Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization

cisa.gov · Undated · Licence: not assessed; coordinator-only cache; do not redistribute

CVEs this report names

4 CVEs

CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1133External Remote Services T1505.003Web Shell+2 more · 5 reports
>99.9%Top 0.01%
89.4priority
CVE-2021-27065Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 7.8T1505.003Web Shell4 reports
99.9%Top 0.04%
87.4priority
CVE-2021-26857Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 7.8T1505.003Web Shell3 reports
95.8%Top 0.13%
86.2priority
CVE-2021-26858Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwareHigh · 7.8T1505.003Web Shell3 reports
93.7%Top 0.16%
81.2priority

Where it names them

CVE-2021-26855

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Original ↗

CVE-2021-27065

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Original ↗

CVE-2021-26857

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Original ↗

CVE-2021-26858

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Original ↗

Techniques drawn from this report

4 links, in kill-chain order

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-27065

MITRE CTID mapping of the KEV entry

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Original ↗

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-26858

MITRE CTID mapping of the KEV entry

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Original ↗

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-26855

Matched in report text

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Original ↗

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-26857

Matched in report text

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Original ↗