@rapid7
- Low & slow BBQ•opinions are my own• Speaker•
Christiaan Beek
- 146 Followers
- 59 Following
- 7 Posts
Latest research where we use @velocidex to hunt for DLL injection files abused by actors: https://www.rapid7.com/blog/post/2023/02/09/evasion-techniques-uncovered-an-analysis-of-apt-methods/ #plugx
Fantastic in-depth analytics of CVE-2022-47966: https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966 #AttackerKB @catc0n @todb
CVE-2022-41080, CVE-2022-41082: Rapid7 Observed Exploitation of `OWASSRF` in Exchange for RCE https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
CVE-2022-41080, CVE-2022-41082: Rapid7 Observed Exploitation of `OWASSRF` in Exchange for RCE | Rapid7 Blog
Beginning December 20, 2022, Rapid7 has responded to an increase in the number of Microsoft Exchange server compromises. Further investigation aligned these attacks to what CrowdStrike is reporting as “OWASSRF”.
imp0rtp3Advisory of #CVE_2022_42475 (FortiOS SSL-VPN RCE) updated with additional IPs of the threat actor exploiting it:
139.180.184[.]197
66.42.91[.]32
158.247.221[.]101
107.148.27[.]117
139.180.128[.]142
155.138.224[.]122
185.174.136[.]20