Us 21 Anatomy Of Native Iis Malware wp
i.blackhat.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
4 CVEs- CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1133External Remote ServicesT1505.003Web Shell+2 more · 5 reports>99.9%Top 0.01%89.4priority
- CVE-2021-27065Microsoft Exchange Server Remote Code Execution Vulnerability99.9%Top 0.04%87.4priority
- CVE-2021-26857Microsoft Exchange Server Remote Code Execution Vulnerability95.8%Top 0.13%86.2priority
- CVE-2021-26858Microsoft Exchange Server Remote Code Execution Vulnerability93.7%Top 0.16%81.2priority
Where it names them
CVE-2021-26855 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
pre-authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-
ProxyLogon vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-
authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-
C:\ProxyLogon-CVE-2021-26855-main\IIS-Raid-modify\module\x64\Release\IIS-
CVE-2021-27065 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
pre-authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE- 2021-27065), with government institutions among the targets.
ProxyLogon vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021- 27065).
authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE- 2021-27065), aka ProxyLogon, was disclosed.
CVE-2021-26857 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
pre-authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-
ProxyLogon vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-
authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-
CVE-2021-26858 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
pre-authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-
ProxyLogon vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-
authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.