The five-day job: A BlackByte ransomware intrusion case study
microsoft.com · 6 Jul 2023 · Licence: not cleared; local research copy only
CVEs this report names
4 CVEs- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1053.005Scheduled Task+3 more · 9 reports>99.9%Top 0.01%89.4priority
- CVE-2021-34523Microsoft Exchange Server Privilege Escalation VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing Application9 reports>99.9%Top 0.01%89.3priority
- CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account ControlT1565Data Manipulation9 reports99.8%Top 0.04%87.6priority
- CVE-2019-16098The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user…Public exploit1 report19.8%Top 2.6%76.4priority
Where it names them
CVE-2021-34473 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
To obtain initial access into the victim’s environment, the threat actor was observed exploiting the ProxyShell vulnerabilities CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 on unpatched Microsoft Exchange Servers.
CVE-2021-34473
CVE-2021-34523 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
To obtain initial access into the victim’s environment, the threat actor was observed exploiting the ProxyShell vulnerabilities CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 on unpatched Microsoft Exchange Servers.
CVE-2021-34523
CVE-2021-31207 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
To obtain initial access into the victim’s environment, the threat actor was observed exploiting the ProxyShell vulnerabilities CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 on unpatched Microsoft Exchange Servers.
‘CVE-2021-31207’ exploit malware was detected
CVE-2021-31207
CVE-2019-16098 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
C:SystemDatarENEgOtiAtES (A vulnerable (CVE-2019-16098) driver RtCore64.sys used to evade detection by installed antivirus software; SHA-256: 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd)
CVE-2019-16098
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.