Actors Still Exploiting Share Point Vulnerability to Attack Middle East Government Organizations
Summary: Unit 42 observed unknown actors exploiting CVE-2019-0604 on September 10, 2019 to install webshells on a Middle East government organization's SharePoint site, then moved laterally using a custom-loaded Mimikatz variant and Impacket's atexec. A January 10, 2020 Shodan search found 28,881 servers advertising a vulnerable SharePoint version, and the same Mimikatz variant appeared on September 19, 2019 at a second Middle East government organization in another country.
Bottom line: Nearly 29,000 internet-facing SharePoint servers advertised a vulnerable version months after Microsoft's patch, and the shared custom .NET Mimikatz loader ties both intrusions to one group - so an unpatched collaboration server is the entry point, not the edge case.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-0604
- Related
- CVE-2019-0604: Microsoft Share Point Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Microsoft Patch Tuesday, Sept. 2020 Edition Cyber Risks ·