Patchfirst
Patchfirst

Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

cisa.gov · Undated · Licence: not cleared; local research copy only

Read the original ↗

CVEs this report names

10 CVEs
  1. CVE-2021-26084Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
    Atlassian · Confluence Server and Data CenterKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1496Resource Hijacking3 reports
    >99.9%Top 0.01%
    87.6priority
  2. CVE-2020-1472Microsoft Netlogon Privilege Escalation Vulnerability
    Microsoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reports
    99.4%Top 0.06%
    86.8priority
  3. CVE-2021-4034Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
    Red Hat · PolkitKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation3 reports
    94.9%Top 0.14%
    86.2priority
  4. CVE-2022-26134Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
    Atlassian · Confluence Server/Data CenterKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application2 reports
    >99.9%Top 0.01%
    86.0priority
  5. CVE-2022-26138Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
    Atlassian · ConfluenceKEVPublic exploitCritical · 9.8T1552.001Credentials In Files1 report
    98.2%Top 0.08%
    83.7priority
  6. CVE-2021-33044Dahua IP Camera Authentication Bypass Vulnerability
    Dahua · IP Camera FirmwareKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts1 report
    >99.9%Top 0.02%
    73.7priority
  7. CVE-2021-33045Dahua IP Camera Authentication Bypass Vulnerability
    Dahua · IP Camera FirmwareKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts1 report
    99.6%Top 0.05%
    73.7priority
  8. CVE-2022-3236Sophos Firewall Code Injection Vulnerability
    Sophos · FirewallKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report
    98.9%Top 0.07%
    73.7priority
  9. CVE-2021-3156Sudo Heap-Based Buffer Overflow Vulnerability
    Sudo · SudoKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation1 report
    >99.9%Top 0.02%
    72.3priority
  10. CVE-2022-27666A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c
    Public exploit1 report
    5.5%Top 7.2%
    29.7priority

Where it names them

CVE-2021-26084
CVE-2021-26084 (Atlassian Confluence Server and Data Center)
Original (opens in a new tab) ↗
 NIST NVD: CVE-2021-26084
Original (opens in a new tab) ↗
CVE-2020-1472
CVE-2020-1472 (Microsoft: Windows Server)
Original (opens in a new tab) ↗
 NIST NVD: CVE-2020-1472
Original (opens in a new tab) ↗
CVE-2021-4034
scripts for, but not exploiting, the following CVEs:  CVE-2020-1472 (Microsoft: Windows Server)  CVE-2021-26084 (Atlassian Confluence Server and Data Center)  CVE-2021-3156 (Red Hat: Privilege Escalation via Command Line Argument Parsing)  CVE-2021-4034 (Red Hat: Polkit Privilege
Original (opens in a new tab) ↗
 NIST NVD: CVE-2021-4034
Original (opens in a new tab) ↗
CVE-2022-26134
CVE-2022-26134 (Atlassian Confluence Server and Data Center)
Original (opens in a new tab) ↗
the Wire is a proof of concept exploit for CVE-2022-26134, an OGNL injection vulnerability
Original (opens in a new tab) ↗
CVE-2021-33044, CVE-2021-33045, CVE-2022-26134, and CVE-2022-
Original (opens in a new tab) ↗
The proof of concept exploit for CVE-2022-26134, Through the Wire, has
Original (opens in a new tab) ↗
: Russia Cyber Threat Overview and Advisories  MITRE: Group G1003 - Ember Bear  MITRE: Impacket  NIST NVD: CVE-2020-1472  NIST NVD: CVE-2021-26084  NIST NVD: CVE-2021-3156  NIST NVD: CVE-2021-4034  NIST NVD: CVE-2022-27666  NIST NVD: CVE-2021-33044  NIST NVD: CVE-2021-33045  NIST NVD: CVE-2022-26134
Original (opens in a new tab) ↗
CVE-2022-26138
CVE-2022-26138 (Atlassian Confluence Server and Data Center)
Original (opens in a new tab) ↗
CVE-2021-33044, CVE-2021-33045, CVE-2022-26134, and CVE-2022- 26138.
Original (opens in a new tab) ↗
ew and Advisories  MITRE: Group G1003 - Ember Bear  MITRE: Impacket  NIST NVD: CVE-2020-1472  NIST NVD: CVE-2021-26084  NIST NVD: CVE-2021-3156  NIST NVD: CVE-2021-4034  NIST NVD: CVE-2022-27666  NIST NVD: CVE-2021-33044  NIST NVD: CVE-2021-33045  NIST NVD: CVE-2022-26134  NIST NVD: CVE-2022-26138
Original (opens in a new tab) ↗
CVE-2021-33044
Line Argument Parsing)  CVE-2021-4034 (Red Hat: Polkit Privilege Escalation)  CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw) Analysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as detailed throughout this advisory:  CVE-2021-33044 (Dahua
Original (opens in a new tab) ↗
In one instance, Unit 29155 cyber actors exploited CVE-2021-33044 and CVE-2021-
Original (opens in a new tab) ↗
CVE-2021-33044, CVE-2021-33045, CVE-2022-26134, and CVE-2022-
Original (opens in a new tab) ↗
 NIST NVD: CVE-2021-33044
Original (opens in a new tab) ↗
CVE-2021-33045
(Red Hat: Polkit Privilege Escalation)  CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw) Analysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as detailed throughout this advisory:  CVE-2021-33044 (Dahua Security)  CVE-2021-33045 (Dahua
Original (opens in a new tab) ↗
In one instance, Unit 29155 cyber actors exploited CVE-2021-33044 and CVE-2021- 33045 on Dahua IP cameras to bypass identity authentication.
Original (opens in a new tab) ↗
CVE-2021-33044, CVE-2021-33045, CVE-2022-26134, and CVE-2022-
Original (opens in a new tab) ↗
 NIST NVD: CVE-2021-33045
Original (opens in a new tab) ↗
CVE-2022-3236
CVE-2022-3236 (Sophos: Firewall)
Original (opens in a new tab) ↗
Group G1003 - Ember Bear  MITRE: Impacket  NIST NVD: CVE-2020-1472  NIST NVD: CVE-2021-26084  NIST NVD: CVE-2021-3156  NIST NVD: CVE-2021-4034  NIST NVD: CVE-2022-27666  NIST NVD: CVE-2021-33044  NIST NVD: CVE-2021-33045  NIST NVD: CVE-2022-26134  NIST NVD: CVE-2022-26138  NIST NVD: CVE-2022-3236
Original (opens in a new tab) ↗
CVE-2021-3156
CVE-2021-3156 (Red Hat: Privilege Escalation via Command Line Argument Parsing)
Original (opens in a new tab) ↗
 NIST NVD: CVE-2021-3156
Original (opens in a new tab) ↗
CVE-2022-27666
following CVEs:  CVE-2020-1472 (Microsoft: Windows Server)  CVE-2021-26084 (Atlassian Confluence Server and Data Center)  CVE-2021-3156 (Red Hat: Privilege Escalation via Command Line Argument Parsing)  CVE-2021-4034 (Red Hat: Polkit Privilege Escalation)  CVE-2022-27666 (Red Hat: Heap Buffer Overflow
Original (opens in a new tab) ↗
 NIST NVD: CVE-2022-27666
Original (opens in a new tab) ↗

Techniques drawn from this report

2 links, in kill-chain order

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-33045

AI mapping from the description

(Red Hat: Polkit Privilege Escalation)  CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw) Analysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as detailed throughout this advisory:  CVE-2021-33044 (Dahua Security)  CVE-2021-33045 (Dahua
Original (opens in a new tab) ↗

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-33044

AI mapping from the description

Line Argument Parsing)  CVE-2021-4034 (Red Hat: Polkit Privilege Escalation)  CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw) Analysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as detailed throughout this advisory:  CVE-2021-33044 (Dahua
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close