2020 Financial Services and Insurance Industry Threat Report
proofpoint.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
7 CVEs- CVE-2017-11882Microsoft Office Memory Corruption VulnerabilityMicrosoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter13 reports99.9%Top 0.03%88.5priority
- CVE-2017-0199Microsoft Office and WordPad Remote Code Execution VulnerabilityMicrosoft · Office and WordPadKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution12 reports99.5%Top 0.06%88.4priority
- CVE-2018-0802Microsoft Office Memory Corruption VulnerabilityMicrosoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution8 reports93.3%Top 0.17%88.4priority
- CVE-2018-8174Microsoft Windows VBScript Engine Out-of-Bounds Write VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.5T1189Drive-by CompromiseT1059Command and Scripting Interpreter2 reports88.2%Top 0.23%84.3priority
- CVE-2017-8570Microsoft Office Remote Code Execution VulnerabilityMicrosoft · OfficeKEVPublic exploitHigh · 7.8T1203Exploitation for Client ExecutionT1204.002Malicious File5 reports89.9%Top 0.21%78.4priority
- CVE-2014-0515Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and…94.5%Top 0.15%78.2priority
- CVE-2017-8759Microsoft .NET Framework Remote Code Execution VulnerabilityMicrosoft · .NET FrameworkKEVPublic exploitHigh · 7.8T1204.002Malicious FileT1059Command and Scripting Interpreter4 reports88.7%Top 0.23%77.4priority
Where it names them
CVE-2017-11882 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Engineering Office VBA Macro Thread Hijacking PowerShell WMI Keitaro TDS RIG Exploit Kit PDF XL4 Macro VBS Password Protected Regsvr32 Compressed Executable Geofencing Regsvcs/Regasm Scheduled Task BITS Jobs HTML BlackTDS LCG Kit Executable CVE-2017-11882
/1/20 200k 180k 160k 140k 100k 80k 60k 40k 20k 0 Office VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS PDF Geofencing XL4 Macro Regsvr32 Compressed Executable Executable HTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882
05/11/205/18/205/25/206/1/20 600k 400k 300k 200k 100k 0 Office VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS PDFGeofencing XL4 MacroRegsvr32 Compressed Executable ExecutableHTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882
CVE-2017-0199 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2017-11882 JavaJavaScript CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTA Packager Shell Object IP Filtering Certutil CVE-2017-8570 Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802 Headers fencing XL4 macros CVE-2017-0199 CVE-2017-8759Lotus-Blue Toolkit (O365) Template Injection
Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTAPackager Shell Object IP FilteringCertutil CVE-2017-8570 Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802 Headers fencing XL4 macros CVE-2017-0199
obs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTA Packager Shell Object IP FilteringCertutil CVE-2017-8570Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802 Headers fencing XL4 macros CVE-2017-0199
CVE-2018-0802 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Regsvcs/Regasm Scheduled Task BITS Jobs HTML BlackTDS LCG Kit Executable CVE-2017-11882 JavaJavaScript CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTA Packager Shell Object IP Filtering Certutil CVE-2017-8570 Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802 Headers fencing XL4
utable Executable HTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTAPackager Shell Object IP FilteringCertutil CVE-2017-8570 Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802
table ExecutableHTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTA Packager Shell Object IP FilteringCertutil CVE-2017-8570Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802
CVE-2018-8174 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
k 3k 2k 1k 0 Social Engineering Office VBA Macro Thread Hijacking PowerShell WMI Keitaro TDS RIG Exploit Kit PDF XL4 Macro VBS Password Protected Regsvr32 Compressed Executable Geofencing Regsvcs/Regasm Scheduled Task BITS Jobs HTML BlackTDS LCG Kit Executable CVE-2017-11882 JavaJavaScript CAPTCHA CVE-2018-8174
20k 0 Office VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS PDF Geofencing XL4 Macro Regsvr32 Compressed Executable Executable HTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174
0k 100k 0 Office VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS PDFGeofencing XL4 MacroRegsvr32 Compressed Executable ExecutableHTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174
CVE-2017-8570 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2017-8570 Lemon Tree FreeRDP
VBS Password Protected Regsvr32 Compressed Executable Geofencing Regsvcs/Regasm Scheduled Task BITS Jobs HTML BlackTDS LCG Kit Executable CVE-2017-11882 JavaJavaScript CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTA Packager Shell Object IP Filtering Certutil CVE-2017-8570 Application Access Token
S RIG Exploit Kit VBS PDF Geofencing XL4 Macro Regsvr32 Compressed Executable Executable HTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTAPackager Shell Object IP FilteringCertutil CVE-2017-8570
CVE-2017-8570.
XL4 MacroRegsvr32 Compressed Executable ExecutableHTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTA Packager Shell Object IP FilteringCertutil CVE-2017-8570Application Access
CVE-2014-0515 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
05/18/205/25/206/1/20 200k 180k 160k 140k 100k 80k 60k 40k 20k 0 Office VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS PDF Geofencing XL4 Macro Regsvr32 Compressed Executable Executable HTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515
0/204/27/205/4/205/11/205/18/205/25/206/1/20 600k 400k 300k 200k 100k 0 Office VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS PDFGeofencing XL4 MacroRegsvr32 Compressed Executable ExecutableHTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515
CVE-2017-8759 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2017-11882 JavaJavaScript CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTA Packager Shell Object IP Filtering Certutil CVE-2017-8570 Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802 Headers fencing XL4 macros CVE-2017-0199 CVE-2017-8759Lotus-Blue Toolkit (O365) Template Injection
t BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTAPackager Shell Object IP FilteringCertutil CVE-2017-8570 Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802 Headers fencing XL4 macros CVE-2017-0199 CVE-2017-8759
BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTA Packager Shell Object IP FilteringCertutil CVE-2017-8570Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802 Headers fencing XL4 macros CVE-2017-0199 CVE-2017-8759
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.