Eset gelsemium
web-assets.esetstatic.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution15 reports>99.9%Top 0.02%89.2priority
- CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 3 reports>99.9%Top 0.03%86.9priority
Where it names them
CVE-2012-0158 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
spearphishing with attachments exploiting a then-old vulnerability in Microsoft Office (CVE-2012-0158)
a Microsoft Office vulnerability (CVE-2012-0158) .
vulnerabilities for execution, such as CVE-2012-0158
CVE-2020-0688 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2020-0688, as the timeline fits and also Microsoft released an article following the security fix
T1190 Exploit Public-Facing Application Gelsemium exploits the vulnerability CVE-2020- 0688 .
and CVE-2020-0688 .
Techniques drawn from this report
1 link, in kill-chain orderInitial Access Exploit Public-Facing Application T1190 for CVE-2020-0688
MITRE CTID mapping of the KEV entry
T1190 Exploit Public-Facing Application Gelsemium exploits the vulnerability CVE-2020- 0688 .