{"vulnerability": "cve-2021-31207", "sightings": [{"uuid": "d64ecf1a-4e42-4119-975e-2fcaac8a38a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://www.thezdi.com/blog/2024/9/4/exploiting-exchange-powershell-after-proxynotshell-part-1-multivaluedproperty", "content": "", "creation_timestamp": "2024-09-05T15:39:37.000000Z"}, {"uuid": "251079db-faf4-4ad7-a854-9816041fb614", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "c406a79b-f05c-4017-9b3c-da3a443b1e79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "d03b05fe-71c9-403f-b10a-a26536417989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/35b42540-d55e-4aed-99e3-be21d39a5a88", "content": "", "creation_timestamp": "2022-07-11T09:22:39.000000Z"}, {"uuid": "00b3c115-3ce9-48fd-82fb-dd686fe8c671", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:30:42.000000Z"}, {"uuid": "688a9fcd-c1ec-4f7d-af7c-d2fc79e56614", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/5b421c0a-3bc4-4bce-a7cc-daa036ea090b", "content": "", "creation_timestamp": "2021-09-16T11:20:21.000000Z"}, {"uuid": "a0b65a84-5c87-43b3-94da-4f0fa6bcc98b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/90e532fb-4efa-4ff2-95ab-ddaf25454791", "content": "", "creation_timestamp": "2022-10-27T20:30:22.000000Z"}, {"uuid": "01fb2167-b23a-4057-a8a3-dc58b542aafe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/5fac61d7-a610-49f6-8b37-440a91c67978", "content": "", "creation_timestamp": "2024-07-17T07:25:22.000000Z"}, {"uuid": "5747ae05-4434-4c9c-bcc5-c44046c67988", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/cec219ff-8f6d-45c9-bdbb-b4fb8c9c0f2b", "content": "", "creation_timestamp": "2023-09-20T10:28:25.000000Z"}, {"uuid": "3294d1f8-3fe6-4013-82f8-e045630fe132", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/a9eb9e8e-d894-4f36-a6c2-ca8142f72d29", "content": "", "creation_timestamp": "2024-05-21T13:04:43.000000Z"}, {"uuid": "c1edb7e3-31c5-4c4a-afde-11a5b5b2d3d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/fb8794e7-3965-40fc-ac5a-80fd9be85476", "content": "", "creation_timestamp": "2024-07-30T09:15:03.000000Z"}, {"uuid": "5d24bcdf-8bdf-4e3c-98bc-f6fc21ce811c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971015", "content": "", "creation_timestamp": "2024-12-24T20:23:05.735934Z"}, {"uuid": "1235a450-b06b-4ffe-8a63-b99e939045ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "268a0cd9-eea4-4d6a-af50-999b647058a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:37.000000Z"}, {"uuid": "d665bac6-62f9-43ac-844b-02f331c24316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://bsky.app/profile/aakl.bsky.social/post/3likimyxics2p", "content": "", "creation_timestamp": "2025-02-19T19:20:21.699529Z"}, {"uuid": "11247987-6b7d-4712-b258-54a79c95fae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:55.000000Z"}, {"uuid": "24b12ad1-2519-45f6-96e2-6eb5c013ac10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://gist.github.com/AstaGITS/306c35e191920f6229e94fd4f1745e86", "content": "", "creation_timestamp": "2025-07-02T08:22:07.000000Z"}, {"uuid": "8b5db8a6-7d6f-483e-b7cd-1b21744183bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://gist.github.com/AstaGITS/a8e25e05f51e6430e80a30bb15e2d2d6", "content": "", "creation_timestamp": "2025-07-02T09:41:34.000000Z"}, {"uuid": "02006187-fb03-439b-acf7-049ec23bb1a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://gist.github.com/AstaGITS/abc86c56e2a9c8ed2f2a7b39ce70f4f4", "content": "", "creation_timestamp": "2025-07-02T09:53:41.000000Z"}, {"uuid": "461a3128-02ca-4ba7-9618-c7d9c631e965", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/35b42540-d55e-4aed-99e3-be21d39a5a88", "content": "", "creation_timestamp": "2025-06-04T13:18:47.000000Z"}, {"uuid": "da74445f-9013-43f5-ab11-aa2a977af91a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3lswu2mpe6k2p", "content": "", "creation_timestamp": "2025-07-01T23:28:45.414194Z"}, {"uuid": "6c6fe990-18fb-497e-b118-71f50c23d007", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/90e532fb-4efa-4ff2-95ab-ddaf25454791", "content": "", "creation_timestamp": "2025-07-01T21:18:45.000000Z"}, {"uuid": "33377b14-7864-4044-ba2d-1e5c75dcb10f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb", "content": "", "creation_timestamp": "2021-08-19T15:41:58.000000Z"}, {"uuid": "73f83a37-7de1-4567-a3b0-8e1cd51b2ddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://gist.github.com/Hamid-K/f4288dae3a1f2dea8905b1cf16d59c1b", "content": "", "creation_timestamp": "2025-10-03T16:37:38.000000Z"}, {"uuid": "b5647b96-51f8-4b13-967a-97b4ea5ac668", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/a9eb9e8e-d894-4f36-a6c2-ca8142f72d29", "content": "", "creation_timestamp": "2026-02-06T21:11:55.000000Z"}, {"uuid": "58a8c464-d97c-4a6d-ad8d-ab8038ebe6da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/d41ef7ed-39b6-4408-a718-2c3bce5fc99e", "content": "", "creation_timestamp": "2025-03-03T08:51:11.190614Z"}, {"uuid": "4ddd45ed-70a2-4b57-88ca-ead50145cf99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ddc64a36-fa4b-44b6-aeed-22cf0b07b28e", "content": "", "creation_timestamp": "2026-02-02T12:28:52.102799Z"}, {"uuid": "b6cc6d40-44a7-4fa1-8553-dfb9e4415b24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/Linux_Arabss/84", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2025-08-15T00:31:25.000000Z"}, {"uuid": "d968d9cf-25d6-49af-a988-54c0b90e4d51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/630", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPOC for scanning ProxyShell(CVE-2021-34423,CVE-2021-34473,CVE-2021-31207)\nURL\uff1ahttps://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2021-10-02T08:47:08.000000Z"}, {"uuid": "9c4eca8b-4295-45bd-a366-e94b3d0631c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/c2d3cd1d-c08d-4312-8a7f-882826e2d83b", "content": "", "creation_timestamp": "2026-04-19T02:35:52.000000Z"}, {"uuid": "c664a231-752d-4364-bc64-cf9e9e135c59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://t.me/codeby_sec/4863", "content": "\u200b\u200b\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell\n\n\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u043c\u0435\u043d\u0443\u0435\u043c\u0430\u044f \u043a\u0430\u043a LockFile, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell.\n\nProxyShell - \u044d\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0451\u0445 (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0451 \u0432 \u043c\u0430\u0435 2021 \u0433\u043e\u0434\u0430, \u043d\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u0432\u0442\u043e\u0440\u0443\u044e \u0436\u0438\u0437\u043d\u044c.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \u041f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exchange, \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u043d\u0430 \u043d\u0435\u0433\u043e, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u0430\u0432\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0431\u043e\u043b\u0435\u0435 \u043e\u0431\u0448\u0438\u0440\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439. \u041f\u0440\u0438 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0438 \u0432 \u0441\u0435\u0442\u044c, LockFile \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0430 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Exchange, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0430\u0442\u0430\u043a\u0443 ProxyShell, \u0430 \u043f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c PetitPotam \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\n\u0427\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ProxyShell, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f Microsoft Exchange. \u0410\u0442\u0430\u043a\u0443 PetitPotam \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c  \u043d\u0435 \u0442\u0430\u043a \u043f\u0440\u043e\u0441\u0442\u043e, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Microsoft \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442 \u0432\u0441\u0435 \u0432\u0435\u043a\u0442\u043e\u0440\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0427\u0442\u043e\u0431\u044b \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 NTLM, \u043c\u043e\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u0442\u0447 \u043e\u0442 0patch, \u043b\u0438\u0431\u043e \u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0444\u0438\u043b\u044c\u0442\u0440\u044b NETSH RPC,  \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c \u0432 MS-EFSRPC API.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\n\n#infosec #microsoft #exploit", "creation_timestamp": "2024-03-12T14:43:07.000000Z"}, {"uuid": "0d0551fb-657c-4e93-89db-9a37516023d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://t.me/BleepingComputer/11058", "content": "Microsoft Exchange servers hacked to deploy BlackByte ransomware\n\nBlackByte ransomware actors were observed exploiting the ProxyShell set of vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to compromise Microsoft Exchange servers. [...]\n\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware/", "creation_timestamp": "2021-12-03T16:36:50.000000Z"}, {"uuid": "fd0e03b3-82f0-4787-acb0-f002518e4995", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/avleonovrus/54", "content": "\u0412 \u0442\u043e\u043c \u0436\u0435 \u043e\u0442\u0447\u0435\u0442\u0435 Palo Alto 2022 Unit 42 Incident Response Report \u0435\u0441\u0442\u044c \u0435\u0449\u0451 \u043e\u0434\u0438\u043d \u043f\u0440\u0438\u043a\u043e\u043b\u044c\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442. \u0413\u0440\u0443\u043f\u043f\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u043b\u043e\u043c\u0430\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \"\u0412 \u0441\u043b\u0443\u0447\u0430\u044f\u0445, \u043a\u043e\u0433\u0434\u0430 \u0440\u0435\u0441\u043f\u043e\u043d\u0434\u0435\u043d\u0442\u044b \u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0431\u043e\u043b\u0435\u0435 87% \u0438\u0437 \u043d\u0438\u0445 \u043f\u043e\u043f\u0430\u043b\u0438 \u0432 \u043e\u0434\u043d\u0443 \u0438\u0437 \u0448\u0435\u0441\u0442\u0438 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0439 CVE\".\n\n\u041a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438: \n\n\u2022 55% Microsoft Exchange ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)\n\u2022 14% Log4j\n\u2022 7% SonicWall CVEs\n\u2022 5% Microsoft Exchange ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)\n\u2022 4% Zoho ManageEngine ADSelfService Plus (CVE-2021-40539)\n\u2022 3% Fortinet CVEs\n\n\u2022 13% Other\n\n\u0421 \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u044d\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0434\u043b\u044f \u043e\u0431\u0449\u0438\u0445 \u0440\u0430\u0437\u043c\u044b\u0448\u043b\u0435\u043d\u0438\u0439 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u0430\u043a\u043e\u043c \u0441\u043e\u0444\u0442\u0435 \u0441\u0442\u043e\u0438\u0442 \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0431\u0440\u0430\u0449\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435. \u041d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0437 Other \u044f \u0431\u044b \u0442\u043e\u0436\u0435 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u043b, \u043d\u043e \u0438\u0445 \u043a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u043d\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435. \n\n\u0421 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u044d\u0442\u043e \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043c\u0430 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0438\u043e\u043d\u0430. \u041d\u0443 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c Exchange \u0432\u0435\u0437\u0434\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442, \u044d\u0442\u043e \u0434\u0430. Log4j \u0442\u0430\u043a\u0436\u0435 \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435. \u041c\u043e\u0436\u043d\u043e \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c, \u0447\u0442\u043e \u0432 \u043d\u0430\u0448\u0438\u0445 \u0448\u0438\u0440\u043e\u0442\u0430\u0445 \u043a\u043e\u0435-\u043a\u0442\u043e \u043a\u0440\u0435\u043f\u043a\u043e \u0441\u0438\u0434\u0438\u0442 \u043d\u0430 Fortinet. \u041d\u043e \u0432\u043e\u0442 SonicWall \u0438 Zoho \u043a\u0430\u0436\u0443\u0442\u0441\u044f \u0447\u0435\u043c-\u0442\u043e \u0441\u043e\u0432\u0441\u0435\u043c \u044d\u043a\u0437\u043e\u0442\u0438\u0447\u043d\u044b\u043c. \u0410 \u0442\u0430\u043c, \u0433\u0434\u0435 Unit 42  incident response \u043a\u0435\u0439\u0441\u044b \u0440\u0435\u0448\u0430\u0435\u0442, \u044d\u0442\u043e \u043e\u0447\u0435\u043d\u044c \u0437\u043d\u0430\u0447\u0438\u043c\u044b\u0435 \u0448\u0442\u0443\u043a\u0438. \u0418\u043b\u0438 \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u044e\u044e \u044d\u043f\u043e\u043f\u0435\u044e, \u043a\u043e\u0433\u0434\u0430  \u043c\u0430\u0441\u0441\u043e\u0432\u043e \u043f\u043e\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Kaseya VSA. \u0411\u043e\u043b\u044c\u0448\u0435 \u0442\u044b\u0441\u044f\u0447\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u0438, \u043d\u043e \u043e\u043f\u044f\u0442\u044c \u0436\u0435 \u044d\u0442\u043e \u043d\u0435 \u0432 \u043d\u0430\u0448\u0435\u043c \u0440\u0435\u0433\u0438\u043e\u043d\u0435, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u043c \u043d\u0435 \u043e\u0441\u043e\u0431\u043e \u044d\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0431\u044b\u043b\u043e. \n\n\u0421 \u0443\u0447\u0435\u0442\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u0430 \u0437\u0430\u043f\u0430\u0434\u043d\u044b\u0445 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432 \u0441 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0440\u044b\u043d\u043a\u0430 IT \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u044b \"\u0437\u0434\u0435\u0441\u044c\" \u0438 \"\u0442\u0430\u043c\" \u0431\u0443\u0434\u0443\u0442 \u0432\u0441\u0435 \u0431\u043e\u043b\u044c\u0448\u0435 \u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u0442\u044c\u0441\u044f. \u0418 \u0432\u0441\u0435 \u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0440\u043e\u043b\u044c \u0432 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0431\u0443\u0434\u0443\u0442 \u0438\u0433\u0440\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u043e\u0444\u0442\u0435, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0437\u0430\u043f\u0430\u0434\u043d\u044b\u0435 \u0418\u0411 \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0438 \u043d\u0435 \u0441\u043b\u044b\u0448\u0430\u043b\u0438 \u043d\u0438\u043a\u043e\u0433\u0434\u0430. \u0418 \u044d\u0442\u043e \u0432 \u043e\u0431\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442. \u0417\u043d\u0430\u0447\u0438\u0442 \u043b\u0438 \u044d\u0442\u043e, \u0447\u0442\u043e \u0438 Vulnerability Management \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u044f\u0442\u0441\u044f \u0432\u0441\u0435 \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0437\u0430\u0442\u043e\u0447\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0448\u0438 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0440\u0435\u0430\u043b\u0438\u0438? \u041d\u0443 \u0432\u0438\u0434\u0438\u043c\u043e \u0434\u0430. \n\n\u041f\u043e\u0445\u043e\u0436\u0435, \u0447\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0431\u0435\u0437\u0443\u0441\u043b\u043e\u0432\u043d\u043e\u0439 \u0433\u043b\u043e\u0431\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 IT \u0443\u0445\u043e\u0434\u0438\u0442, \u0430 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u0442\u0435\u043c \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 VM-\u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 \u043d\u043e\u0432\u044b\u0445 \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u0445. \u0427\u0442\u043e \u043f\u043e\u0434\u0435\u043b\u0430\u0442\u044c.\n\n@avleonovrus #VMnews #PaloAlto", "creation_timestamp": "2023-09-21T09:23:10.000000Z"}, {"uuid": "ac1cd169-b03e-426a-99ad-9766e191b889", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/justsecurity/116", "content": "\u041f\u043e\u0437\u043d\u0430\u0439 \u0441\u0432\u043e\u0439 Exchange \u0441\u0435\u0440\u0432\u0435\u0440 \u0438 OWA\n\n\u041c\u043d\u043e\u0433\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e\u0442 Microsoft \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0438\u0441\u0435\u043c, \u043d\u043e \u043c\u0430\u043b\u043e \u043a\u0442\u043e \u0437\u043d\u0430\u0435\u0442, \u043a\u0430\u043a\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0432 Exchange \u0438 OWA.\n\n\u041e\u0431\u0449\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043d\u0438\u0445:\n\n\u25ab\ufe0f ProxyLogon: \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u25ab\ufe0f ProxyShell: \u043d\u0430\u0431\u043e\u0440 \u0438\u0437 \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u25ab\ufe0f ProxyToken: \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u041c\u043d\u043e\u0433\u0438\u0435 \u0438\u0445 \u043d\u0438\u0445 \u2014 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, ProxyShell \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u0435\u0442 \u0432 \u0441\u0435\u0431\u044f CVE-2021-34473, CVE-2021-34523, CVE-2021-31207.\n\n\u0427\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c \u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043a \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c \u0431\u0430\u0433\u0430\u043c, \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441\u043a\u0430\u043d\u0435\u0440\u0430\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Nuclei \u0438\u043b\u0438 \u0433\u043e\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u043e\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430.\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0438\u043c\u0435\u044e\u0442 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043c\u043e\u0447\u044c \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0443\u0448\u0443\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a.\n\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438:\n\n\u25ab\ufe0f\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 (Timing-Based Username Enumeration): \u0430\u0442\u0430\u043a\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e OWA \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0441 \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u043e\u0439, \u0435\u0441\u043b\u0438 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u0430\u0440\u043e\u043b\u044c \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u0439. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c email-\u0430\u0434\u0440\u0435\u0441\u0430 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a.\n\n\u25ab\ufe0fPassword Spraying: \u0430\u0442\u0430\u043a\u0430, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0430\u0440\u043e\u043b\u044c, \u0430 \u043b\u043e\u0433\u0438\u043d \u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f. \u041f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u0440\u0438 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u0435 \u0431\u043e\u043b\u0435\u0435 N-\u0440\u0430\u0437 \u0437\u0430 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u043a \u0432\u0440\u0435\u043c\u0435\u043d\u0438. \n\n\u041a\u0430\u043a \u0431\u044b\u0442\u044c?\n\n\u2192 \u0414\u0435\u0440\u0436\u0438\u043c \u0441\u0432\u043e\u0435 \u041f\u041e \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0438 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\u2192 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0441\u0442\u0440\u043e\u0433\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0438 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.\n\u2192 \u0415\u0441\u043b\u0438 \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u043c \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u043e \u0413\u0435\u043e-\u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u043c.\n\u2192 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 CAPTCHA (\u0441\u043b\u043e\u0436\u043d\u043e \u0434\u043b\u044f OWA, \u043d\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e).\n\n\u041a\u0441\u0442\u0430\u0442\u0438, \u0443 \u043a\u043e\u0433\u043e-\u0442\u043e \u0431\u044b\u043b \u043e\u043f\u044b\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f https://www.messageware.com/epg/? \u041f\u043e\u0434\u0435\u043b\u0438\u0442\u0435\u0441\u044c \u0441\u0432\u043e\u0438\u043c \u043c\u043d\u0435\u043d\u0438\u0435\u043c)", "creation_timestamp": "2022-10-22T09:21:32.000000Z"}, {"uuid": "99df36b7-f378-4399-8fc6-e018546a7f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/SpadSec/25", "content": "\u203c\ufe0f \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0633\u06cc\u06a9\u06cc\u0645 \u062e\u06cc\u0627\u0631\u06cc \u067e\u0648\u0631\u062a 443 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc Exchange \u0632\u06cc\u0631 \u062d\u0645\u0644\u0627\u062a ProxyShell  !!!\n\n\u25aa\ufe0f  \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0647\u0627\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 \u062f\u0631 Exchange \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u0627\u0645\u0644 ProxyShell Attack \u0645\u06cc\u200c\u0627\u0646\u062c\u0627\u0645\u062f \u0648 \u0647\u06a9\u0631 \u0644\u0627\u0634\u06cc \u062a\u06a9 \u062e\u0648\u0631 \u0645\u06cc\u062a\u0648\u0627\u0646\u062f \u06a9\u062f \u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u0638\u0631 \u062e\u0648\u062f \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u067e\u0648\u0631\u062a 443 \u0628\u0627 \u0628\u0627\u0644\u0627\u062a\u0631\u06cc\u0646 \u0633\u0637\u062d \u062f\u0631 \u0633\u0631\u0648\u0631 \u0627\u062c\u0631\u0627 \u0646\u0645\u0627\u06cc\u062f.\n\n\u203c\ufe0f \u0627\u06af\u0631 \u0639\u0628\u0627\u0631\u0627\u062a \" /mapi/nspi/ \" \u0648 \" /autodiscover/autodiscover.json \" \u062f\u0631 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Log \u0633\u0631\u0648\u06cc\u0633 \u062f\u0647\u0646\u062f\u0647 IIS \u0633\u0631\u0648\u0631\u0634\u0645\u0627 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f \u06cc\u0639\u0646\u06cc \u0647\u06a9\u0631\u0647\u0627 \u0628\u0647 \u0633\u0648\u0644\u0627\u062e\u06cc \u0633\u0631\u0648\u0631 \u0634\u0645\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc\u0647\u0627 \u0645\u0648\u0631\u062f \u0627\u0633\u06a9\u0646 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0628\u0627\u06cc\u062f \u0633\u0631\u0648\u0631 \u0628\u0631\u0631\u0633\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0627\u0645\u0644 \u0634\u0648\u062f.\n\n\u203c\ufe0f \u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627\u06cc \u0645\u062a\u0639\u062f\u062f \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0631\u0648\u06cc \u067e\u0648\u0631\u062a 443 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc Exchange \u062f\u0631 \u0633\u0627\u0644 2021 \u0627\u06a9\u06cc\u062f\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u06af\u0631\u062f\u062f \u0627\u06cc\u0646 \u067e\u0648\u0631\u062a \u062a\u0648\u0633\u0637 \u0645\u062d\u062f\u0648\u062f \u06af\u0631\u062f\u062f.\n\n#\u0628\u06af\u0627\u06cc\u06cc\n#\u0627\u06cc\u06a9\u0633_\u0686\u0646\u062c\n\n\ud83c\uddee\ud83c\uddf7 @SpadSec", "creation_timestamp": "2021-08-23T12:25:04.000000Z"}, {"uuid": "32b9e69f-d355-43c7-8924-c2c841e4c92d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/ggfcvj/2954", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2021-12-03T14:02:51.000000Z"}, {"uuid": "177c7514-ec2e-44d0-81a2-2a39b78ac823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/anwar1213xx/1411", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2021-12-03T15:03:05.000000Z"}, {"uuid": "c355a860-bc0a-4b16-a942-c2f5aed0dced", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/arpsyndicate/1241", "content": "#ExploitObserverAlert\n\nCVE-2021-31207\n\nDESCRIPTION: Exploit Observer has 36 entries related to CVE-2021-31207. Microsoft Exchange Server Security Feature Bypass Vulnerability\n\nFIRST-EPSS: 0.952100000\nNVD-IS: 5.9\nNVD-ES: 0.7", "creation_timestamp": "2023-12-04T15:41:59.000000Z"}, {"uuid": "f8e37940-72a5-449f-b70d-fe2b6f1cf71e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/Termux_AND_Security7667/408", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2021-12-03T15:02:36.000000Z"}, {"uuid": "06a1dc25-1377-49f5-8f1f-643955ff763a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/228", "content": "#poc for scanning ProxyShell (CVE-2021-34423,CVE-2021-34473,CVE-2021-31207)\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nthe metasploit script(POC/EXP) about CVE-2021-22005 VMware vCenter Server contains an arbitrary file upload vulnerability\nhttps://github.com/TaroballzChen/CVE-2021-22005-metasploit", "creation_timestamp": "2021-10-03T08:55:43.000000Z"}, {"uuid": "a72781fa-34dd-4086-a0bc-5a9d335ffb48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/hack77z99/9372", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2021-12-03T15:02:58.000000Z"}, {"uuid": "ee7bfce1-221e-4297-898f-154ce736eccf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/6178", "content": "\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0431\u043e\u043c\u0431\u0438\u0442\u044c \u043d\u043e\u0432\u044b\u043c\u0438 \u043e\u0442\u0447\u0435\u0442\u0430\u043c\u0438.\n\n\u0412 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0442 \u0446\u0435\u043b\u0435\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 APT-\u0433\u0440\u0443\u043f\u043f\u044b Tropic Trooper, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0440\u0430\u0432 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0430 \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435.\n\n\u0414\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u0441 2011, Tropic Trooper, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a APT23, Earth Centaur, KeyBoy \u0438 Pirate Panda, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u043d\u0430 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435, \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u0438\u0435, \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043d\u044b\u0435 \u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u0422\u0430\u0439\u0432\u0430\u043d\u0435, \u0413\u043e\u043d\u043a\u043e\u043d\u0433\u0435 \u0438 \u043d\u0430 \u0424\u0438\u043b\u0438\u043f\u043f\u0438\u043d\u0430\u0445. \n\n\u0418\u043c\u0435\u0435\u0442 \u0442\u0435\u0441\u043d\u044b\u0435 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043a\u0430\u043a FamousSparrow.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430, Tropic Trooper \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430, \u043e\u0431\u044a\u0435\u043a\u0442\u0430\u043c\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043d\u0435\u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0435 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435 \u0438 \u0432 \u041c\u0430\u043b\u0430\u0439\u0437\u0438\u0438.\n\n\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0438\u044e\u043d\u0435 2024 \u0433\u043e\u0434\u0430, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 China Chopper - \u0438\u0437\u043b\u044e\u0431\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u044f\u0437\u044b\u0447\u043d\u044b\u043c\u0438 APT \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c, - \u043d\u0430 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u043c \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u043e\u0439 Umbraco CMS.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Crowdoor, \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u0430\u00a0SparrowDoor, \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e ESET \u0435\u0449\u0435 \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430.\n\n\u041f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0442\u0438, \u0431\u043e\u043a\u043e\u0432\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0431\u043e\u043a\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 DLL (Fscan, Swor, Neo-reGeorg, ByPassGodzilla).\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Adobe ColdFusion (CVE-2023-26360) \u0438 Microsoft Exchange Server (CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31207).\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, Crowdoor, \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 \u0438\u044e\u043d\u0435 2023 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Cobalt Strike \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u044f \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0441\u0442\u0438 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u0430\u0445.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438, \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u044b.\n\n\u041a\u0430\u0441\u0430\u0435\u043c\u043e \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u041a \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0437\u043d\u0430\u043b\u0438 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438\u043c\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u044b, \u043f\u0440\u0438\u043b\u0430\u0433\u0430\u044f \u0432\u0441\u0435 \u0443\u0441\u0438\u043b\u0438\u044f \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n\u041f\u043e\u043c\u0438\u043c\u043e \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u044f \u0432 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u044a\u0435\u043a\u0442 \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0432\u0438\u0434\u0435\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0434\u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u044a\u0435\u043a\u0442 \u0432 \u041c\u0430\u043b\u0430\u0439\u0437\u0438\u0438.\n\n\u0410\u043d\u0430\u043b\u0438\u0437 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u044f \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0441 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f\u043c\u0438 \u043f\u043e \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0435 \u043f\u0440\u0430\u0432 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0430 \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435 \u0431\u044b\u043b\u0430 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e, \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u044f \u043e\u0431 \u043e\u0441\u043e\u0431\u043e\u0439 \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u043e\u0441\u0442\u0438 \u0430\u043a\u0442\u043e\u0440\u0430 \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u043a\u043e\u043d\u0444\u043b\u0438\u043a\u0442\u0430 \u043c\u0435\u0436\u0434\u0443 \u0418\u0437\u0440\u0430\u0438\u043b\u0435\u043c \u0438 \u0425\u0410\u041c\u0410\u0421.\n\n\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2024-09-06T18:10:05.000000Z"}, {"uuid": "425018ba-4d3f-45e0-865f-bdc156ef144e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://t.me/true_secator/3223", "content": "\u0423 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0435\u0449\u0435 \u043c\u0435\u043d\u044c\u0448\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0447\u0435\u043c \u0441\u0447\u0438\u0442\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u043d\u0435\u0435.\n\n\u041d\u043e\u0432\u044b\u0439\u00a0\u043e\u0442\u0447\u0435\u0442 \u0437\u0430 2022 \u0433\u043e\u0434 Palo Alto Unit 42 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0445\u043e\u0441\u0442\u044b \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 15 \u043c\u0438\u043d\u0443\u0442 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043d\u043e\u0432\u044b\u0439 CVE \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c.\n\nPalo Alto Unit 42 \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u041f\u041e \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u0434\u043b\u044f RCE. \n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u043f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0440\u043e\u0441\u043b\u0430.\n\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043e\u0441\u043e\u0431\u044b\u0445 \u0443\u0441\u0438\u043b\u0438\u0439 \u043d\u0438\u0437\u043a\u043e\u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u0435\u0434\u0443\u0442 \u043c\u043e\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0434\u0430\u044e\u0442 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0441\u0432\u043e\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0434\u0430\u0440\u043a\u043d\u0435\u0442\u0435 \u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u044b\u0442\u043d\u044b\u043c \u0445\u0430\u043a\u0435\u0440\u0430\u043c, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u043c \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0422\u0430\u043a, \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-1388 \u0432 F5 BIG-IP \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 4 \u043c\u0430\u044f 2022 \u0433\u043e\u0434\u0430, \u0438, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Unit 42, \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u0441\u044f\u0442\u044c \u0447\u0430\u0441\u043e\u0432 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0431\u044b\u043b\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e 2552 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0435 Palo Alto, \u0441\u0440\u0435\u0434\u0438 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0438 \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043f\u043e\u043b\u0443\u0433\u043e\u0434\u0438\u0438 2022\u00a0\u0433\u043e\u0434\u0430 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 ProxyShell (CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31207), \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0434\u043e 55% \u043e\u0442 \u043e\u0431\u0449\u0435\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432.\u00a0\n\n\u041d\u0430 \u0432\u0442\u043e\u0440\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u043b\u0441\u044f Log4Shell \u0441 14%, \u0434\u0430\u043b\u0435\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 CVE SonicWall \u2014 7%, ProxyLogon \u2014 5%, \u0430 RCE \u0432\u00a0Zoho ManageEngine ADSelfService Plus \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0432 3% \u0441\u043b\u0443\u0447\u0430\u0435\u0432.\n\n\u041a\u0430\u043a \u0432\u0438\u0434\u043d\u043e \u0438\u0437 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438, \u043b\u044c\u0432\u0438\u043d\u0430\u044f \u0434\u043e\u043b\u044f \u0432 \u043e\u0431\u044a\u0435\u043c\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043d\u0435 \u0441\u0430\u043c\u044b\u0435 \u0441\u0432\u0435\u0436\u0438\u0435, \u0430 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 CVE, \u0447\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0438 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0430\u0442\u0430\u043a\u0443\u044e\u0442\u0441\u044f \u0447\u0430\u0449\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c 0-day \u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0435\u043e\u0431\u044a\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Unit 42, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u041f\u041e \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043e\u0434\u043d\u0443 \u0442\u0440\u0435\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u0432\u0441\u0435\u0445 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0439.\n\n\u0412 37% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0444\u0438\u0448\u0438\u043d\u0433 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u043f\u043e\u0447\u0442\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\u00a0\u0412 15% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u043e\u043d\u0438\u043a\u0430\u043b\u0438 \u0432 \u0441\u0435\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0421\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0434\u043a\u0443\u043f \u0438\u043d\u0441\u0430\u0439\u0434\u0435\u0440\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 10% \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432.\n\n\u0412\u044b\u0432\u043e\u0434\u044b \u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u0441\u0430\u043c\u0438: \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430.", "creation_timestamp": "2022-07-27T13:35:05.000000Z"}, {"uuid": "7080d904-4df2-44f7-946f-79a2f1d30d8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://t.me/NeKaspersky/1158", "content": "\u041d\u043e\u0432\u044b\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Microsoft Exchange\n\nLockFile - \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440 \u043e\u0434\u043d\u043e\u0438\u043c\u0451\u043d\u043d\u043e\u0433\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0448\u0438\u0444\u0440\u0443\u0435\u0442 \u0434\u043e\u043c\u0435\u043d\u044b Windows \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange. \u0412\u0441\u0435\u0433\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f ProxyShell \u0431\u044b\u043b\u043e \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043e \u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430\u043c\u0438 \u0431\u043e\u043b\u0435\u0435 2000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432. \n\n\u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Microsoft, \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u0435\u0449\u0451 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0430\u0432\u0433\u0443\u0441\u0442\u0430. \u041e\u0431\u0449\u0435\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u0434\u043b\u044f \u043d\u0438\u0445 ProxyShell: \n\nCVE-2021-34473: Path Confusion \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0432\u0435\u0434\u0443\u0449\u0438\u0439 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 ACL (\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 \u0432\u00a0KB5001779);\n\nCVE-2021-34523: \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0431\u044d\u043a\u044d\u043d\u0434\u0435 Exchange PowerShell (\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 \u0432\u00a0KB5001779);\n\nCVE-2021-31207: \u0437\u0430\u043f\u0438\u0441\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0447\u0442\u043e \u0432\u0435\u0434\u0435\u0442 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 (\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 \u043c\u0430\u0435 \u0432\u00a0KB5003435).\n\nPoC \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 6 \u0430\u0432\u0433\u0443\u0441\u0442\u0430, \u043d\u043e 8 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u0431\u043e\u043b\u0435\u0435 30 000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u0434\u043b\u044f \u0430\u0442\u0430\u043a. \u0423\u043f\u0440\u043e\u0441\u0442\u0438\u043b\u043e \u0437\u0430\u0434\u0430\u0447\u0443 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0444\u043e\u0440\u0443\u043c\u043e\u0432 \u0441\u043f\u0438\u0441\u043a\u0430 100 000 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Exchange. \n\nMicrosoft \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u043f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e \u043d\u0435 \u0432\u0441\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0442\u043e\u0440\u043e\u043f\u044f\u0442\u0441\u044f \u0441 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u043f\u0430\u0442\u0447\u0435\u0439.", "creation_timestamp": "2021-08-23T23:01:21.000000Z"}, {"uuid": "39c837c5-8be1-4e67-8b93-b462ba72779a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://t.me/true_secator/2402", "content": "\u0421\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange \u0432\u043d\u043e\u0432\u044c \u043f\u043e\u0434 \u0443\u0434\u0430\u0440\u043e\u043c.\n \nRed Canary \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 BlackByte, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u044e\u0442 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0435\u0442\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u044b Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell. \n \n\u0412\u0441\u0435 \u043c\u044b \u043f\u043e\u043c\u043d\u0438\u043c \u043e \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Microsoft Exchange, \u0432\u043a\u043b\u044e\u0447\u0430\u044f CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31207, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u043e\u0442\u044c \u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u0430\u043f\u0440\u0435\u043b\u0435-\u043c\u0430\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430, \u043d\u043e \u043d\u0430 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n \n\u0414\u0435\u0439\u0441\u0442\u0432\u0443\u044f \u043f\u043e \u043d\u0430\u043a\u0430\u0442\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438, BlackByte \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u044b \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange, \u0437\u0430\u0442\u0435\u043c \u0446\u0435\u043f\u043b\u044f\u044e\u0442 Cobalt Strike, \u0430 \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0430\u044e\u0442 \u043a \u0440\u0430\u0431\u043e\u0442\u0435 \u0441\u043e \u0441\u0432\u043e\u0438\u043c \u0441\u043e\u0444\u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442 BlackByte \u043e\u0442 \u043a\u043e\u043b\u043b\u0435\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438\u043b\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f ransomware.\n \n\u0418\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b BlackByte \u0438\u0433\u0440\u0430\u0435\u0442 \u043a\u043b\u044e\u0447\u0435\u0432\u0443\u044e \u0440\u043e\u043b\u044c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u043a\u0430\u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u0442\u0430\u043a \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0431\u043e\u043a\u043e\u0432\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435. \u041f\u041e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0442\u0440\u0438 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0435\u0441\u0442\u0440\u0430: \u043e\u0434\u043d\u043e \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043e\u0434\u043d\u043e \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043c\u0435\u0436\u0434\u0443 \u0432\u0441\u0435\u043c\u0438 \u0443\u0440\u043e\u0432\u043d\u044f\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u043e\u0434\u043d\u043e \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u0438\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u043f\u0443\u0442\u0438 \u0434\u043b\u044f \u043f\u0443\u0442\u0435\u0439 \u043a \u0444\u0430\u0439\u043b\u0430\u043c.\n \n\u041f\u0435\u0440\u0435\u0434 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c malware \u0443\u0434\u0430\u043b\u044f\u0435\u0442 \u0437\u0430\u0434\u0430\u0447\u0443 Raccine Rules Updater \u0438 \u0441\u0442\u0438\u0440\u0430\u0435\u0442 \u0442\u0435\u043d\u0435\u0432\u044b\u0435 \u043a\u043e\u043f\u0438\u0438 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0447\u0435\u0440\u0435\u0437 WMI \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b PowerShell. \u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a, \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WinRAR \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u043e\u0431\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a file.io \u0438\u043b\u0438 anonymfiles.com.\n \n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439 Red Canary \u0432\u0440\u044f\u0434 \u043b\u0438 \u043f\u043e\u0440\u0430\u0434\u0443\u044e\u0442, \u0432\u0435\u0434\u044c \u0441\u0442\u0430\u043b\u043e \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0439 Trustwave \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 \u0434\u0435\u043a\u0440\u0438\u043f\u0442\u043e\u0440 \u0443\u0436\u0435 \u0431\u0435\u0441\u043f\u043e\u043b\u0435\u0437\u0435\u043d \u043f\u0435\u0440\u0435\u0434  \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u0431\u043e\u043b\u0435\u0435 \u0441\u0432\u0435\u0436\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 BlackByte.\n\n\u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f\u043c ProxyShell \u043a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, \u0443\u0436\u0435 \u043d\u0438\u043a\u043e\u0433\u043e \u043d\u0435 \u0443\u0434\u0438\u0432\u0438\u0448\u044c, \u043d\u043e \u0432\u0441\u0435 \u0436\u0435 \u0441\u0445\u0435\u043c\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u0432\u0440\u0435\u043c\u044f \u0434\u043b\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u0435\u0449\u0435 \u043f\u043e\u0437\u0430\u0432\u0447\u0435\u0440\u0430, \u043f\u0440\u0435\u0436\u0434\u0435 \u0432\u0441\u0435\u0433\u043e, \u0434\u043b\u044f \u0442\u0435\u0445, \u043a\u0442\u043e \u0435\u0449\u0435 \u043d\u0435 \u0437\u043d\u0430\u043a\u043e\u043c \u0441 ransomware.", "creation_timestamp": "2021-12-02T18:01:00.000000Z"}, {"uuid": "591318bf-1cb7-4daf-b789-16db3562b155", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/true_secator/1705", "content": "Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u043c\u0435\u0441\u044f\u0447\u043d\u044b\u0439 \u0430\u043f\u0434\u0435\u0439\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0423\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 55 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, 4 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435. \u0422\u0440\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 - 0-day.\n\n\u0421\u0440\u0435\u0434\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 - CVE-2021-31207 \u0432 Exchange, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u044f Pwn2Own. \u0418 \u0445\u043e\u0442\u044f \u043e\u0446\u0435\u043d\u043a\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435\u0432\u044b\u0441\u043e\u043a\u0430 (6,6 \u043f\u043e CVSS), \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438. \u0415\u0449\u0435 \u0434\u0432\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f - RCE-\u0434\u044b\u0440\u043a\u0430 CVE-2021-31200, \u0430 \u0442\u0430\u043a\u0436\u0435 CVE-2021-31204, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 .NET \u0438 Visual Studio.\n\n\u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u044b \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430.\n\n\u041a\u043e\u0440\u043e\u0447\u0435, \u043a\u0430\u043a \u0432\u0441\u0435\u0433\u0434\u0430, \u0441\u0442\u043e\u0438\u0442 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f.", "creation_timestamp": "2021-05-12T14:21:07.000000Z"}, {"uuid": "95bf201a-9011-40b6-8a3f-51b9beecf89d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://t.me/SecLabNews/12481", "content": "\u0423 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0435\u0449\u0435 \u043c\u0435\u043d\u044c\u0448\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0447\u0435\u043c \u0441\u0447\u0438\u0442\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u043d\u0435\u0435.\n\n\u041d\u043e\u0432\u044b\u0439\u00a0\u043e\u0442\u0447\u0435\u0442 \u0437\u0430 2022 \u0433\u043e\u0434 Palo Alto Unit 42 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0445\u043e\u0441\u0442\u044b \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 15 \u043c\u0438\u043d\u0443\u0442 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043d\u043e\u0432\u044b\u0439 CVE \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c.\n\nPalo Alto Unit 42 \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u041f\u041e \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u0434\u043b\u044f RCE. \n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u043f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0440\u043e\u0441\u043b\u0430.\n\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043e\u0441\u043e\u0431\u044b\u0445 \u0443\u0441\u0438\u043b\u0438\u0439 \u043d\u0438\u0437\u043a\u043e\u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u0435\u0434\u0443\u0442 \u043c\u043e\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0434\u0430\u044e\u0442 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0441\u0432\u043e\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0434\u0430\u0440\u043a\u043d\u0435\u0442\u0435 \u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u044b\u0442\u043d\u044b\u043c \u0445\u0430\u043a\u0435\u0440\u0430\u043c, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u043c \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0422\u0430\u043a, \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-1388 \u0432 F5 BIG-IP \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 4 \u043c\u0430\u044f 2022 \u0433\u043e\u0434\u0430, \u0438, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Unit 42, \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u0441\u044f\u0442\u044c \u0447\u0430\u0441\u043e\u0432 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0431\u044b\u043b\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e 2552 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0435 Palo Alto, \u0441\u0440\u0435\u0434\u0438 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0438 \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043f\u043e\u043b\u0443\u0433\u043e\u0434\u0438\u0438 2022\u00a0\u0433\u043e\u0434\u0430 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 ProxyShell (CVE-2021-34473, CVE-2021-34523 \u0438 CVE-2021-31207), \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0434\u043e 55% \u043e\u0442 \u043e\u0431\u0449\u0435\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432.\u00a0\n\n\u041d\u0430 \u0432\u0442\u043e\u0440\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u043b\u0441\u044f Log4Shell \u0441 14%, \u0434\u0430\u043b\u0435\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 CVE SonicWall \u2014 7%, ProxyLogon \u2014 5%, \u0430 RCE \u0432\u00a0Zoho ManageEngine ADSelfService Plus \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0432 3% \u0441\u043b\u0443\u0447\u0430\u0435\u0432.\n\n\u041a\u0430\u043a \u0432\u0438\u0434\u043d\u043e \u0438\u0437 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438, \u043b\u044c\u0432\u0438\u043d\u0430\u044f \u0434\u043e\u043b\u044f \u0432 \u043e\u0431\u044a\u0435\u043c\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043d\u0435 \u0441\u0430\u043c\u044b\u0435 \u0441\u0432\u0435\u0436\u0438\u0435, \u0430 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 CVE, \u0447\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0438 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0430\u0442\u0430\u043a\u0443\u044e\u0442\u0441\u044f \u0447\u0430\u0449\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c 0-day \u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0435\u043e\u0431\u044a\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Unit 42, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u041f\u041e \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043e\u0434\u043d\u0443 \u0442\u0440\u0435\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u0432\u0441\u0435\u0445 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0439.\n\n\u0412 37% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0444\u0438\u0448\u0438\u043d\u0433 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u043f\u043e\u0447\u0442\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\u00a0\u0412 15% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u043e\u043d\u0438\u043a\u0430\u043b\u0438 \u0432 \u0441\u0435\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0421\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0434\u043a\u0443\u043f \u0438\u043d\u0441\u0430\u0439\u0434\u0435\u0440\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 10% \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432.\n\n\u0412\u044b\u0432\u043e\u0434\u044b \u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u0441\u0430\u043c\u0438: \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430.", "creation_timestamp": "2022-07-28T07:20:54.000000Z"}, {"uuid": "7a729db8-6fbd-437d-be0d-c86bf8470bb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://t.me/forensictools/469", "content": "RedTeam Toolkit\n[https://github.com/signorrayan/RedTeam_toolkit]\n\nweb-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Python (Django), \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0435 \u043d\u0430\u0431\u043e\u0440 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 red-team \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u043b\u0435\u0436\u0430\u0442 \u0442\u0430\u043a\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u043a\u0430\u043a nmap, rustscan, dirsearch, shreder, circl, crowbar \u0438 \u0442.\u0434.\n\n\u2022 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0446\u0435\u043b\u0438\n\u2022 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0436\u0438\u0432\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0432 \u043f\u043e\u0434\u0441\u0435\u0442\u0438\n\u2022 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 \u0446\u0435\u043b\u0438\n\u2022 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 CVE \u043f\u043e CveID\n\u2022 \u0430\u0442\u0430\u043a\u0430 \u043f\u043e \u0441\u043b\u043e\u0432\u0430\u0440\u044e SSH\n\u2022 RDP BruteForce\n\u2022 \u0440\u0430\u0437\u0434\u0435\u043b WebApps: Apache Path Traversal PoC (CVE-2021-41773), \u0412\u0435\u0431-\u043a\u0440\u0430\u0443\u043b\u0435\u0440 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 URL-\u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435 \u0441\u0443\u0431\u0434\u043e\u043c\u0435\u043d\u043e\u0432\n\u2022 \u0440\u0430\u0437\u0434\u0435\u043b Windows (\u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u0442\u0441\u044f, \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 CVE \u0431\u0443\u0434\u0443\u0442 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u044b): Microsoft Exchange ProxyShell PoC (CVE-2021-34523, CVE-2021-34473, CVE-2021-31207)\n\u2022 \u0440\u0430\u0437\u0434\u0435\u043b Linux \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 CVE \u0432 Linux \u0442\u0430\u043a\u0436\u0435 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\n\n#pentest #python #redteam #vulns", "creation_timestamp": "2021-11-29T11:51:06.000000Z"}, {"uuid": "174f668f-4650-4ca0-ba80-5ae526674387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/4055", "content": "#Offensive_security\nNuclei Scanner for Proxyshell RCE\n(CVE-2021-34423, CVE-2021-34473, CVE-2021-31207)\nhttps://github.com/cyberheartmi9/Proxyshell-Scanner\n]-> PoC for scanning ProxyShell:\nhttps://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2021-10-02T16:54:19.000000Z"}, {"uuid": "3af81c59-7222-41f0-8acc-a643f4965d33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "Telegram/lcB6UyrYi7Q6Iq6pQnUnsOCdBwhQsi0UBGl892XlL0BP4uA", "content": "", "creation_timestamp": "2022-11-02T04:40:46.000000Z"}, {"uuid": "5feed17a-0a73-4faa-a2b7-3e3474a6b93e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1683", "content": "POC for scanning ProxyShell (CVE-2021-34523,CVE-2021-34473,CVE-2021-31207) https://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2026-08-03T05:00:03.903022Z"}, {"uuid": "fcb51c3a-850e-4d4f-8122-4579d75cd8b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://t.me/Linux_Arabs/60", "content": "\u0645\u062c\u0645\u0648\u0639\u0629 \u0628\u0631\u0627\u0645\u062c \u0627\u0644\u0641\u062f\u064a\u0629 BlackByte \u062a\u0642\u0648\u0645 \u0628\u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0627\u062a ProxyShell \u0641\u064a \u062e\u0627\u062f\u0645 Microsoft Exchange \u0644\u0644\u0648\u0635\u0648\u0644 \u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0634\u0631\u0643\u0627\u062a\n_ \u0641\u064a \u062a\u0642\u0631\u064a\u0631 \u0645\u0641\u0635\u0644 \u0639\u0646 Red Canary \u062d\u0644\u0644 \u0627\u0644\u0628\u0627\u062d\u062b\u0648\u0646 \u0647\u062c\u0648\u0645 BlackByte Ransomware \u0648\u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0644\u062b\u063a\u0631\u0629 ProxyShell \u0644\u062a\u062b\u0628\u064a\u062a web shells \u0639\u0644\u0649 \u062e\u0627\u062f\u0645 Exchange \u0645\u064f\u062e\u062a\u0631\u0642\n\nRed Canary\nhttps://redcanary.com/blog/blackbyte-ransomware\n\nBleeping Computer\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware\n\n#ProxyShell #exploit #CVE-2021-31207 dCVE-2021-34523 #CVE-2021-34473\nProxyShell #poc\nhttps://github.com/dmaasland/proxyshell-poc\n\nProxyShell poc Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)\nhttps://github.com/ktecv2000/ProxyShell\n\n#poc for scanning ProxyShell\nhttps://github.com/mithridates1313/ProxyShell_POC\n\nAutomatic ProxyShell #Exploit\nhttps://github.com/Udyz/proxyshell-auto", "creation_timestamp": "2024-11-02T22:56:11.000000Z"}, {"uuid": "91ed9b9b-5290-422a-a251-74025998d049", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1683", "content": "POC for scanning ProxyShell (CVE-2021-34523,CVE-2021-34473,CVE-2021-31207) https://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2026-08-04T00:00:48.920183Z"}, {"uuid": "4f235829-394d-4dad-a725-80046016acef", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3cbb3f39-d5ee-45e8-b7f2-eadac61a689c", "content": "", "creation_timestamp": "2026-06-19T12:47:50.968684Z"}, {"uuid": "f2a8036b-3355-423d-a317-246504576dab", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f58f9c03-3137-4783-a1cb-145f9ee3ee40", "content": "", "creation_timestamp": "2026-06-23T14:04:36.575899Z"}, {"uuid": "52f05b77-19d6-473e-a591-98690a812cb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "Telegram/82WzZR4SeVKGZngFmfTXCNP7Y6iUTJPQ9HnhkKIB0RZgq9E", "content": "", "creation_timestamp": "2026-08-15T08:00:11.432790Z"}, {"uuid": "20872370-034d-495a-a4e3-2fc7aa78d9a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "published-proof-of-concept", "source": "Telegram/82WzZR4SeVKGZngFmfTXCNP7Y6iUTJPQ9HnhkKIB0RZgq9E", "content": "", "creation_timestamp": "2026-08-16T00:00:11.830105Z"}, {"uuid": "003ce088-c613-4194-aa54-542dd669cdb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/securixy_kz/660", "content": "\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31195\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31195\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\nCVSS Score: 8.8 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31196\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34473\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34523\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MS Exchange\nCVE-ID: CVE-2021-31207\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31207\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b:\nMicrosoft Exchange Server 2013\nMicrosoft Exchange Server 2016\nMicrosoft Exchange Server 2019", "creation_timestamp": "2026-07-12T22:00:13.687063Z"}, {"uuid": "daab91f2-a7a2-4d9c-8358-3a019b303127", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/securixy_kz/659", "content": "\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell\n\n\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u043c\u0435\u043d\u0443\u0435\u043c\u0430\u044f \u043a\u0430\u043a LockFile, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell.\n\nProxyShell - \u044d\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0451\u0445 (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0451 \u0432 \u043c\u0430\u0435 2021 \u0433\u043e\u0434\u0430, 5 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA 2021 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u044f\u0445 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 MS Exchange \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2021-31195, CVE-2021-31196, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u0432\u0442\u043e\u0440\u0443\u044e \u0436\u0438\u0437\u043d\u044c.\n\n\u0412\u0441\u0435\u043c\u0443 \u041a\u0430\u0437\u043d\u0435\u0442\u0443, \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c \u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0441\u043e\u0432\u0435\u0442\u0443\u0435\u043c \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u043b\u0430\u0442\u043a\u0438.", "creation_timestamp": "2026-07-12T22:00:13.769036Z"}, {"uuid": "30f76b66-fbd8-477d-a56b-72c3845107fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/securixy_kz/660", "content": "\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31195\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31195\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\nCVSS Score: 8.8 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31196\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34473\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34523\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MS Exchange\nCVE-ID: CVE-2021-31207\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31207\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b:\nMicrosoft Exchange Server 2013\nMicrosoft Exchange Server 2016\nMicrosoft Exchange Server 2019", "creation_timestamp": "2026-07-13T00:00:37.630138Z"}, {"uuid": "b9159cb5-7ce9-42df-bdb5-4f95abf2f447", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/securixy_kz/659", "content": "\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell\n\n\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u043c\u0435\u043d\u0443\u0435\u043c\u0430\u044f \u043a\u0430\u043a LockFile, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell.\n\nProxyShell - \u044d\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0451\u0445 (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0451 \u0432 \u043c\u0430\u0435 2021 \u0433\u043e\u0434\u0430, 5 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA 2021 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u044f\u0445 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 MS Exchange \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2021-31195, CVE-2021-31196, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u0432\u0442\u043e\u0440\u0443\u044e \u0436\u0438\u0437\u043d\u044c.\n\n\u0412\u0441\u0435\u043c\u0443 \u041a\u0430\u0437\u043d\u0435\u0442\u0443, \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c \u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0441\u043e\u0432\u0435\u0442\u0443\u0435\u043c \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u043b\u0430\u0442\u043a\u0438.", "creation_timestamp": "2026-07-13T00:00:37.713275Z"}, {"uuid": "12f33dd3-a215-49a2-bf99-a4e97d18afec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/securixy_kz/660", "content": "\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31195\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31195\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\nCVSS Score: 8.8 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31196\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34473\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34523\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MS Exchange\nCVE-ID: CVE-2021-31207\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31207\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b:\nMicrosoft Exchange Server 2013\nMicrosoft Exchange Server 2016\nMicrosoft Exchange Server 2019", "creation_timestamp": "2026-07-14T00:00:55.648046Z"}, {"uuid": "5bff867c-4a05-4080-b58b-4e0224381c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/securixy_kz/659", "content": "\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell\n\n\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u043c\u0435\u043d\u0443\u0435\u043c\u0430\u044f \u043a\u0430\u043a LockFile, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell.\n\nProxyShell - \u044d\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0451\u0445 (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0451 \u0432 \u043c\u0430\u0435 2021 \u0433\u043e\u0434\u0430, 5 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA 2021 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u044f\u0445 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 MS Exchange \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2021-31195, CVE-2021-31196, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u0432\u0442\u043e\u0440\u0443\u044e \u0436\u0438\u0437\u043d\u044c.\n\n\u0412\u0441\u0435\u043c\u0443 \u041a\u0430\u0437\u043d\u0435\u0442\u0443, \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c \u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0441\u043e\u0432\u0435\u0442\u0443\u0435\u043c \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u043b\u0430\u0442\u043a\u0438.", "creation_timestamp": "2026-07-14T00:00:55.428956Z"}, {"uuid": "88790297-0401-4027-9ddf-856ca0d0a330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/EchelonEyes/232", "content": "\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438, \u041a\u0430\u043d\u0430\u0434\u044b, \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 \u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0430\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0432 2021-\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA). \u041e\u043d \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430c\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 (CISA, \u0410\u041d\u0411, \u0424\u0411\u0420), \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 (\u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - ACSC), \u041a\u0430\u043d\u0430\u0434\u044b (\u041a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - CCCS), \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 - NZ NCSC) \u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 - NCSC-UK).\n\n\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0432\u0430 \u0441\u043f\u0438\u0441\u043a\u0430: \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439, \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e 15 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n1. CVE-2021-44228, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u043a\u0430\u043a Log4Shell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Apache Log4j. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n2. CVE-2021-40539, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Zoho ManageEngine AD SelfService Plus. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n3 \u2013 5. CVE-2021-34523, CVE-2021-34473, CVE-2021-31207, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyShell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n6 \u2013 9. CVE-2021-27065, CVE-2021-26858, CVE-2021-26857, CVE-2021-26855, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyLogon. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server. \u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n10. CVE-2021-26084, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Atlassian Confluence Server and Data Center. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n11. CVE-2021-21972, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 VMware vSphere Client. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n12. CVE-2020-1472, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Netlogon Remote Protocol (MS-NRPC). \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n13. CVE-2020-0688, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Exchange Server. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n14. CVE-2019-11510, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Pulse Secure Pulse Connect Secure. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n15. CVE-2018-13379, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Fortinet FortiOS and FortiProxy. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u0415\u0449\u0435 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Sitecore XP, ForgeRock OpenAM server, Accellion FTA, SonicWall Secure Mobile Access (SMA), VMware vCenter Server, Checkbox Survey, QNAP QTS and QuTS hero, Cisco IOS Software and IOS XE Software, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u044f\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0438 \u0441\u043b\u0443\u0436\u0431 Microsoft Windows. \n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0434\u0435\u043b\u044f\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u0430\u0445. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/uscert/ncas/alerts/aa22-117a", "creation_timestamp": "2026-07-17T05:00:05.295394Z"}, {"uuid": "f66317cf-fe15-44f4-b477-40772f90811c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/rtinfobez/244", "content": "KillChain: \u0437\u0430\u043a\u0443\u043b\u0438\u0441\u044c\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0430\u0442\u0430\u043a\u0438\n\n\ud83d\udce2 \u041f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u0410\u043d\u0434\u0440\u0435\u0439 \u0424\u0435\u0434\u043e\u0440\u043e\u0432, \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f RT Protect SOC. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c \u043f\u0435\u0440\u0432\u0443\u044e \u0433\u043b\u0430\u0432\u0443 \u0440\u0430\u0437\u0431\u043e\u0440\u0430: \u043a\u0430\u043a \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443. \u0413\u043e\u0442\u043e\u0432\u044b \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043f\u043e \u0442\u0443 \u0441\u0442\u043e\u0440\u043e\u043d\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438?\n\n\u042d\u0442\u0430\u043f 0 \u2014 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 \u043a \u0430\u0442\u0430\u043a\u0435\n\u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043d\u0430\u0447\u043d\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0435\u043c\u0443 \u043d\u0443\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438 \u0441\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443.\n\u26ab\ufe0f \u0412 \u043d\u0430\u0448\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u043d \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Exchange Server \u0432\u0435\u0440\u0441\u0438\u0438 2016 CU12, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u043c\u0435\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207). \n\u26ab\ufe0f \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0443\u044f\u0437\u0432\u0438\u043c \u0434\u043b\u044f ProxyShell, \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0442\u043e\u0447\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Exchange. \n\u26ab\ufe0f ProxyShell \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0415\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Exchange 2016 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d \u0434\u043e Cumulative Update 21, \u043e\u043d \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439.\n\n\u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \n\ud83d\udcce \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Metasploit \n\ud83d\udcce BOF MiniDumpWriteDump\n\ud83d\udcce \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 pypykatz\n\ud83d\udcce \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 CrackMapExec\n\ud83d\udcce \u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u0441\u043a\u0430\u043d\u0435\u0440 Nmap\n\ud83d\udcce \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 John The Ripper\n\ud83d\udcce \u0423\u0442\u0438\u043b\u0438\u0442\u0430 PsExec\n\n\u042d\u0442\u0430\u043f 1 \u2014 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\u0412 Metasploit \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043d\u0430\u0445\u043e\u0434\u0438\u0442 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0443. \n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442? \u041e\u043d \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Microsoft Exchange. \u041c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u041d\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0442\u043e\u0436\u0435 \u043d\u0435 \u0441\u043f\u0438\u0442.\n\n\u041a\u0430\u043a \u043e\u0442\u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043b RT Protect EDR? \n\u0417\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0442\u0440\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430: \n1\ufe0f\u20e3 \u0414\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 MSExchangeMailboxReplication.exe. \n2\ufe0f\u20e3 \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \n\u0412\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 System. \n3\ufe0f\u20e3 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e PowerShell-\u043a\u043e\u0434\u0430\n\u0422\u0440\u0435\u0442\u0438\u0439 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0432\u043e\u0437\u043d\u0438\u043a \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 powershell \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f base64 \u0441\u0442\u0440\u043e\u043a\u0438.\n\n\u0418\u0442\u043e\u0433\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u0444\u0430\u0437\u044b \u0430\u0442\u0430\u043a\u0438\n\u2b1b\ufe0f \u0427\u0442\u043e \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443?\n\u0423\u0441\u043f\u0435\u0448\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\n\u2b1b\ufe0f \u0427\u0442\u043e \u0443\u0432\u0438\u0434\u0435\u043b RT Protect EDR? \n\u0414\u0430\u043d\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 RT Protect EDR \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u043b\u0430 \u0431\u044b\u0442\u044c \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0430.\n\n\ud83d\udd25 \u041f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0442\u0435\u0441\u044c, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u0442\u044c\n\u0421\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0432\u044b\u0439\u0434\u0435\u0442 \u0440\u043e\u0432\u043d\u043e \u0447\u0435\u0440\u0435\u0437 7 \u0434\u043d\u0435\u0439!\n\n#KillChain", "creation_timestamp": "2026-07-17T11:00:04.363749Z"}, {"uuid": "4c750b98-257d-47a8-8505-66eef6a609f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/rtinfobez/244", "content": "KillChain: \u0437\u0430\u043a\u0443\u043b\u0438\u0441\u044c\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0430\u0442\u0430\u043a\u0438\n\n\ud83d\udce2 \u041f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u0410\u043d\u0434\u0440\u0435\u0439 \u0424\u0435\u0434\u043e\u0440\u043e\u0432, \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f RT Protect SOC. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c \u043f\u0435\u0440\u0432\u0443\u044e \u0433\u043b\u0430\u0432\u0443 \u0440\u0430\u0437\u0431\u043e\u0440\u0430: \u043a\u0430\u043a \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443. \u0413\u043e\u0442\u043e\u0432\u044b \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043f\u043e \u0442\u0443 \u0441\u0442\u043e\u0440\u043e\u043d\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438?\n\n\u042d\u0442\u0430\u043f 0 \u2014 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 \u043a \u0430\u0442\u0430\u043a\u0435\n\u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043d\u0430\u0447\u043d\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0435\u043c\u0443 \u043d\u0443\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438 \u0441\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443.\n\u26ab\ufe0f \u0412 \u043d\u0430\u0448\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u043d \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Exchange Server \u0432\u0435\u0440\u0441\u0438\u0438 2016 CU12, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u043c\u0435\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207). \n\u26ab\ufe0f \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0443\u044f\u0437\u0432\u0438\u043c \u0434\u043b\u044f ProxyShell, \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0442\u043e\u0447\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Exchange. \n\u26ab\ufe0f ProxyShell \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0415\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Exchange 2016 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d \u0434\u043e Cumulative Update 21, \u043e\u043d \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439.\n\n\u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \n\ud83d\udcce \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Metasploit \n\ud83d\udcce BOF MiniDumpWriteDump\n\ud83d\udcce \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 pypykatz\n\ud83d\udcce \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 CrackMapExec\n\ud83d\udcce \u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u0441\u043a\u0430\u043d\u0435\u0440 Nmap\n\ud83d\udcce \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 John The Ripper\n\ud83d\udcce \u0423\u0442\u0438\u043b\u0438\u0442\u0430 PsExec\n\n\u042d\u0442\u0430\u043f 1 \u2014 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430\n\u0412 Metasploit \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043d\u0430\u0445\u043e\u0434\u0438\u0442 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0443. \n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442? \u041e\u043d \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Microsoft Exchange. \u041c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u041d\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0442\u043e\u0436\u0435 \u043d\u0435 \u0441\u043f\u0438\u0442.\n\n\u041a\u0430\u043a \u043e\u0442\u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043b RT Protect EDR? \n\u0417\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0442\u0440\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430: \n1\ufe0f\u20e3 \u0414\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 MSExchangeMailboxReplication.exe. \n2\ufe0f\u20e3 \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \n\u0412\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 System. \n3\ufe0f\u20e3 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e PowerShell-\u043a\u043e\u0434\u0430\n\u0422\u0440\u0435\u0442\u0438\u0439 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0432\u043e\u0437\u043d\u0438\u043a \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 powershell \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f base64 \u0441\u0442\u0440\u043e\u043a\u0438.\n\n\u0418\u0442\u043e\u0433\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u0444\u0430\u0437\u044b \u0430\u0442\u0430\u043a\u0438\n\u2b1b\ufe0f \u0427\u0442\u043e \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443?\n\u0423\u0441\u043f\u0435\u0448\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432\u0435\u0431-\u0448\u0435\u043b\u043b \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\n\u2b1b\ufe0f \u0427\u0442\u043e \u0443\u0432\u0438\u0434\u0435\u043b RT Protect EDR? \n\u0414\u0430\u043d\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 RT Protect EDR \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u043b\u0430 \u0431\u044b\u0442\u044c \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0430.\n\n\ud83d\udd25 \u041f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0442\u0435\u0441\u044c, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u0442\u044c\n\u0421\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0432\u044b\u0439\u0434\u0435\u0442 \u0440\u043e\u0432\u043d\u043e \u0447\u0435\u0440\u0435\u0437 7 \u0434\u043d\u0435\u0439!\n\n#KillChain", "creation_timestamp": "2026-07-18T00:00:31.282343Z"}, {"uuid": "a7e3a7df-874d-41dd-9265-f892101e23d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/EchelonEyes/232", "content": "\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438, \u041a\u0430\u043d\u0430\u0434\u044b, \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 \u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0430\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0432 2021-\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA). \u041e\u043d \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430c\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 (CISA, \u0410\u041d\u0411, \u0424\u0411\u0420), \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438 (\u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - ACSC), \u041a\u0430\u043d\u0430\u0434\u044b (\u041a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 - CCCS), \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438 - NZ NCSC) \u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 (\u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u041a\u043e\u0440\u043e\u043b\u0435\u0432\u0441\u0442\u0432\u0430 - NCSC-UK).\n\n\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0432\u0430 \u0441\u043f\u0438\u0441\u043a\u0430: \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439, \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e 15 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n1. CVE-2021-44228, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u043a\u0430\u043a Log4Shell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Apache Log4j. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n2. CVE-2021-40539, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Zoho ManageEngine AD SelfService Plus. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n3 \u2013 5. CVE-2021-34523, CVE-2021-34473, CVE-2021-31207, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyShell. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n6 \u2013 9. CVE-2021-27065, CVE-2021-26858, CVE-2021-26857, CVE-2021-26855, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043a\u0430\u043a ProxyLogon. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 Microsoft Exchange Server. \u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n10. CVE-2021-26084, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Atlassian Confluence Server and Data Center. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n11. CVE-2021-21972, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 VMware vSphere Client. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n12. CVE-2020-1472, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Netlogon Remote Protocol (MS-NRPC). \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n13. CVE-2020-0688, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Microsoft Exchange Server. \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n14. CVE-2019-11510, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Pulse Secure Pulse Connect Secure. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n15. CVE-2018-13379, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Fortinet FortiOS and FortiProxy. \u041f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0447\u0442\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u0415\u0449\u0435 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Sitecore XP, ForgeRock OpenAM server, Accellion FTA, SonicWall Secure Mobile Access (SMA), VMware vCenter Server, Checkbox Survey, QNAP QTS and QuTS hero, Cisco IOS Software and IOS XE Software, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u044f\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0438 \u0441\u043b\u0443\u0436\u0431 Microsoft Windows. \n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0434\u0435\u043b\u044f\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u0430\u0445. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/uscert/ncas/alerts/aa22-117a", "creation_timestamp": "2026-07-18T00:00:38.148466Z"}, {"uuid": "97579563-e200-499d-86cb-210063b61620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/cec219ff-8f6d-45c9-bdbb-b4fb8c9c0f2b", "content": "", "creation_timestamp": "2026-07-23T21:15:02.490356Z"}, {"uuid": "f275b56c-2603-4958-9a2e-92403fbfd096", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/cec219ff-8f6d-45c9-bdbb-b4fb8c9c0f2b", "content": "", "creation_timestamp": "2026-07-24T00:15:03.195575Z"}, {"uuid": "13db8dfc-7d3f-4cd2-a83a-4bc1b1fba35a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/469a09e8-cdbb-405e-b1fa-87ee37a92c1b", "content": "", "creation_timestamp": "2026-07-25T06:15:04.567029Z"}, {"uuid": "bf254e21-c003-40e4-8ffe-1644675f23d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "MISP/469a09e8-cdbb-405e-b1fa-87ee37a92c1b", "content": "", "creation_timestamp": "2026-07-26T00:15:02.171908Z"}, {"uuid": "eb907ffc-da13-4a47-91fd-fa6e1a74a956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/EchelonEyes/2932", "content": "\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0430\u044f APT40 \u0433\u043e\u0442\u043e\u0432\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\n\n\u041f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u044b \u0432\u043e\u0441\u044c\u043c\u0438 \u0441\u0442\u0440\u0430\u043d, \u0432\u043e \u0433\u043b\u0430\u0432\u0435 \u0441 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0435\u0439, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044e, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043c\u0435\u0442\u043e\u0434\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u043e\u0439 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 APT40 (\u043e\u043d\u0430 \u0436\u0435 Kryptonite Panda, GINGHAM TYPHOON, Leviathan \u0438 Bronze Mohawk). \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0437 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0445\u0430\u043a\u0435\u0440\u044b, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u041a\u0438\u0442\u0430\u044f, \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043d\u0430 \u0441\u0432\u0435\u0436\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432.\n\n\u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430\u043c\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438, \u0421\u0428\u0410, \u041a\u0430\u043d\u0430\u0434\u044b, \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438, \u042f\u043f\u043e\u043d\u0438\u0438, \u042e\u0436\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438 \u0438 \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u0438. \u041e\u043d\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0447\u0442\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0442\u0441\u044f \u043f\u043e \u043f\u043e\u0440\u0443\u0447\u0435\u043d\u0438\u044e \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u0430 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041a\u0438\u0442\u0430\u044f.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u0432\u043e\u0437\u0433\u043b\u0430\u0432\u0438\u043b\u0430 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u044f, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (ACSC) \u0443\u0437\u043d\u0430\u043b \u0432 2022 \u0433\u043e\u0434\u0443 \u043e\u0431 \u0430\u0442\u0430\u043a\u0435 APT40 \u043d\u0430 \u043c\u0435\u0441\u0442\u043d\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e. ACSC \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0434\u0430\u0442\u0447\u0438\u043a\u0438 \u043d\u0430 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0445\u043e\u0441\u0442\u0430\u0445 \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043a\u0430\u0440\u0442\u0443 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 APT40.\n\n\u0412 \u0438\u0442\u043e\u0433\u0435 ACSC \u043f\u0440\u0438\u0448\u0435\u043b \u043a \u0432\u044b\u0432\u043e\u0434\u0443, \u0447\u0442\u043e APT40 \u00ab\u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u044b\u0441\u0442\u0440\u043e \u0442\u0440\u0430\u043d\u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u043f\u0440\u043e\u0442\u0438\u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0435\u0442\u0435\u0439, \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0438\u0445 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\u00bb. \u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u0442 \u0437\u0430 \u0441\u0435\u0442\u044f\u043c\u0438, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c\u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441, \u0432 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0439.\n\n\u00ab\u042d\u0442\u0430 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u0430\u044f \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0433\u0440\u0443\u043f\u043f\u0435 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435, \u0432\u044b\u0448\u0435\u0434\u0448\u0438\u0435 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u0438\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u0435\u0441 \u0441\u0435\u0442\u044f\u0445 \u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b\u00bb, \u2014 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f.\n\n\u0421\u0440\u0435\u0434\u0438 \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043d\u0435 \u0431\u0440\u0435\u0437\u0433\u0443\u0435\u0442 APT40, - Log4J (CVE 2021 44228), Atlassian Confluence (CVE-2021-31207, CVE-2021- 6084) \u0438 Microsoft Exchange (CVE-2021-31207, CVE 2021-34523, CVE-2021-34473) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435.\n\n\u0414\u043b\u044f \u043d\u0430\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u0436\u0435\u0440\u0442\u0432 APT40, \u0441\u0443\u0434\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443, \u0438\u0449\u0435\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043d\u0430 \u043d\u0435\u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u043c \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u0430\u0442\u0430\u043a\u043e\u0439, \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0439 ACSC, \u044d\u0442\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u043e\u0441\u044c \u043d\u0430 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u043c \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u0438\u043b\u0438 \u0432 \u0434\u043e\u043c\u0435. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0443, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0430\u0442\u0430\u043a\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043a\u0430\u043a \u0447\u0430\u0441\u0442\u044c \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.\n\nACSC \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b, \u0447\u0442\u043e APT40 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0438 \u0438\u0449\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0412 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0441 \u0446\u0435\u043b\u044c\u044e \u043a\u0440\u0430\u0436\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u0412 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u0445 \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0430 \u0442\u0430\u043a\u0442\u0438\u043a\u0430 \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439. \u0417\u0434\u0435\u0441\u044c \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e: \u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u044f \u0441\u0435\u0442\u0438. \u0412\u0434\u043e\u0431\u0430\u0432\u043e\u043a \u043a \u043d\u0438\u043c \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u043d\u043e\u0433\u043e\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u043b\u0443\u0436\u0431, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u043e\u0432 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0438 \u0437\u0430\u043c\u0435\u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441 \u0438\u0441\u0442\u0435\u043a\u0448\u0438\u043c \u0441\u0440\u043e\u043a\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/apt40-advisory-prc-mss-tradecraft-in-action \n\n#\u0448\u043f\u0438\u043e\u043d\u0430\u0436 #APT #\u041a\u0438\u0442\u0430\u0439 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438", "creation_timestamp": "2026-07-26T02:02:08.367678Z"}, {"uuid": "784a660a-b8f4-4167-ade6-750400e0c19f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/EchelonEyes/2932", "content": "\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0430\u044f APT40 \u0433\u043e\u0442\u043e\u0432\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\n\n\u041f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u044b \u0432\u043e\u0441\u044c\u043c\u0438 \u0441\u0442\u0440\u0430\u043d, \u0432\u043e \u0433\u043b\u0430\u0432\u0435 \u0441 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0435\u0439, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044e, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043c\u0435\u0442\u043e\u0434\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u043e\u0439 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 APT40 (\u043e\u043d\u0430 \u0436\u0435 Kryptonite Panda, GINGHAM TYPHOON, Leviathan \u0438 Bronze Mohawk). \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0437 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0445\u0430\u043a\u0435\u0440\u044b, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u041a\u0438\u0442\u0430\u044f, \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043d\u0430 \u0441\u0432\u0435\u0436\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432.\n\n\u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430\u043c\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438, \u0421\u0428\u0410, \u041a\u0430\u043d\u0430\u0434\u044b, \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438, \u042f\u043f\u043e\u043d\u0438\u0438, \u042e\u0436\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438 \u0438 \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u0438. \u041e\u043d\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0447\u0442\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0442\u0441\u044f \u043f\u043e \u043f\u043e\u0440\u0443\u0447\u0435\u043d\u0438\u044e \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u0430 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041a\u0438\u0442\u0430\u044f.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u0432\u043e\u0437\u0433\u043b\u0430\u0432\u0438\u043b\u0430 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u044f, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (ACSC) \u0443\u0437\u043d\u0430\u043b \u0432 2022 \u0433\u043e\u0434\u0443 \u043e\u0431 \u0430\u0442\u0430\u043a\u0435 APT40 \u043d\u0430 \u043c\u0435\u0441\u0442\u043d\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e. ACSC \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0434\u0430\u0442\u0447\u0438\u043a\u0438 \u043d\u0430 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0445\u043e\u0441\u0442\u0430\u0445 \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043a\u0430\u0440\u0442\u0443 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 APT40.\n\n\u0412 \u0438\u0442\u043e\u0433\u0435 ACSC \u043f\u0440\u0438\u0448\u0435\u043b \u043a \u0432\u044b\u0432\u043e\u0434\u0443, \u0447\u0442\u043e APT40 \u00ab\u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u044b\u0441\u0442\u0440\u043e \u0442\u0440\u0430\u043d\u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u043f\u0440\u043e\u0442\u0438\u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0435\u0442\u0435\u0439, \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0438\u0445 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\u00bb. \u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u0442 \u0437\u0430 \u0441\u0435\u0442\u044f\u043c\u0438, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c\u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441, \u0432 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0439.\n\n\u00ab\u042d\u0442\u0430 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u0430\u044f \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0433\u0440\u0443\u043f\u043f\u0435 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435, \u0432\u044b\u0448\u0435\u0434\u0448\u0438\u0435 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u0438\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u0435\u0441 \u0441\u0435\u0442\u044f\u0445 \u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b\u00bb, \u2014 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f.\n\n\u0421\u0440\u0435\u0434\u0438 \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043d\u0435 \u0431\u0440\u0435\u0437\u0433\u0443\u0435\u0442 APT40, - Log4J (CVE 2021 44228), Atlassian Confluence (CVE-2021-31207, CVE-2021- 6084) \u0438 Microsoft Exchange (CVE-2021-31207, CVE 2021-34523, CVE-2021-34473) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435.\n\n\u0414\u043b\u044f \u043d\u0430\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u0436\u0435\u0440\u0442\u0432 APT40, \u0441\u0443\u0434\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443, \u0438\u0449\u0435\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043d\u0430 \u043d\u0435\u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u043c \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u0430\u0442\u0430\u043a\u043e\u0439, \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0439 ACSC, \u044d\u0442\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u043e\u0441\u044c \u043d\u0430 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u043c \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u0438\u043b\u0438 \u0432 \u0434\u043e\u043c\u0435. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0443, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0430\u0442\u0430\u043a\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043a\u0430\u043a \u0447\u0430\u0441\u0442\u044c \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.\n\nACSC \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b, \u0447\u0442\u043e APT40 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0438 \u0438\u0449\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0412 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0441 \u0446\u0435\u043b\u044c\u044e \u043a\u0440\u0430\u0436\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u0412 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u0445 \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0430 \u0442\u0430\u043a\u0442\u0438\u043a\u0430 \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439. \u0417\u0434\u0435\u0441\u044c \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e: \u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u044f \u0441\u0435\u0442\u0438. \u0412\u0434\u043e\u0431\u0430\u0432\u043e\u043a \u043a \u043d\u0438\u043c \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u043d\u043e\u0433\u043e\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u043b\u0443\u0436\u0431, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u043e\u0432 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0438 \u0437\u0430\u043c\u0435\u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441 \u0438\u0441\u0442\u0435\u043a\u0448\u0438\u043c \u0441\u0440\u043e\u043a\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/apt40-advisory-prc-mss-tradecraft-in-action \n\n#\u0448\u043f\u0438\u043e\u043d\u0430\u0436 #APT #\u041a\u0438\u0442\u0430\u0439 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438", "creation_timestamp": "2026-07-27T00:00:46.094290Z"}, {"uuid": "8e356b46-ead8-489f-a9dd-cccd99279c27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/EchelonEyes/2932", "content": "\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0430\u044f APT40 \u0433\u043e\u0442\u043e\u0432\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\n\n\u041f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u044b \u0432\u043e\u0441\u044c\u043c\u0438 \u0441\u0442\u0440\u0430\u043d, \u0432\u043e \u0433\u043b\u0430\u0432\u0435 \u0441 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0435\u0439, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044e, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043c\u0435\u0442\u043e\u0434\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u043e\u0439 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 APT40 (\u043e\u043d\u0430 \u0436\u0435 Kryptonite Panda, GINGHAM TYPHOON, Leviathan \u0438 Bronze Mohawk). \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0437 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0445\u0430\u043a\u0435\u0440\u044b, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u041a\u0438\u0442\u0430\u044f, \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043d\u0430 \u0441\u0432\u0435\u0436\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432.\n\n\u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430\u043c\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438, \u0421\u0428\u0410, \u041a\u0430\u043d\u0430\u0434\u044b, \u041d\u043e\u0432\u043e\u0439 \u0417\u0435\u043b\u0430\u043d\u0434\u0438\u0438, \u042f\u043f\u043e\u043d\u0438\u0438, \u042e\u0436\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438 \u0438 \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u0438. \u041e\u043d\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0447\u0442\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0442\u0441\u044f \u043f\u043e \u043f\u043e\u0440\u0443\u0447\u0435\u043d\u0438\u044e \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u0430 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041a\u0438\u0442\u0430\u044f.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u0432\u043e\u0437\u0433\u043b\u0430\u0432\u0438\u043b\u0430 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u044f, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (ACSC) \u0443\u0437\u043d\u0430\u043b \u0432 2022 \u0433\u043e\u0434\u0443 \u043e\u0431 \u0430\u0442\u0430\u043a\u0435 APT40 \u043d\u0430 \u043c\u0435\u0441\u0442\u043d\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e. ACSC \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0434\u0430\u0442\u0447\u0438\u043a\u0438 \u043d\u0430 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0445\u043e\u0441\u0442\u0430\u0445 \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043a\u0430\u0440\u0442\u0443 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 APT40.\n\n\u0412 \u0438\u0442\u043e\u0433\u0435 ACSC \u043f\u0440\u0438\u0448\u0435\u043b \u043a \u0432\u044b\u0432\u043e\u0434\u0443, \u0447\u0442\u043e APT40 \u00ab\u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u044b\u0441\u0442\u0440\u043e \u0442\u0440\u0430\u043d\u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u043f\u0440\u043e\u0442\u0438\u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0435\u0442\u0435\u0439, \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0438\u0445 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\u00bb. \u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u0442 \u0437\u0430 \u0441\u0435\u0442\u044f\u043c\u0438, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c\u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441, \u0432 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0439.\n\n\u00ab\u042d\u0442\u0430 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u0430\u044f \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0433\u0440\u0443\u043f\u043f\u0435 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435, \u0432\u044b\u0448\u0435\u0434\u0448\u0438\u0435 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u0438\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u0435\u0441 \u0441\u0435\u0442\u044f\u0445 \u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b\u00bb, \u2014 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f.\n\n\u0421\u0440\u0435\u0434\u0438 \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043d\u0435 \u0431\u0440\u0435\u0437\u0433\u0443\u0435\u0442 APT40, - Log4J (CVE 2021 44228), Atlassian Confluence (CVE-2021-31207, CVE-2021- 6084) \u0438 Microsoft Exchange (CVE-2021-31207, CVE 2021-34523, CVE-2021-34473) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435.\n\n\u0414\u043b\u044f \u043d\u0430\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u0436\u0435\u0440\u0442\u0432 APT40, \u0441\u0443\u0434\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443, \u0438\u0449\u0435\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043d\u0430 \u043d\u0435\u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u043c \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u0430\u0442\u0430\u043a\u043e\u0439, \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0439 ACSC, \u044d\u0442\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u043e\u0441\u044c \u043d\u0430 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u043c \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u0438\u043b\u0438 \u0432 \u0434\u043e\u043c\u0435. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0443, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0430\u0442\u0430\u043a\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043a\u0430\u043a \u0447\u0430\u0441\u0442\u044c \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.\n\nACSC \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b, \u0447\u0442\u043e APT40 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0438 \u0438\u0449\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0412 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0441 \u0446\u0435\u043b\u044c\u044e \u043a\u0440\u0430\u0436\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u0412 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u0445 \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0430 \u0442\u0430\u043a\u0442\u0438\u043a\u0430 \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439. \u0417\u0434\u0435\u0441\u044c \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e: \u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u044f \u0441\u0435\u0442\u0438. \u0412\u0434\u043e\u0431\u0430\u0432\u043e\u043a \u043a \u043d\u0438\u043c \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u043d\u043e\u0433\u043e\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u043b\u0443\u0436\u0431, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u043e\u0432 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0438 \u0437\u0430\u043c\u0435\u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441 \u0438\u0441\u0442\u0435\u043a\u0448\u0438\u043c \u0441\u0440\u043e\u043a\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/apt40-advisory-prc-mss-tradecraft-in-action \n\n#\u0448\u043f\u0438\u043e\u043d\u0430\u0436 #APT #\u041a\u0438\u0442\u0430\u0439 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438", "creation_timestamp": "2026-07-28T00:00:42.867949Z"}, {"uuid": "11d04106-14e4-4e2e-85e9-7dcde2869736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/reverseame/1683", "content": "POC for scanning ProxyShell (CVE-2021-34523,CVE-2021-34473,CVE-2021-31207) https://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2026-07-29T12:02:52.756721Z"}, {"uuid": "47d714ee-7527-4d06-911f-d0e8006e45fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/reverseame/1683", "content": "POC for scanning ProxyShell (CVE-2021-34523,CVE-2021-34473,CVE-2021-31207) https://github.com/mithridates1313/ProxyShell_POC", "creation_timestamp": "2026-07-30T00:02:43.195099Z"}, {"uuid": "d287c73f-c089-443a-a6f8-51771d8bfc45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/cissp/4021", "content": "Offensive security\nNuclei Scanner for Proxyshell RCE\n(CVE-2021-34423, CVE-2021-34473, CVE-2021-31207)\nhttps://github.com/cyberheartmi9/Proxyshell-Scanner\n\nCloud Security\nSecurity as code:\nThe best (and maybe only) path to securing cloud applications and systems\nhttps://www.mckinsey.com/business-functions/mckinsey-digital/our-insights/security-as-code-the-best-and-maybe-only-path-to-securing-cloud-applications-and-systems\n\n\nRed Team Tactics\n1.  ; echo \"Shell Injection\"\nhttps://matklad.github.io//2021/07/30/shell-injection.html\n2. Bypass UAC at any level by abusing the Program Compatibility Assistant with RPC, WDI, and more Windows components\nhttps://github.com/AzAgarampur/byeintegrity8-uac\n\nThreat Research\n1. Visual Studio Code\u00a0.ipynb\u00a0Jupyter Notebook XSS (Arbitrary File Read)\nhttps://github.com/justinsteven/advisories/blob/master/2021_vscode_ipynb_xss_arbitrary_file_read.md\n2. GraphQL Security Analysis\nhttps://securitygoat.medium.com/common-graphql-misconceptions-a-rant-489647167ca3", "creation_timestamp": "2026-09-01T17:00:43.063763Z"}, {"uuid": "2f51a521-9da8-45a2-a750-10fc29fa13d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/hacking_Attack/82154", "content": "Black Hat Ethical Hacking\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection Vulnerabilities\n\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection VulnerabilitiesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Cybersecurity analysts at Prodraft\u2019s threat intelligence team detected\u00a0that the hacker group FIN7 was actively exploiting vulnerabilities in Microsoft Exchange and SQL injection through an automated attack system in an attempt to perform the following illicit activities:* Infiltrate corporate networks in order to steal information.\n* Data theft.\n* Adaptive ransomware attacks based on the financial size of the networks.\n\nFor years now, this security organization has closely followed the operations of FIN7. There are a number of details revealed by Prodaft about FIN7\u2019s behind-the-scenes:-\n\n* The hierarchy at the internal level.\n* Affiliations with a variety of ransomware projects.\n* A new SSH backdoor system.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Attack Modes and Auto-attackingFIN7 is a Russian-speaking threat group that has been active at least since 2012, and its motivations seem to be financial. \n\nA number of attacks have been linked to this threat group including:-\n\n* Attacks on ATMs.\n* The use of teddy bears to conceal malware-carrying USB drives.\n* Hiring pentesters to analyze ransomware attacks by setting up a false cybersecurity firm.\n* \nhttps://lh6.googleusercontent.com/bxGOUHzyqt1-qg7Uq2jsUnRi1HV_TyXD8GskpkUj8FCiC0GcPWtjfi1GMoJ-uOXsAZfvxua6L2oUgzkvxxELVUGQ2UjGfe91LwMwV280f0XKIkkr4TtLr72lNqOC0B11-KSzNN_roFQhJ-iK1PsO5AxGzJHFdVXCeJJ3oYQIowsVpWt1QF7TR92MaYZJZw \n<figcaptionAttack Modes \nThere is a system for automatic attacks called Checkmarks that has been discovered by Prodaft. So, in this scenario Checkmarks works as a scanner that scans for vulnerabilities that could result in remote code execution or privilege elevation in Microsoft Exchange, including:-\n\n* CVE-2021-34473\n* CVE-2021-34523\n* CVE-2021-31207\n\nSince June 2021 it\u2019s actively using Checkmarks for finding the corporate networks\u2019 vulnerable endpoints and exploiting them by using PowerShell to drop web shells which enabled FIN7 to gain access to corporate networks.\nhttps://lh5.googleusercontent.com/uIhqkcqkv5Fd4OCX_BWdGS6STKMeUdYYmhw9uRj__fsVqBI7uAhuNZHgOhZhXV_2An9pGMP4hb5CddH9eIejslPtDCRRpadLboahh3o-3DL3d5Ai92zpEY4yKqlriuK9MNXxCCiMAjJXcYTq0qC3BrITuQAUajMTQETbMuX6a7hAcHpuKxHPYxoHZaosXw \nAs part of its attack, FIN7 used multiple exploits, including its own custom code and publicly available Proof Of Concepts, to gain access to the target networks.\n\nThere are some other vulnerabilities that can be exploited with the Checkmarks attack platform in addition to the MS Exchange flaws. There is also a SQL injection module that uses SQLMap to scan for potential vulnerabilities on a website that may be exploited.\n\nFollowing the scanning of over 1.8 million targets with FIN7\u2019s Checkmarks platform, 8,147 companies have already been infiltrated. Here the most interesting thing is that all these companies are mainly based in the United States. \nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Digital Forensics Tool: Email Analyzer Communications With the C&C ServerApart from this, from the retrieved Jabber logs, the security analysts also found extensive evidence that multiple ransomware groups were in communication with FIN7, including:-\n\n* Darkside\n* REvil\n* LockBit\n\nThere is one particular det[...]", "creation_timestamp": "2026-09-01T20:01:12.477975Z"}, {"uuid": "0be8a4fd-93e1-4db6-a1f4-75835a62af22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/hacking_Attack/83430", "content": "code execution and privilege elevation vulnerabilities, such as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.\n\nFIN7\u2019s new platform has already been used to infiltrate 8,147 companies, primarily located in the United States (16.7%), after scanning over 1.8 million targets.\nTrending: Operation OpRussia \u2013 Anonymous attacks on Russia Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-3-300x150.png PyTorch Framework compromised with dependency confusion attackJanuary 3, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-9-300x150.png New Linux malware uses 30 plugin exploits to backdoor WordPress sitesJanuary 2, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-8-300x150.png Google Home speakers allowed hackers to snoop on conversationsDecember 30, 2022\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-7-300x150.png Hackers abuse Google Ads to spread malware in legit softwareDecember 29, 2022\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Over 60,000 Exchange servers vulnerable to ProxyNotShell attacks first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:01:11.902826Z"}, {"uuid": "75477fe9-f792-4e86-abf3-e93c81b9e42c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/hacking_Attack/33374", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange servers hacked to deploy BlackByte ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange servers hacked to deploy BlackByte ransomwarePost Views: 118 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe BlackByte ransomware gang is now breaching corporate networks by exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities.\nProxyShell is the name for a set of three Microsoft Exchange vulnerabilities that allow unauthenticated, remote code execution on the server when chained together.\n\nThese vulnerabilities are listed below and were fixed by security updates released in April and May 2021:\n\n* CVE-2021-34473\u00a0\u2013 Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)\n* CVE-2021-34523\u00a0\u2013 Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)\n* CVE-2021-31207\u00a0\u2013 Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)\n\nSince researchers disclosed the vulnerabilities, threat actors have begun to exploit them\u00a0to breach servers and install web shells, coin miners, and ransomware.\nSee Also: Complete Offensive Security and Ethical Hacking Course BlackByte\u00a0begins exploiting ProxyShellIn a detailed report by Red Canary, researchers analyzed a BlackByte\u00a0ransomware attack where they saw them exploiting the ProxyShell vulnerabilities to install web shells on a compromised Microsoft Exchange server.\n\nWeb Shells are small scripts uploaded to web servers that allow a threat actor to gain persistence to a device and remotely execute commands or upload additional files to the server.\nhttps://www.bleepstatic.com/images/news/security/webshell-example.jpg \nBlackByte is still a severe threatWhen conducting ransomware attacks, threat actors commonly use third-party tools to gain elevated privileges or deploy the ransomware on a network.\n\nHowever, the actual BlackByte ransomware executable plays a central role as it handles both privilege escalation and the ability to worm, or perform lateral movement, within the compromised environment.\n\nThe malware sets three registry values, one for local privilege elevation, one for enabling network connection sharing between all privilege levels, and one to allow long path values for file paths, names, and namespaces.\n\nBefore encryption, the malware deletes the \u201cRaccine Rules Updater\u201d scheduled task to prevent last-minute interceptions and also wipes shadow copies directly through WMI objects using an obfuscated PowerShell command.\n\nFinally, stolen files are exfiltrated using WinRAR to archive files and anonymous file-sharing platforms such as \u201cfile.io\u201d or \u201canonymfiles.com.\u201d\n\nAlthough Trustwave released a decryptor\u00a0for BlackByte ransomware in October 2021, it is unlikely that the operators are still using the same encryption tactics that allowed victims to restore their files for free.\n\nAs such, you may or may not be able to restore your files using that decryptor, depending on what key wa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:07.491397Z"}, {"uuid": "adf45cf8-f8a8-4701-a139-ac10bfebdf0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/hacking_Attack/8312", "content": "includes the fix for CVE-2021-31207, which made its debut in the 2021 Pwn2Own competition,\u201d he said.\n\nThe bug tracked as CVE-2021-31207 is only rated as \u201cmoderate,\u201d but the \u201csecurity feature-bypass exploit was showcased prominently in the Pwn2Own contest and at some point details of the exploit will be published,\u201d Goettl explained. \u201cAt that point threat actors will be able to take advantage of the vulnerability if they have not already begun attempting to reverse engineer an exploit.\u201d\n\nThere two other publicly disclosed vulnerabilities resolved by Microsoft this month that exist in Common Utilities, found in the NNI open-source toolkit (CVE-2021-31200), and in .NET and Visual Studio (CVE-2021-31204).\n\n\u201cCommon Utilities and .NET and Visual Studio are less likely to be targeted, but due to the public disclosures they should not be ignored for long,\u201d Goettl added. Other Notable Microsoft Security Patches for May 2021As for the other patches in the update that stood out to the research community, ZDI\u2019s Childs highlighted a Windows wireless networking information-disclosure bug, tracked as CVE-2020-24587.\n\n\u201cThe ZDI doesn\u2019t normally highlight info disclosure bugs, but this one has the potential to be pretty damaging,\u201d Childs said. \u201cThis patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system. It\u2019s not clear what the range on such an attack would be, but you should assume some proximity is needed. You\u2019ll also note this CVE is from 2020, which could indicate Microsoft has been working on this fix for some time.\u201d Windows Graphics, SharePoint Server PatchesA trio of local privilege escalation flaws \u2013 two in the Windows Graphics Component (CVE-2021-31188, CVE-2021-31170) and one in SharePoint Server (CVE-2021-28474) \u2013 caught Breen\u2019s eye.\n\nAs for the first two, he noted they could be chained with another bug, such as the wormable bug listed above, to become highly dangerous and allow for WannaCry-style attacks.\n\n\u201cThis kind of vulnerability is often used by attackers after they have already gained a foothold through an initial infection vector, like phishing or via another exploit like the RCE in HTTP.sys (CVE-2021-31166),\u201d Breen noted via email. \u201cThe attackers are looking to increase their privileges so they can move laterally across a network or gain access to other accounts that may have access to more sensitive information.\u201d\n\nMeanwhile, the SharePoint bug allows an authenticated attacker to run code on remote SharePoint Servers.\n\n\u201cAs this is post-authentication, it\u2019s likely to be used as part of post-exploitation and lateral movement phases of an attack, rather than the initial-infection vector,\u201d Breen said. \u201cAttackers could gain access to sensitive documents or even replace real documents with weaponized versions, enabling the compromise of more user devices across the organization\u2019s network.\u201d Microsoft Exchange Server PatchesMicrosoft also patched four vulnerabilities in Microsoft Exchange Server. The flaws (CVE-2021-31198, RCE; CVE-2021-31207, spoofing; CVE-2021-31209, security bypass; and CVE-2021-31195, RCE), are all rated important or moderate.\n\n\u201cCVE-2021-31195 is attributed to Orange Tsai of the DEVCORE research team, who was responsible for disclosing the ProxyLogon Exchange Server\u00a0vulnerabilities that [were] patched in an out-of-band release back in March,\u201d Satnam Narang, staff research engineer with Tenable, told Threatpost. \u201cWhile none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organizations that have yet to update their systems should do so as soon as possible.\u201d\n\nAnd finally, Ivanti\u2019s Goettl noted that several Microsoft products have reached end-of-life and won\u2019t be getting support going forward.\n\n\u201cThis month marks the final update for several Windows 10 and Server [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:42.786429Z"}, {"uuid": "3ee1b419-4207-470a-8bd3-e59c43e38b0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/hacking_Attack/82154", "content": "Black Hat Ethical Hacking\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection Vulnerabilities\n\nHackers Using Automated Attack to Exploit Exchange Server and SQL Injection VulnerabilitiesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Cybersecurity analysts at Prodraft\u2019s threat intelligence team detected\u00a0that the hacker group FIN7 was actively exploiting vulnerabilities in Microsoft Exchange and SQL injection through an automated attack system in an attempt to perform the following illicit activities:* Infiltrate corporate networks in order to steal information.\n* Data theft.\n* Adaptive ransomware attacks based on the financial size of the networks.\n\nFor years now, this security organization has closely followed the operations of FIN7. There are a number of details revealed by Prodaft about FIN7\u2019s behind-the-scenes:-\n\n* The hierarchy at the internal level.\n* Affiliations with a variety of ransomware projects.\n* A new SSH backdoor system.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Attack Modes and Auto-attackingFIN7 is a Russian-speaking threat group that has been active at least since 2012, and its motivations seem to be financial. \n\nA number of attacks have been linked to this threat group including:-\n\n* Attacks on ATMs.\n* The use of teddy bears to conceal malware-carrying USB drives.\n* Hiring pentesters to analyze ransomware attacks by setting up a false cybersecurity firm.\n* \nhttps://lh6.googleusercontent.com/bxGOUHzyqt1-qg7Uq2jsUnRi1HV_TyXD8GskpkUj8FCiC0GcPWtjfi1GMoJ-uOXsAZfvxua6L2oUgzkvxxELVUGQ2UjGfe91LwMwV280f0XKIkkr4TtLr72lNqOC0B11-KSzNN_roFQhJ-iK1PsO5AxGzJHFdVXCeJJ3oYQIowsVpWt1QF7TR92MaYZJZw \n<figcaptionAttack Modes \nThere is a system for automatic attacks called Checkmarks that has been discovered by Prodaft. So, in this scenario Checkmarks works as a scanner that scans for vulnerabilities that could result in remote code execution or privilege elevation in Microsoft Exchange, including:-\n\n* CVE-2021-34473\n* CVE-2021-34523\n* CVE-2021-31207\n\nSince June 2021 it\u2019s actively using Checkmarks for finding the corporate networks\u2019 vulnerable endpoints and exploiting them by using PowerShell to drop web shells which enabled FIN7 to gain access to corporate networks.\nhttps://lh5.googleusercontent.com/uIhqkcqkv5Fd4OCX_BWdGS6STKMeUdYYmhw9uRj__fsVqBI7uAhuNZHgOhZhXV_2An9pGMP4hb5CddH9eIejslPtDCRRpadLboahh3o-3DL3d5Ai92zpEY4yKqlriuK9MNXxCCiMAjJXcYTq0qC3BrITuQAUajMTQETbMuX6a7hAcHpuKxHPYxoHZaosXw \nAs part of its attack, FIN7 used multiple exploits, including its own custom code and publicly available Proof Of Concepts, to gain access to the target networks.\n\nThere are some other vulnerabilities that can be exploited with the Checkmarks attack platform in addition to the MS Exchange flaws. There is also a SQL injection module that uses SQLMap to scan for potential vulnerabilities on a website that may be exploited.\n\nFollowing the scanning of over 1.8 million targets with FIN7\u2019s Checkmarks platform, 8,147 companies have already been infiltrated. Here the most interesting thing is that all these companies are mainly based in the United States. \nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Digital Forensics Tool: Email Analyzer Communications With the C&C ServerApart from this, from the retrieved Jabber logs, the security analysts also found extensive evidence that multiple ransomware groups were in communication with FIN7, including:-\n\n* Darkside\n* REvil\n* LockBit\n\nThere is one particular det[...]", "creation_timestamp": "2026-09-02T01:01:29.133671Z"}, {"uuid": "4213be21-bc66-4944-8508-6671ca37542e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/hacking_Attack/83430", "content": "code execution and privilege elevation vulnerabilities, such as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.\n\nFIN7\u2019s new platform has already been used to infiltrate 8,147 companies, primarily located in the United States (16.7%), after scanning over 1.8 million targets.\nTrending: Operation OpRussia \u2013 Anonymous attacks on Russia Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-3-300x150.png PyTorch Framework compromised with dependency confusion attackJanuary 3, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-9-300x150.png New Linux malware uses 30 plugin exploits to backdoor WordPress sitesJanuary 2, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-8-300x150.png Google Home speakers allowed hackers to snoop on conversationsDecember 30, 2022\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-7-300x150.png Hackers abuse Google Ads to spread malware in legit softwareDecember 29, 2022\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Over 60,000 Exchange servers vulnerable to ProxyNotShell attacks first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:01:28.425339Z"}, {"uuid": "b0c48277-3c1c-4c6f-a6a2-7f3caeb9a7aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/hacking_Attack/8312", "content": "includes the fix for CVE-2021-31207, which made its debut in the 2021 Pwn2Own competition,\u201d he said.\n\nThe bug tracked as CVE-2021-31207 is only rated as \u201cmoderate,\u201d but the \u201csecurity feature-bypass exploit was showcased prominently in the Pwn2Own contest and at some point details of the exploit will be published,\u201d Goettl explained. \u201cAt that point threat actors will be able to take advantage of the vulnerability if they have not already begun attempting to reverse engineer an exploit.\u201d\n\nThere two other publicly disclosed vulnerabilities resolved by Microsoft this month that exist in Common Utilities, found in the NNI open-source toolkit (CVE-2021-31200), and in .NET and Visual Studio (CVE-2021-31204).\n\n\u201cCommon Utilities and .NET and Visual Studio are less likely to be targeted, but due to the public disclosures they should not be ignored for long,\u201d Goettl added. Other Notable Microsoft Security Patches for May 2021As for the other patches in the update that stood out to the research community, ZDI\u2019s Childs highlighted a Windows wireless networking information-disclosure bug, tracked as CVE-2020-24587.\n\n\u201cThe ZDI doesn\u2019t normally highlight info disclosure bugs, but this one has the potential to be pretty damaging,\u201d Childs said. \u201cThis patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system. It\u2019s not clear what the range on such an attack would be, but you should assume some proximity is needed. You\u2019ll also note this CVE is from 2020, which could indicate Microsoft has been working on this fix for some time.\u201d Windows Graphics, SharePoint Server PatchesA trio of local privilege escalation flaws \u2013 two in the Windows Graphics Component (CVE-2021-31188, CVE-2021-31170) and one in SharePoint Server (CVE-2021-28474) \u2013 caught Breen\u2019s eye.\n\nAs for the first two, he noted they could be chained with another bug, such as the wormable bug listed above, to become highly dangerous and allow for WannaCry-style attacks.\n\n\u201cThis kind of vulnerability is often used by attackers after they have already gained a foothold through an initial infection vector, like phishing or via another exploit like the RCE in HTTP.sys (CVE-2021-31166),\u201d Breen noted via email. \u201cThe attackers are looking to increase their privileges so they can move laterally across a network or gain access to other accounts that may have access to more sensitive information.\u201d\n\nMeanwhile, the SharePoint bug allows an authenticated attacker to run code on remote SharePoint Servers.\n\n\u201cAs this is post-authentication, it\u2019s likely to be used as part of post-exploitation and lateral movement phases of an attack, rather than the initial-infection vector,\u201d Breen said. \u201cAttackers could gain access to sensitive documents or even replace real documents with weaponized versions, enabling the compromise of more user devices across the organization\u2019s network.\u201d Microsoft Exchange Server PatchesMicrosoft also patched four vulnerabilities in Microsoft Exchange Server. The flaws (CVE-2021-31198, RCE; CVE-2021-31207, spoofing; CVE-2021-31209, security bypass; and CVE-2021-31195, RCE), are all rated important or moderate.\n\n\u201cCVE-2021-31195 is attributed to Orange Tsai of the DEVCORE research team, who was responsible for disclosing the ProxyLogon Exchange Server\u00a0vulnerabilities that [were] patched in an out-of-band release back in March,\u201d Satnam Narang, staff research engineer with Tenable, told Threatpost. \u201cWhile none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organizations that have yet to update their systems should do so as soon as possible.\u201d\n\nAnd finally, Ivanti\u2019s Goettl noted that several Microsoft products have reached end-of-life and won\u2019t be getting support going forward.\n\n\u201cThis month marks the final update for several Windows 10 and Server [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:18.950911Z"}, {"uuid": "d8d82cb2-6ac6-4aa2-a8fb-3a27a8da60b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/hacking_Attack/33374", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange servers hacked to deploy BlackByte ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange servers hacked to deploy BlackByte ransomwarePost Views: 118 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe BlackByte ransomware gang is now breaching corporate networks by exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities.\nProxyShell is the name for a set of three Microsoft Exchange vulnerabilities that allow unauthenticated, remote code execution on the server when chained together.\n\nThese vulnerabilities are listed below and were fixed by security updates released in April and May 2021:\n\n* CVE-2021-34473\u00a0\u2013 Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)\n* CVE-2021-34523\u00a0\u2013 Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)\n* CVE-2021-31207\u00a0\u2013 Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)\n\nSince researchers disclosed the vulnerabilities, threat actors have begun to exploit them\u00a0to breach servers and install web shells, coin miners, and ransomware.\nSee Also: Complete Offensive Security and Ethical Hacking Course BlackByte\u00a0begins exploiting ProxyShellIn a detailed report by Red Canary, researchers analyzed a BlackByte\u00a0ransomware attack where they saw them exploiting the ProxyShell vulnerabilities to install web shells on a compromised Microsoft Exchange server.\n\nWeb Shells are small scripts uploaded to web servers that allow a threat actor to gain persistence to a device and remotely execute commands or upload additional files to the server.\nhttps://www.bleepstatic.com/images/news/security/webshell-example.jpg \nBlackByte is still a severe threatWhen conducting ransomware attacks, threat actors commonly use third-party tools to gain elevated privileges or deploy the ransomware on a network.\n\nHowever, the actual BlackByte ransomware executable plays a central role as it handles both privilege escalation and the ability to worm, or perform lateral movement, within the compromised environment.\n\nThe malware sets three registry values, one for local privilege elevation, one for enabling network connection sharing between all privilege levels, and one to allow long path values for file paths, names, and namespaces.\n\nBefore encryption, the malware deletes the \u201cRaccine Rules Updater\u201d scheduled task to prevent last-minute interceptions and also wipes shadow copies directly through WMI objects using an obfuscated PowerShell command.\n\nFinally, stolen files are exfiltrated using WinRAR to archive files and anonymous file-sharing platforms such as \u201cfile.io\u201d or \u201canonymfiles.com.\u201d\n\nAlthough Trustwave released a decryptor\u00a0for BlackByte ransomware in October 2021, it is unlikely that the operators are still using the same encryption tactics that allowed victims to restore their files for free.\n\nAs such, you may or may not be able to restore your files using that decryptor, depending on what key wa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:32.891648Z"}, {"uuid": "3e0dba5d-9238-4b16-b82e-f3500170d9e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31207", "type": "seen", "source": "https://t.me/cissp/4021", "content": "Offensive security\nNuclei Scanner for Proxyshell RCE\n(CVE-2021-34423, CVE-2021-34473, CVE-2021-31207)\nhttps://github.com/cyberheartmi9/Proxyshell-Scanner\n\nCloud Security\nSecurity as code:\nThe best (and maybe only) path to securing cloud applications and systems\nhttps://www.mckinsey.com/business-functions/mckinsey-digital/our-insights/security-as-code-the-best-and-maybe-only-path-to-securing-cloud-applications-and-systems\n\n\nRed Team Tactics\n1.  ; echo \"Shell Injection\"\nhttps://matklad.github.io//2021/07/30/shell-injection.html\n2. Bypass UAC at any level by abusing the Program Compatibility Assistant with RPC, WDI, and more Windows components\nhttps://github.com/AzAgarampur/byeintegrity8-uac\n\nThreat Research\n1. Visual Studio Code\u00a0.ipynb\u00a0Jupyter Notebook XSS (Arbitrary File Read)\nhttps://github.com/justinsteven/advisories/blob/master/2021_vscode_ipynb_xss_arbitrary_file_read.md\n2. GraphQL Security Analysis\nhttps://securitygoat.medium.com/common-graphql-misconceptions-a-rant-489647167ca3", "creation_timestamp": "2026-09-02T01:04:30.331220Z"}]}