North Korean APT InkySquid Infects Victims Using Browser Exploits
On another occasion, CVE-2021-26411 was used, which is another exploit targeting Internet Explorer and legacy versions of Microsoft Edge.
CVE-2021-26411 KEVRansomwarePublic exploit High · 8.8 EPSS 81.7%
Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet Explorer
Summary
A memory corruption flaw in Microsoft Internet Explorer, classified as a use-after-free issue, lives in the browser's rendering and memory-handling code. An attacker who can reach the target over the network can exploit it without authentication or special privileges, but a user must interact with the attacker's content, such as by visiting a malicious page, for the exploit to succeed, and the attack can affect resources beyond the vulnerable component's own security scope.
Official description · NVD
Internet Explorer Memory Corruption Vulnerability
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
80.0 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 1
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 days before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 8 months after disclosure.
- First seen exploitedVulnCheck KEV evidence2 days before
- Disclosedday 0
- Named in a threat reportvolexity.com+5 mo
- Added to CISA KEVknown ransomware use; EU database agrees+8 mo
- Public exploit codePoC-in-GitHub+8 mo
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 1 cited passage 1Initial AccessTA0001
Drive-by Compromise T1189 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
AI mapping from the description · how it is exploited
browser memory corruption via drive-by content
Internet Explorer Memory Corruption Vulnerability
Detection
0 rules for this CVE · 3 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2021-26411 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Drive-by CompromiseT11893 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 1 threat report1 reportVolexityAug 2021
Reports are matched by finding the exact id CVE-2021-26411 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.