RansomHub never sleeps episode 1
group-ib.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
3 CVEs- CVE-2024-3400Palo Alto Networks PAN-OS Command Injection VulnerabilityPalo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter3 reports>99.9%Top 0.01%87.7priority
- CVE-2020-1472Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reports99.4%Top 0.06%86.8priority
- CVE-2021-42278Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityMicrosoft · Active DirectoryKEVRansomwarePublic exploitHigh · 7.5T1078Valid AccountsT1068Exploitation for Privilege Escalation1 report73.3%Top 0.54%82.0priority
Where it names them
CVE-2024-3400 Original (opens in a new tab) ↗
Their intelligence revealed a critical vulnerability—CVE-2024-3400—impacting Palo Alto Networks firewall appliances running an outdated PAN-OS software.
CVE-2020-1472 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
This technique allowed the attacker to exploit two vulnerabilities in the domain controller: CVE-2021-42278 (sAMAccount Spoofing) and CVE-2020-1472.
second one, labelled with CVE-2020-1472 and known also as ZeroLogon, affects Microsoft’s Active Directory NetLogon remote Protocol (MS-NRPC), and it allows a malicious actor without user credentials to gain the highest privileges in the domain, and take the control of a vulnerable domain controller via NT Lan
CVE-2021-42278 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
This technique allowed the attacker to exploit two vulnerabilities in the domain controller: CVE-2021-42278 (sAMAccount Spoofing) and CVE-2020-1472.
The vulnerability labelled as CVE-2021-42278 enables an attacker with limited domain user credentials to obtain a Kerberos service ticket for the domain controller, ultimately allowing them to compromise the domain controller.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.