https://vulnerability.circl.lu/sightings/feed 2026-09-17T13:07:55.064771+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6c0680e1-ebd2-43a9-9327-6d05b610b56b/export 2026-09-17T13:07:55.072159+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6c0680e1-ebd2-43a9-9327-6d05b610b56b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-0802", "type": "published-proof-of-concept", "source": "https://t.me/purp_sec/1420", "content": "\u0412\u0442\u043e\u0440\u043d\u0438\u043a \u2014 \u043f\u043e\u0440\u0430 \u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u043c\u0438 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430\u043c\u0438 \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c\u0438 \u0438 \u0438\u0445 \u00ab\u0442\u0432\u043e\u0440\u0447\u0435\u0441\u0442\u0432\u043e\u043c\u00bb.\n\n\u0421\u043e\u0431\u0440\u0430\u043b \u0432\u0430\u043c \u043f\u0430\u0440\u0443 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u0438 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043c\u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c\u0438.\n\n\ud83d\udd35 Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails \u2014 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e XWorm RAT. \u0416\u0435\u0440\u0442\u0432\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u0438\u0441\u044c\u043c\u043e \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c Excel-\u0444\u0430\u0439\u043b\u043e\u043c (.XLAM), \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f CVE-2018-0802 (RCE \u0432 Equation Editor). Shellcode \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 HTA \u0447\u0435\u0440\u0435\u0437 ShellExecuteExW, \u0434\u0430\u043b\u0435\u0435 PowerShell \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u00ab\u0444\u043e\u0442\u043e\u00bb (JPEG), \u0433\u0434\u0435 \u043c\u0435\u0436\u0434\u0443 \u043c\u0430\u0440\u043a\u0435\u0440\u0430\u043c\u0438 BaseStart/BaseEnd \u0441\u043f\u0440\u044f\u0442\u0430\u043d base64-\u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 .NET-\u043c\u043e\u0434\u0443\u043b\u044c. \u041f\u043e\u0441\u043b\u0435 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f process hollowing (\u0432 Msbuild.exe), \u043c\u0430\u043b\u0432\u0430\u0440\u044c \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 C2-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 (AES-\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435) \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439.\n\n\ud83d\udd35 Inside the Fix \u2014 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2026-21513 (security feature bypass \u0432 MSHTML/IEFRAME), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043b\u043e\u0442\u043d\u043e \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0442 \u0441 APT28. \u0412\u0435\u043a\u0442\u043e\u0440 \u2014 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 .LNK-\u0444\u0430\u0439\u043b \u0441\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c HTML \u043f\u043e\u0441\u043b\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b LNK. \u0427\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 iframe \u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 DOM \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u0445\u043e\u0434\u0438\u043b\u0438 Mark of the Web \u0438 Internet Explorer Enhanced Security Configuration (IE ESC), \u0447\u0442\u043e \u0432 \u0438\u0442\u043e\u0433\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u043e \u043a \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 URL \u0438 \u0432\u044b\u0437\u043e\u0432\u0443 ShellExecuteExW \u0431\u0435\u0437 \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430.\n\n\ud83d\udd35 Intel ME: Anatomy of a Ring -3 Backdoor \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043e\u0431\u0437\u043e\u0440 Intel Management Engine (ME), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 \u043e\u0442\u043a\u0440\u044b\u0442\u043e \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u00ab\u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c\u00bb. \u042d\u043a\u0441\u043f\u0435\u0440\u0442 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 ME \u043a\u0430\u043a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0441 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u043c \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u0442\u0435\u043a\u043e\u043c, \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0443\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c. \u0412 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0440\u0438\u0441\u043a\u0438 \u0438\u0437-\u0437\u0430 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0438 \u0430\u0443\u0434\u0438\u0442\u0430 ME \u0438 \u0438\u0441\u0442\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0410\u0432\u0442\u043e\u0440 \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u0435\u0442 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0442\u044c AMT \u043f\u0440\u0438 \u043d\u0435\u043d\u0430\u0434\u043e\u0431\u043d\u043e\u0441\u0442\u0438.\n\n\ud83d\udd35 GitLab Threat Intelligence Team reveals North Korean tradecraft \u2014 GitLab \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043e \u0441\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435. \u0412 2025 \u0433\u043e\u0434\u0443 \u043f\u043e\u0434 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u043f\u043e\u043f\u0430\u043b 131 \u0430\u043a\u043a\u0430\u0443\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0432\u044f\u0437\u0430\u043b\u0438 \u0441 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f\u043c\u0438 Lazarus \u0438 Contagious Interview. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u0440\u0435\u043a\u0440\u0443\u0442\u0435\u0440\u043e\u0432, \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0430\u044e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043d\u0430 \u00ab\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u043e\u0431\u0435\u0441\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f\u00bb \u0438 \u0443\u0431\u0435\u0436\u0434\u0430\u044e\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0441 GitLab. \u0412 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0432\u043d\u0443\u0442\u0440\u0438 \u0431\u044b\u043b\u0438 \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 BeaverTail \u0438 Ottercookie. \u041f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0445 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0434\u043b\u044f \u0442\u0440\u0443\u0434\u043e\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u0438\u043d\u043e\u0441\u0442\u0440\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n#blue_team #\u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0435", "creation_timestamp": "2026-09-15T00:00:11.218819Z"} 2026-09-15T00:00:11.218819+00:00 https://vulnerability.circl.lu/sighting/e7f7e254-971e-4322-9a26-666eac29286d/export 2026-09-17T13:07:55.074379+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "e7f7e254-971e-4322-9a26-666eac29286d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-0802", "type": "seen", "source": "https://t.me/purp_sec/1420", "content": "\u0412\u0442\u043e\u0440\u043d\u0438\u043a \u2014 \u043f\u043e\u0440\u0430 \u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u043c\u0438 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430\u043c\u0438 \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c\u0438 \u0438 \u0438\u0445 \u00ab\u0442\u0432\u043e\u0440\u0447\u0435\u0441\u0442\u0432\u043e\u043c\u00bb.\n\n\u0421\u043e\u0431\u0440\u0430\u043b \u0432\u0430\u043c \u043f\u0430\u0440\u0443 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u0438 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043c\u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c\u0438.\n\n\ud83d\udd35 Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails \u2014 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e XWorm RAT. \u0416\u0435\u0440\u0442\u0432\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u0438\u0441\u044c\u043c\u043e \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c Excel-\u0444\u0430\u0439\u043b\u043e\u043c (.XLAM), \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f CVE-2018-0802 (RCE \u0432 Equation Editor). Shellcode \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 HTA \u0447\u0435\u0440\u0435\u0437 ShellExecuteExW, \u0434\u0430\u043b\u0435\u0435 PowerShell \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u00ab\u0444\u043e\u0442\u043e\u00bb (JPEG), \u0433\u0434\u0435 \u043c\u0435\u0436\u0434\u0443 \u043c\u0430\u0440\u043a\u0435\u0440\u0430\u043c\u0438 BaseStart/BaseEnd \u0441\u043f\u0440\u044f\u0442\u0430\u043d base64-\u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 .NET-\u043c\u043e\u0434\u0443\u043b\u044c. \u041f\u043e\u0441\u043b\u0435 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f process hollowing (\u0432 Msbuild.exe), \u043c\u0430\u043b\u0432\u0430\u0440\u044c \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 C2-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 (AES-\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435) \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439.\n\n\ud83d\udd35 Inside the Fix \u2014 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2026-21513 (security feature bypass \u0432 MSHTML/IEFRAME), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043b\u043e\u0442\u043d\u043e \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0442 \u0441 APT28. \u0412\u0435\u043a\u0442\u043e\u0440 \u2014 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 .LNK-\u0444\u0430\u0439\u043b \u0441\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c HTML \u043f\u043e\u0441\u043b\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b LNK. \u0427\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 iframe \u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 DOM \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u0445\u043e\u0434\u0438\u043b\u0438 Mark of the Web \u0438 Internet Explorer Enhanced Security Configuration (IE ESC), \u0447\u0442\u043e \u0432 \u0438\u0442\u043e\u0433\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u043e \u043a \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 URL \u0438 \u0432\u044b\u0437\u043e\u0432\u0443 ShellExecuteExW \u0431\u0435\u0437 \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430.\n\n\ud83d\udd35 Intel ME: Anatomy of a Ring -3 Backdoor \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043e\u0431\u0437\u043e\u0440 Intel Management Engine (ME), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 \u043e\u0442\u043a\u0440\u044b\u0442\u043e \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u00ab\u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c\u00bb. \u042d\u043a\u0441\u043f\u0435\u0440\u0442 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 ME \u043a\u0430\u043a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0441 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u043c \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u0442\u0435\u043a\u043e\u043c, \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0443\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c. \u0412 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0440\u0438\u0441\u043a\u0438 \u0438\u0437-\u0437\u0430 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0438 \u0430\u0443\u0434\u0438\u0442\u0430 ME \u0438 \u0438\u0441\u0442\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0410\u0432\u0442\u043e\u0440 \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u0435\u0442 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0442\u044c AMT \u043f\u0440\u0438 \u043d\u0435\u043d\u0430\u0434\u043e\u0431\u043d\u043e\u0441\u0442\u0438.\n\n\ud83d\udd35 GitLab Threat Intelligence Team reveals North Korean tradecraft \u2014 GitLab \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043e \u0441\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435. \u0412 2025 \u0433\u043e\u0434\u0443 \u043f\u043e\u0434 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u043f\u043e\u043f\u0430\u043b 131 \u0430\u043a\u043a\u0430\u0443\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0432\u044f\u0437\u0430\u043b\u0438 \u0441 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f\u043c\u0438 Lazarus \u0438 Contagious Interview. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u0440\u0435\u043a\u0440\u0443\u0442\u0435\u0440\u043e\u0432, \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0430\u044e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043d\u0430 \u00ab\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u043e\u0431\u0435\u0441\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f\u00bb \u0438 \u0443\u0431\u0435\u0436\u0434\u0430\u044e\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0441 GitLab. \u0412 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0432\u043d\u0443\u0442\u0440\u0438 \u0431\u044b\u043b\u0438 \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 BeaverTail \u0438 Ottercookie. \u041f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0445 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0434\u043b\u044f \u0442\u0440\u0443\u0434\u043e\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u0438\u043d\u043e\u0441\u0442\u0440\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n#blue_team #\u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0435", "creation_timestamp": "2026-09-14T18:00:06.868408Z"} 2026-09-14T18:00:06.868408+00:00 https://vulnerability.circl.lu/sighting/8aba6dce-1836-47e3-99e2-fa684b24ec55/export 2026-09-17T13:07:55.074580+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8aba6dce-1836-47e3-99e2-fa684b24ec55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-0802", "type": "published-proof-of-concept", "source": "https://t.me/kasperskylab_ru/7648", "content": "\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c APT-\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Cloud Atlas. \u0412 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0431\u044b\u043b \u0437\u0430\u043c\u0435\u0447\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u2014 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c CloudAtlasGo, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Golang. \u0420\u0430\u043d\u0435\u0435 \u044d\u0442\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 PowerShell \u0438 VBS.\n\u00a0\n\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0444\u0430\u043a\u0442\u044b \u043e \u043d\u043e\u0432\u043e\u043c \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u0435:\n\ud83d\udd35\u041d\u0430\u0447\u0430\u043b\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c \u043d\u0435\u0438\u0437\u043c\u0435\u043d\u043d\u044b\u043c \u2014 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u044e\u0442 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b CVE-2018-0802.\n\ud83d\udd35\u041f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0441\u0432\u044f\u0437\u0438 \u0441 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u2014 \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438 Trello. \u0417\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u043d \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0432 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f\u0445 \u043a\u0430\u0440\u0442\u043e\u0447\u0435\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432.\n\ud83d\udd35\u0417\u043b\u043e\u0432\u0440\u0435\u0434 \u0443\u043c\u0435\u0435\u0442 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u044b, \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043e\u0442\u043b\u0430\u0434\u0447\u0438\u043a\u0430.\n\ud83d\udd35\u2060\u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 CloudAtlasGo \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u0430, \u0441\u0445\u0435\u043c\u044b \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\nKaspersky \ud83d\udc99 \u0412\u041a | \ud83d\udcac Max | \ud83d\udcdd \u0414\u0437\u0435\u043d\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-10T00:00:56.440227Z"} 2026-09-10T00:00:56.440227+00:00 https://vulnerability.circl.lu/sighting/8abe3833-fdfb-4ec3-b13a-be820abe56fa/export 2026-09-17T13:07:55.074721+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8abe3833-fdfb-4ec3-b13a-be820abe56fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-0802", "type": "published-proof-of-concept", "source": "https://t.me/kasperskylab_ru/7648", "content": "\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c APT-\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Cloud Atlas. \u0412 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0431\u044b\u043b \u0437\u0430\u043c\u0435\u0447\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u2014 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c CloudAtlasGo, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Golang. \u0420\u0430\u043d\u0435\u0435 \u044d\u0442\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 PowerShell \u0438 VBS.\n\u00a0\n\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0444\u0430\u043a\u0442\u044b \u043e \u043d\u043e\u0432\u043e\u043c \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u0435:\n\ud83d\udd35\u041d\u0430\u0447\u0430\u043b\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c \u043d\u0435\u0438\u0437\u043c\u0435\u043d\u043d\u044b\u043c \u2014 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u044e\u0442 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b CVE-2018-0802.\n\ud83d\udd35\u041f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0441\u0432\u044f\u0437\u0438 \u0441 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u2014 \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438 Trello. \u0417\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u043d \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0432 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f\u0445 \u043a\u0430\u0440\u0442\u043e\u0447\u0435\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432.\n\ud83d\udd35\u0417\u043b\u043e\u0432\u0440\u0435\u0434 \u0443\u043c\u0435\u0435\u0442 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u044b, \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043e\u0442\u043b\u0430\u0434\u0447\u0438\u043a\u0430.\n\ud83d\udd35\u2060\u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 CloudAtlasGo \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u0430, \u0441\u0445\u0435\u043c\u044b \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\nKaspersky \ud83d\udc99 \u0412\u041a | \ud83d\udcac Max | \ud83d\udcdd \u0414\u0437\u0435\u043d\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-09T03:00:07.482316Z"} 2026-09-09T03:00:07.482316+00:00 https://vulnerability.circl.lu/sighting/7a9d909d-ed05-4094-873e-2417d91e289e/export 2026-09-17T13:07:55.074845+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7a9d909d-ed05-4094-873e-2417d91e289e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-0808", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ntusermndragover.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86\", \"author\": [\"Cl\\u00e9ment Lecigne\", \"Grant Willcox\", \"timwr\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a NULL pointer dereference vulnerability in\\n MNGetpItemFromIndex(), which is reachable via a NtUserMNDragOver() system call.\\n\\n The NULL pointer dereference occurs because the xxxMNFindWindowFromPoint()\\n function does not effectively check the validity of the tagPOPUPMENU\\n objects it processes before passing them on to MNGetpItemFromIndex(),\\n where the NULL pointer dereference will occur.\\n\\n This module has been tested against Windows 7 x86 SP0 and SP1. Offsets\\n within the solution may need to be adjusted to work with other versions\\n of Windows, such as Windows Server 2008.\", \"disclosure_date\": \"2019-03-12\", \"fullname\": \"exploit/windows/local/ntusermndragover\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:46 +0000\", \"name\": \"Microsoft Windows NtUserMNDragOver Local Privilege Elevation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"screen-effects\"], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/exploits/windows/local/ntusermndragover.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/local/ntusermndragover\", \"references\": [\"CVE-2019-0808\", \"URL-https://github.com/exodusintel/CVE-2019-0808\", \"URL-https://github.com/ze0r/cve-2019-0808-poc\", \"URL-http://blogs.360.cn/post/RootCause_CVE-2019-0808_EN.html\", \"URL-https://blog.exodusintel.com/2019/05/17/windows-within-windows/\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Windows 7 x86\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:12.412008Z"} 2026-09-08T06:52:12.412008+00:00 https://vulnerability.circl.lu/sighting/0609415c-cad4-4e21-82c7-6da144e92c76/export 2026-09-17T13:07:55.074975+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "0609415c-cad4-4e21-82c7-6da144e92c76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-0805", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"Unknown\", \"jduck \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a memory corruption vulnerability in the Internet Explorer\\n Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet\\n Explorer are vulnerable.\\n\\n By specifying a long value as the \\\"DataURL\\\" parameter to this control, it is possible\\n to write a NUL byte outside the bounds of an array. By targeting control flow data\\n on the stack, an attacker can execute arbitrary code.\", \"disclosure_date\": \"2010-03-09\", \"fullname\": \"exploit/windows/browser/ms10_018_ie_tabular_activex\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"windows/browser/ms10_018_ie_tabular_activex\", \"references\": [\"CVE-2010-0805\", \"OSVDB-63329\", \"BID-39025\", \"ZDI-10-034\", \"MSB-MS10-018\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Automatic (Heap Spray)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:09.035291Z"} 2026-09-08T06:51:09.035291+00:00 https://vulnerability.circl.lu/sighting/d0b427aa-aeaa-48bc-93cf-ea9b982d974f/export 2026-09-17T13:07:55.075098+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d0b427aa-aeaa-48bc-93cf-ea9b982d974f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-0806", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"unknown\", \"Trancer \", \"Nanika\", \"jduck \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a use-after-free vulnerability within the DHTML behaviors\\n functionality of Microsoft Internet Explorer versions 6 and 7. This bug was\\n discovered being used in-the-wild and was previously known as the \\\"iepeers\\\"\\n vulnerability. The name comes from Microsoft's suggested workaround to block\\n access to the iepeers.dll file.\\n\\n According to Nico Waisman, \\\"The bug itself is when trying to persist an object\\n using the setAttribute, which end up calling VariantChangeTypeEx with both the\\n source and the destination being the same variant. So if you send as a variant\\n an IDISPATCH the algorithm will try to do a VariantClear of the destination before\\n using it. This will end up on a call to PlainRelease which deref the reference\\n and clean the object.\\\"\\n\\n NOTE: Internet Explorer 8 and Internet Explorer 5 are not affected.\", \"disclosure_date\": \"2010-03-09\", \"fullname\": \"exploit/windows/browser/ms10_018_ie_behaviors\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"windows/browser/ms10_018_ie_behaviors\", \"references\": [\"CVE-2010-0806\", \"OSVDB-62810\", \"BID-38615\", \"URL-https://web.archive.org/web/20100929225343/http://www.avertlabs.com/research/blog/index.php/2010/03/09/targeted-internet-explorer-0day-attack-announced-cve-2010-0806/\", \"URL-https://web.archive.org/web/20120627174253/http://eticanicomana.blogspot.com/2010/03/aleatory-persitent-threat.html\", \"MSB-MS10-018\"], \"rport\": null, \"session_types\": false, \"targets\": [\"(Automatic) IE6, IE7 on Windows NT, 2000, XP, 2003 and Vista\", \"IE 6 SP0-SP2 (onclick)\", \"IE 7.0 (marquee)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:08.943820Z"} 2026-09-08T06:51:08.943820+00:00 https://vulnerability.circl.lu/sighting/67f2f915-c233-4fbc-974a-53d450ce2c95/export 2026-09-17T13:07:55.075221+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "67f2f915-c233-4fbc-974a-53d450ce2c95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2001-0803", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/dtspcd/heap_noir.rb", "content": "{\"aliases\": [], \"arch\": \"sparc\", \"author\": [\"noir \", \"hdm \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This is a port of noir's dtspcd exploit. This module should\\n work against any vulnerable version of Solaris 8 (sparc).\\n The original exploit code was published in the book\\n Shellcoder's Handbook.\", \"disclosure_date\": \"2002-07-10\", \"fullname\": \"exploit/solaris/dtspcd/heap_noir\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:31 +0000\", \"name\": \"Solaris dtspcd Heap Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-service-restarts\"]}, \"path\": \"/modules/exploits/solaris/dtspcd/heap_noir.rb\", \"platform\": \"Solaris\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"solaris/dtspcd/heap_noir\", \"references\": [\"CVE-2001-0803\", \"OSVDB-4503\", \"BID-3517\", \"URL-https://web.archive.org/web/20011116020106/http://www.cert.org/advisories/CA-2001-31.html\", \"URL-https://media.wiley.com/product_ancillary/83/07645446/DOWNLOAD/Source_Files.zip\"], \"rport\": 6112, \"session_types\": false, \"targets\": [\"Solaris 8\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:32.914045Z"} 2026-09-08T06:50:32.914045+00:00 https://vulnerability.circl.lu/sighting/ed210be2-f83b-4fa8-ba6d-ec9955edf0b0/export 2026-09-17T13:07:55.075333+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ed210be2-f83b-4fa8-ba6d-ec9955edf0b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-0803", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/polarcms_upload_exec.rb", "content": "{\"aliases\": [], \"arch\": \"php, x86\", \"author\": [\"Fady Mohamed Osman\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a file upload vulnerability found in PolarBear CMS\\n By abusing the upload.php file, a malicious user can upload a file to a temp\\n directory without authentication, which results in arbitrary code execution.\", \"disclosure_date\": \"2012-01-21\", \"fullname\": \"exploit/multi/http/polarcms_upload_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"PolarBear CMS PHP File Upload Vulnerability\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/polarcms_upload_exec.rb\", \"platform\": \"Linux,PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/polarcms_upload_exec\", \"references\": [\"CVE-2013-0803\", \"OSVDB-90627\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Generic (PHP Payload)\", \"Linux x86\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:09.654223Z"} 2026-09-08T06:50:09.654223+00:00 https://vulnerability.circl.lu/sighting/793df64e-5bd5-483f-9352-467e973511a8/export 2026-09-17T13:07:55.075448+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "793df64e-5bd5-483f-9352-467e973511a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-0807", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/glassfish_deployer.rb", "content": "{\"aliases\": [], \"arch\": \"java, x86\", \"author\": [\"juan vazquez \", \"Joshua Abraham \", \"sinn3r \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module logs in to a GlassFish Server (Open Source or Commercial) using various\\n methods (such as authentication bypass, default credentials, or user-supplied login),\\n and deploys a malicious war file in order to get remote code execution. It has been\\n tested on Glassfish 2.x, 3.0, 4.0 and Sun Java System Application Server 9.x. Newer\\n GlassFish versions do not allow remote access (Secure Admin) by default, but is required\\n for exploitation.\", \"disclosure_date\": \"2011-08-04\", \"fullname\": \"exploit/multi/http/glassfish_deployer\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 17:11:13 +0000\", \"name\": \"Sun/Oracle GlassFish Server Authenticated Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/glassfish_deployer.rb\", \"platform\": \"Java,Linux,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/glassfish_deployer\", \"references\": [\"CVE-2011-0807\", \"OSVDB-71948\", \"ATT&CK-T1021\"], \"rport\": 4848, \"session_types\": false, \"targets\": [\"Automatic\", \"Java Universal\", \"Windows Universal\", \"Linux Universal\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:49.091646Z"} 2026-09-08T06:49:49.091646+00:00