AA21-200B: Chinese State-Sponsored Cyber Operations: Observed TTPs
us-cert.cisa.gov · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution
CVEs this report names
3 CVEs- CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read VulnerabilityIvanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1133External Remote ServicesT1059Command and Scripting Interpreter+2 more · 6 reports>99.9%Top 0.01%90.0priority
- CVE-2019-19781Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution VulnerabilityCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more · 8 reports>99.9%Top 0.01%89.9priority
- CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution VulnerabilityF5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more · 5 reports>99.9%Top 0.01%89.9priority
Where it names them
CVE-2019-11510 Original (opens in a new tab) ↗
Many exploits can be mitigated by applying available patches for vulnerabilities (such as CVE-2019-11510, CVE-2019-19781, and CVE-2020-5902) affecting external remote services.
CVE-2019-19781 Original (opens in a new tab) ↗
Many exploits can be mitigated by applying available patches for vulnerabilities (such as CVE-2019-11510, CVE-2019-19781, and CVE-2020-5902) affecting external remote services.
CVE-2020-5902 Original (opens in a new tab) ↗
Many exploits can be mitigated by applying available patches for vulnerabilities (such as CVE-2019-11510, CVE-2019-19781, and CVE-2020-5902) affecting external remote services.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.