Patchfirst

Blackcat

blog.group-ib.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution

Read the original ↗

CVEs this report names

3 CVEs
  1. CVE-2021-34473Microsoft Exchange Server Remote Code Execution Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1053.005Scheduled Task+3 more · 9 reports
    >99.9%Top 0.01%
    89.4priority
  2. CVE-2021-34523Microsoft Exchange Server Privilege Escalation Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing Application9 reports
    >99.9%Top 0.01%
    89.3priority
  3. CVE-2021-31207Microsoft Exchange Server Security Feature Bypass Vulnerability
    Microsoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account ControlT1565Data Manipulation9 reports
    99.8%Top 0.04%
    87.6priority

Where it names them

CVE-2021-34473
Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
Original (opens in a new tab) ↗
CVE-2021-34523
Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
Original (opens in a new tab) ↗
CVE-2021-31207
Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
Original (opens in a new tab) ↗

Techniques drawn from this report

3 links, in kill-chain order

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-34473

MITRE CTID mapping of the KEV entry

Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
Original (opens in a new tab) ↗

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-34523

MITRE CTID mapping of the KEV entry

Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
Original (opens in a new tab) ↗

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-31207

ATT&CK ID cited in the report

Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close