Not Simon 🐐

Country: Democratic People's Republic of Korea (DPRK) Organization: Reconnaissance General Bureau (RGB) Objective: Espionage, Cryptocurrency Theft (Page last updated January 22, 2025)

Aliases:

Vulnerabilities Exploited

  • CVE-2024-1709 (10.0 critical, in CISA's KEV Catalog) ConnectWise ScreenConnect Authentication Bypass Vulnerability Source: Kroll

The following seven vulnerabilities have the same source: Cyfirma

  • CVE-2024-21338 (7.8 high, in CISA's KEV Catalog) Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
  • CVE-2021-44228 (10.0 critical, in CISA's KEV Catalog) Apache Log4j2 Remote Code Execution Vulnerability (aka Log4Shell).
  • CVE-2017-17215 (8.8 high) Huawei HG532 Remote Code Execution Vulnerability
  • CVE-2017-11882 (7.8 high, in CISA's KEV Catalog) Microsoft Office Memory Corruption Vulnerability
  • CVE-2020-0787 (7.8 high, in CISA's KEV Catalog) Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
  • CVE-2017-0199 (7.8 high, in CISA's KEV Catalog) Microsoft Office and WordPad Remote Code Execution Vulnerability Additional source: SOCRadar
  • CVE-2017-0144 (8.8 high, in CISA's KEV Catalog) Microsoft SMBv1 Remote Code Execution Vulnerability

The following vulnerabilities have the same source: SOCRadar

  • CVE-2015-2545 (7.8 high, in CISA's KEV Catalog) Microsoft Office Malformed EPS File Vulnerability
  • CVE-2019-0604 (9.8 critical, in CISA's KEV Catalog) Microsoft SharePoint Remote Code Execution Vulnerability

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK

Known Tools Used

External link: MITRE

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2025

2024

2023

2022

2021

2020

2019

2018

2013

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

Country: Islamic Republic of Iran Organization: Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) Objective: Disruption (Page Last Updated: January 19, 2025)

Aliases:

Identified Members

  • Hamid Reza Lashgarian (حمیدرضا لشکریان): head of IRGC-CEC, also IRGC-Qods Force commander
  • Hamid Homayunfal (حمید همایون فال): IRGC-CEC senior official
  • Mahdi Lashgarian (مهدی لشکریان): IRGC-CEC senior official
  • Milad Mansuri (میلاد منصوری): IRGC-CEC senior official
  • Mohammad Bagher Shirinkar (محمد باقر شیرین کار): IRGC-CEC senior official
  • Mohammad Amin Saberian (محمد امین صابریان): IRGC-CEC senior official

General Information

Vulnerabilities Exploited

  • CVE-2023-6448 (9.8 critical, in CISA's KEV Catalog) Unitronics Vision PLC and HMI Insecure Default Password Vulnerability Source: CISA
  • CVE-2023-28130 (7.2 high) CheckPoint Gaia Portal Privilege Escalation Vulnerability Source: SentinelOne

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2024

2023

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

Country: People's Republic of China Organization: Ministry of State Security (MSS) Objective: Espionage (Page Last Updated: January 17, 2025)

Aliases:

Identified Member

  • Yin Kecheng
  • APT40 (Hainan State Security Department (HSSD), of the MSS)

Vulnerabilities Exploited

  • CVE-2021-40539 (9.8 critical, in CISA's KEV Catalog) Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability Source: Implied to be CVE-2021-40539 by Microsoft
  • CVE-2021-44228 (10.0 critical, in CISA's KEV Catalog) Apache Log4j2 Remote Code Execution Vulnerability (aka Log4Shell). Source: Microsoft

The following four vulnerabilities have the same source: Microsoft

  • CVE-2021-26855 (9.1 critical; NVD 9.8, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability (aka ProxyLogon)
  • CVE-2021-26857 (7.8 high, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability (aka ProxyLogon)
  • CVE-2021-26858 (7.8 high, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability (aka ProxyLogon)
  • CVE-2021-27065 (7.8 high, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability (aka ProxyLogon)

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK

Known Tools Used

External link: MITRE

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2025

2024

2022

2021

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

This is a variation of Kraven Security's Cyber Threat Intelligence Report Template which contains great information already but I added my own preferences. Feel free to use this however you'd like.

Report: # Date: Priority: Low/Moderate/High/Critical Source and Reliability Information: Admiralty Scale Score [A-F][1-6] Sensitivity: Traffic Light Protocol

  1. Executive Summary
  2. Key Takeaways
  3. Intelligence Assessment
  4. Key Intelligence Gaps
  5. Indicators of Compromise (IOCs)
  6. MITRE ATT&CK Techniques
  7. Detection Opportunities
  8. Appendices
    • Probability Matrix
    • Priority Matrix
    • Source Reliability and Information Credibility
    • Confidence Levels
    • Feedback Contacts
    • Definitions and Acronyms

1. Executive Summary

A brief summary of the report. It should explain the report's significance, create a simple, easy-to-follow narrative of its key findings, and support a single decision. The reader should be able to make an informed decision based entirely on this summary. Aim to answer the following questions concisely:

  • What intelligence requirement(s) has this report fulfilled?
  • Why is this report relevant to the organization?
  • What is the biggest takeaway?
  • What new intelligence has been provided?
  • Does this report support or contradict existing assumptions, security initiatives, or objectives?

2. Key Takeaways

A bulleted list of the key findings from this report. Aim to answer the following questions:

  • Who is this report for?
  • Where was the data collected (source)?
  • Who was the attacker?
  • Who was the victim?
  • Why does this report matter to the target audience?
  • What is the main takeaway from this report?

This bulleted list is followed by a table summarizing key intelligence and a general analysis of the threat the report discusses using the Diamond Model. This allows key intelligence metrics to be easily identified and visualized.

Intelligence Requirements Addressed Citation of the IR addressed by this report
Data Sources
Threat Actor Primary threat actor (and aliases) or N/A or Unknown
Victim Location Country of victim
Sectors Industry targeted
Motivation Cybercrime / Espionage / Hacktivism / Ransomware / ICS / Other / Unknown

Diamond Model

Capabilities Adversary Infrastructure Victim
MITRE technique, malware, hacking tool Threat Actor, alias, email address, persona IP address, domain name, URL, C2 server company, workstation/server name, email address

3. Intelligence Assessment

This section should include:

  • A call to action, recommendation, or judgment: This threat (e.g., activity, threat actor, malware, etc.) demonstrates X and could potentially impact us. Therefore, we should do Y.
  • Any new information: This threat has a new tool, capability, TTP, etc. Key evidence: The threat has the following characteristics that uniquely distinguish it.
  • Estimative language (see Probability Matrix): “I assess with a level of certainty that < judgment> will impact us .”
  • Background information: Any relevant background information about the threat actor, malware, TTP, etc., to give context to this new assessment.
  • Relations to your organization: How does this threat relate to your organization? Does it target your country or sector? Does it target vulnerabilities in the systems or technologies you use? Does it relate to any previous security incidents or detections?

This section should include a kill chain analysis technique like Lockheed Martin’s Cyber Kill Chain. List the IOCs or TTPs found at each stage of the attack to create an attack narrative for the reader. The security operations team can then use this to identify possible mitigations or gaps.

Cyber Kill Chain

  • S1: Reconnaissance
  • S2: Weaponization
  • S3: Delivery
  • S4: Exploitation
  • S5: Installation
  • S6: Command & Control
  • S7: Actions on Objective

4. Key Intelligence Gaps

A bulleted list that summarizes additional information the CTI team needs to complete their analysis and raise the confidence of the assessment. You should highlight gaps affecting the assessment, such as if new information is discovered or existing information is proven wrong.

These gaps should be tracked externally from the report using a project/task management system.

5. Indicators of Compromise (IOCs)

This section consists of IOCs found on endpoint devices (workstations, servers, mobile devices), in network logs, related malware, and any vulnerabilities relevant to the threat being discussed.

  • Endpoint Artifact: Endpoint Artifact, Type, Description, Tactic
  • Network Artifacts: Network Artifact, Type, Description, Kill Chain Stage (first observed, last observed)
  • Malware: Malware, Hash Type, File Hash, Description, Malware Analysis Report, Kill Chain Stage
  • Common Vulnerabilities and Exposures (CVEs): CVE ID, CVSS (include version) Score, Patch Available (Y/N), Remediation, Date Reported, Patch Applied (Y/N/ N/A)
  • MITRE ATT&CK Techniques: Tactic, Technique, Procedure, D3FEND, Security Control
  • Detection Opportunities: Rule/Query, Name, Type, Description, Reference (source)

6. Appendices

Probability Matrix

almost no chance very unlikely unlikely roughly even chance likely very likely almost certain(ly)
remote highly improbable improbable roughly even odds probable (probably) highly probable nearly certain
01-05% 05-20% 20-45% 45-55% 55-80% 80-95% 95-99%

Analysts are strongly encouraged not to mix terms from different rows. Products that do mix terms must include a disclaimer clearly noting the terms indicate the same assessment of probability.

To avoid confusion, products that express an analyst's confidence in an assessment or judgment using a “confidence level” (e.g., “high confidence”) must not combine a confidence level and a degree of likelihood, which refers to an event or development, in the same sentence.

Priority Matrix

You should assign each report a priority based on its impact on your organization. The following table describes four general priority levels you can assign to a report.

  • Low: The threat requires regular monitoring and should be addressed when possible.
  • Moderate: The threat needs to be monitored closely and addressed.
  • High: The threat needs to be addressed quickly and monitored.
  • Critical: Immediate action is required.

Source and Information Reliability

Each report should include an evaluation of source reliability. An industry standard is the Admiralty Scale, developed by NATO. This scale scores source reliability on a scale of A-F and information credibility on a scale of 1-6. Attaching an appendix that describes this to the reader provides clarity.

Source Reliability (A-F)

  • A (Completely reliable): The source has a history of consistently providing accurate information.
  • B (Usually reliable): Most of the time, the source provides accurate information.
  • C (Fairly reliable): The source has provided accurate information on occasion.
  • D (Not usually reliable): The source has provided accurate information infrequently.
  • E (Unreliable): The source has rarely or never provided accurate information.
  • F (Reliability cannot be judged): The source’s reliability is unknown or untested.

Information Credibility (1-6)

  • 1 (Confirmed): Other independent sources have confirmed the information.
  • 2 (Probably true): The information is likely true but has not been confirmed.
  • 3 (Possibly true): The information might be true, but it is unconfirmed.
  • 4 (Doubtful): The information is unlikely to be true.
  • 5 (Improbable): The information is very unlikely to be true.
  • 6 (Cannot be judged): The credibility of the information cannot be assessed.

Confidence Levels

  • High: Good quality of information, evidence from multiple collection capabilities, possible to make a clear judgment.
  • Moderate: Evidence is open to a number of interpretations, or is credible and plausible but lacks correlation.
  • Low: Fragmentary information, or from collection capabilities of dubious reliability.

Sensitivity Matrix

Each report should attach a sensitivity level as defined by your organization’s data protection policy. This ensures data is handled appropriately and only shared with appropriate personnel. Attaching an appendix that describes this to the reader provides clarity.

  • TLP:RED: For the eyes and ears of individual recipients only, no further disclosure. Sources may use TLP:RED when information cannot be effectively acted upon without significant risk for the privacy, reputation, or operations of the organizations involved. Recipients may therefore not share TLP:RED information with anyone else. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting
  • TLP:AMBER: Limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: If the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT.
  • TLP:GREEN: Limited disclosure, recipients can spread this within their community. Sources may use TLP:GREEN when information is useful to increase awareness within their wider community. Recipients may share TLP:GREEN information with peers and partner organizations within their community, but not via publicly accessible channels. TLP:GREEN information may not be shared outside of the community. Note: When “community” is not defined, assume the cybersecurity/cyber defense community.
  • TLP:CLEAR: Recipients can spread this to the world, there is no limit on disclosure. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction.

Feedback Contacts

Provide a point of contact where the intelligence consumer can direct their feedback once the intelligence report has been published. This will help the CTI team improve future reports, ensure intelligence requirements are being met, and maintain communication channels.

Definitions and Acronyms

A list of key terms and acronyms used throughout the report. This lets the reader understand how the CTI team defines a particular technical term.

Country: Democratic People's Republic of Korea (DPRK) Organization: Lab 110, 3rd Bureau of the Reconnaissance General Bureau (RGB) Objective: Espionage, Ransomware (Page last updated December 27, 2024)

Aliases:

Connections to other groups:

  • Storm-0530 (Microsoft) (previously tracked as DEV-0530)

Identified Members

Vulnerabilities Exploited

  • CVE-2023-42793 (9.8 critical, in CISA's KEV Catalog) JetBrains TeamCity Authentication Bypass Vulnerability Source: Microsoft

The following five vulnerabilities have Microsoft as their source:

  • CVE-2023-46604 (Vendor 10.0/ NVD 9.8 critical, in CISA's KEV Catalog) Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
  • CVE-2023-22515 (Vendor 10.0/ NVD 9.8 critical, in CISA's KEV Catalog) Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
  • CVE-2023-46604 (Vendor 10.0/ NVD 9.8 critical, in CISA's KEV Catalog) Apache ActiveMQ Deserialization of Untrusted Data Vulnerability Other sources: ASEC
  • CVE-2023-27350 (9.8 critical, in CISA's KEV Catalog) PaperCut MF/NG Improper Access Control Vulnerability
  • CVE-2021-44228 (10.0 critical, in CISA's KEV Catalog) Apache Log4j2 Remote Code Execution Vulnerability (aka Log4Shell) Other sources: ASEC, CISA, Cisco Talos

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK

Known Tools Used

External link: MITRE

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2024

2023

2022

2021

2020

2019

2018

2017

2015

2013

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

Here's a handy resource: A list of vendor security advisories, sorted by Patch Tuesday schedule (if they adhere to it). This is not a complete or definitive list, but it's better than nothing. I also don't worry about all of the listed vendors, and didn't include ones who don't even have a portal/landing page for security advisories. I'll try to keep the page updated when I add more vendors, or know that their link changed. (Ideally you'd be monitoring these on your own using RSS). Visit the Vendor Verbiage page to figure out what was publicly disclosed or exploited.

Page last updated: December 25, 2024.

First Monday of the month

First Weekday of the month

Second Tuesday of the month

Preferred on (second Tuesday) of the month (but whenever)

Third Tuesday of the month

Quarterly

Regular Schedule? LOL

Patching? LMAO

Software vendors make it extremely difficult (by design) to understand when a vulnerability affecting their product is either publicly known (proof of concept) or exploited in the wild (possibly as a zero-day). Everyone's language is different from each other. I have compiled a list of messages (sorted by vendor name) from official security advisories that either imply or explicitly state proof of concept or evidence of exploitation. I have included a link and date for reference, in case these vendors change their verbiage in the future. Pair this with the Patch Tuesday post.

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

A

Adobe:

  • Proof of Concept: “Adobe is aware that CVE-2024-53961 has a known proof-of-concept...” Link (December 23, 2024)
  • Exploited in the Wild:
    • “Adobe is aware that CVE-2023-29298 has been exploited in the wild in limited attacks targeting Adobe ColdFusion.” Link (July 19, 2023)
    • “As of September 28, Adobe is aware of a report that CVE-2018-15961 is being actively exploited in the wild.” Link (September 28, 2018)
    • “Adobe is aware that CVE-2024-34102 has been exploited in the wild in limited attacks targeting Adobe Commerce merchants.” (Link: June 26, 2024)

Apple:

  • Exploited in the wild:
    • “Apple is aware of a report that this issue may have been exploited.” (Link: January 22, 2024)
    • “Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.” (Link: November 19, 2024)

Arm:

  • Exploited in the Wild:
    • “Arm is aware of reports of this vulnerability being exploited in the wild.” (Link: June 07, 2024)
    • “There is evidence that this vulnerability may be under limited, targeted exploitation.” (Link: October 02, 2023)

Atlassian:

  • Exploited in the Wild:
    • “Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.” “UPDATE: We have evidence to suggest that a known nation-state actor is actively exploiting CVE-2023-22515 and continue to work closely with our partners and customers to investigate.” (Link: October 05, 2023)
    • “As part of Atlassian's ongoing monitoring and investigation of this CVE, we observed several active exploits and reports of threat actors using ransomware.” (Link: November 06, 2023)
    • “Atlassian is aware of current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server.” (Link: June 03, 2022)

B

Barracuda:

  • Exploited in the Wild:
    • “Based on our investigation to date, we’ve identified that the vulnerability resulted in unauthorized access to a subset of email gateway appliances.” (Link: May 23, 2023)
    • “Earliest identified evidence of exploitation of CVE-2023-2868 is currently October 2022.” (Link: May 30, 2023)
    • ”...including that exploitation occurred on a subset of compromised Barracuda Email Security Gateway (ESG) appliances by an aggressive and highly skilled actor conducting targeted activity...” (Link: June 15, 2023)

C

Check Point:

  • Exploited in the Wild:
    • “Following our security update on May 27, 2024, Check Point's dedicated task force continues investigating attempts to gain unauthorized access to VPN products used by our customers. On May 28, 2024 we discovered a vulnerability in Security Gateways with IPsec VPN in Remote Access VPN community and the Mobile Access software blade (CVE-2024-24919). Exploiting this vulnerability can result in accessing sensitive information on the Security Gateway.” (Link: May 29, 2024)
    • “Yesterday (May 27, 2024) we delivered a solution that addresses attempts we saw on a small number of customers’ VPN remote access networks as referenced below. Today, we found the root cause for these and are now releasing a fix.” (Link: May 28, 2024)

Cisco:

  • Proof of Concept: “The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory.” (Link: September 04, 2024)
  • Exploited in the Wild:
    • “Cisco is aware of active exploitation of these vulnerabilities.” (Link: October 16, 2023)
    • “The Cisco Product Security Incident Response Team (PSIRT) is aware of malicious use of the vulnerability that is described in this advisory.” (Link: October 23, 2024)
    • “In November 2024, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.” (Link: December 02, 2024)

Citrix:

  • Exploited in the Wild:
    • “Exploits of these CVEs on unmitigated appliances have been observed.” (Link: January 16, 2024)
    • “Exploits of CVE-2023-3519 on unmitigated appliances have been observed.” (Link: July 18, 2023)
    • “We are aware of a small number of targeted attacks in the wild using this vulnerability” (Link: June 07, 2023)

D

D-Link:

  • Proof of Concept:
    • “0-day Vulnerability” (Link: September 06, 2022)
    • “On May 15th, 2024, a 3rd party security researcher, publically 0-day disclosed the D-Link Router DIR-X4860 (firmware ver. 1.04b03) with potential vulnerabilities.” (Link: May 16, 2024)

E

F

F5:

  • Exploited in the Wild:
    • “F5 has observed threat actors using this vulnerability to exploit CVE-2023-46748.” (Link: October 30, 2023)
    • “This information is based on the evidence F5 has seen on compromised devices, which appear to be reliable indicators.” (Link: October 30, 2023)

Fortinet:

  • Exploited in the Wild:
    • “Reports have shown this vulnerability to be exploited in the wild.” (Link: November 27, 2024)
    • “Note: This is potentially being exploited in the wild.” (Link: February 08, 2024)
    • “A third-party report is indicating this may be exploited in the wild.” (Link: October 11, 2024)

G

Google (Android):

  • Exploited in the Wild:
    • “Note: There are indications that the following may be under limited, targeted exploitation.” (Link: November 04, 2024)
    • “Note: There are indications that CVE-2024-36971 may be under limited, targeted exploitation.” (Link: August 05, 2024)

Google (Chrome):

  • Exploited in the Wild:
    • “Google is aware of reports that an exploit for CVE-2024-0519 exists in the wild.” (Link: January 16, 2024)
    • “Updated on 26 August 2024 to reflect the in the wild exploitation of CVE-2024-7965 which was reported after this release.” (Link: August 26, 2024)

H

I

Ivanti:

  • Proof of Concept: “However, a Proof of Concept is publicly available...” (Link: August 12, 2024)
  • Exploited in the Wild:
    • “We are aware of a limited number of customers’ Ivanti Connect Secure appliances being exploited by CVE-2025-0282 at the time of disclosure.” (Link: January 08, 2025)
    • “We are aware of a limited number of customers running CSA 4.6 patch 518 and prior who have been exploited when CVE-2024-9379 or CVE-2024-9380 are chained with CVE-2024-8963” (Link: October 08, 2024)
    • ”...at time of disclosure we were aware of a limited number of customers impacted by CVE-2023-46805, CVE-2024-21887 and CVE-2024-21893.” “We are aware of less than 20 customers impacted by the vulnerabilities prior to public disclosure.” (Link: January 10, 2024)

J

JetBrains:

  • Exploited in the Wild:
    • “On October 17, 2023, the Microsoft Threat Intelligence Center team reached out to JetBrains to inform us they have observed multiple North Korean nation-state threat actors actively exploiting the CVE-2023-42793 vulnerability since early October 2023.” (Link: October 18, 2023)
    • “On December 13, 2023 the Cybersecurity & Infrastructure Security Agency of the U.S. Department of Homeland Security (CISA) released a public advisory, in which they shared new ways in which this vulnerability (CVE-2023-42793) has been exploited by Russian nation-state threat actors as of September 2023.” (Link: December 14, 2023)
    • “Customer A ... Believed they were impacted by the CVE-2024-27198 vulnerability.” “They noticed several unauthorized admin accounts created on the server.” “Their TeamCity environment had been compromised through the recent vulnerabilities.” “Several unknown user accounts had been created on their TeamCity server.” (Link: March 11, 2024)

Juniper:

  • Proof of Concept: “However, a proof-of-concept exploit does exist in the wild.” (Link: June 28, 2021)
  • Exploited in the Wild: “Juniper SIRT is aware of successful malicious exploitation of these vulnerabilities.” (Link: November 08, 2023)

K

L

M

Microsoft:

  • Proof of Concept: “Publicly disclosed: Yes” (Link: December 10, 2024)
  • Exploited in the Wild: “Exploited: Yes” ; “Exploitability assessment: Exploitation Detected” (Link: December 10, 2024)

Mozilla Foundation:

  • Exploited in the Wild:
    • “We have had reports of this vulnerability being exploited in the wild.” (Link: October 09, 2024)
    • “An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows.” (Link: November 30, 2016)

N

O

Oracle:

  • Exploited in the Wild: “It was reported as being actively exploited “in the wild” by CrowdStrike.” (Link: November 18, 2024)

P

Palo Alto Networks:

  • Proof of Concept:
    • “We are aware of a publicly available conference talk and blog posts discussing this issue. A proof of concept for this issue is also publicly available.” (Link: November 25, 2024)
    • “However, a proof of concept for this issue is publicly available.” (Link: October 09, 2024)
    • “Proof of concepts for this vulnerability have been publicly disclosed by third parties.” (Link: April 29, 2024)
  • Exploited in the Wild:
    • “Palo Alto Networks is aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue.” (Link: December 26, 2024)
    • “Palo Alto Networks is aware of an increasing number of attacks that leverage the exploitation of this vulnerability.” (Link: November 18, 2024)
    • “Palo Alto Networks is aware of an increasing number of attacks that leverage the exploitation of this vulnerability.” (Link: April 29, 2024)
    • “Palo Alto Networks recently learned that an attempted reflected denial-of-service (RDoS) attack was identified by a service provider. This attempted attack took advantage of susceptible firewalls from multiple vendors, including Palo Alto Networks.” (Link: August 10, 2022)

PaperCut:

  • Exploited in the Wild: “We have evidence to suggest that unpatched servers are being exploited in the wild.” “PaperCut received our first report from a customer of suspicious activity on their PaperCut server on the 18th April at 03:30 AEST / 17th April 17:30 UTC.” (Link: April 18, 2023)

Progress Software (MOVEit):

  • Exploited in the Wild: “NOTE: this is exploited in the wild in May and June 2023” (Link: June 16, 2023)

Q

Qlik:

  • Exploited in the Wild: “Qlik has received reports that this vulnerability may be being used by malicious actors.” (Link: May 15, 2024)

QNAP:

  • Exploited in the Wild: “QNAP detected a new DeadBolt ransomware campaign on the morning of September 3rd, 2022 (GMT+8). The campaign appears to target QNAP NAS devices running Photo Station with internet exposure.” (Link: September 03, 2022)

Qualcomm:

  • Exploited in the Wild: “There are indications from Google Threat Analysis Group that CVE-2024-43047 may be under limited, targeted exploitation.” (Link: October 07, 2024)

R

S

SolarWinds:

  • Exploited in the Wild: “This is being exploited in the wild.” (Link: June 06, 2024)

SonicWall:

  • Proof of Concept: “SonicWall PSIRT is aware that a proof of concept (PoC) exploit for this vulnerabilities is publicly available” (Link: September 27, 2024)
  • Exploited in the Wild: “This vulnerability is potentially being exploited in the wild.” (Link: September 06, 2024)

Sophos:

  • Exploited in the Wild:
    • “Sophos has observed this vulnerability being used in the wild.” (Link: October 20, 2022)
    • “In December 2023, we delivered an updated fix after identifying new exploit attempts against this same vulnerability in older, unsupported versions of the Sophos Firewall.” (Link: December 11, 2023)

SysAid:

  • Exploited in the Wild: “The investigation determined that there was a zero-day vulnerability in the SysAid on-premises software.”“The vulnerability was exploited by a group known as DEV-0950 (Lace Tempest), as identified by the Microsoft Threat Intelligence team.” (Link: November 08, 2023)

T

TP-Link:

  • Exploited in the Wild: “TP-Link is aware of reports that the Remote Code Execution (REC) vulnerability detailed in CVE-2023-1389 in AX21 has been added to the Mirai botnet Arsenal.” (Link: April 27, 2023)

Trend Micro:

  • Exploited in the Wild: “ITW Alert: Trend Micro has observed at least one active attempt of potential exploitation of this vulnerability in the wild.” (Link: September 13, 2022)

U

V

Veritas:

  • Exploited in the Wild: “March 2023: A known exploit is available in the wild for the vulnerabilities below and could be used as part of a ransomware attack.” (Link: March ?? 2023)

Versa:

  • Proof of Concept: “A proof of concept exists in the lab environment.” (Link: September 20, 2024)
  • Exploited in the Wild: “This vulnerability has been exploited in at least one known instance by an Advanced Persistent Threat actor.” (Link: August 26, 2024)

VMware (Broadcom):

  • Proof of Concept: “VMware has confirmed that exploit code leveraging CVE-2021-39144 against impacted products has been published.” (Link: October 27, 2022)
  • Exploited in the Wild:
    • “VMware by Broadcom confirmed that exploitation has occurred in the wild for CVE-2024-38812.” (Link: November 18, 2024) (Link: August 26, 2024)
    • “VMware has confirmed that exploitation of CVE-2023-20887 has occurred in the wild.” (Link: June 20, 2023)

W

X

Y

Z

Zimbra:

  • Exploited in the Wild: “Important: This vulnerability has been actively exploited, making it imperative to take immediate action.” (Link: July 13, 2023)

Zoho (ManageEngine):

  • Proof of Concept: “The exploit POC for the above vulnerability is available in public.” (Link: July 19, 2022)

Zyxel:

  • Exploited in the Wild: “Zyxel is aware of recent attempts by threat actors to target Zyxel firewalls through previously disclosed vulnerabilities” (Link: November 27, 2024)

Country: Russia Organization: Federal Security Service (FSB) Center 16 and 18 Objective: Information Theft, Espionage Page last updated: December 12, 2024

Aliases:

Identified Members

Sources: SSU, European Union

  • Sklianko Oleksandr Mykolaiovych (Deputy Chief, 4th Section of the Counterintelligence Operations Service (SCO), FSB Department in occupied Crimea and Sevastopol)
  • Chernykh Mykola Serhiiovych (Head of the unit identified as responsible for conducting Gamaredon operations, 4th Section of the SCO, FSB Department in occupied Crimea and Sevastopol)
  • Starchenko Anton Oleksandrovych (Officer within the unit identified as responsible for conducting Gamaredon operations, 4th Section of the SCO, FSB Department in occupied Crimea and Sevastopol)
  • Miroshnychenko Oleksandr Valeriiovych (Officer within the unit identified as responsible for conducting Gamaredon operations, 4th Section of the SCO, FSB Department in occupied Crimea and Sevastopol) ▪ Sushchenko Oleh Oleksandrovych (Officer within the unit identified as responsible for conducting Gamaredon operations, 4th Section of the SCO, FSB Department in occupied Crimea and Sevastopol)

Vulnerabilities Exploited

  • CVE-2017-0199 (7.8 high, in CISA's KEV Catalog) Microsoft Office and WordPad Remote Code Execution Vulnerability (Source: BlackBerry)

Associated with InvisiMole activity: (Source: ESET)

  • CVE-2019-0708 (9.8 critical, in CISA's KEV Catalog) Microsoft Remote Desktop Services Remote Code Execution Vulnerability (aka BlueKeep)
  • CVE-2017-0144 (8.8 high, in CISA's KEV Catalog) Microsoft SMBv1 Remote Code Execution Vulnerability (aka EternalBlue)
  • CVE-2007-5633 (CVSSv2: 7.2 high) speedfan.sys local privilege escalation vulnerability (Bring Your Own Vulnerable Driver)

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK Navigator Layers

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2024

2023

2022

2021

2020

2019

2015

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

Country: Democratic People's Republic of Korea (DPRK) Objective: Corporate Espionage, Financial Gain (Page Last Updated: January 23, 2025) Organizations:

  • 313 General Bureau of the Munitions Industry Department (MID)
  • The Ministry of Atomic Energy Industry
  • Ministry of Defense
  • Korea People's Army
  • DPRK Education Commission's Foreign Trade Office
  • Pyongyang Information Technology Bureau of the Central Committee's Science and Education Department
  • Pyongyang University of Automation (training)
  • Technical Reconnaissance Bureau
    • subordinate cyber unit: 110th Research Center
  • Chinyong Information Technology Cooperation Company (Chinyong)
  • Department 53 of The Ministry of The People’s Armed Forces
  • Department 53 front company Korea Osong Shipping Co (Osong)
  • Department 53 front company Chonsurim Trading Corporation (Chonsurim)
  • Liaoning China Trade Industry Co., Ltd (Liaoning China Trade)

Companies employing DPRK IT workers:

  • Yanbian Silverstar Network Technology Co. Ltd.
  • Volasys Silver Star

North Korean money laundering for DPRK IT workers:

  • Green Alpine Trading, LLC

Identified North Korean IT workers:

  1. Jong Song Hwa (정성화), CEO of both Yanbian Silverstar Network Technology Co. Ltd. and Volasys Silver Star
  2. Kim Ryu Song (김류성), president of Yanbian Silverstar
  3. Ri Kyong Sik (리경식), president of Volasys Silver Star
  4. Rim Un Chol (림은철), senior manager
  5. Kim Mu Rim (김무림), senior manager
  6. Cho Chung Pom (조충범), mid-level manager
  7. Hyon Chol Song (현철성), mid-level manager
  8. Son Un Chol (손은철), mid-level manager
  9. Sok Kwang Hyok (석광혁), mid-level manager
  10. Choe Jong Yong (최정용), IT worker
  11. Ko Chung Sok (고충석), IT worker
  12. Kim Ye Won (김예원), IT worker
  13. Jong Kyong Chol (정경철), IT worker
  14. Jang Chol Myong (장철명), IT worker

Identified individuals assisting DPRK IT workers:

  • Minh Phuong Vong
  • Matthew Isaac Knoot
  • Christina Marie Chapman
  • Oleksandr Didenko

  • Sim Hyon Sop (Sim)

  • Lu Huaying

  • Zhang Jian

  • Jong In Chol

  • Son Kyong Sik

Groups or Aliases:

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

Unknown Date

2025

2024

2023

2022

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

Country: People's Republic of China Organization(s): Sichuan Juxinhe Network Technology Co., LTD. (Sichuan Juxinhe) Objective: Espionage (Page Last Updated: January 17, 2025)

Aliases:

Vulnerabilities Exploited

  • ProxyLogon (Sources: ESET, Kaspersky, Sygnia, Trend Micro):
    • CVE-2021-26855 (9.8 critical, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability
    • CVE-2021-26857 (7.8 high, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability
    • CVE-2021-26858 (7.8 high, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability
    • CVE-2021-27065 (7.8 high, in CISA's KEV Catalog)
  • Source: Trend Micro
    • CVE-2023-46805 (8.2 high, in CISA's KEV Catalog) Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
    • CVE-2024-21887 (9.1 critical, in CISA's KEV Catalog) Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
    • CVE-2023-48788 (9.8 critical, in CISA's KEV Catalog) Fortinet FortiClient EMS SQL Injection Vulnerability
    • CVE-2022-3236 (9.8 critical, in CISA's KEV Catalog) Sophos Firewall Code Injection Vulnerability
  • unidentified Microsoft SharePoint and Oracle Opera business software vulnerabilities (Source: ESET)
  • CVE-2017-11882 (7.8 high, in CISA's KEV Catalog. Note: associated with alias Tropic Trooper) Microsoft Office Memory Corruption Vulnerability Source: Trend Micro
  • CVE-2012-0158 (8.8 high, in CISA's KEV Catalog. Note: associated with alias Tropic Trooper, KeyBoy) Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability Sources: Unit 42, Citizen Lab
  • CVE-2017-0199 (7.8 high, in CISA's KEV Catalog. Note: associated with alias Tropic Trooper) Microsoft Office and WordPad Remote Code Execution Vulnerability Source: Citizen Lab
  • CVE-2015-1641 (7.8 high, in CISA's KEV Catalog. Note: associated with alias KeyBoy) Microsoft Office Memory Corruption Vulnerability Source: Citizen Lab

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2025

2024

2023

2022

2021

2020

2018

2017

2016

2015

2013

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat