Rewterz Threat Advisory –CVE-2021-29736 – IBM WebSphere Application Server Security Vulnerability
July 30, 2021Rewterz Threat Update – 2021 CVEs Being Exploited in the Wild
July 30, 2021Rewterz Threat Advisory –CVE-2021-29736 – IBM WebSphere Application Server Security Vulnerability
July 30, 2021Rewterz Threat Update – 2021 CVEs Being Exploited in the Wild
July 30, 2021Severity
Medium
Analysis Summary
Konni’s APT Group continues to attack malicious documents written in Russian. Konni’s APT Group conducts attacks with Russian-North Korean trade and economic investment documents.
The vector used for the attack is probably the Spear Phishing method and has been reported in Korea.
The malicious file suspected of being used as an attachment has the name Russia-North Korea-South Korea-Trade and Economic Relations-Investment.doc
The malicious DOC document file contains the following VBA code. If the [Use Content] button is clicked, the VBA malware included inside is activated. And the contents of the document are printed as follows, which makes the user dazzle like a normal document file. VBA code makes connections with malicious C2 servers contained in the ObjectPool zone. The attacker would communicate with the attacker’s server through a combination of instructions contained in the ObjectPool TextBox1 to TextBox3 data and content.
Impact
- Exposure of Sensitive Data
Indicators of Compromise
Filename
- economic relations[.]doc
MD5
- 9b1ca0408e33c43970b87c4c380b134f
SHA-256
- d283a0d5cfed4d212cd76497920cf820472c5f138fd061f25e3cddf65190283f
SHA-1
- 2fadfaef5179fe69bfecbd9adebd8f6a50615fa4
Remediation
- Block all threat indicators at your respective controls
- Always be suspicious about emails sent by unknown senders
- Never click on the link/attachments sent by unknown senders