Malicious Tag Roundup (Sep 14-30, 2021) | Cybersecurity Blog | Grey Noise
Summary: GreyNoise's tag roundup for September 14-30, 2021 lists new detection tags including malicious-intent attempts against Azure Open Management Infrastructure (CVE-2021-38647, CVE-2021-38648, CVE-2021-38645, CVE-2021-38649), a remote file upload flaw in VMware vCenter Server Appliance (CVE-2021-22005, CVE-2021-22017), and default-credential SSH authentication against Cisco IMC Supervisor and UCS Director (CVE-2019-1935). Other tags cover LDAP SearchRequest crawling, Veeder-Root automatic tank gauge discovery, Printer Job Language commands, PowerShell reverse or bind shell attempts, and VMware vCenter file disclosure.
Key Takeaway: The list shows attackers scanning for Azure OMI root RCE and VMware vCenter file upload flaws within weeks of disclosure, alongside a Cisco backdoor reachable with default SSH credentials - so unpatched management infrastructure is the target, not the perimeter.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Mentions
- CVE-2019-1935CVE-2021-22005CVE-2021-22017CVE-2021-38645CVE-2021-38647CVE-2021-38648CVE-2021-38649
- Related
- Threat Source newsletter (Sept. 23, 2021) Cyber Risks ·Threat Brief: OMI Vulnerabilities (CVE-2021-38645, CVE-2021-38647, CVE-2021-38648 and CVE-2021-38649) Cyber Risks ·CVE-2021-22017: VMware vCenter Server Improper Access Control Known Exploited Vulnerabilities · Jan 10, 2022