Outbreak Alert: UNC1549 Critical Infrastructure Espionage Attack

[smallick]

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
CVE ID	CVE-2021-26855
CVE Title	Microsoft Exchange Server Remote Code Execution Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	93/100
Epss Score	0.94358
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (UNC2596, Black Basta Ransomware Group, AvosLocker Ransomware, Black Kingdom Ransomware Operators, BlackCat Ransomware Operators, DearCry ransomware operators)
Exploited by APT Group(s)	Yes (HAFNUIM, APT 41, Ballistic Bobcat, GELSEMIUM, Calypso APT, PKPLUG Group, HAFNIUM, Witchetty, Axiom, N/A, CoughingDown, Hafnium, Naikon, Salt Typhoon aka Earth Estries, Tick, DEV-0842, Emissary Panda)
Included in CISA KEV List	Yes
Available working exploit(s)	10
Available POC exploit(s)	55
Darknet Mention(s)	34 (raidforums, xss, crdclub, exploit)
Telegram Mention(s)	17 (DC8044 F33d, IT Security Alerts, ARVIN, Ralf Hacker Channel, SecAtor, Freedom F0x, مرکز تحقیقاتی APT IRAN, Malware Corporation, Termux Israel :israel:, itsecforu (Информационная безопасность))
FortiRecon Intelligence Reporting(s)	21 (OSINT), 32 (Technical Intelligence), 4 (Darknet), 19 (FortiGuard Research)
Vendor Advisory:	http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855 http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.h... http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26855 http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html

CVE ID	CVE-2020-0688
CVE Title	Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	93/100
Epss Score	0.94352
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes (Twisted Kitten, Dark Halo, OceanLotus Group, MuddyWater, Gelsemium, Berserk Bear, Emissary Panda, Chinese MSS-affiliated cyber threat actors, Winnti Umbrella, NightEagle)
Included in CISA KEV List	Yes
Available working exploit(s)	4
Available POC exploit(s)	26
Darknet Mention(s)	7 (xss, 90sec)
Telegram Mention(s)	7 (Freedom F0x, مرکز تحقیقاتی APT IRAN, SecAtor, Cybersecurity News Everyday)
FortiRecon Intelligence Reporting(s)	12 (OSINT), 2 (Darknet), 14 (Technical Intelligence), 6 (FortiGuard Research)
Vendor Advisory:	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688 http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html https://www.zerodayinitiative.com/advisories/ZDI-20-258/ http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Executio...