A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity

welivesecurity.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution

CVEs this report names

2 CVEs

CVE-2019-0604Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload Malware T1190Exploit Public-Facing Application+3 more · 4 reports
99.9%Top 0.03%
88.8priority
CVE-2017-11882Microsoft Office Memory Corruption Vulnerability
Microsoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing Attachment T1059Command and Scripting Interpreter13 reports
99.9%Top 0.03%
88.5priority

Attackers linked to LookingFrog exploited Microsoft SharePoint servers in 2019 to gain code execution, probably by leveraging CVE-2019-0604.

Files built with this tool are RTF documents exploiting Equation Editor N-day vulnerabilities such as CVE-2017-11882.

1 link, in kill-chain order

MITRE CTID mapping of the KEV entry

Attackers linked to LookingFrog exploited Microsoft SharePoint servers in 2019 to gain code execution, probably by leveraging CVE-2019-0604.