Threat Source newsletter (May 11, 2023) — So much for that ransomware decline
Summary: Cisco Talos researchers found a new phishing-as-a-service tool called "Greatness" that steals Microsoft Office login credentials from large organizations, using MFA bypass, IP filtering and Telegram bot integration, with attacks dating back to mid-2022. The newsletter also notes new exploit code for the critical PaperCut vulnerability CVE-2023-27350, an unauthenticated remote code execution flaw in PaperCut MF or NG versions 8.0 or later that bypasses Sysmon-based detections and is being exploited by Iranian state-sponsored actors MuddyWater and Charming Kitten.
Bottom line: Greatness is sold as a service, so anyone can buy access to MFA bypass and convincing credential-harvesting pages aimed at large organizations, and the PaperCut flaw carries a 9.8 CVSS score with working exploit code that already evades existing Sysmon detections.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Mentions
- CVE-2023-27350
- Related
- Grey Noise Round Up: Product Updates - April 2023 Cyber Risks ·CVE-2023-27350: Paper Cut MF/NG Improper Access Control Vulnerability Known Exploited Vulnerabilities · Apr 21, 2023