Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets
microsoft.com · 14 Sep 2023 · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2022-47966Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1136.001Local Account+1 more · 3 reports99.8%Top 0.04%87.6priority
- CVE-2022-26134Atlassian Confluence Server and Data Center Remote Code Execution VulnerabilityAtlassian · Confluence Server/Data CenterKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application2 reports>99.9%Top 0.01%86.0priority
Where it names them
CVE-2022-47966 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2022-47966 is a remote code execution vulnerability affecting a subset of on-premises Zoho ManageEngine products.
https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html
CVE-2022-26134 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2022-26134 is a remote code execution vulnerability in Confluence Server and Data Center.
Recommendations that help organizations protect against exploitation of multiple vulnerabilities, including CVE-2022-26134, can be found in the recommendations section of this report.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26134
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.