December 3, 2023
Severity High Analysis Summary A new and sophisticated Android malware, named FjordPhantom, has been disclosed by cybersecurity researchers. The malware targets users in Southeast Asian countries, […]
Rewterz Threat Advisory – CVE-2021-27240 – SolarWinds Patch Manager privilege escalation
February 25, 2021Rewterz Threat Advisory – CVE-2021-27241 – Avast Premium Security denial of service
February 25, 2021Rewterz Threat Advisory – CVE-2021-27240 – SolarWinds Patch Manager privilege escalation
February 25, 2021Rewterz Threat Advisory – CVE-2021-27241 – Avast Premium Security denial of service
February 25, 2021
Severity
High
Analysis Summary
The APT group Turla is known by many names including Krypton, MAKERSMARK, Snake, Uroburosk, Venomous Bear, Waterbug and WhiteBear, and is tracked by researchers. Turla is primarily known for its espionage activities. This time they’re back with the another malicious sample dropping malicious exe file samples to different users. Believed to be sponsored by the Russian FSB security service, Turla has been active since at least 2008 and while constantly evolving its own toolkit, has also been turning its attention towards the infrastructure and resources of other APTs.
Impact
Information theft and espionage
Indicators of Compromise
MD5
- 49786eae402075152fbbe8cd4b69545e
SHA-256
- e14e8fe43636dab896cbb6f65e3389e41f999f1a52e813bc5469d8ed61de1aae
SHA1
- 58ce5b72ce7d72572da76c12d1db0a9a68b40004
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.