People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action

cisa.gov · Undated · Licence: not cleared; local research copy only

CVEs this report names

5 CVEs

CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
Apache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload Malware T1190Exploit Public-Facing Application+3 more · 10 reports
>99.9%Top 0.01%
90.0priority
CVE-2021-34473Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1053.005Scheduled Task+3 more · 9 reports
>99.9%Top 0.01%
89.4priority
CVE-2021-34523Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing Application9 reports
>99.9%Top 0.01%
89.3priority
CVE-2021-26084Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Atlassian · Confluence Server and Data CenterKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting Interpreter T1496Resource Hijacking3 reports
>99.9%Top 0.01%
87.6priority
CVE-2021-31207Microsoft Exchange Server Security Feature Bypass Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account Control T1565Data Manipulation9 reports
99.8%Top 0.04%
87.6priority

Where it names them

CVE-2021-44228

APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J (CVE-2021-44228), Atlassian Confluence (CVE-2021-31207, CVE-2021-26084) and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523, CVE-2021-34473).

Original ↗

CVE-2021-34473

APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J (CVE-2021-44228), Atlassian Confluence (CVE-2021-31207, CVE-2021-26084) and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523, CVE-2021-34473).

Original ↗

CVE-2021-34523

APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J (CVE-2021-44228), Atlassian Confluence (CVE-2021-31207, CVE-2021-26084) and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523, CVE-2021-34473).

Original ↗

CVE-2021-26084

APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J (CVE-2021-44228), Atlassian Confluence (CVE-2021-31207, CVE-2021-26084) and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523, CVE-2021-34473).

Original ↗

CVE-2021-31207

APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J (CVE-2021-44228), Atlassian Confluence (CVE-2021-31207, CVE-2021-26084) and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523, CVE-2021-34473).

Original ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.