Patchfirst
Patchfirst

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself

microsoft.com · 9 May 2022 · Licence: not cleared; local research copy only

Read the original ↗

CVEs this report names

16 CVEs
  1. CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
    Ivanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1133External Remote ServicesT1059Command and Scripting Interpreter+2 more · 6 reports
    >99.9%Top 0.01%
    90.0priority
  2. CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
    Apache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports
    >99.9%Top 0.01%
    90.0priority
  3. CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal Vulnerability
    Fortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application5 reports
    >99.9%Top 0.01%
    89.9priority
  4. CVE-2019-19781Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
    Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more · 8 reports
    >99.9%Top 0.01%
    89.9priority
  5. CVE-2019-0604Microsoft SharePoint Remote Code Execution Vulnerability
    Microsoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 4 reports
    99.9%Top 0.03%
    88.8priority
  6. CVE-2021-31207Microsoft Exchange Server Security Feature Bypass Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account ControlT1565Data Manipulation9 reports
    99.8%Top 0.04%
    87.6priority
  7. CVE-2022-30190Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1105Ingress Tool Transfer4 reports
    99.2%Top 0.07%
    87.4priority
  8. CVE-2021-40444Microsoft MSHTML Remote Code Execution Vulnerability
    Microsoft · MSHTMLKEVRansomwarePublic exploitHigh · 8.8T1204.002Malicious FileT1203Exploitation for Client Execution3 reports
    97.8%Top 0.09%
    86.9priority
  9. CVE-2021-22893Ivanti Pulse Connect Secure Use-After-Free Vulnerability
    Ivanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report
    47.2%Top 1.2%
    83.6priority
  10. CVE-2020-8260Ivanti Pulse Connect Secure Code Execution Vulnerability
    Ivanti · Pulse Connect SecureKEVPublic exploitHigh · 7.2T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report
    96.5%Top 0.12%
    81.9priority
  11. CVE-2021-20016SonicWall SSLVPN SMA100 SQL Injection Vulnerability
    SonicWall · SSLVPN SMA100KEVRansomwareCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System1 report
    40.0%Top 1.4%
    78.5priority
  12. CVE-2020-8243Ivanti Pulse Connect Secure Code Execution Vulnerability
    Ivanti · Pulse Connect SecureKEVHigh · 7.2T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report
    90.8%Top 0.2%
    76.9priority
  13. CVE-2020-10189Zoho ManageEngine Desktop Central File Upload Vulnerability
    Zoho · ManageEngineKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report
    99.9%Top 0.03%
    73.7priority
  14. CVE-2021-22894Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
    Ivanti · Pulse Connect SecureKEVHigh · 8.8T1078Valid AccountsT1059Command and Scripting Interpreter1 report
    41.3%Top 1.3%
    67.8priority
  15. CVE-2021-22899Ivanti Pulse Connect Secure Command Injection Vulnerability
    Ivanti · Pulse Connect SecureKEVHigh · 8.8T1078Valid Accounts1 report
    22.9%Top 2.3%
    67.6priority
  16. CVE-2021-22900Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
    Ivanti · Pulse Connect SecureKEVHigh · 7.2T1059Command and Scripting InterpreterT1068Exploitation for Privilege Escalation1 report
    14.1%Top 3.4%
    66.2priority

Where it names them

CVE-2019-11510
Pulse Secure VPN systems affected by CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900
Original (opens in a new tab) ↗
CVE-2021-44228
In February of 2022, DEV-0401 was observed deploying the Pandora ransomware family, primarily via unpatched VMware Horizon systems vulnerable to the Log4j 2 CVE-2021-44228 vulnerability.
Original (opens in a new tab) ↗
Apache log4j CVE-2021-44228
Original (opens in a new tab) ↗
CVE-2018-13379
FortiGate VPN servers affected by CVE-2018-13379
Original (opens in a new tab) ↗
CVE-2019-19781
Citrix ADC systems affected by CVE-2019-19781
Original (opens in a new tab) ↗
CVE-2019-0604
Microsoft SharePoint servers affected by CVE-2019-0604
Original (opens in a new tab) ↗
CVE-2021-31207
ELBRUS has also been abusing CVE-2021-31207 in Exchange to compromise organizations in April of 2022, an interesting pivot to using a less popular authenticated vulnerability in the ProxyShell cluster of vulnerabilities.
Original (opens in a new tab) ↗
CVE-2022-30190
DEV-0464 also rapidly adopted the Microsoft Support Diagnostic Tool (MSDT) vulnerability (CVE-2022-30190) in their campaigns.
Original (opens in a new tab) ↗
CVE-2021-40444
DEV-0193 infrastructure has also been implicated in attacks deploying novel techniques, including exploitation of CVE-2021-40444.
Original (opens in a new tab) ↗
CVE-2021-22893
Pulse Secure VPN systems affected by CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900
Original (opens in a new tab) ↗
CVE-2020-8260
Pulse Secure VPN systems affected by CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900
Original (opens in a new tab) ↗
CVE-2021-20016
SonicWall SSLVPN affected by CVE-2021-20016
Original (opens in a new tab) ↗
CVE-2020-8243
Pulse Secure VPN systems affected by CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900
Original (opens in a new tab) ↗
CVE-2020-10189
Zoho ManageEngine systems affected by CVE-2020-10189
Original (opens in a new tab) ↗
CVE-2021-22894
Pulse Secure VPN systems affected by CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900
Original (opens in a new tab) ↗
CVE-2021-22899
Pulse Secure VPN systems affected by CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900
Original (opens in a new tab) ↗
CVE-2021-22900
Pulse Secure VPN systems affected by CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900
Original (opens in a new tab) ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.

↑ ↓ chooseEnter openEsc close