Emissary Panda Attacks Middle East Government Share Point Servers
Summary: In April 2019, Unit 42 observed the Emissary Panda threat group installing webshells on three SharePoint servers hosted by two Middle East government organizations, uploading 24 unique executables between April 1 and April 16. The actors are believed to have exploited the remote code execution vulnerability CVE-2019-0604, then used tools including Mimikatz, a scanner for CVE-2017-0144 (the EternalBlue vulnerability), and the HyperBro backdoor to dump credentials and move laterally.
Why it matters: A patched SharePoint flaw gave Emissary Panda a beachhead on two government networks, and the group then reached for EternalBlue, the same vulnerability behind WannaCry, to spread further - so an unpatched web-facing server is the entry point, not the end of the story.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-0144CVE-2019-0604
- Related
- CVE-2017-0144: Microsoft SMBv1 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022CVE-2019-0604: Microsoft Share Point Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Microsoft Patch Tuesday, Sept. 2020 Edition Cyber Risks ·