MoustachedBouncer: Espionage against foreign diplomats in Belarus
welivesecurity.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2021-1732Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft · Win32kKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation1 report78.4%Top 0.42%82.2priority
- CVE-2022-27926Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1189Drive-by CompromiseT1059.007JavaScript1 report17.6%Top 2.9%70.6priority
Where it names them
CVE-2021-1732 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Executes C:\Users\Public\driverpack\driverpackUpdate.exe (the plugin above) using elevated rights via CVE-2021-1732.
Win64/Exploit.CVE-2021-1732.I
LPE exploit for CVE-2021-1732.
Disco has a plugin to exploit the CVE-2021-1732 local privilege escalation vulnerability.
CVE-2022-27926 Original (opens in a new tab) ↗
En marzo de 2023, Winter Vivern había usado una vulnerabilidad XSS (CVE-2022-27926) en el portal de mail Zimbra para robar credenciales de webmails de diplomáticos de varios países europeos.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.