SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations

blog.cyble.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution

CVEs this report names

3 CVEs

CVE-2017-11882Microsoft Office Memory Corruption Vulnerability
Microsoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing Attachment T1059Command and Scripting Interpreter13 reports
99.9%Top 0.03%
88.5priority
CVE-2018-0802Microsoft Office Memory Corruption Vulnerability
Microsoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution8 reports
93.3%Top 0.17%
88.4priority
CVE-2018-0798Microsoft Office Memory Corruption Vulnerability
Microsoft · OfficeKEVPublic exploitHigh · 8.8T1204.002Malicious File T1203Exploitation for Client Execution5 reports
95.1%Top 0.14%
79.1priority

Where it names them

CVE-2017-11882

RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.

Original ↗

CVE-2018-0802

RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.

Original ↗

CVE-2018-0798

RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.

Original ↗

Techniques drawn from this report

3 links, in kill-chain order

Execution Software Deployment Tools T1072 for CVE-2017-11882

Labelled by dataset annotators

RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.

Original ↗

Execution Software Deployment Tools T1072 for CVE-2018-0802

Labelled by dataset annotators

RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.

Original ↗

Execution Software Deployment Tools T1072 for CVE-2018-0798

Labelled by dataset annotators

RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.

Original ↗