp:category=\"External analysis\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2023-46805"
}
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--dd05a57a-ed94-4a99-b95f-b6d8a835fa31",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:28:21.000Z",
"modified": "2024-11-27T08:28:21.000Z",
"name": "CVE-2024-21887",
"labels": [
"misp:type=\"vulnerability\"",
"misp:category=\"External analysis\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2024-21887"
}
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--5596e6e9-b906-4ef4-9831-09226e134d28",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:28:21.000Z",
"modified": "2024-11-27T08:28:21.000Z",
"name": "CVE-2023-48788",
"labels": [
"misp:type=\"vulnerability\"",
"misp:category=\"External analysis\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2023-48788"
}
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--e6b7864e-38e0-43a5-ac25-051beb63506c",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:28:21.000Z",
"modified": "2024-11-27T08:28:21.000Z",
"name": "CVE-2022-3236",
"labels": [
"misp:type=\"vulnerability\"",
"misp:category=\"External analysis\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2022-3236"
}
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--669b4001-f63d-4bdf-b9e2-4fb86abba5df",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:28:21.000Z",
"modified": "2024-11-27T08:28:21.000Z",
"name": "CVE-2021-26855",
"labels": [
"misp:type=\"vulnerability\"",
"misp:category=\"External analysis\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-26855"
}
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--df48cd61-c020-49f9-82a2-e0a798183068",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:28:21.000Z",
"modified": "2024-11-27T08:28:21.000Z",
"name": "CVE-2021-26857",
"labels": [
"misp:type=\"vulnerability\"",
"misp:category=\"External analysis\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-26857"
}
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--67d93fff-c91c-41d1-89b2-dced25d651a5",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:28:21.000Z",
"modified": "2024-11-27T08:28:21.000Z",
"name": "CVE-2021-26858",
"labels": [
"misp:type=\"vulnerability\"",
"misp:category=\"External analysis\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-26858"
}
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--a66dce6e-a6ff-4146-9d6a-5d7ffd4b5737",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:28:21.000Z",
"modified": "2024-11-27T08:28:21.000Z",
"name": "CVE-2021-27065",
"labels": [
"misp:type=\"vulnerability\"",
"misp:category=\"External analysis\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-27065"
}
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b07e0aa5-d18d-4a91-9e5e-dadb887c88be",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:03.000Z",
"modified": "2024-11-27T08:37:03.000Z",
"description": "Campaign Beta (GHOSTSPIDER)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '139.59.108.43']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--a0eeaf5e-f029-427c-931c-c6a22854a6f6",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:03.000Z",
"modified": "2024-11-27T08:37:03.000Z",
"description": "Campaign Beta (GHOSTSPIDER)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.105.1.243']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5df65d1e-050c-472c-a95e-6e52e600b2df",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:03.000Z",
"modified": "2024-11-27T08:37:03.000Z",
"description": "Campaign Beta (GHOSTSPIDER)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '143.198.92.175']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--744b3c19-afcd-4637-95d6-0852576acef9",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:03.000Z",
"modified": "2024-11-27T08:37:03.000Z",
"description": "Campaign Beta (GHOSTSPIDER)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '139.99.114.108']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--f324d9f7-99c6-44ff-90e1-22411a9bae4f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:03.000Z",
"modified": "2024-11-27T08:37:03.000Z",
"description": "Campaign Beta (GHOSTSPIDER)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '139.59.236.31']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--64275dd4-6a4a-446d-af02-822574e7e6c3",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:03.000Z",
"modified": "2024-11-27T08:37:03.000Z",
"description": "Campaign Beta (GHOSTSPIDER)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.194.153.65']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--fbebda1d-3710-41b7-9af6-8ea87dfc2e64",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:24.000Z",
"modified": "2024-11-27T08:37:24.000Z",
"description": "Campaign Beta (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '45.125.67.144']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e37d0a2-2c7a-4419-8936-0acab03a32c2",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:24.000Z",
"modified": "2024-11-27T08:37:24.000Z",
"description": "Campaign Beta (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '43.226.126.164']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--6ac0a2e8-c12e-4bf9-94d8-dc1eaa016c53",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:24.000Z",
"modified": "2024-11-27T08:37:24.000Z",
"description": "Campaign Beta (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '172.93.165.10']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--3509a3db-b2df-4801-838e-d4bc72994cda",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:24.000Z",
"modified": "2024-11-27T08:37:24.000Z",
"description": "Campaign Beta (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '193.239.86.168']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--0e0b23e7-eb09-440d-89d7-20496b8b6828",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:24.000Z",
"modified": "2024-11-27T08:37:24.000Z",
"description": "Campaign Beta (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '146.70.79.18']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--78c0410e-d99b-4a79-ba3d-8d431125fa5e",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:24.000Z",
"modified": "2024-11-27T08:37:24.000Z",
"description": "Campaign Beta (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '146.70.79.105']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--ad898f63-b2f1-4863-8d51-dd8d289fe14c",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:24.000Z",
"modified": "2024-11-27T08:37:24.000Z",
"description": "Campaign Beta (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '205.189.160.3']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--ecf727ea-f971-4dca-acaf-825667465fc8",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:24.000Z",
"modified": "2024-11-27T08:37:24.000Z",
"description": "Campaign Beta (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '96.9.211.27']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--cc4a4511-4972-4faa-b269-1978e46a28c5",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:37:24.000Z",
"modified": "2024-11-27T08:37:24.000Z",
"description": "Campaign Beta (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '43.226.126.165']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:37:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--7c7a26ec-9b9f-4f6f-916a-c7d0e3842ebc",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:38:12.000Z",
"modified": "2024-11-27T08:38:12.000Z",
"description": "Campaign Alpha (related C&C)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '103.75.190.73']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:38:12Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--61ae0a0b-bc83-4e96-b144-581f43b90877",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:38:12.000Z",
"modified": "2024-11-27T08:38:12.000Z",
"description": "Campaign Alpha (related C&C)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '172.93.165.14']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:38:12Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--7df6b10f-0984-445e-8ec6-88c1d5467e07",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:38:40.000Z",
"modified": "2024-11-27T08:38:40.000Z",
"description": "Campaign Alpha (SNAPPYBEE)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.245.253.27']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:38:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--051363d5-c2c5-467d-a48c-d2ba6c93b56d",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:38:40.000Z",
"modified": "2024-11-27T08:38:40.000Z",
"description": "Campaign Alpha (SNAPPYBEE)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '158.247.222.165']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:38:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--c6bad4e2-3049-4d96-9fe8-284f2f671c9f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:41:05.000Z",
"modified": "2024-11-27T08:41:05.000Z",
"description": "Campaign Alpha (Open directory C&C)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '23.81.41.166']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:41:05Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--792efa82-74b0-4604-85cf-879224d10be4",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:41:25.000Z",
"modified": "2024-11-27T08:41:25.000Z",
"description": "Campaign Alpha (frpc)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '165.154.227.192']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--2ad05ad6-5baa-4525-9d3d-c6fb164acb2b",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:41:48.000Z",
"modified": "2024-11-27T08:41:48.000Z",
"description": "Campaign Alpha (DEMODEX)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '103.91.64.214']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:41:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--ded8856b-f754-4b8a-a137-9042433c49b9",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:21:09.000Z",
"modified": "2024-11-27T08:21:09.000Z",
"labels": [
"misp:name=\"report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "link",
"value": "https://www.trendmicro.com/en_us/research/24/k/earth-estries.html",
"category": "External analysis",
"uuid": "12509bbd-6a44-4cc2-8c9e-dcd3eb16d482"
},
{
"type": "text",
"object_relation": "summary",
"value": "- Earth Estries, a Chinese APT group, has primarily targeted critical sectors like telecommunications and government entities across the US, Asia-Pacific, Middle East, and South Africa since 2023.\r\n- The group employs advanced attack techniques and multiple backdoors, such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, affecting several Southeast Asian telecommunications companies and government entities.\r\n- Earth Estries exploits public-facing server vulnerabilities to establish initial access and uses living-off-the-land binaries for lateral movement within networks to deploy malware and conduct long-term espionage.\r\n- The group has compromised over 20 organizations, targeting various sectors including telecommunications, technology, consulting, chemical, and transportation industries, as well as government agencies and NGOs in numerous countries.\r\n\r\n- Earth Estries uses a complex C&C infrastructure managed by different teams, and their operations often overlap with TTPs of other known Chinese APT groups, indicating possible use of shared tools from malware-as-a-service providers",
"category": "Other",
"uuid": "876b9222-4866-4f06-a5b4-6a017f9df1c8"
},
{
"type": "text",
"object_relation": "title",
"value": "Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions",
"category": "Other",
"uuid": "3e65a453-646d-4db8-94af-0661c8e3f34d"
},
{
"type": "text",
"object_relation": "type",
"value": "Blog",
"category": "Other",
"uuid": "41e4fb2d-59a6-406d-8ae6-c71e0b00a363"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "report"
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--598166cf-5511-49b0-b406-0754e6ab2440",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:22.000Z",
"modified": "2024-11-27T08:29:22.000Z",
"name": "CVE-2021-27065",
"description": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"labels": [
"misp:name=\"vulnerability\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-27065"
},
{
"source_name": "url",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27065"
},
{
"source_name": "url",
"url": "http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html"
},
{
"source_name": "url",
"url": "http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html"
}
],
"x_misp_cvss_score": "7.8",
"x_misp_cvss_string": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"x_misp_modified": "2024-07-25T17:34:00+00:00",
"x_misp_published": "2021-03-03T00:15:00+00:00",
"x_misp_state": "Published",
"x_misp_vulnerable_configuration": [
"cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--0691345e-b820-496f-b054-562fef233a3d",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:22.000Z",
"modified": "2024-11-27T08:29:22.000Z",
"labels": [
"misp:name=\"weakness\"",
"misp:meta-category=\"vulnerability\""
],
"x_misp_attributes": [
{
"type": "weakness",
"object_relation": "id",
"value": "CWE-22",
"category": "External analysis",
"uuid": "bbfb9f29-82d2-43d5-af30-1466297c00c8"
},
{
"type": "text",
"object_relation": "name",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"category": "Other",
"uuid": "937828b2-7918-4a51-b81a-ebe8fe29d197"
},
{
"type": "text",
"object_relation": "status",
"value": "Stable",
"category": "Other",
"uuid": "90f4cf83-295b-4fd3-a981-0d4e9e5cdff8"
},
{
"type": "text",
"object_relation": "weakness-abs",
"value": "Base",
"category": "Other",
"uuid": "f5dfa803-a024-4d28-9ad8-f47c03fe9b9a"
}
],
"x_misp_comment": "CVE-2021-27065: Enriched via the cve_advanced module",
"x_misp_meta_category": "vulnerability",
"x_misp_name": "weakness"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--df3f8d43-4697-44cb-acf0-0bf24c1f73ed",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:22.000Z",
"modified": "2024-11-27T08:29:22.000Z",
"name": "Manipulating Web Input to File System Calls",
"description": "An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-76"
}
],
"x_misp_prerequisites": "Program must allow for user controlled variables to be applied directly to the filesystem",
"x_misp_related_weakness": [
"CWE-15",
"CWE-22",
"CWE-23",
"CWE-264",
"CWE-272",
"CWE-285",
"CWE-346",
"CWE-348",
"CWE-59",
"CWE-715",
"CWE-73",
"CWE-74",
"CWE-77"
],
"x_misp_solutions": "Design: Enforce principle of least privilege. Design: Ensure all input is validated, and does not contain file system commands Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands. Design: For interactive user applications, consider if direct file system interface is necessary, instead consider having the application proxy communication. Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--5342f955-30a8-496a-97b7-52c7904b4ab4",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:23.000Z",
"modified": "2024-11-27T08:29:23.000Z",
"name": "Using Escaped Slashes in Alternate Encoding",
"description": "This attack targets the use of the backslash in alternate encoding. An attacker can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the attacker tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-78"
}
],
"x_misp_prerequisites": "The application accepts the backlash character as escape character. The application server does incomplete input data decoding, filtering and validation.",
"x_misp_related_weakness": [
"CWE-171",
"CWE-172",
"CWE-173",
"CWE-180",
"CWE-181",
"CWE-20",
"CWE-21",
"CWE-22",
"CWE-697",
"CWE-707",
"CWE-73",
"CWE-74"
],
"x_misp_solutions": "Verify that the user-supplied data does not use backslash character to escape malicious characters. Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Be aware of the threat of alternative method of data encoding. Regular expressions can be used to filter out backslash. Make sure you decode before filtering and validating the untrusted input data. In the case of path traversals, use the principle of least privilege when determining access rights to file systems. Do not allow users to access directories/files that they should not access. Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process. Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--5a1ed979-35ef-4e2d-a9bb-1551f2a52928",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:23.000Z",
"modified": "2024-11-27T08:29:23.000Z",
"name": "Path Traversal",
"description": "An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or \\\\) and/or dots (.)) to reach desired directories or files.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-126"
}
],
"x_misp_prerequisites": "The attacker must be able to control the path that is requested of the target. The target must fail to adequately sanitize incoming paths",
"x_misp_related_weakness": "CWE-22",
"x_misp_solutions": "Design: Configure the access control correctly. Design: Enforce principle of least privilege. Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing with limited privileges to protect against remote execution. Design: Input validation. Assume that user inputs are malicious. Utilize strict type, character, and encoding enforcement. Design: Proxy communication to host, so that communications are terminated at the proxy, sanitizing the requests before forwarding to server host. Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands. Implementation: Host integrity monitoring for critical files, directories, and processes. The goal of host integrity monitoring is to be aware when a security issue has occurred so that incident response and other forensic activities can begin. Implementation: Perform input validation for all remote content, including remote and user-generated content. Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables. Implementation: Use indirect references rather than actual file names. Implementation: Use possible permissions on file access when developing and deploying web applications. Implementation: Validate user input by only accepting known good. Ensure all content that is delivered to client is sanitized against an acceptable content specification -- using an allowlist approach."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2ba27d93-0df1-46b0-ba6a-ed8cfe29bd96",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:23.000Z",
"modified": "2024-11-27T08:29:23.000Z",
"name": "Using Slashes and URL Encoding Combined to Bypass Validation Logic",
"description": "This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (\\\\%HEX-CODE). For instance US-ASCII space character would be represented with \\\\%20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-64"
}
],
"x_misp_prerequisites": "The application accepts and decodes URL string request. The application performs insufficient filtering/canonicalization on the URLs.",
"x_misp_related_weakness": [
"CWE-171",
"CWE-172",
"CWE-173",
"CWE-177",
"CWE-20",
"CWE-21",
"CWE-22",
"CWE-697",
"CWE-707",
"CWE-73",
"CWE-74"
],
"x_misp_solutions": "Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Test your decoding process against malicious input. Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding. When client input is required from web-based forms, avoid using the \\\\\"GET\\\\\" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use the \\\\\"POST method whenever possible. Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process. Refer to the RFCs to safely decode URL. Regular expression can be used to match safe URL patterns. However, that may discard valid URL requests if the regular expression is too restrictive. There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx)."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--ee77a247-d203-47ad-9e73-537a21646276",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:24.000Z",
"modified": "2024-11-27T08:29:24.000Z",
"name": "Using Slashes in Alternate Encoding",
"description": "This attack targets the encoding of the Slash characters. An attacker would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the attacker many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-79"
}
],
"x_misp_prerequisites": "The application server accepts paths to locate resources. The application server does insufficient input data validation on the resource path requested by the user. The access right to resources are not set properly.",
"x_misp_related_weakness": [
"CWE-171",
"CWE-173",
"CWE-180",
"CWE-181",
"CWE-185",
"CWE-20",
"CWE-200",
"CWE-21",
"CWE-22",
"CWE-697",
"CWE-707",
"CWE-73",
"CWE-74"
],
"x_misp_solutions": "Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process. Refer to the RFCs to safely decode URL. When client input is required from web-based forms, avoid using the \\\\\"GET\\\\\" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use the \\\\\"POST method whenever possible. There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx) Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding. (See related guideline section) Test your path decoding process against malicious input. In the case of path traversals, use the principle of least privilege when determining access rights to file systems. Do not allow users to access directories/files that they should not access. Assume all input is malicious. Create an allowlist that defines all valid input to the application based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system."
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--307fab05-6e48-4d29-aa58-b4ef8ed9d0de",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:39.000Z",
"modified": "2024-11-27T08:29:39.000Z",
"name": "CVE-2021-26858",
"description": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"labels": [
"misp:name=\"vulnerability\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-26858"
},
{
"source_name": "url",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858"
}
],
"x_misp_cvss_score": "7.8",
"x_misp_cvss_string": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"x_misp_modified": "2024-07-25T17:53:00+00:00",
"x_misp_published": "2021-03-03T00:15:00+00:00",
"x_misp_state": "Published",
"x_misp_vulnerable_configuration": [
"cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--804f2152-e97e-48ce-9915-fa298949b955",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:55.000Z",
"modified": "2024-11-27T08:29:55.000Z",
"name": "CVE-2021-26857",
"description": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"labels": [
"misp:name=\"vulnerability\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-26857"
},
{
"source_name": "url",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857"
}
],
"x_misp_cvss_score": "7.8",
"x_misp_cvss_string": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"x_misp_modified": "2024-07-25T17:53:00+00:00",
"x_misp_published": "2021-03-03T00:15:00+00:00",
"x_misp_state": "Published",
"x_misp_vulnerable_configuration": [
"cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--79ff18f5-0bc3-42c6-9351-030d98f8a125",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:56.000Z",
"modified": "2024-11-27T08:29:56.000Z",
"labels": [
"misp:name=\"weakness\"",
"misp:meta-category=\"vulnerability\""
],
"x_misp_attributes": [
{
"type": "weakness",
"object_relation": "id",
"value": "CWE-502",
"category": "External analysis",
"uuid": "2c589972-dcb2-4891-9b70-5775e1dce1b6"
},
{
"type": "text",
"object_relation": "name",
"value": "Deserialization of Untrusted Data",
"category": "Other",
"uuid": "169fdec2-56ef-4e09-b6d7-42bd0b7d8507"
},
{
"type": "text",
"object_relation": "status",
"value": "Draft",
"category": "Other",
"uuid": "ed6cfff9-ff65-47f5-a91c-49090b00c7c2"
},
{
"type": "text",
"object_relation": "weakness-abs",
"value": "Base",
"category": "Other",
"uuid": "14865f6a-7434-4eb7-8c98-8002c9fc1866"
}
],
"x_misp_comment": "CVE-2021-26857: Enriched via the cve_advanced module",
"x_misp_meta_category": "vulnerability",
"x_misp_name": "weakness"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--451d3abd-c6e7-45c3-90c0-e72a24d02f7a",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:29:56.000Z",
"modified": "2024-11-27T08:29:56.000Z",
"name": "Object Injection",
"description": "An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-586"
}
],
"x_misp_prerequisites": "The target application must unserialize data before validation.",
"x_misp_related_weakness": "CWE-502",
"x_misp_solutions": "Implementation: Validate object before deserialization process Design: Limit which types can be deserialized. Implementation: Avoid having unnecessary types or gadgets available that can be leveraged for malicious ends. Use an allowlist of acceptable classes. Implementation: Keep session state on the server, when possible."
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--cb455add-8385-4a5c-912d-267c7d54b69e",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:30:16.000Z",
"modified": "2024-11-27T08:30:16.000Z",
"name": "CVE-2021-26855",
"description": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"labels": [
"misp:name=\"vulnerability\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-26855"
},
{
"source_name": "url",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855"
},
{
"source_name": "url",
"url": "http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html"
},
{
"source_name": "url",
"url": "http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html"
},
{
"source_name": "url",
"url": "http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html"
},
{
"source_name": "url",
"url": "http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html"
}
],
"x_misp_cvss_score": "9.1",
"x_misp_cvss_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"x_misp_modified": "2024-02-15T20:18:00+00:00",
"x_misp_published": "2021-03-03T00:15:00+00:00",
"x_misp_state": "Published",
"x_misp_vulnerable_configuration": [
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--e901580b-1b8a-4af1-8b30-560ab54e6360",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:30:17.000Z",
"modified": "2024-11-27T08:30:17.000Z",
"labels": [
"misp:name=\"weakness\"",
"misp:meta-category=\"vulnerability\""
],
"x_misp_attributes": [
{
"type": "weakness",
"object_relation": "id",
"value": "CWE-918",
"category": "External analysis",
"uuid": "8224f5ea-cab0-4abe-a78d-be13233acb58"
},
{
"type": "text",
"object_relation": "name",
"value": "Server-Side Request Forgery (SSRF)",
"category": "Other",
"uuid": "b5bc1a43-a2c7-4346-a087-52aea6512d60"
},
{
"type": "text",
"object_relation": "status",
"value": "Incomplete",
"category": "Other",
"uuid": "669b06f6-366f-4294-9179-ae6284d5db61"
},
{
"type": "text",
"object_relation": "weakness-abs",
"value": "Base",
"category": "Other",
"uuid": "b82794b1-2410-4288-8560-854aaeff8271"
}
],
"x_misp_comment": "CVE-2021-26855: Enriched via the cve_advanced module",
"x_misp_meta_category": "vulnerability",
"x_misp_name": "weakness"
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--aef48aac-76e3-426a-a5ec-9ff59fb018a1",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:30:37.000Z",
"modified": "2024-11-27T08:30:37.000Z",
"name": "CVE-2021-26857",
"description": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"labels": [
"misp:name=\"vulnerability\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-26857"
},
{
"source_name": "url",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857"
}
],
"x_misp_cvss_score": "7.8",
"x_misp_cvss_string": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"x_misp_modified": "2024-07-25T17:53:00+00:00",
"x_misp_published": "2021-03-03T00:15:00+00:00",
"x_misp_state": "Published",
"x_misp_vulnerable_configuration": [
"cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--2311608a-fa79-4786-97d9-b9c71d1b7414",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:30:58.000Z",
"modified": "2024-11-27T08:30:58.000Z",
"name": "CVE-2021-26858",
"description": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"labels": [
"misp:name=\"vulnerability\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2021-26858"
},
{
"source_name": "url",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858"
}
],
"x_misp_cvss_score": "7.8",
"x_misp_cvss_string": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"x_misp_modified": "2024-07-25T17:53:00+00:00",
"x_misp_published": "2021-03-03T00:15:00+00:00",
"x_misp_state": "Published",
"x_misp_vulnerable_configuration": [
"cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
]
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:31:59.000Z",
"modified": "2024-11-27T08:31:59.000Z",
"name": "CVE-2024-21887",
"description": "A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.",
"labels": [
"misp:name=\"vulnerability\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "cve",
"external_id": "CVE-2024-21887"
},
{
"source_name": "url",
"url": "https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US"
},
{
"source_name": "url",
"url": "http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html"
}
],
"x_misp_cvss_score": "9.1",
"x_misp_cvss_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"x_misp_modified": "2024-06-10T16:21:00+00:00",
"x_misp_published": "2024-01-12T17:15:00+00:00",
"x_misp_state": "Published",
"x_misp_vulnerable_configuration": [
"cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:22.5:r2.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*"
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--59eda582-0c44-4695-94be-2fc8be45a740",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:32:00.000Z",
"modified": "2024-11-27T08:32:00.000Z",
"labels": [
"misp:name=\"weakness\"",
"misp:meta-category=\"vulnerability\""
],
"x_misp_attributes": [
{
"type": "weakness",
"object_relation": "id",
"value": "CWE-77",
"category": "External analysis",
"uuid": "c8b478ee-c66f-4241-8451-6e126acc9726"
},
{
"type": "text",
"object_relation": "name",
"value": "Improper Neutralization of Special Elements used in a Command ('Command Injection')",
"category": "Other",
"uuid": "178c36ae-a32c-48c9-9006-b56d885e161f"
},
{
"type": "text",
"object_relation": "status",
"value": "Draft",
"category": "Other",
"uuid": "7ccf1d85-a0e9-49bb-8400-2b50d96aca1a"
},
{
"type": "text",
"object_relation": "weakness-abs",
"value": "Class",
"category": "Other",
"uuid": "65202907-136e-4206-9346-29649f9d0d85"
}
],
"x_misp_comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"x_misp_meta_category": "vulnerability",
"x_misp_name": "weakness"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0b8e087d-e807-4737-a91d-a7b23b7dcab2",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:32:00.000Z",
"modified": "2024-11-27T08:32:00.000Z",
"name": "Command Injection",
"description": "An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-248"
}
],
"x_misp_prerequisites": "The target application must accept input from the user and then use this input in the construction of commands to be executed. In virtually all cases, this is some form of string input that is concatenated to a constant string defined by the application to form the full command to be executed.",
"x_misp_related_weakness": "CWE-77",
"x_misp_solutions": "All user-controllable input should be validated and filtered for potentially unwanted characters. Using an allowlist for input is desired, but if use of a denylist approach is necessary, then focusing on command related terms and delimiters is necessary. Input should be encoded prior to use in commands to make sure command related characters are not treated as part of the command. For example, quotation characters may need to be encoded so that the application does not treat the quotation as a delimiter. Input should be parameterized, or restricted to data sections of a command, thus removing the chance that the input will be treated as part of the command itself."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--6d7a3232-2d66-438e-808d-3186176eb00b",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:32:01.000Z",
"modified": "2024-11-27T08:32:01.000Z",
"name": "Manipulating Writeable Terminal Devices",
"description": "This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-40"
}
],
"x_misp_prerequisites": "User terminals must have a permissive access control such as world writeable that allows normal users to control data on other user\\'s terminals.",
"x_misp_related_weakness": "CWE-77",
"x_misp_solutions": "Design: Ensure that terminals are only writeable by named owner user and/or administrator Design: Enforce principle of least privilege"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--a0168d78-1fca-4506-9874-52644df4ef2d",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:32:01.000Z",
"modified": "2024-11-27T08:32:01.000Z",
"name": "Exploiting Multiple Input Interpretation Layers",
"description": "An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a \\\\\"layer\\\\\" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-43"
}
],
"x_misp_prerequisites": "User input is used to construct a command to be executed on the target system or as part of the file name. Multiple parser passes are performed on the data supplied by the user.",
"x_misp_related_weakness": [
"CWE-171",
"CWE-179",
"CWE-181",
"CWE-183",
"CWE-184",
"CWE-20",
"CWE-697",
"CWE-707",
"CWE-74",
"CWE-77",
"CWE-78"
],
"x_misp_solutions": "An iterative approach to input validation may be required to ensure that no dangerous characters are present. It may be necessary to implement redundant checking across different input validation layers. Ensure that invalid data is rejected as soon as possible and do not continue to work with it. Make sure to perform input validation on canonicalized data (i.e. data that is data in its most standard form). This will help avoid tricky encodings getting past the filters. Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist would not be permitted to enter into the system."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--c7044849-01f8-4713-90fe-9ee40ae51ae4",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:32:01.000Z",
"modified": "2024-11-27T08:32:01.000Z",
"name": "LDAP Injection",
"description": "An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-136"
}
],
"x_misp_prerequisites": "The target application must accept a string as user input, fail to sanitize characters that have a special meaning in LDAP queries in the user input, and insert the user-supplied string in an LDAP query which is then processed.",
"x_misp_related_weakness": [
"CWE-20",
"CWE-77",
"CWE-90"
],
"x_misp_solutions": "Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as LDAP content. Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about an error without disclosing information about the LDAP or application."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--105b6cc6-7686-4912-88bd-3154dbf554bc",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:32:01.000Z",
"modified": "2024-11-27T08:32:01.000Z",
"name": "Command Delimiters",
"description": "An attack of this type exploits a programs\\' vulnerabilities that allows an attacker\\'s commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-15"
}
],
"x_misp_prerequisites": "Software\\'s input validation or filtering must not detect and block presence of additional malicious command.",
"x_misp_related_weakness": [
"CWE-138",
"CWE-140",
"CWE-146",
"CWE-154",
"CWE-157",
"CWE-184",
"CWE-185",
"CWE-697",
"CWE-713",
"CWE-77",
"CWE-78",
"CWE-93"
],
"x_misp_solutions": "Design: Perform allowlist validation against a positive specification for command length, type, and parameters. Design: Limit program privileges, so if commands circumvent program input validation or filter routines then commands do not running under a privileged account Implementation: Perform input validation for all remote content. Implementation: Use type conversions such as JDBC prepared statements."
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--b6d47efc-6f91-42a2-be2b-e37b2ece71a7",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"name": "IMAP/SMTP Command Injection",
"description": "An attacker exploits weaknesses in input validation on IMAP/SMTP servers to execute commands on the server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web-mail server fails to adequately sanitize these requests, these commands are then sent to the back-end mail server when it is queried by the web-mail server, where the commands are then executed. This attack can be especially dangerous since administrators may assume that the back-end server is protected against direct Internet access and therefore may not secure it adequately against the execution of malicious commands.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-183"
}
],
"x_misp_prerequisites": "The target environment must consist of a web-mail server that the attacker can query and a back-end mail server. The back-end mail server need not be directly accessible to the attacker. The web-mail server must fail to adequately sanitize fields received from users and passed on to the back-end mail server. The back-end mail server must not be adequately secured against receiving malicious commands from the web-mail server.",
"x_misp_related_weakness": "CWE-77"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--9578f5a0-9e1c-4e32-a99a-0fa0a48b5f5a",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"name": "Manipulating Writeable Configuration Files",
"description": "Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers\\' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "vulnerability"
}
],
"labels": [
"misp:name=\"attack-pattern\"",
"misp:meta-category=\"vulnerability\"",
"misp:to_ids=\"False\""
],
"external_references": [
{
"source_name": "capec",
"external_id": "CAPEC-75"
}
],
"x_misp_prerequisites": "Configuration files must be modifiable by the attacker",
"x_misp_related_weakness": [
"CWE-346",
"CWE-349",
"CWE-353",
"CWE-354",
"CWE-713",
"CWE-77",
"CWE-99"
],
"x_misp_solutions": "Design: Enforce principle of least privilege Design: Backup copies of all configuration files Implementation: Integrity monitoring for configuration files Implementation: Enforce audit logging on code and configuration promotion procedures. Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--20d3b0fe-91f1-44e7-b4a1-b16d5206d58c",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:35:49.000Z",
"modified": "2024-11-27T08:35:49.000Z",
"name": "Backdoor_GHOSTSPIDER_beacon_loader",
"pattern": "rule Backdoor_GHOSTSPIDER_beacon_loader\r\n{\r\n meta:\r\n author = \\\\\"Trend Micro Research\\\\\"\r\n\r\n strings:\r\n $clr = {\r\n\t\t\tC7 45 ?? 43 4C 52 43\r\n\t\t\tC7 45 ?? 72 65 61 74\r\n\t\t\tC7 45 ?? 65 49 6E 73\r\n\t\t\tC7 45 ?? 74 61 6E 63\r\n\t\t}\r\n\r\n $chunk1 = {\r\n\t\t\tC1 EA ??\r\n\t\t\t0F B6 D2\r\n\t\t\t8B 34 95 ?? ?? ?? ??\r\n\t\t\t8B 55 ??\r\n\t\t\tC1 EA ??\r\n\t\t\t8B 14 95 ?? ?? ?? ??\r\n\t\t\tC1 E9 ??\r\n\t\t\t0F B6 F9\r\n\t\t\t33 34 BD ?? ?? ?? ??\r\n\t\t\t8B 7D ??\r\n\t\t\t89 75 ??\r\n\t\t\t31 55 ??\r\n\t\t\t0F B6 55 ??\r\n\t\t\t8B 75 ??\r\n\t\t\t33 34 95 ?? ?? ?? ??\r\n\t\t\t8B D3\r\n\t\t\t33 B0 ?? ?? ?? ??\r\n\t\t}\r\n\r\n $chunk2 = {\r\n 41 0F B6 1B\r\n 41 8B C2\r\n 99\r\n 41 F7 F9\r\n 48 63 C2\r\n 0F B6 4C 05 ??\r\n 44 03 C1\r\n 44 03 C3\r\n }\r\n\r\n condition:\r\n uint16(0) == 0x5a4d and\r\n\t\tfilesize < 300KB and\r\n (\r\n $clr and any of ($chunk*)\r\n )\r\n}",
"pattern_type": "yara",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:35:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
],
"x_misp_context": "all"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--6c8fab68-2138-4c27-9597-9ff6e1a4ffb2",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:36:19.000Z",
"modified": "2024-11-27T08:36:19.000Z",
"name": "Backdoor_GHOSTSPIDER_stager",
"pattern": "rule Backdoor_GHOSTSPIDER_stager\r\n{\r\n meta:\r\n author = \\\\\"Trend Micro Research\\\\\"\r\n\r\n strings:\r\n $s1 = \\\\\"new_comp\\\\\" ascii wide\r\n $s2 = \\\\\"del_comp\\\\\" ascii wide\r\n $s3 = \\\\\"new_client\\\\\" ascii wide\r\n $s4 = \\\\\"del_client\\\\\" ascii wide\r\n $s5 = \\\\\"new_base\\\\\" ascii wide\r\n $s6 = \\\\\"del_base\\\\\" ascii wide\r\n $cookie = \\\\\"phpsessid=\\\\%s; b=\\\\%d; path=/; expires=\\\\%s\\\\\" ascii wide\r\n\r\n condition:\r\n uint16(0) == 0x5a4d and\r\n filesize < 300KB and\r\n (\r\n $cookie and 2 of ($s*)\r\n )\r\n}",
"pattern_type": "yara",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:36:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
],
"x_misp_context": "all"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--54ae012f-305c-4d09-84af-beacb401288d",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:44:55.000Z",
"modified": "2024-11-27T08:44:55.000Z",
"description": "SNAPPYBEE payload",
"pattern": "[file:hashes.SHA256 = '1a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296' AND file:name = 'dbindex.dat']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:44:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--abf6c3b8-fe85-436f-90c6-538b9d419ca0",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:45:49.000Z",
"modified": "2024-11-27T08:45:49.000Z",
"description": "SNAPPYBEE loader",
"pattern": "[file:hashes.SHA256 = '05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa870' AND file:name = 'imfsbDLL.dll']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:45:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4b7cd1b0-c0e4-45c5-bc6b-7d38b54d7f25",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:46:19.000Z",
"modified": "2024-11-27T08:46:19.000Z",
"description": "SNAPPYBEE loader",
"pattern": "[file:hashes.SHA256 = 'b2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac' AND file:name = 'DgApi.dll']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:46:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--25be932d-b3e2-42df-b5e6-657d82bf1916",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:46:50.000Z",
"modified": "2024-11-27T08:46:50.000Z",
"description": "SNAPPYBEE loader",
"pattern": "[file:hashes.SHA256 = '6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc' AND file:name = 'imfsbDLL.dll']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:46:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--bfa7d29f-7f74-4dd9-82ab-1606cf366cfe",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:47:13.000Z",
"modified": "2024-11-27T08:47:13.000Z",
"description": "SNAPPYBEE loader",
"pattern": "[file:hashes.SHA256 = '25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b' AND file:name = 'DgApi.dll']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:47:13Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--e8b5e843-a4e3-434d-9f34-a6ea7a85f9b0",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:47:34.000Z",
"modified": "2024-11-27T08:47:34.000Z",
"description": "DEMODEX loader",
"pattern": "[file:hashes.SHA256 = '9ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c' AND file:name = '\\\\%WINDIR\\\\%\\\\System32\\\\SstpCfs.dll']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:47:34Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--c43cc341-1655-466f-9baa-00a409f5d8f6",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:48:00.000Z",
"modified": "2024-11-27T08:48:00.000Z",
"description": "DEMODEX driver",
"pattern": "[file:hashes.SHA256 = '16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c58619587266' AND file:name = '\\\\%WINDIR\\\\%\\\\System32\\\\drivers\\\\dumpfiskfss.sys']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:48:00Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--8e8cdf20-8235-4dc7-a015-7654010b9e88",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:48:57.000Z",
"modified": "2024-11-27T08:48:57.000Z",
"description": "DEMODEX PowerShell dropper ",
"pattern": "[file:hashes.SHA256 = '2fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec' AND file:name = 'onedrived.ps1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:48:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--da6199b2-b6a7-4cf7-8f81-9a897db8cd09",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:49:22.000Z",
"modified": "2024-11-27T08:49:22.000Z",
"description": "SNAPPYBEE payload",
"pattern": "[file:hashes.SHA256 = 'fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b823098' AND file:name = 'NortonLog.txt']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:49:22Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--fc910d5a-983c-45ab-8475-380426288138",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:50:03.000Z",
"modified": "2024-11-27T08:50:03.000Z",
"description": "SNAPPYBEE loader\t",
"pattern": "[file:hashes.SHA256 = 'fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5' AND file:name = 'WINMM.dll']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:50:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--0e88a065-9d44-479e-93af-82f834e1dbce",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:57:32.000Z",
"modified": "2024-11-27T08:57:32.000Z",
"description": "The frpc C&C 165.154.227[.]192 could be linked to an SSL certificate (SHA256: 2b5e7b17fc6e684ff026df3241af4a651fc2b55ca62f8f1f7e34ac8303db9a31) previously used by ShadowPad, which is another shared tool among several Chinese APT groups. In addition, the C&C IP address was also mentioned in a Fortinet report and indicators of compromise related to the Ivanti exploit.",
"pattern": "[x509-certificate:hashes.SHA256 = '2b5e7b17fc6e684ff026df3241af4a651fc2b55ca62f8f1f7e34ac8303db9a31' AND x509-certificate:x509_v3_extensions.subject_alternative_name = 'IP:165.154.227.192']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-11-27T08:57:32Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"x509\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\""
]
},
{
"type": "note",
"spec_version": "2.1",
"id": "note--fe91a5fe-b3b1-41ab-8948-bafb2fab4bd0",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2024-11-27T08:23:10.000Z",
"modified": "2024-11-27T08:23:10.000Z",
"abstract": "Report from - https://www.trendmicro.com/en_us/research/24/k/earth-estries.html (1732695682)",
"content": "# Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions\r\n\r\n\r\nSince 2023, APT group Earth Estries has aggressively targeted key industries globally with sophisticated techniques and new backdoors, like GHOSTSPIDER and MASOL RAT, for prolonged espionage operations. \r\n\r\nBy: Leon M Chang, Theo Chen, Lenart Bermejo, Ted Lee\r\n \r\n November 25, 2024\r\n\r\n#### Summary\r\n \r\n* Earth Estries, a Chinese APT group, has primarily targeted critical sectors like telecommunications and government entities across the US, Asia\\-Pacific, Middle East, and South Africa since 2023\\.\r\n* The group employs advanced attack techniques and multiple backdoors, such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, affecting several Southeast Asian telecommunications companies and government entities.\r\n* Earth Estries exploits public\\-facing server vulnerabilities to establish initial access and uses living\\-off\\-the\\-land binaries for lateral movement within networks to deploy malware and conduct long\\-term espionage.\r\n* The group has compromised over 20 organizations, targeting various sectors including telecommunications, technology, consulting, chemical, and transportation industries, as well as government agencies and NGOs in numerous countries.\r\n* Earth Estries uses a complex C\\&C infrastructure managed by different teams, and their operations often overlap with TTPs of other known Chinese APT groups, indicating possible use of shared tools from malware\\-as\\-a\\-service providers.\r\n\r\n\r\nSince 2023, Earth Estries (aka Salt Typhoon, FamousSparrow, GhostEmperor and UNC2286\\) has emerged as one of the most aggressive Chinese advanced persistent threat (APT) groups, primarily targeting critical industries such as telecommunications and government entities in the US, the Asia\\-Pacific region, the Middle East, and South Africa. In this blog entry, we will highlight their evolving attack techniques and analyze the motivation behind their operations, providing insights into their long\\-term targeted attacks.\r\n\r\n\r\nA key finding from our recent investigation is the discovery of a new backdoor, GHOSTSPIDER, identified during attacks on Southeast Asian telecommunications companies. We will explore the technical details of GHOSTSPIDER, its impact across multiple countries, and interesting findings when we were tracking its command\\-and\\-control (C\\&C) infrastructure. We have also uncovered the group\u2019s use of the modular backdoor SNAPPYBEE (aka Deed RAT), another tool shared among Chinese APT groups.\u00a0\r\n\r\n\r\nFurthermore, we discovered that Earth Estries uses another cross\\-platform backdoor, which we initially identified during our investigation of Southeast Asian government incidents in 2020\\. We named it MASOL RAT based on its PDB string. We couldn\u2019t link MASOL RAT to any known threat group at the time due to limited information. However, this year we observed that Earth Estries has been deploying MASOL RAT on Linux devices targeting Southeast Asian government networks. More details about MASOL RAT will be provided in this blog entry.\r\n\r\n\r\nRecently, we also noticed that Microsoft has tracked the APT groups FamousSparrow and GhostEmperor under the name Salt Typhoon. However, we don\u2019t have sufficient evidence that Earth Estries is related to the recent news of a recent Salt Typhoon cyberattack, as we have not seen a more detailed report on Salt Typhoon. Currently, we can only confirm that some of Earth Estries\u2019 tactics, techniques, and procedures (TTPs) overlap with that of FamousSparrow and GhostEmperor.\u00a0\r\n\r\n\r\n#### Motivation\r\n\r\n\r\nWe have observed that Earth Esties has been conducting prolonged attacks targeting governments and internet service providers since 2020\\. In mid\\-2022, we noticed that the attackers also started targeting service providers for governments and telecommunications companies. For example, we found that in 2023, the attackers had also targeted consulting firms and NGOs that work with the U.S. federal government and military. The attackers use this approach to gather intelligence more efficiently and to attack their primary targets more quickly.\u00a0\r\n\r\n\r\nNotably, we observed that attackers targeted not only critical services (like database servers and cloud servers) used by the telecommunications company, but also their vendor network. We found that they implanted the DEMODEX rootkit on vendor machines. This vendor is a primary contractor for the region\u2019s main telecommunications provider, and we believe that attackers use this approach to facilitate access to more targets.\r\n\r\n\r\n#### Victimology\r\n\r\n\r\nWe found that Earth Estries successfully compromised more than 20 organizations in areas that include the telecommunications, technology, consulting, chemical, and transportation industries, government agencies, and non\\-profit organizations (NGOs). Victims also came from numerous countries, including:\r\n\r\n\r\n* Afghanistan\r\n* Brazil\r\n* Eswatini\r\n* India\r\n* Indonesia\r\n* Malaysia\r\n* Pakistan\r\n* The Philippines\r\n* South Africa\r\n* Taiwan\r\n* Thailand\r\n* US\r\n* Vietnam\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 1\\. Victimology map of Earth Estries\r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n#### Initial access\r\n\r\n\r\nEarth Estries is aggressively targeting the public\\-facing servers of victims. We have observed them exploiting server\\-based N\\-day vulnerabilities, including the following:\r\n\r\n\r\n\r\n\r\n| **Vulnerability** | **Description** |\r\n| --- | --- |\r\n| Ivanti Connect Secure VPN Exploitation (CVE\\-2023\\-46805 and CVE\\-2024\\-21887) | A chain of exploits to bypass authentication, craft malicious requests, and execute arbitrary commands with elevated privileges. |\r\n| CVE\\-2023\\-48788 | Fortinet FortiClient EMS SQL Injection Vulnerability |\r\n| CVE\\-2022\\-3236 | A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution. |\r\n| ProxyLogon (CVE\\-2021\\-26855, CVE\\-2021\\-26857, CVE\\-2021\\-26858, and CVE\\-2021\\-27065) | A set of four chained vulnerabilities that perform remote code execution (RCE) in Microsoft Exchange servers. |\r\n\r\n\r\n\r\nTable 1\\. The list of vulnerabilities exploited by Earth Estries\r\n\r\n\r\nAfter gaining control of the vulnerable server, we observed that the attackers leveraged living\\-off\\-the\\-land binaries (LOLBINs) like WMIC.exe and PSEXEC.exe for lateral movement, and deployed customized malware such as SNAPPYBEE, DEMODEX, and GHOSTSPIDER to conduct long\\-term espionage activities against their targets.\r\n\r\n\r\n#### Campaign overview\r\n\r\n\r\nOur analysis suggests that Earth Estries is a well\\-organized group with a clear division of labor. Based on observations from multiple campaigns, we speculate that attacks targeting different regions and industries are launched by different actors. Additionally, the C\\&C infrastructure used by various backdoors seems to be managed by different infrastructure teams, further highlighting the complexity of the group's operations.\r\n\r\n\r\n#### Campaign Alpha\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 2\\. Campaign Alpha overview \r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nIn the attacks we observed last October targeting the Taiwanese government and a chemical company, we found that the attackers downloaded malicious tools from their C\\&C server (23\\.81\\.41\\[.]166\\). While investigating the download site (23\\.81\\.41\\[.]166\\), we found more interesting samples on the C\\&C server which had an open directory on port 80\\.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 3\\. The C\\&C with open directory vulnerability \r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nThe notable samples are listed in Table 2 below, based on our monitoring from October 2023 to April 2024\\.\r\n\r\n\r\n\r\n\r\n| **File** | **Description** |\r\n| --- | --- |\r\n| sql.toml | frpc config (C\\&C server: 165\\.154\\.227\\[.]192\\) |\r\n| onedrived.zip | Contains the PowerShell script ondrived.ps1\\. |\r\n| Nsc.exe | The first SNAPPYBEE sample set \u00a0 (SNAPPYBEE C\\&C domain: api.solveblemten\\[.]com) |\r\n| 123\\.zip/WINMM.dll |\r\n| NortonLog.txt |\r\n| 0202/\\* | Another SNAPPYBEE sample set (imfsbSvc.exe, imfsbDll.dll, DgApi.dll, and dbindex.dat). (SNAPPYBEE C\\&C domain: esh.hoovernamosong\\[.]com) |\r\n| Others | Open\\-source hacktools like frpc, NeoReGeorg tunnel, and fscan. |\r\n\r\n\r\n\r\nTable 2\\. Notable samples\r\n\r\n\r\nHere is a summary of notable findings:\r\n\r\n\r\n* The frpc C\\&C 165\\.154\\.227\\[.]192 could be linked to an SSL certificate (SHA256: 2b5e7b17fc6e684ff026df3241af4a651fc2b55ca62f8f1f7e34ac8303db9a31\\) previously used by ShadowPad, which is another shared tool among several Chinese APT groups. In addition, the C\\&C IP address was also mentioned in a Fortinet report and indicators of compromise related to the Ivanti exploit.\r\n* **We observed the TTPs used by onedrived.ps1 are similar to those of\u00a0GhostEmperor\u2019s first\\-stage PowerShell dropper. The only difference is that the strings are encoded using base64 algorithm in this new variant.**\r\n* **Based on our analysis, although the two sets of samples used different DLL hijacking combinations and decoding algorithms to decrypt the payload, we found that the backdoor characteristics matched those of the previous SNAPPYBEE. (We identified that the decrypted shellcode module header signature is 0xDEED4554 and the Main/Root module ID is still 0x20, can be seen in Figure 4\\).**\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 4\\. The analysis screenshot of SNAPPYBEE \r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n#### DEMODEX rootkit infection chain\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 5\\. The infection chain of DEMODEX rootkit\r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nThere are two requirements to analyze the DEMODEX rootkit:\r\n\r\n\r\n1. The first\\-stage PowerShell script requires a decryption key as an argument.\r\n2. The second\\-stage service loader uses the computer name as the AES decryption key.\r\n\r\n\r\nBased on our telemetry, we discovered that the attacker used PSEXEC.exe to execute the following commands to install the DEMODEX rootkit:\r\n\r\n\r\n\r\n> Powershell.exe \\-ex bypass c:\\\\windows\\\\assembly\\\\onedrived.ps1 \r\n> \r\n> password@123\r\n\r\n\r\nNotably, we discovered that all components related to the DEMODEX rootkit use control flow flattening techniques to increase the difficulty of analysis (Figure 6\\).\u00a0\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 6\\. DEMODEX Anti\\-analysis techniques (control flow flattening) \r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 7\\. Core\\-implant malware configuration (C\\&C: 103\\.91\\.64\\[.]214\\) \r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n#### C\\&C infrastructure activities\r\n\r\n\r\nWhile tracking the C\\&C infrastructure of the aforementioned backdoor, we found the following notable findings:\r\n\r\n\r\n1. We found that one of the SNAPPYBEE C\\&C domains, api.solveblemten\\[.]com, has WHOIS registration information that overlaps with some indicators of compromise (IOCs) mentioned in Mandiant's UNC4841 report. Based on our research, we believe that these related C\\&C domains were likely registered by the same provider and shared them in different operations. However, we don't have sufficient evidence to consider UNC4841 as one of the subgroups related to Earth Estries.\r\n2. Another SNAPPYBEE C\\&C domain (esh.hoovernamosong\\[.]com) resolved to a C\\&C IP address (158\\.247\\.222\\[.]165\\), which could be linked to a SoftEther domain (vpn114240349\\.softether\\[.]net). Therefore, we believe the threat actor also used SoftEther VPN to establish their operational networks, making it more difficult to track their activities.\r\n3. Notably, we discovered and downloaded victim data from the SNAPPYBEE C\\&C (158\\.247\\.222\\[.]165\\) with an open directory on 8000 port this February. Based on our analysis, we believe the victim data was exfiltrated from a US NGO. Most of the victim data is composed of financial, human resources, and business\\-related documents.\u202fIt's worth noting that the attacker also collected data related to multiple military units and federal government entities.\r\n\r\n\r\n\r\n\r\n\r\n\r\n#### Post\\-exploitation findings\r\n\r\n\r\nIn this campaign, we observed that the attackers primarily used the following LOLbin tools to gather endpoint information and perform lateral movement to gain access to more compromised machines.\r\n\r\n\r\n\r\n\r\n| **Tools** | **Description** |\r\n| --- | --- |\r\n| frpc related | * WMIC.exe /node:\\<REDATED\\> /user:\\<REDATED\\> /password:\\<REDATED\\> process call create \"cmd.exe /c expand c:/windows/debug/1\\.zip c:/windows/debug/notepadup.exe * cmd.exe /c ping 165\\.154\\.227\\.192 \\-n 1 \\> c:\\\\Windows\\\\debug\\\\info. * cmd.exe /c c:/windows/debug/win32up.exe \\-c c:/windows/debug/sql.toml * cmd.exe /c wevtutil qe security /format:text /q:\\\\\"Event\\[System\\[(EventID\\=4624\\)]\\\\\" \\> c:\\\\windows\\\\debug\\\\info.log |\r\n| ps.exe (PSEXEC.exe) | * C:\\\\Windows\\\\assembly\\\\ps.exe /accepteula \\\\\\\\\\<REDATED\\> \\-u \\<REDATED\\> \\-p \\<REDATED\\> \\-s cmd /c c:\\\\Windows\\\\assembly\\\\1\\.bat * WMIC.exe /node:\\<REDATED\\> /user:\\<REDATED\\> /password:\\<REDATED\\> process call create \"cmd.exe /c c:\\\\Windows\\\\debug\\\\1\\.bat\"\" |\r\n\r\n\r\n\r\nTable 3\\. LOLbin tools used to gather endpoint information and perform lateral movement\r\n\r\n\r\n#### Campaign Beta\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 8\\. Campaign Beta overview\r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nIn this section, we will introduce Earth Estries\u2019 long\\-term attacks on telecommunications companies and government entities. According to our research, most of the victims have been compromised for several years. We believe that in the early stages, the attackers successfully obtained credentials and control target machines through web vulnerabilities and the Microsoft Exchange ProxyLogon exploit chain. We observed that for these long\\-term targets, the attackers primarily used the DEMODEX rootkit to remain hidden within the victims' networks. Notably, in a recent investigation into attacks on telecommunications companies in Southeast Asia, we discovered a previously undisclosed backdoor; we have named it GHOSTSPIDER.\r\n\r\n\r\n#### GHOSTSPIDER\u2019s technique analysis\r\n\r\n\r\nGHOSTSPIDER is a sophisticated multi\\-modular backdoor designed with several layers to load different modules based on specific purposes. This backdoor communicates with its C\\&C server using a custom protocol protected by Transport Layer Security (TLS), ensuring secure communication.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 9\\. The GHOSTSPIDER infection flow\r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n**Initial infection and stager deployment**\r\n\r\n\r\nBased on our telemetry, we observed that the threat actor installs the first\\-stage stager via regsvr32\\.exe, which is used to install a DLL (with export names such as core.dll or spider.dll) as a service. The stager is designed to check for a specific hostname hard\\-coded in the DLL, ensuring that it only runs on the targeted machine. Once the stager is executed, it connects to the stager's C\\&C server to register a new connection and subsequently receives a module (DLL export name: login.dll) to load and execute in memory. This login module collects basic information about the infected endpoint and sends it back to the stager's C\\&C server. After this initial phase, the stager enters a polling mode, waiting for the threat actor's next payload.\r\n\r\n\r\n**Beacon loader deployment**\r\n\r\n\r\nOn the infected endpoint, the threat actor deploys a legitimate executable file alongside a malicious DLL file for DLL search order hijacking. This malicious DLL, another GHOSTSPIDER module known as the beacon loader (DLL export name: loader.dll), is used to launch the beacon payload in memory. A scheduled task is created to launch the executable. The beacon loader contains an encrypted .NET DLL payload (DLL export name: client.dll), which is decrypted and executed in memory.\r\n\r\n\r\n**Communication protocol**\r\n\r\n\r\nThe communication requests that are used by the GHOSTSPIDER stager follow a common format. A connection ID is placed in the HTTP header's cookie as \u201cphpsessid\u201d. The connection ID is calculated using CRC32 or CRC64 with UUID4 values. Figure 10 shows an example of a stager's first request to the C\\&C server.\u00a0\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 10\\. Example of a stager's first request to the C\\&C server\r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nHere is an example of a decrypted response:\r\n\r\n\r\n\\=\\|did\\=96A52F5C1F2C2C67\\|wid\\=13CF3E8E0E5580EB\\|act\\=2\\|tt\\=41003562\\|\\<f\r\n\r\n\r\nThe data is separated by \u201c\\|\u201d with the following items:\r\n\r\n\r\n* \r\n* An unknown prefix\r\n* \r\n* did: the connection ID calculated from the infected machine\r\n* \r\n* wid: the remote ID for a specific connection\r\n* \r\n* act: an action code\r\n* \r\n* tt: tick count\r\n* \r\n* An unknown suffix\r\n\r\n\r\n**Beacon communication and command codes**\r\n\r\n\r\nLike the stager, the GHOSTSPIDER beacon uses an almost identical format to communicate with the beacon C\\&C server to receive command codes.\u00a0\r\n\r\n\r\nTable 4 outlines the command codes supported by the GHOSTSPIDER beacon.\r\n\r\n\r\n\r\n\r\n| **Code** | **Action** | **Description** |\r\n| --- | --- | --- |\r\n| 1 | upload | Load and invoke delegate from received buffer, with 3 methods from delegate: Open / Close / Write |\r\n| 2 | create | Call the Open method from the loaded delegate |\r\n| 3 | normal | Call the Write method from the loaded delegate |\r\n| 4 | close | Unload and remove the delegate |\r\n| 5 | update | Update interval value (idle time) |\r\n| 6 | Heartbeat | Heartbeat, no action. |\r\n\r\n\r\n\r\nTable 4\\. Command codes supported by the GHOSTSPIDER beacon\r\n\r\n\r\n\r\n\r\n\r\n\r\nThe GHOSTSPIDER beacon is segmented into distinct delegates, each tailored to specific functions. These modules are retrieved from the C\\&C server and are reflectively loaded into memory as dictated by specific command codes.\r\n\r\n\r\nThis modular design significantly enhances the backdoor's flexibility and adaptability, as individual components can be deployed or updated independently based on the attacker\u2019s evolving needs. Additionally, it complicates detection and analysis, as analysts are forced to piece together a fragmented view of the malware\u2019s full functionality. By isolating different capabilities across separate modules, GHOSTSPIDER not only reduces its footprint, but also makes it challenging to construct a comprehensive understanding of its operation and overall objectives.\r\n\r\n\r\n#### The new DEMODEX infection flow\r\n\r\n\r\nThis year, we observed that the attackers used another variant of DEMODEX. In this new installation flow, the attackers no longer use a first\\-stage PowerShell script to deploy the additional needed payload. Instead, the required registry data (the encrypted configuration and the shellcode payload) for installation are bundled in a CAB file. The CAB bundle will be deleted after installation is finished. This approach ensures that, even after we collected the first\\-stage PowerShell script, the analysis cannot proceed due to the lack of additional information. We found a report published by another vendor that mentions findings consistent with our observations.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 11\\. New DEMODEX infection flow\r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 12\\. The DEMODEX rootkit installation flow observed in Trend Vision One\u2122 \r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n#### Additional C\\&C infrastructure analysis\r\n\r\n\r\n**Deploying the MASOL backdoor (aka Backdr\\-NQ) on a Linux server**\u00a0\r\n\r\n\r\nWhile investigating the C\\&C infrastructure related to Campaign Alpha, we tracked the associated C\\&C IP (103\\.159\\.133\\[.]251\\) to a Linux backdoor (name: dash\\_board, SHA256: 44ea2e85ea6cffba66f5928768c1ee401f3a6d6cd2a04e0d681d695f93cc5a1f). Our analysis confirmed that this sample is linked to the MASOL RAT, which we identified in 2020 and observed being used to target Southeast Asian government entities (Figure 13\\). Based on the backdoor's PDB string (E:\\\\Masol\\_https190228\\\\x64\\\\Release\\\\Masol.pdb), we believe the backdoor may have been developed as early as 2019\\. We observed the new Linux variant of MASOL in the wild after 2021\\. However, we haven\u2019t seen the Windows variant of MASOL after 2021\\. Currently, we have moderate to high confidence that Earth Estries uses MASOL RAT to target Linux servers within Southeast Asian governments recent years.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 13\\. The extracted MASOL RAT malware configuration \r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nBased on the following reasons, we currently only have low confidence that Earth Estries has previously deployed the MASOL RAT through CVE\\-2022\\-3236:\r\n\r\n\r\n* Since August of this year, we have observed a new campaign launched by Earth Estries targeting Southeast Asian governments. Our Deep Discovery Inspector (DDI) detected a compromised Linux server communicating with the MASOL RAT C\\&C. During the same period, we also observed other compromised hosts within the same organization communicating with the C\\&C infrastructure associated with the sub\\-domain of CrowDoor backdoor. We will continue monitoring this ongoing campaign and may provide more details after we have completed our investigation.\r\n* We didn\u2019t find any C\\&C infrastructure that overlaps between our research and\u00a0the Sophos report. Although we only observed limited MASOL RAT IOCs in the wild, we cannot rule out the possibility that MASOL RAT is a shared tool among limited Chinese APT threat groups.\r\n\r\n\r\n**Additional GHOSTSPIDER C\\&C infrastructure**\r\n\r\n\r\nCurrently, we do not have sufficient evidence to attribute the DEMODEX rootkit and GHOSTSPIDER as a proprietary backdoor used by Earth Estries. Therefore, we will only list the C\\&C infrastructure used by two campaigns discussed above in the IOC section. However, we discovered some interesting GHOSTSPIDER C\\&C infrastructure.\r\n\r\n\r\nIn the certificate used by the GHOSTSPIDER C\\&C 141\\.255\\.164\\[.]98:2096 (C\\&C active timeline: August 2, 2024 to August 22, 2024\\), we found that one of the certificate\u2019s alternative names, \u201cpalloaltonetworks\\[.]com\u201d, was mentioned in a vendor report related to a Inc Ransom attack (Figure 14\\). Although we haven\u2019t observed any GHOSTSPIDER\\-related incidents that links it to Inc Ransom, based on these OSINT findings, it is possible that Earth Estries may use ransomware in their operations for espionage or for financial gain.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 14\\. Certificate used by GHOSTSPIDER \r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n#### Attribution\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 15\\. Attribution overview (demonstrates a possible joint operation across different units)\r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nIn our first Earth Estries blog entry, we found some TTPs that overlapped between Earth Estries and FamousSparrow. Since then, we have found the two campaigns that are related to the DEMODEX rootkit mentioned in GhostEmperor report. Since we found that the attacker also used SNAPPYBEE, we suspect that the tools used by Earth Estries might come from different malware\\-as\\-a\\-service (MaaS) providers. We attribute the two campaigns to Earth Estries with high confidence based on the following shared TTPs:\u00a0\r\n\r\n\r\n1. Campaign Alpha and Campaign Beta\u2019s C\\&C domain shared the same WHOIS registration information.\r\n2. Both campaigns utilized the DEMODEX rootkit and GHOSTSPIDER.\r\n3. We observed the DEMODEX, SparrowDoor, and CrowDoor used the same C\\&C infrastructure in the past. Additionally, the C\\&C 27\\.102\\.113\\[.]240 was mentioned in the FamousSparrow and GhostEmperor reports. Therefore, we believe that Earth Estries has used DEMODEX, GHOSTSPIDER, SparrowDoor and CrowDoor. But we\u2019re not sure if these customized backdoors are proprietary tools used by Earth Estries, so some of the C\\&C infrastructure cannot be attributed to this threat group.\r\n\r\n\r\nBased on our telemetry, we observed that the Campaign Alpha actors deployed another x86 SNAPPYBEE sample set at %SYSTEMROOT%\\\\assembly\\\\imfsbDll.dll (SHA256: 6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc) and %SYSTEMROOT%\\\\assembly\\\\DgApi.dll (SHA256: 25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b) in their operations on October 10, 2024\\. We detected the same hashes in two other government entities.\r\n\r\n\r\nWe also found that one of these government entities had been compromised by Earth Estries since 2020\\. Notably, SNAPPYBEE was deployed in the ZINGDOOR attack chains on October 13, 2024\\. This is why we believe Earth Estries used distinct C\\&C infrastructure for different targets, and that the operations might have been launched by different teams. Some of the TTPs differ significantly, even though the same toolset was shared.\r\n\r\n\r\nIt's worth noting that we observed the following C\\&C infrastructure overlapping across multiple victim environments. First, we found DEMODEX and Cobalt Strike beacon samples in the same infected machine. The DEMODEX C\\&C domain pulseathermakf\\[.]com is used by operator of Campaign Beta. The Cobalt Strike beacon C\\&C cloudlibraries\\[.]global\\[.]ssl\\[.]fastly\\[.]net (with the sample downloaded from the C\\&C hxxp://103\\.159\\.133\\[.]205/lib3\\.cab) and the post\\-exploitation activity is linked to TrillClient attack chains, which involve the Hemigate, SparrowDoor, and CrowDoor toolsets.\u00a0\u00a0\u00a0\r\n\r\n\r\nNext, we found that the DEMODEX C\\&C domain pulseathermakf\\[.]com has been used to target a Southeast Asian government agency for several years. However, on August 28, 2024, we detected a network connection to pulseathermakf\\[.]com from a compromised server belonging to a Southeast Asian telecommunications company (Campaign Beta). We speculate that the attacker may have made a mistake while deploying the backdoor. Currently, we observe that the attacker primarily uses the DEMODEX C\\&C domains www\\[.]infraredsen\\[.]com and imap\\[.]dateupdata\\[.]com to target multiple Southeast Asian telecom companies.\r\n\r\n\r\nDuring our investigation of Campaign Beta, we discovered the GHOSTSPIDER backdoor. Subsequently, while tracking the C\\&C infrastructure related to GHOSTSPIDER, we found that the attacker had also tested GHOSTSPIDER on the Campaign Alpha open directory C\\&C server 23\\.81\\.41\\[.]166\\.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nFigure 16\\. The certificate (SHA256: b63c82fc37f0e9c586d07b96d70ff802d4b707ffb2d59146cf7d7bb922c52e7e) used by GHOSTPSIDER (Campaign Alpha) \r\n\r\n\r\n\r\n\r\ndownload\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n#### Conclusion\r\n\r\n\r\nEarth Estries is one of the most aggressive Chinese APT groups, primarily targeting critical industries such as telecommunications and government sectors. Their notable TTPs include exploiting known vulnerabilities and using widely available shared tools, such as SNAPPYBEE. Earth Estries conducts stealthy attacks that start from edge devices and extend to cloud environments, making detection challenging. They employ various methods to establish operational networks that effectively conceal their cyber espionage activities, demonstrating a high level of sophistication in their approach to infiltrating and monitoring sensitive targets.\r\n\r\n\r\nIt is crucial for organizations and their security teams to remain vigilant and proactively strengthen their cybersecurity defenses against cyberespionage campaigns. Through technologies like Trend Vision One\u2122, security practitioners can visualize all organizational components from a single platform, enabling them to monitor and track tools, behaviors, and payloads as they navigate their organization's networks, systems, and infrastructure, while simultaneously detecting and blocking threats as early in the attack or infection process as possible.\r\n\r\n\r\n#### Trend Micro Vision One Threat Intelligence\r\n\r\n\r\nTo stay ahead of evolving threats, Trend Micro customers can access a range of Intelligence Reports and Threat Insights within Trend Micro Vision One. Threat Insights helps customers stay ahead of cyber threats before they happen and better prepared for emerging threats. It offers comprehensive information on threat actors, their malicious activities, and the techniques they use. By leveraging this intelligence, customers can take proactive steps to protect their environments, mitigate risks, and respond effectively to threats.\r\n\r\n\r\n**Trend Micro Vision One Intelligence Reports App \\[IOC Sweeping]**\r\n\r\n\r\n* Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions\r\n\r\n\r\n**Trend Micro Vision One Threat Insights App**\r\n\r\n\r\n* Threat Actors: Earth Estries\r\n* Emerging Threats: Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions\r\n\r\n\r\n#### Hunting Queries\r\n\r\n\r\n**Trend Micro Vision One Search App**\r\n\r\n\r\nVision One customers can use the Search App to match or hunt the malicious indicators mentioned in this blog post with data in their environment.\u202f\u202f\u202f\u202f\r\n\r\n\r\n*Hunting DEMODEX Malware*\r\n\r\n\r\n\r\n> objectFilePath:\"PsvchostDLL\\_X64\\.dll\" OR \r\n> \r\n> objectFilePath:\"AesedMemoryBinX64\\.REG\" OR \r\n> \r\n> objectFilePath:\"msmp4dec.dll\" OR objectFilePath:\"wpccfg.dll\" OR \r\n> \r\n> objectFilePath:\"dumpfiskfss.sys\" OR \r\n> \r\n> objectFilePath:\"SstpCfs.dll\"\r\n\r\n\r\nMore hunting queries are available for Vision One customers with Threat Insights Entitlement enabled.\u00a0\r\n\r\n\r\n#### Yara Rules\r\n\r\n\r\nDownload the YARA rules here.\u00a0\r\n\r\n\r\n#### Indicators of Compromise\r\n\r\n\r\nDownload the list of IOCs here. This IOC list was last updated on October 31, 2024, during which we observed some of IOCs were still used in the ongoing campaigns. This is not a comprehensive list of IOCs, because most of the related components of DEMODEX and GHOSTSPIDER have different file hashes for different endpoints. We will release more IOCs and hunting queries on the Vision One platform.",
"object_refs": [
"report--ffea72a3-7935-4078-b769-b872475c5eae"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6140b82d-b235-475f-a249-55902e25df98",
"created": "2024-11-27T08:29:24.000Z",
"modified": "2024-11-27T08:29:24.000Z",
"relationship_type": "related-to",
"source_ref": "vulnerability--598166cf-5511-49b0-b406-0754e6ab2440",
"target_ref": "vulnerability--a66dce6e-a6ff-4146-9d6a-5d7ffd4b5737"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d259e1a4-e18b-4375-b8d3-808a1d76d43b",
"created": "2024-11-27T08:29:24.000Z",
"modified": "2024-11-27T08:29:24.000Z",
"relationship_type": "weakened-by",
"source_ref": "vulnerability--598166cf-5511-49b0-b406-0754e6ab2440",
"target_ref": "x-misp-object--0691345e-b820-496f-b054-562fef233a3d"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d0c03e5d-a213-4441-8423-0b1a84704edb",
"created": "2024-11-27T08:29:24.000Z",
"modified": "2024-11-27T08:29:24.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--598166cf-5511-49b0-b406-0754e6ab2440",
"target_ref": "attack-pattern--df3f8d43-4697-44cb-acf0-0bf24c1f73ed"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--46d2a8a6-1cc8-460b-8109-d6f9f4732fc1",
"created": "2024-11-27T08:29:24.000Z",
"modified": "2024-11-27T08:29:24.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--598166cf-5511-49b0-b406-0754e6ab2440",
"target_ref": "attack-pattern--5342f955-30a8-496a-97b7-52c7904b4ab4"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--369b81d1-6c88-4a1b-8b4b-1b622289c768",
"created": "2024-11-27T08:29:24.000Z",
"modified": "2024-11-27T08:29:24.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--598166cf-5511-49b0-b406-0754e6ab2440",
"target_ref": "attack-pattern--5a1ed979-35ef-4e2d-a9bb-1551f2a52928"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--54901cad-d1f3-4e32-92c1-eacf1774f7f4",
"created": "2024-11-27T08:29:24.000Z",
"modified": "2024-11-27T08:29:24.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--598166cf-5511-49b0-b406-0754e6ab2440",
"target_ref": "attack-pattern--2ba27d93-0df1-46b0-ba6a-ed8cfe29bd96"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8e461c5b-8b15-4601-a4a1-1645f3b88564",
"created": "2024-11-27T08:29:24.000Z",
"modified": "2024-11-27T08:29:24.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--598166cf-5511-49b0-b406-0754e6ab2440",
"target_ref": "attack-pattern--ee77a247-d203-47ad-9e73-537a21646276"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--03f86837-9448-4da5-b4d8-48d09fba1a65",
"created": "2024-11-27T08:29:40.000Z",
"modified": "2024-11-27T08:29:40.000Z",
"relationship_type": "related-to",
"source_ref": "vulnerability--307fab05-6e48-4d29-aa58-b4ef8ed9d0de",
"target_ref": "vulnerability--67d93fff-c91c-41d1-89b2-dced25d651a5"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a7eb7354-8e53-418d-9eca-2ac9c0cacf9f",
"created": "2024-11-27T08:29:56.000Z",
"modified": "2024-11-27T08:29:56.000Z",
"relationship_type": "related-to",
"source_ref": "vulnerability--804f2152-e97e-48ce-9915-fa298949b955",
"target_ref": "vulnerability--df48cd61-c020-49f9-82a2-e0a798183068"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1a6fe442-c210-4ec5-a376-1c78b54e2292",
"created": "2024-11-27T08:29:56.000Z",
"modified": "2024-11-27T08:29:56.000Z",
"relationship_type": "weakened-by",
"source_ref": "vulnerability--804f2152-e97e-48ce-9915-fa298949b955",
"target_ref": "x-misp-object--79ff18f5-0bc3-42c6-9351-030d98f8a125"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--63fa2fed-0da4-4136-9572-5dfc667b1a6b",
"created": "2024-11-27T08:29:56.000Z",
"modified": "2024-11-27T08:29:56.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--804f2152-e97e-48ce-9915-fa298949b955",
"target_ref": "attack-pattern--451d3abd-c6e7-45c3-90c0-e72a24d02f7a"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b2782480-835e-4789-9a4b-cb32c2e53471",
"created": "2024-11-27T08:30:17.000Z",
"modified": "2024-11-27T08:30:17.000Z",
"relationship_type": "related-to",
"source_ref": "vulnerability--cb455add-8385-4a5c-912d-267c7d54b69e",
"target_ref": "vulnerability--669b4001-f63d-4bdf-b9e2-4fb86abba5df"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d4b9b839-3272-441f-aedf-4b11031724ae",
"created": "2024-11-27T08:30:17.000Z",
"modified": "2024-11-27T08:30:17.000Z",
"relationship_type": "weakened-by",
"source_ref": "vulnerability--cb455add-8385-4a5c-912d-267c7d54b69e",
"target_ref": "x-misp-object--e901580b-1b8a-4af1-8b30-560ab54e6360"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bc829dce-4cda-4e43-bbf4-b205b69734bf",
"created": "2024-11-27T08:30:38.000Z",
"modified": "2024-11-27T08:30:38.000Z",
"relationship_type": "related-to",
"source_ref": "vulnerability--aef48aac-76e3-426a-a5ec-9ff59fb018a1",
"target_ref": "vulnerability--df48cd61-c020-49f9-82a2-e0a798183068"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--619d7956-64c4-43d4-8a21-0828d86f0246",
"created": "2024-11-27T08:30:38.000Z",
"modified": "2024-11-27T08:30:38.000Z",
"relationship_type": "weakened-by",
"source_ref": "vulnerability--aef48aac-76e3-426a-a5ec-9ff59fb018a1",
"target_ref": "x-misp-object--79ff18f5-0bc3-42c6-9351-030d98f8a125"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b75532fe-aea0-4a5e-94f5-a1095300034f",
"created": "2024-11-27T08:30:38.000Z",
"modified": "2024-11-27T08:30:38.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--aef48aac-76e3-426a-a5ec-9ff59fb018a1",
"target_ref": "attack-pattern--451d3abd-c6e7-45c3-90c0-e72a24d02f7a"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5bf24a8d-7c4c-45f6-9445-9188e8c70502",
"created": "2024-11-27T08:30:59.000Z",
"modified": "2024-11-27T08:30:59.000Z",
"relationship_type": "related-to",
"source_ref": "vulnerability--2311608a-fa79-4786-97d9-b9c71d1b7414",
"target_ref": "vulnerability--67d93fff-c91c-41d1-89b2-dced25d651a5"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0606b812-79a2-41ec-9ff9-f42f6c940a0b",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "related-to",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "vulnerability--dd05a57a-ed94-4a99-b95f-b6d8a835fa31"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--dbe0562f-6d2a-4adf-b34e-df8a280545a9",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "weakened-by",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "x-misp-object--59eda582-0c44-4695-94be-2fc8be45a740"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--94b867ef-e809-4093-98c0-b3767369d6e5",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "attack-pattern--df3f8d43-4697-44cb-acf0-0bf24c1f73ed"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--92458d46-4cf9-4bdf-811e-5b8019e53f70",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "attack-pattern--0b8e087d-e807-4737-a91d-a7b23b7dcab2"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--80d2c6aa-5a2f-41ce-9deb-8088c6502af0",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "attack-pattern--6d7a3232-2d66-438e-808d-3186176eb00b"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--51d1b54b-4bc8-4e73-ac4f-4e8e2dd099b1",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "attack-pattern--a0168d78-1fca-4506-9874-52644df4ef2d"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c972c2a3-e9a2-429e-8c26-af75828d5ac2",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "attack-pattern--c7044849-01f8-4713-90fe-9ee40ae51ae4"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--47888cd2-a35b-49d9-aeca-24f05eac78e1",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "attack-pattern--105b6cc6-7686-4912-88bd-3154dbf554bc"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1d938f20-3f0e-4276-a1c0-1f7d72b48fc2",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "attack-pattern--b6d47efc-6f91-42a2-be2b-e37b2ece71a7"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e97976cd-9273-4d87-9fb2-58e57cab9ddf",
"created": "2024-11-27T08:32:02.000Z",
"modified": "2024-11-27T08:32:02.000Z",
"relationship_type": "targeted-by",
"source_ref": "vulnerability--6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"target_ref": "attack-pattern--9578f5a0-9e1c-4e32-a99a-0fa0a48b5f5a"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink