Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
cisa.gov · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution
CVEs this report names
1 CVE- CVE-2021-44228Apache Log4j2 Remote Code Execution VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports>99.9%Top 0.01%90.0priority
Where it names them
CVE-2021-44228 Original (opens in a new tab) ↗
CISA observed bi-directional traffic between the network and a known malicious IP address associated with exploitation of the Log4Shell vulnerability (CVE-2021-44228) in VMware Horizon servers.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.