{"uuid": "5fb80e8a-c034-48e7-9f5a-2f47940b9fa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/cissp/3917", "content": "Always check to ensure that you are downloading software from the legitimate website for the desired product.\nMITRE ATT&CK: [MITRE ATT&CK] Obfuscated Files or Information - T1027 | [MITRE ATT&CK] Software Discovery - T1518 | [MITRE ATT&CK] Remote Services - T1021 | [MITRE ATT&CK] Command-Line Interface - T1059 | [MITRE ATT&CK] Standard Application Layer Protocol - T1071\nTags: Malware loader, MosaicLoader, Cracked software\nCVE-2021-3438: 16 Years in Hiding \u2013 Millions of Printers Worldwide Vulnerable\n(published: July 20, 2021)\nA high-severity vulnerability, registered as CVE-2021-3438, has been identified by SentinelLabs researchers that affects HP, Samsung, and Xerox printers. The vulnerability has resided in the printers\u2019 driver software since 2005. The number of printers created by HP, Samsung, and Xerox during the last 16 years amounts to over 380 different models by HP and Samsung and at least 12 Xerox models. Exploitation of CVE-2021-3438, which is a kernel driver vulnerability, can result in an unprivileged user account changing to \u201cSYSTEM account and run code in kernel mode (since the vulnerable driver is locally available to anyone).\u201d Researchers note that they have not seen this vulnerability actively-exploited in the wild.\nAnalyst Comment: The potential scope of this vulnerability is significant. Users should follow Security Advisories from both HP (HPSBPI03724) and Xerox (XRX21K) and apply the necessary patches as soon as possible. The list of affected HP and Samsung printer models can be found here, and the list of affected Xerox printers models can be found here.\nTags: Vulnerability, CVE-2021-3438, Printer driver software, HP, Samsung, Xerox\nRemcos RAT Delivered via Visual Basic\n(published: July 19, 2021)\nMalwarebytes researchers have discovered a financially-themed malspam campaign that distributed the remote access tool (RAT) Remcos. All of the malspam email subject lines are typical for malspam delivering a commodity tool like Remcos. Some of these subject lines include: Appraisal Report for you Loan Application-1100788392210, FWD: Reminder: Your July Appointment-11002214991. The emails refer recipients to an attached archive that, if downloaded, will enable a Visual Basic script to download and execute a Remcos payload. Researchers found metadata inside the archive inside a .hta file that included \u201cdemo\u201d in its code which researchers suggest may indicate that threat actors are testing new code.\nAnalyst Comment: Financially-themed malspam emails are a common tactic among threat actors, therefore, it is crucial that your employees are aware of their financial institutions policies regarding electronic communication. If a user is concerned due to the scare tactics often used in such emails, they should contact their financial institution via legitimate email or another form of communication.\nMITRE ATT&CK: [MITRE ATT&CK] Obfuscated Files or Information - T1027 | [MITRE ATT&CK] Command-Line Interface - T1059 | REVOKED - [MITRE ATT&CK] File Permissions Modification - T1222\nTags: Malspam, VB Script, Remcos RAT\nResearchers Warn of Linux Cryptojacking Attackers Operating from Romania\n(published: July 19, 2021)\nA new cryptojacking threat group, which is likely based in Romania and has been active since at least 2020, is actively attacking Linux-based machines with weak SSH passwords, according to Bitdefender researchers. The group uses a previously-unknown SSH brute force attack tool written in Go, dubbed \u201cDiicot brute,\u201d that is reportedly being sold as a software-as-a-service (SaaS). In addition, the unnamed group is also involved in distributed denial-of-service (DDoS), which involves a variant of the DDoS botnet malware Demonbot called \u201cchernobyl.\u201d The group is primarily-motivated by mining Monero cryptocurrency via XMRig through access gained by conducting SSH brute force attacks.", "creation_timestamp": "2026-09-01T17:00:45.163963Z"}