APT44: Unearthing
services.google.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
3 CVEs- CVE-2022-30190Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1105Ingress Tool Transfer4 reports99.2%Top 0.07%87.4priority
- CVE-2021-4034Red Hat Polkit Out-of-Bounds Read and Write VulnerabilityRed Hat · PolkitKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation3 reports94.9%Top 0.14%86.2priority
- CVE-2019-10149Exim Mail Transfer Agent (MTA) Improper Input ValidationExim · Mail Transfer Agent (MTA)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter3 reports>99.9%Top 0.02%77.6priority
Where it names them
CVE-2022-30190 Original (opens in a new tab) ↗
Variant #1 A107-004 Protected Theater - APT44, COLIBRI, Execution, Variant #2 A106-107 Protected Theater - APT44, Create GOGETTER Scheduled Task A107-005 Protected Theater - APT44, DARKCRYSTALRAT, Execution, Variant #1 A105-346 Protected Theater - APT44, EARLYBLOOM, CVE-2022-30190, HTML Downloader,
CVE-2021-4034 Original (opens in a new tab) ↗
PWNKIT Exploit PWNKIT is an implementation of CVE-2021-4034, used for privilege escalation.
CVE-2019-10149 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
A101-165 Application Vulnerability - APT44, CVE-2019-10149, Remote Code Execution, Benign Payload
A101-166 Application Vulnerability - APT44, CVE-2019-10149, Remote Code Execution, Malicious Payload
#1 A102-579 Malicious File Transfer - APT44, VPNFILTER, Download, Variant #1 A102-580 Malicious File Transfer - APT44, VPNFILTER, Download, Variant #2 A102-581 Malicious File Transfer - APT44, VPNFILTER, Download, Variant #3 A101-287 Malicious File Transfer - CVE-2019-10149, APT44, Malicious Bash Script,
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.