{"uuid": "784765ee-a983-45c0-a2c3-ed67b7a26179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3931", "content": "Malware analysis\n1. Malicious Content Delivered Through archive.org\ud83d\ude0a\nhttps://isc.sans.edu/forums/diary/Malicious+Content+Delivered+Through+archiveorg/27688\n2. Crimea \"manifesto\" deploys VBA Rat using double attack vectors\nhttps://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-deploys-vba-rat-using-double-attack-vectors\n\nexploit\nCVE-2021-34470:\nMS Exchange AD Schema Misconfiguration Privilege Escalation (PoC)\ud83d\ude03\nhttps://packetstormsecurity.com/files/163706/Microsoft-Exchange-AD-Schema-Misconfiguration-Privilege-Escalation.html\n\nThreat Research\n1. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group\nhttps://unit42.paloaltonetworks.com/thor-plugx-variant\n2. Vultur RAT malware, with a V for VNC\nhttps://www.threatfabric.com/blogs/vultur-v-for-vnc.html\n\nFinding and Exploiting Unintended Functionality in Main Web App APIs\nhttps://bendtheory.medium.com/finding-and-exploiting-unintended-functionality-in-main-web-app-apis-6eca3ef000af", "creation_timestamp": "2026-09-10T23:00:04.712561Z"}