RaaS AvosLocker Incident Response Analysis
linkedin.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
8 CVEs- CVE-2021-44228Apache Log4j2 Remote Code Execution VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports>99.9%Top 0.01%90.0priority
- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1053.005Scheduled Task+3 more · 9 reports>99.9%Top 0.01%89.4priority
- CVE-2021-34523Microsoft Exchange Server Privilege Escalation VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing Application9 reports>99.9%Top 0.01%89.3priority
- CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account ControlT1565Data Manipulation9 reports99.8%Top 0.04%87.6priority
- CVE-2021-45046Apache Log4j2 Deserialization of Untrusted Data VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 9.0T1059Command and Scripting InterpreterT1486Data Encrypted for Impact2 reports>99.9%Top 0.02%85.4priority
- CVE-2021-44832Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configurationApache Software Foundation · Apache Log4j2Public exploitMedium · 6.6T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report97.9%Top 0.09%81.5priority
- CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluationApache Software Foundation · Apache Log4j2Public exploitMedium · 5.9T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation1 report>99.9%Top 0.01%81.0priority
- CVE-2021-31206Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Microsoft Exchange Server 2013 Cumulative Update 23High · 7.61 report13.0%Top 3.7%76.5priority
Where it names them
CVE-2021-44228 Original (opens in a new tab) ↗
topology above: vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege
CVE-2021-34473 Original (opens in a new tab) ↗
CVEs involved in these exploits are CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, and CVE-2021-31207.
CVE-2021-34523 Original (opens in a new tab) ↗
CVEs involved in these exploits are CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, and CVE-2021-31207.
CVE-2021-31207 Original (opens in a new tab) ↗
CVEs involved in these exploits are CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, and CVE-2021-31207.
CVE-2021-45046 Original (opens in a new tab) ↗
above: vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege non-root user named
CVE-2021-44832 Original (opens in a new tab) ↗
vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege non-root user named
CVE-2021-45105 Original (opens in a new tab) ↗
vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege non-root user named
CVE-2021-31206 Original (opens in a new tab) ↗
CVEs involved in these exploits are CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, and CVE-2021-31207.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.