Mastodon

🛡 H3lium@infosec.exchange/:~# :blinking_cursor:"🚨 Lazarus Group Unleashes CollectionRAT in Sophisticated Campaigns 🚨"Lazarus Group, a North Korean state-sponsored actor, has been utilizing infrastructure reuse to launch sophisticated cyber attacks. Their latest campaign exploits CVE-2022-47966, a vulnerability in ManageEngine ServiceDesk, to deploy multiple threats including a new malware, CollectionRAT. This RAT showcases capabilities such as executing arbitrary commands and managing files on infected systems. Intriguingly, Lazarus Group is increasingly leveraging open-source tools like the DeimosC2 framework, marking a strategic shift in their attack methodologies. CollectionRAT, along with other tools like the malicious PuTTY Link (Plink), indicates a refined approach in their cyber warfare tactics.Details: <a href="https://blog.talosintelligence.com/lazarus-collectionrat/" rel="nofollow noopener noreferrer" target="_blank">Cisco Talos Blog</a>Authors: Asheer Malhotra, Vitor Ventura, Jungsoo AnTags: <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/LazarusGroup" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LazarusGroup</a> <a href="https://infosec.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#APT</a> <a href="https://infosec.exchange/tags/CollectionRAT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CollectionRAT</a> <a href="https://infosec.exchange/tags/DeimosC2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DeimosC2</a> <a href="https://infosec.exchange/tags/CVE202247966" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE202247966</a> <a href="https://infosec.exchange/tags/ManageEngine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ManageEngine</a> <a href="https://infosec.exchange/tags/Plink" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Plink</a> <a href="https://infosec.exchange/tags/NorthKorea" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NorthKorea</a> <a href="https://infosec.exchange/tags/StateSponsoredCyberAttacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#StateSponsoredCyberAttacks</a> 💻🌍🔐<a href="https://attack.mitre.org/groups/G0032/" rel="nofollow noopener noreferrer" target="_blank">Mitre - Lazarus Group</a>

Ron BowesI just posted our <a href="https://infosec.exchange/tags/Rapid7" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Rapid7</a> technical analysis of the recent vulnerability in <a href="https://infosec.exchange/tags/ManageEngine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ManageEngine</a> - CVE-2022-47966 (<a href="https://infosec.exchange/tags/cve202247966" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cve202247966</a> / <a href="https://infosec.exchange/tags/CVE_2022_47966" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE_2022_47966</a>. Big thanks to <a href="https://infosec.exchange/@catc0n" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@catc0n</a> and my new co-worker @stephenfewer@twitter.com for their help on this one! I can see I have a lot to learn from Stephen :)<a href="https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis" rel="nofollow noopener noreferrer" target="_blank">https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis</a>

Recent searches

Search options

Administered by:

Server stats:

#cve202247966