{"vulnerability": "CVE-2021-42258", "sightings": [{"uuid": "71a9fcae-0ea9-4eae-8e75-4c8f801f6d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:17.000000Z"}, {"uuid": "c197f8e3-d4af-4db9-a5b9-5ba78f94db22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "f8730d7c-fae1-4b8a-a97b-afb1d204eb93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:32:43.000000Z"}, {"uuid": "787ac87a-13a1-4d96-a6a7-2a56da73e519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-42258.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "78a2183d-a808-461f-8a7c-9a3392e44d63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971118", "content": "", "creation_timestamp": "2024-12-24T20:24:31.116819Z"}, {"uuid": "52c7fd8e-18ea-4504-b9a8-e7bfb9947c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "81b90ff7-02dd-4d28-9c0f-20d195a00767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:40.000000Z"}, {"uuid": "6f8aa11d-0c56-494f-ac5d-b7a15b027a53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:58.000000Z"}, {"uuid": "79fc42a4-88a2-4459-8393-1a3a98142077", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/billquick_txtid_sqli.rb", "content": "", "creation_timestamp": "2021-11-11T23:23:32.000000Z"}, {"uuid": "c47c4408-7d65-4cd4-aeda-f6b568f8fdd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-42258", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c5664c96-b3ed-49d9-8959-d90f8b742d15", "content": "", "creation_timestamp": "2026-02-02T12:28:39.665549Z"}, {"uuid": "69724b4b-2fa3-467d-ac0c-aa936058005e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "exploited", "source": "Telegram/SfsPcTKDBJd6nY2jaCgwHbnHmF3NWzCJGNch8P-EpajA47UB", "content": "", "creation_timestamp": "2025-02-06T02:39:18.000000Z"}, {"uuid": "51c157fb-d8eb-4dff-8a40-27beca7c974d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "https://t.me/true_secator/2254", "content": "\u041d\u0438 \u0434\u043d\u044f \u0431\u0435\u0437 ransomware: \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BQE Software \u0432\u0434\u043e\u043b\u044c \u0438 \u043f\u043e\u043f\u0435\u0440\u0435\u043a \u0448\u0438\u0444\u0440\u0443\u044e\u0442 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 \u0431\u0438\u043b\u043b\u0438\u043d\u0433\u043e\u0432\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0439 BillQuick Web Suite. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0436\u0435\u0440\u0442\u0432 - 400 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n \n\u0412 \u043c\u0430\u0441\u0441\u0435 \u0441\u0432\u043e\u0435\u0439 \u0430\u0442\u0430\u043a\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 BillQuick, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u043b\u044f CVE-2021-42258, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043b\u0435\u0433\u043a\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043d\u0430 \u0432\u0445\u043e\u0434 \u0441 \u043d\u0435\u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 (\u043e\u0434\u0438\u043d\u0430\u0440\u043d\u0430\u044f \u043a\u0430\u0432\u044b\u0447\u043a\u0430) \u0432 \u043f\u043e\u043b\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n \n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0435 7 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 22.0.9.1 BQE Software, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0435 \u0431\u0430\u0433\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b Huntress ThreatOps \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0435\u0449\u0435 \u0432\u043e\u0441\u0435\u043c\u044c \u0434\u0440\u0443\u0433\u0438\u0445 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 BillQuick (CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742). \u0412\u0441\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 - \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u044b.\n \n\u0410\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 Huntress Labs \u043a \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0431\u0430\u043d\u0434\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f: \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u0432 \u0434\u0435\u043b\u0435 \u0431\u043e\u043b\u0435\u0435 \u043c\u0435\u043b\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0439 ransomware \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 \u043c\u0430\u044f 2020 \u0433\u043e\u0434\u0430 \u0438 \u0432 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0437\u0430\u0438\u043c\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u043e\u0434 \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 AutoIT. \u0425\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0412\u041f\u041e \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0438\u0441\u043e\u043a \u043e \u0432\u044b\u043a\u0443\u043f\u0435 \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0430 \u043b\u0438\u0448\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 pusheken91@bk.ru \u043a\u043e \u0432\u0441\u0435\u043c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 \u0434\u043b\u044f \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u044f \u0432\u044b\u043a\u0443\u043f\u0430.\n \n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, BQE Software \u0432\u043e\u0432\u0441\u044e \u0432\u0435\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u043d\u0430\u0434 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438, \u0432\u043f\u0440\u043e\u0447\u0435\u043c, \u043a\u0430\u043a \u0438 \u0445\u0430\u043a\u0435\u0440\u044b. \u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432, \u043a \u0430\u0442\u0430\u043a\u0430\u043c BillQuick \u0443\u0436\u0435 \u0432 \u0441\u0430\u043c\u043e\u0435 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0442\u044c\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u0430\u043a\u0442\u043e\u0440\u044b.", "creation_timestamp": "2021-10-26T18:55:45.000000Z"}, {"uuid": "a6607a82-8bd4-43e7-9f30-f12ae30773d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "exploited", "source": "https://t.me/cibsecurity/31084", "content": "\u203c CVE-2021-42258 \u203c\n\nBQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-23T02:39:32.000000Z"}, {"uuid": "d50ef9cd-e4a6-4cbe-8157-efc7e4543d2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "exploited", "source": "https://t.me/S_E_Reborn/1208", "content": "\u041d\u0438 \u0434\u043d\u044f \u0431\u0435\u0437 ransomware: \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BQE Software \u0432\u0434\u043e\u043b\u044c \u0438 \u043f\u043e\u043f\u0435\u0440\u0435\u043a \u0448\u0438\u0444\u0440\u0443\u044e\u0442 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 \u0431\u0438\u043b\u043b\u0438\u043d\u0433\u043e\u0432\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0439 BillQuick Web Suite. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0436\u0435\u0440\u0442\u0432 - 400 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n \n\u0412 \u043c\u0430\u0441\u0441\u0435 \u0441\u0432\u043e\u0435\u0439 \u0430\u0442\u0430\u043a\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 BillQuick, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u043b\u044f CVE-2021-42258, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043b\u0435\u0433\u043a\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043d\u0430 \u0432\u0445\u043e\u0434 \u0441 \u043d\u0435\u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 (\u043e\u0434\u0438\u043d\u0430\u0440\u043d\u0430\u044f \u043a\u0430\u0432\u044b\u0447\u043a\u0430) \u0432 \u043f\u043e\u043b\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n \n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0435 7 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 22.0.9.1 BQE Software, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0435 \u0431\u0430\u0433\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b Huntress ThreatOps \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0435\u0449\u0435 \u0432\u043e\u0441\u0435\u043c\u044c \u0434\u0440\u0443\u0433\u0438\u0445 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 BillQuick (CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742). \u0412\u0441\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 - \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u044b.\n \n\u0410\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 Huntress Labs \u043a \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0431\u0430\u043d\u0434\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f: \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u0432 \u0434\u0435\u043b\u0435 \u0431\u043e\u043b\u0435\u0435 \u043c\u0435\u043b\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0439 ransomware \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 \u043c\u0430\u044f 2020 \u0433\u043e\u0434\u0430 \u0438 \u0432 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0437\u0430\u0438\u043c\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u043e\u0434 \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 AutoIT. \u0425\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0412\u041f\u041e \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0438\u0441\u043e\u043a \u043e \u0432\u044b\u043a\u0443\u043f\u0435 \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0430 \u043b\u0438\u0448\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 pusheken91@bk.ru \u043a\u043e \u0432\u0441\u0435\u043c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 \u0434\u043b\u044f \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u044f \u0432\u044b\u043a\u0443\u043f\u0430.\n \n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, BQE Software \u0432\u043e\u0432\u0441\u044e \u0432\u0435\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u043d\u0430\u0434 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438, \u0432\u043f\u0440\u043e\u0447\u0435\u043c, \u043a\u0430\u043a \u0438 \u0445\u0430\u043a\u0435\u0440\u044b. \u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432, \u043a \u0430\u0442\u0430\u043a\u0430\u043c BillQuick \u0443\u0436\u0435 \u0432 \u0441\u0430\u043c\u043e\u0435 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0442\u044c\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u0430\u043a\u0442\u043e\u0440\u044b.", "creation_timestamp": "2021-10-27T10:22:02.000000Z"}, {"uuid": "b61480ce-6db4-49bc-af34-c430d3710749", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2745e119-b268-4f93-986f-9b446bb2c26d", "content": "", "creation_timestamp": "2026-06-19T12:47:57.454117Z"}, {"uuid": "21601642-5673-46e1-927a-bba1c9bb96e5", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/aacf402e-31c7-4068-b221-70dac3d2e5f4", "content": "", "creation_timestamp": "2026-06-23T14:04:46.033598Z"}, {"uuid": "8ea13c52-9983-4d70-bb69-268a2fd9fedd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-01T20:02:12.695174Z"}, {"uuid": "580dbaff-30c2-4bee-89c9-39c634a6b5c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-02T01:02:38.525830Z"}, {"uuid": "667a8657-3668-4f59-a390-ff9bbbaf281e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "exploited", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-07T07:00:14.478671Z"}, {"uuid": "65b6ab93-da78-4183-82f3-861cd4c096f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "exploited", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-08T00:00:56.429663Z"}, {"uuid": "0247ca08-1604-4a16-ad1c-d0b17701e2c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42258", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/billquick_txtid_sqli.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"h00die\", \"Caleb Stewart \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection vulnerability in BillQUick Web Suite prior to version 22.0.9.1.\\n          The application is .net based, and the database is required to be MSSQL.  Luckily the website gives\\n          error based SQLi messages, so it is trivial to pull data from the database.  However the webapp\\n          uses an unknown password security algorithm.  This vulnerability does not seem to support stacked\\n          queries.\\n          This module pulls the database name, banner, user, hostname, and the SecurityTable (user table).\", \"disclosure_date\": \"2021-10-22\", \"fullname\": \"auxiliary/gather/billquick_txtid_sqli\", \"is_install_path\": true, \"mod_time\": \"2025-05-21 10:45:08 +0000\", \"name\": \"BillQuick Web Suite txtID SQLi\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/billquick_txtid_sqli.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"gather/billquick_txtid_sqli\", \"references\": [\"URL-https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware\", \"URL-http://billquick.net/download/Support_Download/BQWS2021Upgrade/WebSuite2021LogFile_9_1.pdf\", \"CVE-2021-42258\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:12.271947Z"}]}