Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group
In January 2022, a VMware Horizon server was compromised by threat actors leveraging the Log4Shell vulnerability (CVE-2021-4428).
CVE-2021-4428 Public exploit Low · 2.7 EPSS 15.8%
what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure
what3words · Autosuggest Plugin
Summary
The what3words Autosuggest Plugin (up to 4.0.0 for WordPress) contains a flaw in the enqueue_scripts function of the Setting Handler component, in the file w3w-autosuggest/public/class-w3w-autosuggest-public.php, that exposes sensitive information to unauthorized actors. Exploitation can be launched remotely over the network with low attack complexity, but it requires high privileges, and no user interaction is needed.
Official description · CVE.org
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
32.3 / 100
- Exploited
- Not confirmed
- Reports
- 1
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available 19 months before disclosure.
- Public exploit codePoC-in-GitHub19 mo before
- Named in a threat reportsygnia.co9 mo before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Named in 1 threat report1 reportsygnia.coOct 2022
Reports are matched by finding the exact id CVE-2021-4428 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 8 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- CAPE Sandbox25 Jul 2026
- Credit Mohdrennis Clone | 2022-10-03 Threat Intel Report25 Jul 2026
- Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group4 Oct 2022
- Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group4 Oct 2022
- Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group4 Oct 2022
- Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group3 Oct 2022
- 2 more on OTX