{"vulnerability": "cve-2021-26858", "sightings": [{"uuid": "2d1e1789-7336-496c-90c6-dffbd28d2690", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/76591c3b-efb3-4084-a644-87a6cca8c784", "content": "", "creation_timestamp": "2021-03-03T06:31:11.000000Z"}, {"uuid": "4c604e57-410c-4350-98b7-cc13bc3c8c80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/9a64767a-a0c6-4d10-9c1f-a6129ad95e56", "content": "", "creation_timestamp": "2021-03-09T08:55:42.000000Z"}, {"uuid": "61b1f166-f007-402d-a946-1f424d01a4b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/16ee036b-17f5-4f17-b3c3-9fe89176274a", "content": "", "creation_timestamp": "2021-03-07T19:26:18.000000Z"}, {"uuid": "9d8d7d54-96e0-4ffb-99d1-b37dfb7debac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/1cc4d8d4-4592-4dae-bcdf-2fb9d38b794c", "content": "", "creation_timestamp": "2021-03-16T16:55:45.000000Z"}, {"uuid": "e0e3e0f6-51ee-4b2f-a11e-24897679680e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/da8a7421-97cb-4144-b421-4b82fa85e9a6", "content": "", "creation_timestamp": "2021-03-12T17:29:00.000000Z"}, {"uuid": "7f005645-8676-4ad7-98ff-f0e4cd4c8819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/f4fec1fc-0320-4c81-8c42-4cb04b77fc44", "content": "", "creation_timestamp": "2021-03-17T15:30:49.000000Z"}, {"uuid": "89e85851-2138-461d-bf3f-34f2036c5444", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/b7636c3e-a515-436b-a646-5ebd750df006", "content": "", "creation_timestamp": "2021-03-09T15:17:33.000000Z"}, {"uuid": "637c93ee-0938-4d6a-b454-1f0f0bd64e01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/5ef60b0d-a198-4216-93c5-4b12748294ae", "content": "", "creation_timestamp": "2021-03-11T18:05:03.000000Z"}, {"uuid": "c5be0914-a3e4-437c-bc74-6e465ad53a01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:19.000000Z"}, {"uuid": "42e0870a-d286-4cad-a0cf-45b069a7a105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "9b126f96-641d-4502-8fd0-772f55bd03ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/6fb63c5a-b927-4500-ac80-844bd9ef0926", "content": "", "creation_timestamp": "2021-03-09T17:40:09.000000Z"}, {"uuid": "93d9658e-935c-4314-ac06-221f4ece2b73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/cec219ff-8f6d-45c9-bdbb-b4fb8c9c0f2b", "content": "", "creation_timestamp": "2023-09-20T10:45:41.000000Z"}, {"uuid": "1de23de3-796a-4bf3-8260-8e6b5e67f972", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/ffea72a3-7935-4078-b769-b872475c5eae", "content": "", "creation_timestamp": "2024-11-27T08:28:21.000000Z"}, {"uuid": "f7b41ed5-838b-4c6f-a0a0-00423977d340", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://msrc.microsoft.com/blog/2021/03/guidance-for-responders-investigating-and-remediating-on-premises-exchange-server-vulnerabilities/", "content": "", "creation_timestamp": "2021-03-16T06:00:00.000000Z"}, {"uuid": "01e61f5e-0d91-433a-bd1a-0c8a17f31fab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970985", "content": "", "creation_timestamp": "2024-12-24T20:22:40.414515Z"}, {"uuid": "32eb289b-af98-4370-ac68-c57417114187", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:53.000000Z"}, {"uuid": "100018d2-9037-48d6-b5b0-133dd7691202", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=556", "content": "", "creation_timestamp": "2021-03-03T04:00:00.000000Z"}, {"uuid": "c2fe6c29-0709-4943-a590-90ee04f4d039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitus-exchangen-hyvaksikaytetty-haavoittuvuus", "content": "", "creation_timestamp": "2021-03-03T15:38:55.000000Z"}, {"uuid": "f3662ac0-1b5e-453e-9763-47f842c7f8df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-26858", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1ed4df3d-25d7-4ae8-957e-4847bafa3266", "content": "", "creation_timestamp": "2026-02-02T12:28:56.385353Z"}, {"uuid": "8ab2dd72-5569-458f-86c8-5498ba1f63f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/d6af00ee-c1eb-44fd-8cc5-6fb794d5ddd4", "content": "", "creation_timestamp": "2026-04-27T17:54:24.000000Z"}, {"uuid": "57e2776a-8f9f-4bfe-a820-53b02d23cf57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/avleonovrus/54", "content": "\u0412 \u0442\u043e\u043c \u0436\u0435 \u043e\u0442\u0447\u0435\u0442\u0435 Palo Alto 2022 Unit 42 Incident Response Report \u0435\u0441\u0442\u044c \u0435\u0449\u0451 \u043e\u0434\u0438\u043d \u043f\u0440\u0438\u043a\u043e\u043b\u044c\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442. \u0413\u0440\u0443\u043f\u043f\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u043b\u043e\u043c\u0430\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \"\u0412 \u0441\u043b\u0443\u0447\u0430\u044f\u0445, \u043a\u043e\u0433\u0434\u0430 \u0440\u0435\u0441\u043f\u043e\u043d\u0434\u0435\u043d\u0442\u044b \u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0431\u043e\u043b\u0435\u0435 87% \u0438\u0437 \u043d\u0438\u0445 \u043f\u043e\u043f\u0430\u043b\u0438 \u0432 \u043e\u0434\u043d\u0443 \u0438\u0437 \u0448\u0435\u0441\u0442\u0438 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 CVE\".\n\n\u041a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438: \n\n\u2022 55% Microsoft Exchange ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)\n\u2022 14% Log4j\n\u2022 7% SonicWall CVEs\n\u2022 5% Microsoft Exchange ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)\n\u2022 4% Zoho ManageEngine ADSelfService Plus (CVE-2021-40539)\n\u2022 3% Fortinet CVEs\n\n\u2022 13% Other\n\n\u0421 \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u044d\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0434\u043b\u044f \u043e\u0431\u0449\u0438\u0445 \u0440\u0430\u0437\u043c\u044b\u0448\u043b\u0435\u043d\u0438\u0439 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u0430\u043a\u043e\u043c \u0441\u043e\u0444\u0442\u0435 \u0441\u0442\u043e\u0438\u0442 \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0431\u0440\u0430\u0449\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435. \u041d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0437 Other \u044f \u0431\u044b \u0442\u043e\u0436\u0435 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u043b, \u043d\u043e \u0438\u0445 \u043a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u043d\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435. \n\n\u0421 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u044d\u0442\u043e \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043c\u0430 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0438\u043e\u043d\u0430. \u041d\u0443 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c Exchange \u0432\u0435\u0437\u0434\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442, \u044d\u0442\u043e \u0434\u0430. Log4j \u0442\u0430\u043a\u0436\u0435 \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435. \u041c\u043e\u0436\u043d\u043e \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c, \u0447\u0442\u043e \u0432 \u043d\u0430\u0448\u0438\u0445 \u0448\u0438\u0440\u043e\u0442\u0430\u0445 \u043a\u043e\u0435-\u043a\u0442\u043e \u043a\u0440\u0435\u043f\u043a\u043e \u0441\u0438\u0434\u0438\u0442 \u043d\u0430 Fortinet. \u041d\u043e \u0432\u043e\u0442 SonicWall \u0438 Zoho \u043a\u0430\u0436\u0443\u0442\u0441\u044f \u0447\u0435\u043c-\u0442\u043e \u0441\u043e\u0432\u0441\u0435\u043c \u044d\u043a\u0437\u043e\u0442\u0438\u0447\u043d\u044b\u043c. \u0410 \u0442\u0430\u043c, \u0433\u0434\u0435 Unit 42  incident response \u043a\u0435\u0439\u0441\u044b \u0440\u0435\u0448\u0430\u0435\u0442, \u044d\u0442\u043e \u043e\u0447\u0435\u043d\u044c \u0437\u043d\u0430\u0447\u0438\u043c\u044b\u0435 \u0448\u0442\u0443\u043a\u0438. \u0418\u043b\u0438 \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u044e\u044e \u044d\u043f\u043e\u043f\u0435\u044e, \u043a\u043e\u0433\u0434\u0430  \u043c\u0430\u0441\u0441\u043e\u0432\u043e \u043f\u043e\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Kaseya VSA. \u0411\u043e\u043b\u044c\u0448\u0435 \u0442\u044b\u0441\u044f\u0447\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u0438, \u043d\u043e \u043e\u043f\u044f\u0442\u044c \u0436\u0435 \u044d\u0442\u043e \u043d\u0435 \u0432 \u043d\u0430\u0448\u0435\u043c \u0440\u0435\u0433\u0438\u043e\u043d\u0435, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u043c \u043d\u0435 \u043e\u0441\u043e\u0431\u043e \u044d\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0431\u044b\u043b\u043e. \n\n\u0421 \u0443\u0447\u0435\u0442\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u0430 \u0437\u0430\u043f\u0430\u0434\u043d\u044b\u0445 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432 \u0441 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0440\u044b\u043d\u043a\u0430 IT \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u044b \"\u0437\u0434\u0435\u0441\u044c\" \u0438 \"\u0442\u0430\u043c\" \u0431\u0443\u0434\u0443\u0442 \u0432\u0441\u0435 \u0431\u043e\u043b\u044c\u0448\u0435 \u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u0442\u044c\u0441\u044f. \u0418 \u0432\u0441\u0435 \u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0440\u043e\u043b\u044c \u0432 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0431\u0443\u0434\u0443\u0442 \u0438\u0433\u0440\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u043e\u0444\u0442\u0435, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0437\u0430\u043f\u0430\u0434\u043d\u044b\u0435 \u0418\u0411 \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0438 \u043d\u0435 \u0441\u043b\u044b\u0448\u0430\u043b\u0438 \u043d\u0438\u043a\u043e\u0433\u0434\u0430. \u0418 \u044d\u0442\u043e \u0432 \u043e\u0431\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442. \u0417\u043d\u0430\u0447\u0438\u0442 \u043b\u0438 \u044d\u0442\u043e, \u0447\u0442\u043e \u0438 Vulnerability Management \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u044f\u0442\u0441\u044f \u0432\u0441\u0435 \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0437\u0430\u0442\u043e\u0447\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0448\u0438 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0440\u0435\u0430\u043b\u0438\u0438? \u041d\u0443 \u0432\u0438\u0434\u0438\u043c\u043e \u0434\u0430. \n\n\u041f\u043e\u0445\u043e\u0436\u0435, \u0447\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0431\u0435\u0437\u0443\u0441\u043b\u043e\u0432\u043d\u043e\u0439 \u0433\u043b\u043e\u0431\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 IT \u0443\u0445\u043e\u0434\u0438\u0442, \u0430 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u0442\u0435\u043c \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 VM-\u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 \u043d\u043e\u0432\u044b\u0445 \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u0445. \u0427\u0442\u043e \u043f\u043e\u0434\u0435\u043b\u0430\u0442\u044c.\n\n@avleonovrus #VMnews #PaloAlto", "creation_timestamp": "2023-09-21T09:23:10.000000Z"}, {"uuid": "33a54f64-3b5e-4f29-afef-c500a914af6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "exploited", "source": "https://t.me/cyberbannews_ir/2876", "content": "\ud83d\uded1\u0645\u062a\u0647\u0645 \u0634\u062f\u0646 \u0686\u06cc\u0646 \u0628\u0647 \u0646\u0641\u0648\u0630 \u062f\u0631 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u0627\u06cc\u0645\u06cc\u0644 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\n\n\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062a\u0639\u062f\u0627\u062f\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u0635\u0641\u0631 \u0631\u0648\u0632 \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f \u06a9\u0647 \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0647 \u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f \u062f\u0631 \u0633\u0631\u0648\u0631 \u00abExchange\u00bb \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0645\u062d\u062f\u0648\u062f \u0648 \u0647\u062f\u0641\u0645\u0646\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0639\u0628\u0627\u0631\u062a\u0646\u062f \u0627\u0632 :\n\n\u00abCVE-2021-26855\u00bb\u060c \u00abCVE-2021-26857\u00bb\u060c \u00abCVE-2021-26858\u00bb \u0648 \u00abCVE-2021-27065\u00bb.\n\n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc\n\n\u2705 \u0628\u06cc\u0634\u062a\u0631 \u0628\u062e\u0648\u0627\u0646\u06cc\u062f:\nhttps://bit.ly/2NgsLLD\n\n@cyberbannews_ir", "creation_timestamp": "2021-03-14T02:55:09.000000Z"}, {"uuid": "6b948d00-ee57-45ab-b713-65cced9c028c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "published-proof-of-concept", "source": "https://t.me/pt_soft/270", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f // Pentest HaT \ud83c\udfa9", "creation_timestamp": "2024-05-03T09:04:40.000000Z"}, {"uuid": "75324246-2a91-427b-8bb5-eb47447538eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/pt_soft/243", "content": "\ud83d\uddbc\ufe0f Moriarty v1.1\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f // Pentest HaT \ud83c\udfa9", "creation_timestamp": "2024-03-15T08:58:02.000000Z"}, {"uuid": "d6a03619-fd4c-49c2-ac4e-fb819ee9974b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "exploited", "source": "https://t.me/tomhunter/283", "content": "#news \u041f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0420\u0435\u0441\u043f\u0443\u0431\u043b\u0438\u043a\u0430\u043d\u0441\u043a\u043e\u0439 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u0438 \u0433\u0443\u0431\u0435\u0440\u043d\u0430\u0442\u043e\u0440\u043e\u0432 (RGA) \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0445\u0430\u043a\u0435\u0440\u044b. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043a\u0430\u043a ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065), \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445\u0441\u044f \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Microsoft Exchange, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0435 RGA \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u0444\u0435\u0432\u0440\u0430\u043b\u044f 2021 \u0433\u043e\u0434\u0430 \u043f\u043e \u043c\u0430\u0440\u0442 2021 \u0433\u043e\u0434\u0430. \n\n\u0420\u0430\u043d\u0435\u0435 Microsoft \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0441\u043f\u043e\u043d\u0441\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u043c \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u043e\u043c \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443, Hafnium, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ProxyLogon \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u041f\u043e\u043b\u0443\u0447\u0430\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Microsoft Exchange, Hafnium \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u043b\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043c \u043a\u0440\u0430\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043b\u044e\u0431\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0412\u043f\u0440\u043e\u0447\u0435\u043c, \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043a\u0438\u0442\u0430\u0439\u0446\u044b \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b\u0438 \u0421\u0428\u0410 \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Exchange. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ESET \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430  \u043f\u043e \u043c\u0435\u043d\u044c\u0448\u0435\u0439 \u043c\u0435\u0440\u0435 \u0434\u0435\u0441\u044f\u0442\u044c APT-\u0433\u0440\u0443\u043f\u043f, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Exchange.\n\n@tomhunter", "creation_timestamp": "2021-09-20T19:00:59.000000Z"}, {"uuid": "3263f7ac-95ac-4698-b131-6dca3af72f3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/cibsecurity/24377", "content": "\u203c CVE-2021-26854 \u203c\n\nMicrosoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-03T02:44:45.000000Z"}, {"uuid": "f4b77057-daf2-4eec-aa6c-07f7acf86cbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "exploited", "source": "https://t.me/itsecalert/137", "content": "\u26a0\ufe0f Atlassian Confluence On-Premise (All recent versions) Remote Code Execution vulnerability!\n\nIf your Confluence is reachable from the Internet, take immediate action and restrict access. This is being exploited in the wild! There is no patch available as of right now.\n\nAffected:  All recent On-Prem Confluence Servers & Data Center\nMore Information (Advisory/Updates): https://yt.gl/f1kcv\n(severity: \ud83d\udd36 very high) \n\n#alert #vulnerability #severityhigh #exchange #CVE-2021-26855 #CVE-2021-26857 #CVE-2021-26858 #CVE-2021-27065.\n\n\u27a1\ufe0f Feel free to discuss this issue in @itsectalk and do your colleagues a favor and forward them this critical vulnerability.", "creation_timestamp": "2022-06-03T09:24:05.000000Z"}, {"uuid": "54d66ec1-5737-4d49-b9b0-389d63b69164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/itsecalert/135", "content": "\u26a0\ufe0f Microsoft Exchange Server - GENERAL ADVISORY - UPDATE IMMEDIATELY!\nSeveral new flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065)  have been reported and Microsoft issued an emergency fix. It is reported that the vulnerabilities are actively being exploited.\n\nAffected:  Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019.\n\nMore Information (Advisory/Updates): https://yt.gl/exchangeexp\n\n(severity: \ud83d\udd36 very high) \n\n#alert #vulnerability #severityhigh #atlassian #confluence CVE-2022-26134.\n\n\u27a1\ufe0f Feel free to discuss this issue in @itsectalk and do your colleagues a favor and forward them this critical vulnerability.", "creation_timestamp": "2022-06-03T09:24:24.000000Z"}, {"uuid": "08e9df99-b113-40e4-b14c-4e8def5ae5cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/Russian_OSINT/875", "content": "\u200b\u200b\ud83d\ude94 \u0424\u0411\u0420 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0441\u043f\u0438\u0441\u043e\u043a 30 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 2 \u0433\u043e\u0434\u0430\n\nCVE-2021-26855: It is a Microsoft Exchange Server Remote Code Execution\nCVE-2021-26857: It is a Microsoft Exchange Server Remote Code Execution\nCVE-2021-26858: It is a Microsoft Exchange Server Remote Code Execution\nCVE-2021-27065: It is a Microsoft Exchange Server Remote Code Execution\nCVE-2021-22893: It is an Improper Authentication vulnerability that is marked as critical\nCVE-2021-22894: It is a buffer overflow vulnerability that enables an attacker to execute arbitrary code\nCVE-2021-22899: It is a command injection vulnerability that enables an attacker to execute remote code\nCVE-2021-22900: It is an Improper Control of Generation of Code vulnerability\nCVE-2021-27101: It is an Improper Neutralization of Special Elements used in an SQL Command\nCVE-2021-27102: It is an Improper Neutralization of Special Elements used in an OS Command\nCVE-2021-27103: It is a Server-Side Request Forgery (SSRF) vulnerability\nCVE-2021-27104: It is an Improper Neutralization of Special Elements used in an OS Command vulnerability\nCVE-2021-21985: It is an Improper Input Validation vulnerability\nCVE-2018-13379: It is an Improper Limitation of a Pathname to a Restricted Directory (\u2018Path Traversal\u2019)\nCVE-2020-12812: It is an Improper Authentication vulnerability\nCVE-2019-5591: It is a Missing Authentication for Critical Function vulnerability\nCVE-2019-19781: It is an Improper Limitation of a Pathname to a Restricted Directory \nCVE 2019-11510: It is an Improper Limitation of a Pathname to a Restricted Directory\nCVE 2018-13379: It is an Improper Limitation of a Pathname to a Restricted Directory \nCVE 2020-5902: It is an Inclusion of Functionality from Untrusted Control Sphere and Improper Limitation of a Pathname to a Restricted Directory vulnerability \nCVE 2020-15505: It is an Insufficient Information vulnerability\nCVE-2017-11882: It is a Microsoft Office Memory Corruption vulnerability that enables an attacker to execute arbitrary code.\nCVE-2019-11580: It is an Insufficient Information vulnerability\nCVE-2018-7600: It is an Improper Input Validation vulnerability\nCVE 2019-18935: It is a Deserialization of Untrusted Data vulnerability\nCVE-2019-0604: It is a Microsoft SharePoint Remote Code Execution Vulnerability\nCVE-2020-0787: It is a Windows Background Intelligent Transfer Service Elevation of Privilege vulnerability\nCVE-2020-1472: It is a Netlogon Elevation of Privilege vulnerability \nCVE-2020-15505: It is an Insufficient Information vulnerability\nCVE-2020-0688: It is a Use of Hard-coded Credentials vulnerability", "creation_timestamp": "2021-07-29T17:59:02.000000Z"}, {"uuid": "63ca7dfd-cc03-4f86-a92b-e04b1fad84b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/2835", "content": "#Blue_Team_Techniques\n1. A PowerShell script to identify indicators of exploitation of ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-26865):\nhttps://github.com/soteria-security/HAFNIUM-IOC\nPoCs for CVE-2021-26855:\n]-> https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-26855.yaml\n]-> https://github.com/h4x0r-dz/CVE-2021-26855\n\n2. The SI6 Networks\u2019 IPv6 toolkit is a set of IPv6 security assessment and trouble-shooting tools\nhttps://www.si6networks.com/research/tools/ipv6toolkit", "creation_timestamp": "2021-03-11T06:06:55.000000Z"}, {"uuid": "f9880b3e-8535-47cd-aca5-bbf13e195e01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/2865", "content": "#Analytics\n10 most exploited vulnerabilities of the week (march 2-8)\n\nCVE-2020-1350 - Exploit SIGRed/Windows DNS Server RCE\nCVE-2021-21972 - VMware vCenter RCE (PoC1, PoC2, PoC3)\nCVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 - ProxyLogon MS Exchange Server RCE\nCVE-2021-21166 - Chrome Audio RCE\nCVE-2021-21978 - VMware View Planner\u00a0RCE\nCVE-2021-21315 - Node.JS OS sanitize service Parameters Command Injection\nCVE-2021-23132 - RCE in Joomla core <=3.9.24", "creation_timestamp": "2024-10-14T07:14:24.000000Z"}, {"uuid": "0dde194c-55af-4281-a643-738e31ea238f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2918", "content": "#Blue_Team_Techniques\nMicrosoft Exchange On-Premises Mitigation Tool (partial mitigations CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)\nhttps://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021\n+ Security scripts:\nhttps://github.com/microsoft/CSS-Exchange/tree/main/Security", "creation_timestamp": "2021-03-16T12:24:01.000000Z"}, {"uuid": "37ea0103-43a9-4e5e-bd8a-67dc8a9d51b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/wh_lab/59", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "creation_timestamp": "2026-08-04T13:00:24.099912Z"}, {"uuid": "2b91cfd2-9d8f-40ba-84b8-c099402b70ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/wh_lab/59", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "creation_timestamp": "2026-08-05T00:00:40.356873Z"}, {"uuid": "a65fff8d-dfab-47b9-8099-cfa4e0e889b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/1cc4d8d4-4592-4dae-bcdf-2fb9d38b794c", "content": "", "creation_timestamp": "2026-06-04T22:04:33.000000Z"}, {"uuid": "55ca2dc2-e6b5-4e76-be53-a100f26fce91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "published-proof-of-concept", "source": "https://t.me/wh_lab/59", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "creation_timestamp": "2026-08-06T00:00:43.293038Z"}, {"uuid": "48cd51f5-018b-49c1-98cd-6940531bf477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3msvzzg55rr2x", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-26858: Microsoft Exchange Server Remote Code Execution Vulnerability\nCVSS 7.8 \u00b7 EPSS 89.5% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2021-26858\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-12T21:08:56.173093Z"}, {"uuid": "e82f386b-2da7-4f82-9d52-408b3f84739d", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/24d97951-6f22-4906-936e-87b0a47ba150", "content": "", "creation_timestamp": "2026-06-19T12:48:00.303336Z"}, {"uuid": "cdb5ecac-d63c-48aa-bf86-0f424c4f2114", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5e53bebe-a545-4002-a6d4-940de3900825", "content": "", "creation_timestamp": "2026-06-23T14:04:34.170856Z"}, {"uuid": "2e32fcbb-c23c-4324-aca2-6d9d2234c49c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "exploited", "source": "https://t.me/i_odmin/1394", "content": "\u041f\u0430\u0442\u0447\u0438 Exchange \u043e\u0442 Microsoft (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 8 \u043c\u0430\u0440\u0442\u0430)\n\nhttps://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/\n\n\u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043f\u043e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044e Exchange \u0443\u0433\u0440\u043e\u0437\n\nhttps://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/\n\n\u0421\u043c\u044f\u0433\u0447\u0430\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b \u043e\u0442 CISA\n\nhttps://us-cert.cisa.gov/ncas/current-activity/2021/03/05/microsoft-releases-alternative-mitigations-exchange-server\n\n\u0415\u0449\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u043f\u043e \u0442\u0435\u043c\u0435:\n- https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/\n- https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901\n- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/\n- https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar\n\n\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065\n\nOWA tergets news:\n- https://www.channelfutures.com/security/microsoft-exchange-server-zero-day-exploit-could-have-thousands-of-victims\n- https://www.wired.com/story/china-microsoft-exchange-server-hack-victims/", "creation_timestamp": "2026-08-20T00:00:28.548882Z"}, {"uuid": "d3637eb1-9cd0-432d-98a9-2c46deabaa13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/i_odmin/1394", "content": "\u041f\u0430\u0442\u0447\u0438 Exchange \u043e\u0442 Microsoft (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 8 \u043c\u0430\u0440\u0442\u0430)\n\nhttps://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/\n\n\u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043f\u043e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044e Exchange \u0443\u0433\u0440\u043e\u0437\n\nhttps://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/\n\n\u0421\u043c\u044f\u0433\u0447\u0430\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b \u043e\u0442 CISA\n\nhttps://us-cert.cisa.gov/ncas/current-activity/2021/03/05/microsoft-releases-alternative-mitigations-exchange-server\n\n\u0415\u0449\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u043f\u043e \u0442\u0435\u043c\u0435:\n- https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/\n- https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901\n- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/\n- https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar\n\n\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065\n\nOWA tergets news:\n- https://www.channelfutures.com/security/microsoft-exchange-server-zero-day-exploit-could-have-thousands-of-victims\n- https://www.wired.com/story/china-microsoft-exchange-server-hack-victims/", "creation_timestamp": "2026-08-19T07:00:03.819246Z"}, {"uuid": "64798bed-1123-427a-8a61-fbbea190530d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/EchelonEyes/232", "content": "\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438, \u041a\u0430\u043d\u0430\u0434\u044b, \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 \u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0430\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0432 2021-\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA). \u041e\u043d \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430c\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 (CISA, \u0410\u041d\u0411, \u0424\u0411\u0420), \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 (\u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - ACSC), \u041a\u0430\u043d\u0430\u0434\u044b (\u041a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - CCCS), \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 - NZ NCSC) \u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 - NCSC-UK).\n\n\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0432\u0430 \u0441\u043f\u0438\u0441\u043a\u0430: \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439, \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e 15 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n1. CVE-2021-44228, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u043a\u0430\u043a Log4Shell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Apache Log4j. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n2. CVE-2021-40539, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Zoho ManageEngine AD SelfService Plus. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n3 \u2013 5. CVE-2021-34523, CVE-2021-34473, CVE-2021-31207, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyShell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n6 \u2013 9. CVE-2021-27065, CVE-2021-26858, CVE-2021-26857, CVE-2021-26855, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyLogon. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server. \u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n10. CVE-2021-26084, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Atlassian Confluence Server and Data Center. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n11. CVE-2021-21972, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 VMware vSphere Client. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n12. CVE-2020-1472, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Netlogon Remote Protocol (MS-NRPC). \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n13. CVE-2020-0688, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Exchange Server. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n14. CVE-2019-11510, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Pulse Secure Pulse Connect Secure. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n15. CVE-2018-13379, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Fortinet FortiOS and FortiProxy. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u0415\u0449\u0435 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Sitecore XP, ForgeRock OpenAM server, Accellion FTA, SonicWall Secure Mobile Access (SMA), VMware vCenter Server, Checkbox Survey, QNAP QTS and QuTS hero, Cisco IOS Software and IOS XE Software, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u044f\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0438 \u0441\u043b\u0443\u0436\u0431 Microsoft Windows. \n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0434\u0435\u043b\u044f\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u0430\u0445. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/uscert/ncas/alerts/aa22-117a", "creation_timestamp": "2026-07-17T05:00:05.348775Z"}, {"uuid": "8f7ade68-ff28-4a32-92f1-11e1effc4a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/EchelonEyes/232", "content": "\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438, \u041a\u0430\u043d\u0430\u0434\u044b, \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 \u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0430\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0432 2021-\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA). \u041e\u043d \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430c\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 (CISA, \u0410\u041d\u0411, \u0424\u0411\u0420), \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 (\u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - ACSC), \u041a\u0430\u043d\u0430\u0434\u044b (\u041a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - CCCS), \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 - NZ NCSC) \u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 - NCSC-UK).\n\n\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0432\u0430 \u0441\u043f\u0438\u0441\u043a\u0430: \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439, \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e 15 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n1. CVE-2021-44228, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u043a\u0430\u043a Log4Shell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Apache Log4j. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n2. CVE-2021-40539, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Zoho ManageEngine AD SelfService Plus. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n3 \u2013 5. CVE-2021-34523, CVE-2021-34473, CVE-2021-31207, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyShell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n6 \u2013 9. CVE-2021-27065, CVE-2021-26858, CVE-2021-26857, CVE-2021-26855, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyLogon. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server. \u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n10. CVE-2021-26084, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Atlassian Confluence Server and Data Center. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n11. CVE-2021-21972, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 VMware vSphere Client. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n12. CVE-2020-1472, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Netlogon Remote Protocol (MS-NRPC). \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n13. CVE-2020-0688, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Exchange Server. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n14. CVE-2019-11510, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Pulse Secure Pulse Connect Secure. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n15. CVE-2018-13379, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Fortinet FortiOS and FortiProxy. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u0415\u0449\u0435 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Sitecore XP, ForgeRock OpenAM server, Accellion FTA, SonicWall Secure Mobile Access (SMA), VMware vCenter Server, Checkbox Survey, QNAP QTS and QuTS hero, Cisco IOS Software and IOS XE Software, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u044f\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0438 \u0441\u043b\u0443\u0436\u0431 Microsoft Windows. \n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0434\u0435\u043b\u044f\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u0430\u0445. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/uscert/ncas/alerts/aa22-117a", "creation_timestamp": "2026-07-18T00:00:38.228711Z"}, {"uuid": "196fd909-4d00-4a84-a164-cc912ec14247", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/cec219ff-8f6d-45c9-bdbb-b4fb8c9c0f2b", "content": "", "creation_timestamp": "2026-07-23T21:15:03.670250Z"}, {"uuid": "8b23a6bd-902c-4199-b72c-79edecbe09a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "MISP/cec219ff-8f6d-45c9-bdbb-b4fb8c9c0f2b", "content": "", "creation_timestamp": "2026-07-24T00:15:03.781029Z"}, {"uuid": "215d159e-ef90-4dd7-a7ec-0a30ba4f93bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/cissp/2548", "content": "Blue Team Techniques\nMicrosoft Exchange On-Premises Mitigation Tool (partial mitigations CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)\nhttps://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021\n+ Security scripts:\nhttps://github.com/microsoft/CSS-Exchange/tree/main/Security", "creation_timestamp": "2026-09-01T17:00:58.468426Z"}, {"uuid": "8269b34a-b158-4279-a4af-b6a63e4b1536", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/cissp/2450", "content": "Blue_Team_Techniques\n1. A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-26865:\nhttps://github.com/soteria-security/HAFNIUM-IOC\n\n2. The SI6 Networks\u2019 IPv6 toolkit is a set of IPv6 security assessment and trouble-shooting tools\nhttps://www.si6networks.com/research/tools/ipv6toolkit\n\nRed_Team_Tactics\n1. SharpSphere - Attacking vSphere/vCenter Infrastructure\nhttps://github.com/JamesCooteUK/SharpSphere\n\n2. Cloudflare XSS WAF Bypass\n\n\n3. SSRF to fetch AWS credentials with full access to multiple services\nhttps://zonduu.medium.com/ssrf-to-fetch-aws-credentials-with-full-access-to-various-services-18cd08194e91\n\nTrojans in Artificial Intelligence\nhttps://www.nist.gov/itl/ssd/trojai\n]-> Pruning-based Baseline Approach to Trojan Detection in AI Models\nhttps://github.com/usnistgov/trojai-baseline-pruning\n]-> The TrojAI Software Framework: An OpenSource tool for Embedding Trojans into Deep Learning Models\nhttps://arxiv.org/abs/2003.07233\n]-> threatspec - continuous threat modeling, through code\nhttps://github.com/threatspec/threatspec", "creation_timestamp": "2026-09-01T17:01:00.855390Z"}, {"uuid": "b8d5cf60-3a1b-4dcb-a815-f6273a6bc8f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/hackersmeet0/2539", "content": "Top CYBERSECURITY ATTACKS AND DATA BREACHES IN 2021\nCYBERSECURITY LATEST NEWS\n\nby Aratrika Dutta August 8, 2021\n\nList of top Cyber-attacks and data breaches in 2021.\nThe year 2021 is presenting a new variety of extraordinary challenges for companies and individuals as well. 2021 can be referred to as a record-breaking year for data lost due to a lot of data breaches and cyber-attacks taking place this year. Because of the implementation of evolving technologies such as machine learning and artificial intelligence, as well as the greater tactical cooperation among hacker groups and state actors, there is an increase in the number of data breaches and cyber-attacks taking place.\n\nTake a look at the top cybersecurity attacks in 2021\n\u00a0\nFacebook Data Leak Impacts 533 Million Users\nIn April, Alon Gal, co-founder, and CTO of cybercrime intelligence firm Hudson Rock seemingly discovered the latest incident which involved the personal information of 533 million Facebook users from 106 different countries. The personal information included Facebook members\u2019 bio, birthdate, full name, location, past location, relationship status, and Facebook IT. The members of the hacking forum have got access to freely avail these pieces of information. Facebook claims that it did not know whose information was leaked and therefore could not inform the members about the leakage.\n\nFTC conducted an investigation pertaining to the incident and concluded that Facebook had used illusive divulgence and settings to undermine users\u2019 privacy preferences in violation of a 2012 FTC order. In short, it means Facebook has enabled third-party applications to collect personal information of Facebook members whose friends had downloaded the applications.\n\nMicrosoft Exchange, A Lack of Mending\nIn March, Volexity, the security firm, unearthed a Microsoft Exchange flaw that enabled hackers to install web shells to extract data and credentials. The four CVEs that were involved are CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. Among these the first one provides access and the last three allow code implementation. 120,000 systems had been contaminated and less than 10,000 remained unpatched.\n\nOn April 14, NIST produced four other distinctive CVEs, all of which included remote execution. Though the FBI\u2019s attempts are necessary, organizations cannot depend on the agency for their safety.\n\u00a0\n\nScripps Health Malware Attack Could Cost Lives\nIn May, Scripps Health IT systems were closed down due to a malware attack. Scripps Health is a nonprofit health care system in San Diego, Calif. It includes 5 hospitals and 19 outpatient clinics. On May 1, Scripps Health said its IT systems had been harmed by a malware attack that affected its hospitals and other clinics. The company provisionally suspended user access to IT systems, including the patient portal.\n\nPatient appointments and surgical procedures were canceled provisionally and business has recommenced, though not as usual yet.\n\nMcDonald\u2019s Cyber Attack Targets Data\nOn June 4, Mcdonald\u2019s became the victim of a successful cyber-attack that involved the extraction of data. In South Korea and Taiwan, customers\u2019 email addresses, physical addresses, and phone numbers were exposed. Also in Taiwan, some employees\u2019 names and contact information were exposed. However, Mcdonald\u2019s claimed that the volume of information exposed was small and that it had appointed outside consultants to deal with it.\u00a0 It took the company one week to stop unauthorized access to the data.\n\nJBS Faced a Ransomware Attack\nIn May, JBS USA found that it was the victim of a cyber-attack that infected some of the servers supporting its U.S., Australian, and Canadian IT systems. The company seized all infected systems and then approached law enforcement and third-party consultants to work with internal IT to settle the situation.\n\nOn June 3, Andre Nogueria, JBS CEO, stated that the company was able to revive quickly with the help of government consultants and entities.", "creation_timestamp": "2026-09-01T18:00:04.915483Z"}, {"uuid": "a257227b-0067-406b-b293-707602064cc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/hacking_Attack/22094", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email SnoopingPost Views: 40 \nReading Time: 1 Minute\nA serious security vulnerability in Microsoft Exchange Server that researchers have dubbed ProxyToken could allow an unauthenticated attacker to access and steal emails from a target\u2019s mailbox.\nMicrosoft Exchange uses two websites; one, the front end, is what users connect to in order to access email. The second is a back-end site that handles the authentication function.\n\n\u201cThe front-end website is mostly just a proxy to the back end. To allow access that requires forms authentication, the front end serves pages such as /owa/auth/logon.aspx,\u201d according to a Monday posting on the bug from Trend Micro\u2019s Zero Day Initiative. \u201cFor all post-authentication requests, the front end\u2019s main role is to repackage the requests and proxy them to corresponding endpoints on the Exchange Back End site. It then collects the responses from the back end and forwards them to the client.\u201d\n\nThe issue arises specifically in a feature called \u201cDelegated Authentication,\u201d where the front end passes authentication requests directly to the back end. These requests contain a SecurityToken cookie that identify them; i.e., if the front end finds a non-empty cookie named SecurityToken, it delegates authentication to the back end. However, Exchange has to be specifically configured to have the back end perform the authentication checks; in a default configuration, the module responsible for that (the \u201cDelegatedAuthModule\u201d) isn\u2019t loaded.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cWhen the front end sees the SecurityToken cookie, it knows that the back end alone is responsible for authenticating this request,\u201d according to ZDI. \u201cMeanwhile, the back end is completely unaware that it needs to authenticate some incoming requests based upon the SecurityToken cookie, since the DelegatedAuthModule is not loaded in installations that have not been configured to use the special delegated authentication feature. The net result is that requests can sail through, without being subjected to authentication on either the front or back end.\u201d\n\nFrom there, attacker could install a forwarding rule allowing them to read the victim\u2019s incoming mail.\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets \u201cWith this vulnerability, an unauthenticated attacker can perform configuration actions on mailboxes belonging to arbitrary users,\u201d according to the post. \u201cAs an illustration of the impact, this can be used to copy all emails addressed to a target and account and forward them to an account controlled by the attacker.\u201d\n\nZDI outlined an exploitation scenario wherein an attacker has an account on the same Exchange server as the victim. However, if an administrator permits forwarding rules having arbitrary internet destinations, no Exchange credentials are needed at all, researchers noted.\n\nThe bug (CVE-2021-33766) was reported to the Zero Day Initiative by researcher Le Xuan Tuyen of VNPT ISC, and it was patched by Microsoft in the July Exchange cumulative updates. Organizations should update their products to avoid compromise.\nSee Also: Offensive Security Tool: Starkiller The ProxyToken revelation comes after the disclosure of\u00a0ProxyLogon in early March; that\u2019s an exploit chain comprised of four Exchange flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065), which together create a pre-authentication remote code execution (RCE) exploit. Attackers can take over unpatched servers without knowing [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:26.235264Z"}, {"uuid": "5ff89939-9f9a-45f2-b338-dbdc5ca7af26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/hacking_Attack/8141", "content": "Black Hat Ethical Hacking\nLemon Duck Cryptojacking Botnet Changes Up Tactics\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Lemon Duck Cryptojacking Botnet Changes Up TacticsPost Views: 54 \nReading Time: 2 Minutes\nThe Lemon Duck cryptocurrency-mining botnet has added the ProxyLogon group of exploits\u00a0to its bag of tricks, targeting Microsoft Exchange servers.\nThat\u2019s according to researchers at Cisco Talos, who said that the cybercrime group behind Lemon Duck has also added the Cobalt Strike attack framework into its malware toolkit and has beefed up anti-detection capabilities. On the latter front, it\u2019s using fake domains on East Asian top-level domains (TLDs) to hide command-and-control (C2) infrastructure.\n\nLemon Duck targets victims\u2019 computer resources to mine the Monero virtual currency, with self-propagating capabilities and a modular framework that allows it to infect additional systems that become part of the botnet. It has been active since at least the end of December 2018, and Cisco Talos calls it \u201cone of the more complex\u201d mining botnets, with several interesting tricks up its sleeve.\n\nFor instance, Lemon Duck has at least 12 different initial-infection vectors \u2013 more than most malware, with Proxylogon exploits only the latest addition. Its existing capabilities ranged from Server Message Block (SMB) and Remote Desktop Protocol (RDP) password brute-forcing; targeting the RDP BlueKeep flaw (CVE-2019-0708) in Windows machines; targeting internet-of-things devices\u00a0with weak or default passwords; and exploiting vulnerabilities in Redis (an open-source, in-memory data structure store used as a database, cache and message broker) and YARN Hadoop (a resource-management and job-scheduling technology) in Linux machines.\nSee Also: iPhone Hack Allegedly Used to Spy on China\u2019s Uyghurs\n\u201cSince April 2021, Cisco Talos has observed updated infrastructure and new components associated with the Lemon Duck that target unpatched Microsoft Exchange Servers and attempt to download and execute payloads for Cobalt Strike DNS beacons,\u201d according to an analysis\u00a0released Friday.\n\nCisco Talos researchers previously observed\u00a0an increase in DNS requests connected with Lemon Duck\u2019s C2 and mining servers last August, with the attacks mainly targeting Egypt, India, Iran, the Philippines and Vietnam. In the latest rash of attacks, which began in April, the group has changed up its geographic targets to focus primarily on North America, followed by Europe and Southeast Asia, and a handful of victims in Africa and South America. Targeting Exchange Servers with Monero-MiningProxyLogon consists of four flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) that can be chained together to create a pre-authentication remote code execution (RCE) exploit \u2013 meaning that attackers can take over servers without knowing any valid account credentials. This gives them access to email communications and the opportunity to install a web shell for further exploitation within the environment, such as the deployment of ransomware.\nSee Also: Offensive Security Tool: EyeWitness The highly publicized exploit chain suffered a barrage of attacks from advanced persistent threat (APT) groups to infect systems with everything from ransomware to info-stealers, and now financially motivated groups are getting in on the action too.\n\nIn Lemon Duck\u2019s case, once the Exchange servers are compromised, it executes various system commands using the Windows Control Manager (sc.exe), including copying two .ASPX files named \u201cwanlins.aspx\u201d and \u201cwanlin.aspx.\u201d\n\n\u201cThese files are likely web shells and were copied from C:\\inetpub\\wwwroot\\aspnet_client\\, a known directory where[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:44.254215Z"}, {"uuid": "cb8924e7-e451-4339-9207-63f766b36d4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/hacking_Attack/22094", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email SnoopingPost Views: 40 \nReading Time: 1 Minute\nA serious security vulnerability in Microsoft Exchange Server that researchers have dubbed ProxyToken could allow an unauthenticated attacker to access and steal emails from a target\u2019s mailbox.\nMicrosoft Exchange uses two websites; one, the front end, is what users connect to in order to access email. The second is a back-end site that handles the authentication function.\n\n\u201cThe front-end website is mostly just a proxy to the back end. To allow access that requires forms authentication, the front end serves pages such as /owa/auth/logon.aspx,\u201d according to a Monday posting on the bug from Trend Micro\u2019s Zero Day Initiative. \u201cFor all post-authentication requests, the front end\u2019s main role is to repackage the requests and proxy them to corresponding endpoints on the Exchange Back End site. It then collects the responses from the back end and forwards them to the client.\u201d\n\nThe issue arises specifically in a feature called \u201cDelegated Authentication,\u201d where the front end passes authentication requests directly to the back end. These requests contain a SecurityToken cookie that identify them; i.e., if the front end finds a non-empty cookie named SecurityToken, it delegates authentication to the back end. However, Exchange has to be specifically configured to have the back end perform the authentication checks; in a default configuration, the module responsible for that (the \u201cDelegatedAuthModule\u201d) isn\u2019t loaded.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cWhen the front end sees the SecurityToken cookie, it knows that the back end alone is responsible for authenticating this request,\u201d according to ZDI. \u201cMeanwhile, the back end is completely unaware that it needs to authenticate some incoming requests based upon the SecurityToken cookie, since the DelegatedAuthModule is not loaded in installations that have not been configured to use the special delegated authentication feature. The net result is that requests can sail through, without being subjected to authentication on either the front or back end.\u201d\n\nFrom there, attacker could install a forwarding rule allowing them to read the victim\u2019s incoming mail.\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets \u201cWith this vulnerability, an unauthenticated attacker can perform configuration actions on mailboxes belonging to arbitrary users,\u201d according to the post. \u201cAs an illustration of the impact, this can be used to copy all emails addressed to a target and account and forward them to an account controlled by the attacker.\u201d\n\nZDI outlined an exploitation scenario wherein an attacker has an account on the same Exchange server as the victim. However, if an administrator permits forwarding rules having arbitrary internet destinations, no Exchange credentials are needed at all, researchers noted.\n\nThe bug (CVE-2021-33766) was reported to the Zero Day Initiative by researcher Le Xuan Tuyen of VNPT ISC, and it was patched by Microsoft in the July Exchange cumulative updates. Organizations should update their products to avoid compromise.\nSee Also: Offensive Security Tool: Starkiller The ProxyToken revelation comes after the disclosure of\u00a0ProxyLogon in early March; that\u2019s an exploit chain comprised of four Exchange flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065), which together create a pre-authentication remote code execution (RCE) exploit. Attackers can take over unpatched servers without knowing [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:59.825981Z"}, {"uuid": "44deee42-31ed-40ef-a607-07a58b982e78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/hacking_Attack/8141", "content": "Black Hat Ethical Hacking\nLemon Duck Cryptojacking Botnet Changes Up Tactics\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Lemon Duck Cryptojacking Botnet Changes Up TacticsPost Views: 54 \nReading Time: 2 Minutes\nThe Lemon Duck cryptocurrency-mining botnet has added the ProxyLogon group of exploits\u00a0to its bag of tricks, targeting Microsoft Exchange servers.\nThat\u2019s according to researchers at Cisco Talos, who said that the cybercrime group behind Lemon Duck has also added the Cobalt Strike attack framework into its malware toolkit and has beefed up anti-detection capabilities. On the latter front, it\u2019s using fake domains on East Asian top-level domains (TLDs) to hide command-and-control (C2) infrastructure.\n\nLemon Duck targets victims\u2019 computer resources to mine the Monero virtual currency, with self-propagating capabilities and a modular framework that allows it to infect additional systems that become part of the botnet. It has been active since at least the end of December 2018, and Cisco Talos calls it \u201cone of the more complex\u201d mining botnets, with several interesting tricks up its sleeve.\n\nFor instance, Lemon Duck has at least 12 different initial-infection vectors \u2013 more than most malware, with Proxylogon exploits only the latest addition. Its existing capabilities ranged from Server Message Block (SMB) and Remote Desktop Protocol (RDP) password brute-forcing; targeting the RDP BlueKeep flaw (CVE-2019-0708) in Windows machines; targeting internet-of-things devices\u00a0with weak or default passwords; and exploiting vulnerabilities in Redis (an open-source, in-memory data structure store used as a database, cache and message broker) and YARN Hadoop (a resource-management and job-scheduling technology) in Linux machines.\nSee Also: iPhone Hack Allegedly Used to Spy on China\u2019s Uyghurs\n\u201cSince April 2021, Cisco Talos has observed updated infrastructure and new components associated with the Lemon Duck that target unpatched Microsoft Exchange Servers and attempt to download and execute payloads for Cobalt Strike DNS beacons,\u201d according to an analysis\u00a0released Friday.\n\nCisco Talos researchers previously observed\u00a0an increase in DNS requests connected with Lemon Duck\u2019s C2 and mining servers last August, with the attacks mainly targeting Egypt, India, Iran, the Philippines and Vietnam. In the latest rash of attacks, which began in April, the group has changed up its geographic targets to focus primarily on North America, followed by Europe and Southeast Asia, and a handful of victims in Africa and South America. Targeting Exchange Servers with Monero-MiningProxyLogon consists of four flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) that can be chained together to create a pre-authentication remote code execution (RCE) exploit \u2013 meaning that attackers can take over servers without knowing any valid account credentials. This gives them access to email communications and the opportunity to install a web shell for further exploitation within the environment, such as the deployment of ransomware.\nSee Also: Offensive Security Tool: EyeWitness The highly publicized exploit chain suffered a barrage of attacks from advanced persistent threat (APT) groups to infect systems with everything from ransomware to info-stealers, and now financially motivated groups are getting in on the action too.\n\nIn Lemon Duck\u2019s case, once the Exchange servers are compromised, it executes various system commands using the Windows Control Manager (sc.exe), including copying two .ASPX files named \u201cwanlins.aspx\u201d and \u201cwanlin.aspx.\u201d\n\n\u201cThese files are likely web shells and were copied from C:\\inetpub\\wwwroot\\aspnet_client\\, a known directory where[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:19.719525Z"}, {"uuid": "83a7d4f1-f308-4537-bd5f-49ad5860931e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/hackersmeet0/2539", "content": "Top CYBERSECURITY ATTACKS AND DATA BREACHES IN 2021\nCYBERSECURITY LATEST NEWS\n\nby Aratrika Dutta August 8, 2021\n\nList of top Cyber-attacks and data breaches in 2021.\nThe year 2021 is presenting a new variety of extraordinary challenges for companies and individuals as well. 2021 can be referred to as a record-breaking year for data lost due to a lot of data breaches and cyber-attacks taking place this year. Because of the implementation of evolving technologies such as machine learning and artificial intelligence, as well as the greater tactical cooperation among hacker groups and state actors, there is an increase in the number of data breaches and cyber-attacks taking place.\n\nTake a look at the top cybersecurity attacks in 2021\n\u00a0\nFacebook Data Leak Impacts 533 Million Users\nIn April, Alon Gal, co-founder, and CTO of cybercrime intelligence firm Hudson Rock seemingly discovered the latest incident which involved the personal information of 533 million Facebook users from 106 different countries. The personal information included Facebook members\u2019 bio, birthdate, full name, location, past location, relationship status, and Facebook IT. The members of the hacking forum have got access to freely avail these pieces of information. Facebook claims that it did not know whose information was leaked and therefore could not inform the members about the leakage.\n\nFTC conducted an investigation pertaining to the incident and concluded that Facebook had used illusive divulgence and settings to undermine users\u2019 privacy preferences in violation of a 2012 FTC order. In short, it means Facebook has enabled third-party applications to collect personal information of Facebook members whose friends had downloaded the applications.\n\nMicrosoft Exchange, A Lack of Mending\nIn March, Volexity, the security firm, unearthed a Microsoft Exchange flaw that enabled hackers to install web shells to extract data and credentials. The four CVEs that were involved are CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. Among these the first one provides access and the last three allow code implementation. 120,000 systems had been contaminated and less than 10,000 remained unpatched.\n\nOn April 14, NIST produced four other distinctive CVEs, all of which included remote execution. Though the FBI\u2019s attempts are necessary, organizations cannot depend on the agency for their safety.\n\u00a0\n\nScripps Health Malware Attack Could Cost Lives\nIn May, Scripps Health IT systems were closed down due to a malware attack. Scripps Health is a nonprofit health care system in San Diego, Calif. It includes 5 hospitals and 19 outpatient clinics. On May 1, Scripps Health said its IT systems had been harmed by a malware attack that affected its hospitals and other clinics. The company provisionally suspended user access to IT systems, including the patient portal.\n\nPatient appointments and surgical procedures were canceled provisionally and business has recommenced, though not as usual yet.\n\nMcDonald\u2019s Cyber Attack Targets Data\nOn June 4, Mcdonald\u2019s became the victim of a successful cyber-attack that involved the extraction of data. In South Korea and Taiwan, customers\u2019 email addresses, physical addresses, and phone numbers were exposed. Also in Taiwan, some employees\u2019 names and contact information were exposed. However, Mcdonald\u2019s claimed that the volume of information exposed was small and that it had appointed outside consultants to deal with it.\u00a0 It took the company one week to stop unauthorized access to the data.\n\nJBS Faced a Ransomware Attack\nIn May, JBS USA found that it was the victim of a cyber-attack that infected some of the servers supporting its U.S., Australian, and Canadian IT systems. The company seized all infected systems and then approached law enforcement and third-party consultants to work with internal IT to settle the situation.\n\nOn June 3, Andre Nogueria, JBS CEO, stated that the company was able to revive quickly with the help of government consultants and entities.", "creation_timestamp": "2026-09-02T01:03:29.861184Z"}, {"uuid": "97537813-9628-4132-a14a-468fbd9714e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/cissp/2548", "content": "Blue Team Techniques\nMicrosoft Exchange On-Premises Mitigation Tool (partial mitigations CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)\nhttps://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021\n+ Security scripts:\nhttps://github.com/microsoft/CSS-Exchange/tree/main/Security", "creation_timestamp": "2026-09-02T01:04:49.104098Z"}, {"uuid": "d548108b-29c7-49b9-ba22-e329870fbca1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26858", "type": "seen", "source": "https://t.me/cissp/2450", "content": "Blue_Team_Techniques\n1. A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-26865:\nhttps://github.com/soteria-security/HAFNIUM-IOC\n\n2. The SI6 Networks\u2019 IPv6 toolkit is a set of IPv6 security assessment and trouble-shooting tools\nhttps://www.si6networks.com/research/tools/ipv6toolkit\n\nRed_Team_Tactics\n1. SharpSphere - Attacking vSphere/vCenter Infrastructure\nhttps://github.com/JamesCooteUK/SharpSphere\n\n2. Cloudflare XSS WAF Bypass\n\n\n3. SSRF to fetch AWS credentials with full access to multiple services\nhttps://zonduu.medium.com/ssrf-to-fetch-aws-credentials-with-full-access-to-various-services-18cd08194e91\n\nTrojans in Artificial Intelligence\nhttps://www.nist.gov/itl/ssd/trojai\n]-> Pruning-based Baseline Approach to Trojan Detection in AI Models\nhttps://github.com/usnistgov/trojai-baseline-pruning\n]-> The TrojAI Software Framework: An OpenSource tool for Embedding Trojans into Deep Learning Models\nhttps://arxiv.org/abs/2003.07233\n]-> threatspec - continuous threat modeling, through code\nhttps://github.com/threatspec/threatspec", "creation_timestamp": "2026-09-02T01:04:51.701762Z"}]}