Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool

security.com · Undated · Licence: not cleared; local research copy only

CVEs this report names

5 CVEs

CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1133External Remote Services T1505.003Web Shell+2 more · 5 reports
>99.9%Top 0.01%
89.4priority
CVE-2021-34473Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1053.005Scheduled Task+3 more · 9 reports
>99.9%Top 0.01%
89.4priority
CVE-2021-34523Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing Application9 reports
>99.9%Top 0.01%
89.3priority
CVE-2021-31207Microsoft Exchange Server Security Feature Bypass Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account Control T1565Data Manipulation9 reports
99.8%Top 0.04%
87.6priority
CVE-2021-27065Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 7.8T1505.003Web Shell4 reports
99.9%Top 0.04%
87.4priority

Where it names them

CVE-2021-26855

In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.

Original ↗

CVE-2021-34473

In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.

Original ↗

CVE-2021-34523

In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.

Original ↗

CVE-2021-31207

In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.

Original ↗

CVE-2021-27065

In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.

Original ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.