{"metadata": {"vulnerability": "cve-2021-26411", "count": 86, "kinds": {"milestone": 7, "sighting": 49, "kev": 11, "other": 19}}, "data": [{"timestamp": "2021-01-29T00:00:00Z", "date_only": false, "value": "2021-01-29T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2021-26411", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-03-09T16:00:00Z", "date_only": false, "value": "2021-03-09T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "cve-2021-26411", "field": "containers.cna.datePublic"}, {"timestamp": "2021-03-10T00:00:00Z", "date_only": false, "value": "2021-03-10T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-178", "record": "CERTFR-2021-AVI-178", "field": "last_revision_date"}, {"timestamp": "2021-03-10T00:00:00Z", "date_only": false, "value": "2021-03-10T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-179", "record": "CERTFR-2021-AVI-179", "field": "last_revision_date"}, {"timestamp": "2021-03-10T00:00:00Z", "date_only": false, "value": "2021-03-10T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-178", "record": "CERTFR-2021-AVI-178", "field": "initial_release_date"}, {"timestamp": "2021-03-10T00:00:00Z", "date_only": false, "value": "2021-03-10T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-179", "record": "CERTFR-2021-AVI-179", "field": "initial_release_date"}, {"timestamp": "2021-03-10T00:00:00Z", "date_only": false, "value": "2021-03-10T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-178", "record": "CERTFR-2021-AVI-178", "field": "revisions.0.revision_date"}, {"timestamp": "2021-03-10T00:00:00Z", "date_only": false, "value": "2021-03-10T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-179", "record": "CERTFR-2021-AVI-179", "field": "revisions.0.revision_date"}, {"timestamp": "2021-03-10T04:00:00Z", "date_only": false, "value": "2021-03-10T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=560", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "157caca4-c6b2-47f1-aa55-47ddb15fcd69", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=560"}, {"timestamp": "2021-03-10T15:20:45Z", "date_only": false, "value": "2021-03-10T15:20:45.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/1504", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "2d7c9877-305f-4e7c-981b-e66bc00d4e52", "content": "Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0435 \u0432\u0442\u043e\u0440\u043d\u0438\u0447\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0412\u0441\u0435\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e 89 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438\u0437 \u043d\u0438\u0445 14 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u041f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 - \u0447\u0435\u0442\u044b\u0440\u0435 \u043f\u0440\u0435\u0441\u043b\u043e\u0432\u0443\u0442\u044b\u0445 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 Microsoft Exchange, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0430\u044f APT Hafnium (\u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 Microsoft \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0438\u0445 \u0432\u043d\u0435\u043e\u0447\u0435\u0440\u0435\u0434\u043d\u044b\u043c \u043f\u0430\u0442\u0447\u0435\u043c 2 \u043c\u0430\u0440\u0442\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u043e\u0432\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 - \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u043b\u043e\u0443\u043f\u043e\u043a\u043e\u0432), \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-26411 \u0432 Edge \u0438 Internet Explorer. \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0443 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 (RCE) \u043f\u0440\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0441\u0430\u0439\u0442\u0430.\n\n\u042d\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0437 APT Lazarus \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0414\u043b\u044f \u043d\u0435\u0435 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d PoC, \u0442\u0430\u043a \u0447\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c Explorer  \u0438 Edge (\u0434\u0430-\u0434\u0430, \u0435\u0441\u0442\u044c \u0438 \u0442\u0430\u043a\u0438\u0435) \u043b\u0443\u0447\u0448\u0435 \u043f\u043e\u0431\u044b\u0441\u0442\u0440\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f.\n\n\u041d\u043e \u0438 \u043a\u0440\u043e\u043c\u0435 \u044d\u0442\u0438\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0432 \u043f\u0430\u0442\u0447\u0435 \u0445\u0432\u0430\u0442\u0430\u0435\u0442 \u0433\u043e\u0434\u043d\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439, \u043a \u043f\u0440\u0438\u043c\u0435\u0440\u0443 CVE-2021-26897, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f RCE. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u044b \u0437\u043d\u0430\u0435\u0442\u0435, \u0447\u0442\u043e \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0441\u0434\u0435\u043b\u0430\u0442\u044c.", "url": "https://t.me/true_secator/1504"}, {"timestamp": "2021-03-11T15:07:28Z", "date_only": false, "value": "2021-03-11T15:07:28.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2021-26411", "field": "cveMetadata.datePublished"}, {"timestamp": "2021-03-11T16:15:00Z", "date_only": false, "value": "2021-03-11T16:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C5RH-MMR6-C7CH", "record": "GHSA-C5RH-MMR6-C7CH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-03-11T16:15:13.863Z", "date_only": false, "value": "2021-03-11T16:15:13.863", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-26411", "record": "FKIE_CVE-2021-26411", "field": "published"}, {"timestamp": "2021-03-11T16:15:13.863Z", "date_only": false, "value": "2021-03-11T16:15:13.863", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2021-26411", "record": "GSD-2021-26411", "field": "namespaces.nvd.nist.gov.cve.published"}, {"timestamp": "2021-03-11T19:00:31Z", "date_only": false, "value": "2021-03-11T19:00:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/24780", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "7a549753-22cb-491a-b600-c7064cad0986", "content": "\u203c CVE-2021-26411 \u203c\n\nInternet Explorer Memory Corruption Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/24780"}, {"timestamp": "2021-03-15T04:50:46Z", "date_only": false, "value": "2021-03-15T04:50:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/infobes/295", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "e2fd000d-d229-47a2-9d36-23c252a1e2d1", "content": "#Analytics\n10 most exploited vulnerabilities of the week (march 8 - 14)\nCVE-2021-26855, CVE-2021-27065 - ProxyLogon MS Exchange Server RCE Vulnerability\nhttps://t.me/cybersecuritytechnologies/2835\nCVE-2021-1732 - Windows kernel 0-day exploit\nhttps://t.me/cybersecuritytechnologies/2679\nCVE-2021-22986, CVE-2021-22987 - F5 BIG-IP TMM uri_normalize_host infoleak and out-of-bounds write\nhttps://t.me/cybersecuritytechnologies/2881\nCVE-2021-21193 - Google Chrome Blink code execution\nhttps://vulmon.com/vulnerabilitydetails?qid=CVE-2021-21193\nCVE-2021-21978 - VMware View Planner\u00a0RCE\nhttps://mobile.twitter.com/osama_hroot/status/1367258907601698816\nhttps://paper.seebug.org/1495\nCVE-2021-21300 - Git vulnerability\nhttps://t.me/cybersecuritytechnologies/2880\nCVE-2021-26411 - IE mshtml use-after-free\nhttps://t.me/cybersecuritytechnologies/2908", "url": "https://t.me/infobes/295"}, {"timestamp": "2021-03-15T11:00:37Z", "date_only": false, "value": "2021-03-15T11:00:37.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/2911", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "2e4dede1-e506-4d67-be84-e6585878f0dc", "content": "#Analytics\n10 most exploited vulnerabilities of the week (march 8 - 14)\nCVE-2021-26855, CVE-2021-27065 - ProxyLogon MS Exchange Server RCE Vulnerability\nhttps://t.me/cybersecuritytechnologies/2835\nCVE-2021-1732 - Windows kernel 0-day exploit\nhttps://t.me/cybersecuritytechnologies/2679\nCVE-2021-22986, CVE-2021-22987 - F5 BIG-IP TMM uri_normalize_host infoleak and out-of-bounds write\nhttps://t.me/cybersecuritytechnologies/2881\nCVE-2021-21193 - Google Chrome Blink code execution\nhttps://vulmon.com/vulnerabilitydetails?qid=CVE-2021-21193\nCVE-2021-21978 - VMware View Planner\u00a0RCE\nhttps://mobile.twitter.com/osama_hroot/status/1367258907601698816\nhttps://paper.seebug.org/1495\nCVE-2021-21300 - Git vulnerability\nhttps://t.me/cybersecuritytechnologies/2880\nCVE-2021-26411 - IE mshtml use-after-free\nhttps://t.me/cybersecuritytechnologies/2908", "url": "https://t.me/CyberSecurityTechnologies/2911"}, {"timestamp": "2021-04-11T18:30:17Z", "date_only": false, "value": "2021-04-11T18:30:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/orderofsixangles/1338", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "e70f2d09-b388-4bcc-937f-40e0f8489997", "content": "\u0410\u043d\u0430\u043b\u0438\u0437 IcedID\n\nhttps://4rchib4ld.github.io/blog/IcedIDOnMyNeckImTheCoolest/\n\n\u041e\u0431\u0440\u0430\u0437\u0446\u044b \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f APKpure\n\n\u0418\u043d\u0444\u0430:https://news.drweb.ru/show/?i=14188\nhttps://bazaar.abuse.ch/browse/tag/Triada.4912/\nhttps://bazaar.abuse.ch/browse/tag/Triada.566/\n\nPersistence \u0432 macos\n\nhttps://github.com/CyborgSecurity/PoisonApple\n\nUnofficial Guide to Mimikatz\n\nhttps://adsecurity.org/?page_id=1821\n\nExploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample\n\nhttps://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html\n\nProcess Herpaderping (POC + info)\n\nhttps://movaxbx.ru/2021/04/11/process-herpaderping/\n\n\u041a\u043d\u0438\u0433\u0430 The Antivirus Hacker's Handbook, 2015 \u0433\u043e\u0434\n\nhttps://t.me/OrderOfSixAnglesFiles/41\n\n\u041e\u0431\u043d\u043e\u0432\u0438\u043b\u0441\u044f ViperMonkey (VBA Emulation)\n\nhttps://github.com/decalage2/ViperMonkey\n\n.NET Internals Cookbook\n\nhttps://blog.adamfurmanek.pl/net-internals-cookbook/\n\nhttps://adamsitnik.com/files/ExceptionalExceptions.pdf\n\nWindows kernel mitigations\n\nhttps://public.cnotools.studio/kernel-mitigati", "url": "https://t.me/orderofsixangles/1338"}, {"timestamp": "2021-04-11T21:19:11Z", "date_only": false, "value": "2021-04-11T21:19:11.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/HackerOne/2980", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "294380e2-f772-447b-a86e-36ac5c86c539", "content": "Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample\n\nThe general method of browser render process exploit is: after exploiting the vulnerability to obtain user mode arbitrary memory read/write primitive, the vtable of DOM/js object is tampered to hijack the code execution flow. Then VirtualProtect is called by ROP chain to modify the shellcode memory to PAGE_EXECUTE_READWRITE, and the code execution flow is jumped to shellcode by ROP chain finally. After Windows 8.1, Microsoft introduced CFG (Control Flow Guard)[1] mitigation to verify the indirect function call, which mitigates the exploitation of tampering with vtable to get code execution.\n\nHowever, the confrontation is not end. Some new methods to bypass CFG mitigation have emerged. For example, in chakra/jscript9, the code execution flow is hijacked by tampering with the function return address on the stack; in v8, WebAssembly with executable memory property is used to execute shellcode. In December 2020, Microsoft introduced CET(Control-flow Enforcement Technology)[2] mitigation technology based on Intel Tiger Lake CPU in Windows 10 20H1, which protects the exploitation of tampering with the function return address on the stack. Therefore, how to bypass CFG in a CET mitigation environment has become a new problem for vulnerability exploitation.\n\nhttps://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html", "url": "https://t.me/HackerOne/2980"}, {"timestamp": "2021-04-12T11:01:12Z", "date_only": false, "value": "2021-04-12T11:01:12.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberSecurityTechnologies/3107", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "ecd91842-5fb0-4368-863a-d1ad4e5c76ce", "content": "#Threat_Research\nExploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample\nhttps://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html", "url": "https://t.me/CyberSecurityTechnologies/3107"}, {"timestamp": "2021-04-12T11:01:12Z", "date_only": false, "value": "2021-04-12T11:01:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/3104", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "37684771-999d-48df-9756-da996e83bcce", "content": "#Analytics\n10 most exploited vulnerabilities of the week (April 5-11)\nCVE-2021-26855 - ProxyLogon MS Exchange Srv RCE\nhttps://t.me/cybersecuritytechnologies/2835\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\nhttps://t.me/cybersecuritytechnologies/1515\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\nCVE-2021-26411 - IE mshtml UAF\nhttps://t.me/cybersecuritytechnologies/2908\nCVE-2021-3129 - Laravel debug RCE\nhttps://t.me/cybersecuritytechnologies/2557\nCVE-2021-26708 - LPE in the Linux kernel <5.10.x\nhttps://github.com/jordan9001/vsock_poc\nCVE-2020-16040 - V8 JIT Compiler Bug\nhttps://t.me/cybersecuritytechnologies/2450\nCVE-2021-21982 - SSRF in VMWare\nhttps://t.me/cybersecuritytechnologies/3039\nCVE-2021-21402 - UAF read in Jellyfin\nhttps://t.me/cybersecuritytechnologies/3064\nCVE-2021-29154 - BPF JIT bug\nhttps://www.openwall.com/lists/oss-security/2021/04/08/1", "url": "https://t.me/CyberSecurityTechnologies/3104"}, {"timestamp": "2021-07-30T10:29:01Z", "date_only": false, "value": "2021-07-30T10:29:01.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/1956", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "210a7fda-a2de-4410-b6b8-66d882997689", "content": "\u0410\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Malwarebytes \u043d\u0430\u0448\u043b\u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0443, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u041a\u0440\u044b\u043c\u0443. \u0412 \u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0435, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u0441\u0438\u0434\u0438\u0442 \u0442\u0440\u043e\u044f\u043d.\n\n\u041e\u0442\u0447\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u043f\u0440\u044f\u043c\u043e \u0441\u043c\u0435\u0448\u043d\u043e\u0439.\n\n\u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u043e \u0441\u0443\u0442\u0438 - \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0430 \u0432 \u0432\u0438\u0434\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 \u043d\u0430 \u0440\u0443\u0441\u0441\u043a\u043e\u043c \u0438 \u0430\u043d\u0433\u043b\u0438\u0439\u0441\u043a\u043e\u043c Manifest.docx, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u043c \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u043d\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b \u043a\u0440\u044b\u043c\u0441\u043a\u0438\u0445 \u0433\u0440\u0430\u0436\u0434\u0430\u043d. \u041f\u043e\u043c\u0438\u043c\u043e \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442\u0441\u044f \u0434\u0432\u0430 \u0432\u0435\u043a\u0442\u043e\u0440\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f VBA RAT (Remote Access Trojan) - \u043e\u0434\u0438\u043d \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043c\u0430\u043a\u0440\u043e\u0441\u043e\u0432, \u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-26411 \u0432 IE. \u042d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0441\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0437 APT Lazarus, \u043a\u043e\u0433\u0434\u0430 \u0437\u0438\u043c\u043e\u0439 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438 RAT - \u0442\u0430\u043a\u043e\u0439 \u0441\u0435\u0431\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 RAT, \u0441\u043e \u0432\u0441\u0435\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u043e\u043c: \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430.\n\n\u0422\u0435\u043f\u0435\u0440\u044c \u043e \u0437\u0430\u0431\u0430\u0432\u043d\u043e\u043c. \n\n\u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u0442\u0435\u043a\u0441\u0442 \u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043c\u0430\u043d\u0438\u0444\u0435\u0441\u0442 \u043d\u0435\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u044b \u0436\u0438\u0442\u0435\u043b\u0435\u0439 \u041a\u0440\u044b\u043c\u0430 \u043d\u0430 \u0440\u0443\u0441\u0441\u043a\u043e\u043c \u0438 \u0430\u043d\u0433\u043b\u0438\u0439\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u0441\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0442\u0437\u044b\u0432\u044b \u043e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435 \u041f\u0443\u0442\u0438\u043d\u0430 (\u0434\u0430 \u043f\u0440\u043e\u0434\u043b\u0438\u0442 \u0410\u043a\u0430\u0442\u043e\u0448 \u0435\u0433\u043e \u0434\u043d\u0438, \u0441\u043a\u0440\u0435\u043f\u043d\u043e\u0441\u0442\u044c +15) \u043d\u0430 \u043f\u043e\u043b\u0443\u043e\u0441\u0442\u0440\u043e\u0432\u0435 \u0438 \u043e\u0431\u044a\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \"\u041d\u0430\u0440\u043e\u0434\u043d\u043e\u0433\u043e \u0441\u043e\u043f\u0440\u043e\u0442\u0438\u0432\u043b\u0435\u043d\u0438\u044f\". \u041f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043e \u044d\u0442\u043e \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0433\u0440\u0430\u0436\u0434\u0430\u043d \u043f\u043e\u0434 \u043f\u0440\u0435\u0434\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u0410\u043d\u0434\u0440\u0435\u044f \u0421\u0435\u0440\u0433\u0435\u0435\u0432\u0438\u0447\u0430 \u041f\u043e\u0440\u0442\u044c\u043a\u043e. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Malwarebytes \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u044d\u0442\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u044e\u0442 - \"\u0432\u043e\u0442, \u043c\u043e\u043b, \u0433\u0440\u0443\u043f\u043f\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0410\u043d\u0434\u0440\u0435\u0435\u043c \u0421\u0435\u0440\u0433\u0435\u0435\u0432\u0438\u0447\u0435\u043c \u041f\u043e\u0440\u0442\u044c\u043a\u043e\". \n\n\u041c\u044b \u043f\u043e\u0434\u0443\u043c\u0430\u043b\u0438 \u0431\u044b\u043b\u043e, \u0447\u0442\u043e \u044d\u0442\u043e \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u043f\u0440\u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043c\u044b \u043d\u0435 \u0441\u043b\u044b\u0448\u0430\u043b\u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0431\u0443\u0434\u0443\u0447\u0438 \u0434\u0430\u043b\u0435\u043a\u0438 \u043e\u0442 \u043f\u043e\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0432\u0435\u0441\u0442\u043a\u0438. \u041e\u0434\u043d\u0430\u043a\u043e \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e Google \u0442\u043e\u0436\u0435 \u043d\u0435 \u0441\u043b\u044b\u0448\u0430\u043b \u043f\u0440\u043e \u0410\u043d\u0434\u0440\u0435\u044f \u0421\u0435\u0440\u0433\u0435\u0435\u0432\u0438\u0447\u0430 \u041f\u043e\u0440\u0442\u044c\u043a\u043e. \u0412\u0438\u0434\u0438\u043c\u043e \u0410\u043d\u0434\u0440\u0435\u0439 \u0421\u0435\u0440\u0433\u0435\u0435\u0432\u0438\u0447 \u041f\u043e\u0440\u0442\u044c\u043a\u043e \u043e\u0447\u0435\u043d\u044c \u0441\u0435\u043a\u0440\u0435\u0442\u0435\u043d, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435 \u043f\u043e \u0441\u0435\u0431\u0435.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0448\u043b\u0438 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0443\u044e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u043f\u0430\u043d\u0435\u043b\u044c, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0431 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0436\u0435\u0440\u0442\u0432\u0430\u0445. \u041f\u0430\u043d\u0435\u043b\u044c \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f Ekipa. \u041c\u044b \u0431\u044b \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u0438 \u044d\u0442\u043e \u043a\u0430\u043a \"\u042d\u043a\u0432\u0438\u043f\", \u0442\u043e \u0431\u0438\u0448\u044c \"\u0441\u043d\u0430\u0440\u044f\u0433\u0430\". \u041d\u043e Malwarebytes \u0440\u0435\u0448\u0438\u043b\u0438, \u0447\u0442\u043e \u044d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442 \"\u043a\u043e\u043c\u0430\u043d\u0434\u0430\" \u0438 \u043c\u044b \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u0434\u0443\u043c\u0430\u043b\u0438, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u043f\u0443\u0442\u0430\u043b\u0438 \u0435\u0433\u043e \u0441\u043e \u0441\u043b\u043e\u0432\u043e\u043c \"\u044d\u043a\u0438\u043f\u0430\u0436\", \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0436\u0435 \u0432\u0441\u0435-\u0442\u0430\u043a\u0438 \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u0430 \u0440\u0443\u0441\u0441\u043a\u043e\u044f\u0437\u044b\u0447\u043d\u044b\u0445 \u0436\u0435\u0440\u0442\u0432, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e \u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0438\u043c\u0435\u044e\u0442 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0435 \u043a \u0440\u0443\u0441\u0441\u043a\u043e\u043c\u0443 \u044f\u0437\u044b\u043a\u0443.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0432\u0441\u0435 \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u043f\u0440\u043e\u0449\u0435: \"ekipa\" - \u044d\u0442\u043e \"\u043a\u043e\u043c\u0430\u043d\u0434\u0430\" \u043f\u043e-\u043f\u043e\u043b\u044c\u0441\u043a\u0438. \u041f\u043e\u0441\u043b\u0435 \u0442\u0430\u043a\u043e\u0433\u043e \u0443\u043a\u043b\u043e\u043d\u0447\u0438\u0432\u044b\u0435 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044f Malwarebytes, \u0447\u0442\u043e \u043e\u043d\u0438, \u0434\u0435, \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u0430\u0436\u0435 \u043f\u0440\u0438\u0431\u043b\u0438\u0437\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u043a\u0442\u043e\u0440\u0430, \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043d\u0435\u043b\u0435\u043f\u043e. \n\n\u0422\u0430\u043a \u0447\u0442\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0441\u043a\u0438\u0435 \u0441\u043f\u0435\u0446\u0441\u043b\u0443\u0436\u0431\u044b \u0432\u044b\u0441\u0443\u043d\u0443\u043b\u0438 \u0441\u0432\u043e\u0438 \u043a\u0438\u0431\u0435\u0440\u0442\u0435\u043d\u0442\u0430\u043a\u043b\u0438 \u0438 \u0440\u0435\u0448\u0438\u043b\u0438 \u043f\u043e\u0438\u0433\u0440\u0430\u0442\u044c \u0432 APT. \u0426\u0435\u043b\u044f\u043c\u0438 \u043c\u043e\u0433\u0443\u0442 \u044f\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435, \u0442\u0430\u043a \u0438 \u0443\u043a\u0440\u0430\u0438\u043d\u0441\u043a\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438. \u041f\u043e\u043b\u0430\u0433\u0430\u0435\u043c, \u041f\u043e\u043b\u044c\u0448\u0435 \u0435\u0441\u0442\u044c \u0434\u0435\u043b\u043e \u0438 \u0434\u043e \u0442\u0435\u0445 \u0438 \u0434\u043e \u0434\u0440\u0443\u0433\u0438\u0445.\n\n\u041e\u0434\u0438\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u043e\u043f\u0440\u043e\u0441 \u043d\u0435 \u0434\u0430\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u043a\u043e\u044f. \u041a\u0442\u043e \u0436\u0435 \u0442\u0430\u043a\u043e\u0439 \u0410\u043d\u0434\u0440\u0435\u0439 \u0421\u0435\u0440\u0433\u0435\u0435\u0432\u0438\u0447 \u041f\u043e\u0440\u0442\u044c\u043a\u043e?", "url": "https://t.me/true_secator/1956"}, {"timestamp": "2021-08-12T08:28:58Z", "date_only": false, "value": "2021-08-12T08:28:58.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/6b192856-ccd6-43e7-8fb9-0314baaa8b6d", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "aa295061-3eb1-4c5d-8db4-e0ccec5c993f"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-26411", "field": "timestamps.asserted_at", "uuid": "e600c8bb-80da-4173-bd70-469bd085d89c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-26411", "field": "timestamps.asserted_at", "uuid": "333a11c1-209f-4289-a818-a3e66892e8b3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-26411", "field": "containers.adp.1.metrics.1.other.content.dateAdded"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2021-26411", "record": "GSD-2021-26411", "field": "namespaces.cisa.gov.dateAdded"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-26411", "field": "evidence.0.details.added_date", "uuid": "333a11c1-209f-4289-a818-a3e66892e8b3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-26411", "field": "evidence.0.details.date_added", "uuid": "e600c8bb-80da-4173-bd70-469bd085d89c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-26411", "field": "timestamps.first_seen_at", "uuid": "e600c8bb-80da-4173-bd70-469bd085d89c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-26411", "field": "timestamps.first_seen_at", "uuid": "333a11c1-209f-4289-a818-a3e66892e8b3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-26411", "field": "status.status_updated_at", "uuid": "e600c8bb-80da-4173-bd70-469bd085d89c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-26411", "field": "status.status_updated_at", "uuid": "333a11c1-209f-4289-a818-a3e66892e8b3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-04T18:05:08Z", "date_only": false, "value": "2021-11-04T18:05:08.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f5517417-687f-4fb8-91ce-b2d0f63e4f81", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "21dd195b-de89-46ff-8d61-055ae513eef6"}, {"timestamp": "2021-11-08T08:58:18Z", "date_only": false, "value": "2021-11-08T08:58:18.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "a2c69fb1-6fdc-410e-8af3-13292cfd7126"}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-26411", "field": "evidence.0.details.due_date", "uuid": "e600c8bb-80da-4173-bd70-469bd085d89c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2021-26411", "record": "GSD-2021-26411", "field": "namespaces.cisa.gov.dueDate"}, {"timestamp": "2021-11-20T09:53:52Z", "date_only": false, "value": "2021-11-20T09:53:52.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "92d64910-0615-464d-856b-204bae1a65b5"}, {"timestamp": "2022-04-28T19:45:03Z", "date_only": false, "value": "2022-04-28T19:45:03.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/2902", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "38fa162d-d5cf-44ea-b514-b151b2ce29cf", "content": "\u041f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u043d\u0430 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0430\u0445 RIG Exploit Kit \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u0442\u0440\u043e\u044f\u043d\u043e\u043c RedLine Stealer.\n\n\u0421\u0432\u043e\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442-\u043f\u0430\u043a \u043d\u0430\u0447\u0430\u043b \u0435\u0449\u0435 \u0432 \u043a\u043e\u043d\u0446\u0435 2013 \u0433\u043e\u0434\u0430 \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Internet Explorer, Java, Adobe Flash \u0438 Silverlight. \u0410 \u0432\u043e\u0442 \u043c\u0430\u043b\u0432\u0430\u0440\u044c RedLine Stealer \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u043c\u0430\u0440\u0442\u0435 2020 \u0433\u043e\u0434\u0430. \u0417\u0432\u0435\u0440\u044e\u0433\u0430 \u043a\u0440\u0430\u0439\u043d\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 FTP, \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b, \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u043e\u0432 \u0438 VPN. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441 \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b cookie \u0438 \u043d\u043e\u043c\u0435\u0440\u0430 \u043a\u0430\u0440\u0442, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u0435\u0441\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445, \u043b\u043e\u0433\u0438 \u0447\u0430\u0442\u043e\u0432, \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0440\u0435\u043a\u0432\u0438\u0437\u0438\u0442\u044b \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043d\u044b\u0445 \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u043e\u0432.\n\n\u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0442\u0440\u043e\u044f\u043d \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u044b, \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435, \u0430 \u0437\u0430\u0442\u0435\u043c \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u043d\u0430 C&C.\n\n\u041d\u043e\u0432\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u0441 \u0430\u0440\u0441\u0435\u043d\u0430\u043b\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u0435\u0436\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Internet Explorer, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e Microsoft \u0435\u0449\u0435 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443. \u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f  \u043d\u0430 \u0411\u0440\u0430\u0437\u0438\u043b\u0438\u044e \u0438 \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u044e, \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0442 \u0421\u0428\u0410, \u0415\u0433\u0438\u043f\u0435\u0442, \u041a\u0430\u043d\u0430\u0434\u0430, \u041a\u0438\u0442\u0430\u0439 \u0438 \u041f\u043e\u043b\u044c\u0448\u0430.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043c\u0435\u0442\u043e\u0434 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u044b, \u043f\u0440\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e JS-\u0441\u043a\u0440\u0438\u043f\u0442\u0430, \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442-\u043f\u0430\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 RedLine Stealer \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0438\u0434\u0435\u0442 \u0440\u0435\u0447\u044c \u2014 \u044d\u0442\u043e CVE-2021-26411 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,8) \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 Internet Explorer. \u0414\u043b\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0438 \u044d\u0442\u0430 \u0436\u0435 \u0431\u0430\u0433\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u0438\u043c\u0438 APT. \n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e\u0431\u0440\u0430\u0437\u0435\u0446 RedLine Stealer, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u043c RIG Exploit Kit, \u0443\u043f\u0430\u043a\u043e\u0432\u0430\u043d \u0432 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u0440\u043e\u0432\u043d\u0435\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0446\u0435\u043b\u044b\u0445 \u0448\u0435\u0441\u0442\u044c \u044d\u0442\u0430\u043f\u043e\u0432.\n\n\u041e\u0442\u0447\u0435\u0442 \u043e\u0431 \u0443\u0433\u0440\u043e\u0437\u0430\u0445 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b \u0440\u0443\u043c\u044b\u043d\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043e\u0432, \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u043e\u0432 \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b Bitdefender, \u043d\u043e \u0434\u0430\u0436\u0435 \u044d\u0442\u0438 \u0434\u0435\u043c\u043e\u043d\u044b \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0432\u043e\u0435\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u044b.", "url": "https://t.me/true_secator/2902"}, {"timestamp": "2022-05-24T22:01:28Z", "date_only": false, "value": "2022-05-24T22:01:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C5RH-MMR6-C7CH", "record": "GHSA-C5RH-MMR6-C7CH", "field": "published"}, {"timestamp": "2022-06-01T02:32:51Z", "date_only": false, "value": "2022-06-01T02:32:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/3057", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "4ee5b5ae-37b5-416c-8a47-039759fa142f", "content": "#Analytics\n10 most exploited vulnerabilities of the week (March 29 - April 4)\nCVE-2021-26855 - ProxyLogon MS Exchange Server RCE\nhttps://t.me/cybersecuritytechnologies/2835\nCVE-2021-3449/3450 - OpenSSL DoS/certificate validation\nhttps://t.me/cybersecuritytechnologies/2993\nhttps://thehackernews.com/2021/03/openssl-releases-patches-for-2-high.html\nCVE-2021-21975/CVE-2021-21983 - SSRF in VMWare vRealize Operations Manager API\nhttps://t.me/cybersecuritytechnologies/3039\nCVE-2019-8761 - macOS bug that lets attackers execute HTML within a TXT file\nhttps://www.paulosyibelo.com/2021/04/this-man-thought-opening-txt-file-is.html\nCVE-2021-26411 - IE mshtml UAF\nhttps://t.me/cybersecuritytechnologies/2908\nCVE-2021-28918 - SSRF in Netmask package\nhttps://t.me/cybersecuritytechnologies/3014\nCVE-2020-25078 - D-Link psw disclosure\nhttps://t.me/cybersecuritytechnologies/3055\nCVE-2021-1656 - Windows tpm.sys Device Driver Information Disclosure\nhttps://t.me/cybersecuritytechnologies/3028", "url": "https://t.me/CyberSecurityTechnologies/3057"}, {"timestamp": "2022-07-04T21:05:29Z", "date_only": false, "value": "2022-07-04T21:05:29.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/2908", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "5f733249-d80d-4091-b101-58913183739d", "content": "#exploit\nCVE-2021-26411:\nInternet Explorer mshtml use-after-free.\nRoot cause analyses + PoC\nhttps://iamelli0t.github.io/2021/03/12/CVE-2021-26411.html", "url": "https://t.me/CyberSecurityTechnologies/2908"}, {"timestamp": "2023-02-28T13:24:28Z", "date_only": false, "value": "2023-02-28T13:24:28.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/itsec_news/2284", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "5a512090-e7cc-4331-a8dc-c72b8d4f9ace", "content": "\u200b\u26a1\ufe0f \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u043d\u043e\u0432\u044b\u043c\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c RIG Exploit Kit.\n\n\ud83d\udcac \u00abRIG Exploit Kit \u2014 \u044d\u0442\u043e \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e \u043c\u043e\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 2014 \u0433\u043e\u0434\u0430\u00bb, \u2014 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u0438\u0441\u0447\u0435\u0440\u043f\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 PRODAFT. \u041d\u0430\u0431\u043e\u0440 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 RIG EK \u0434\u043e\u0441\u0442\u0438\u0433 \u0440\u0435\u043a\u043e\u0440\u0434\u043d\u043e \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u2014 \u043f\u043e\u0447\u0442\u0438 30% \u0432 2022 \u0433\u043e\u0434\u0443, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u043c \u0434\u0430\u043d\u043d\u044b\u043c.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0445\u0430\u043a\u0435\u0440\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0442 \u0441\u0432\u043e\u0451 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0447\u0443\u0442\u044c \u043b\u0438 \u043d\u0435 \u0435\u0436\u0435\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u043e, \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044f \u043d\u043e\u0432\u044b\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0412\u043f\u0440\u043e\u0447\u0435\u043c, \u0442\u0430\u043a\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u043d\u0435\u0443\u0434\u0438\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0430, \u0432\u0435\u0434\u044c RIG EK \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u043c\u043e\u0434\u0435\u043b\u0438 (Maas). \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u044f\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430 \u0437\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0438\u043c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445.\n\n\u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0433\u043e \u043e\u0445\u0432\u0430\u0442\u0430, \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b RIG EK \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0440\u0435\u043a\u043b\u0430\u043c\u0443. \u041f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0438\u043b\u0438 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 JavaScript \u043d\u0430 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u00ab\u0418\u0441\u043a\u0443\u0441\u043d\u044b\u0439 \u0434\u0438\u0437\u0430\u0439\u043d Exploit Kit \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0435\u043c\u0443 \u0437\u0430\u0440\u0430\u0436\u0430\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0431\u0435\u0437 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c. \u041c\u0435\u0436\u0434\u0443 \u0442\u0435\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u044f\u0435\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f\u00bb, \u2014 \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438.\n\n\u0421 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432 2014 \u0433\u043e\u0434\u0443 \u0431\u044b\u043b\u043e \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043e, \u0447\u0442\u043e RIG EK \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0442\u0440\u043e\u044f\u043d\u043e\u0432, \u043f\u043e\u0445\u0438\u0442\u0438\u0442\u0435\u043b\u0435\u0439 \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a AZORult, CryptoBit, Dridex, Raccoon Stealer \u0438 WastedLoader. \u041e\u0434\u043d\u0430\u043a\u043e \u0432 2017 \u043f\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 RIG \u0431\u044b\u043b \u043d\u0430\u043d\u0435\u0441\u0435\u043d \u043e\u0433\u0440\u043e\u043c\u043d\u044b\u0439 \u0443\u0434\u0430\u0440 \u043f\u043e\u0441\u043b\u0435 \u0440\u044f\u0434\u0430 \u0441\u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 \u043e\u0442\u0440\u0430\u0441\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041d\u0430 \u0432\u0440\u0435\u043c\u044f \u044d\u0442\u043e \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438.\n\n\u041d\u0435\u0434\u0430\u0432\u043d\u0438\u0435 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 RIG EK \u0431\u044b\u043b\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Internet Explorer \u043f\u043e\u0434 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c CVE-2021-26411. \u0421 \u0435\u0451 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 RedLine Stealer. \u0414\u0440\u0443\u0433\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442: CVE-2013-2551, CVE-2014-6332, CVE-2015-0313, CVE-2015-2419, CVE -2016-0189, CVE-2018-8174, CVE-2019-0752, \u0438 CVE-2020-0674.\n\n\u00ab\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0431\u044b\u043b\u043e \u0441\u0430\u043c\u044b\u043c \u0432\u044b\u0441\u043e\u043a\u0438\u043c \u0432\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a, \u0441\u0440\u0435\u0434\u0443 \u0438 \u0447\u0435\u0442\u0432\u0435\u0440\u0433, \u043f\u0440\u0438\u0447\u0435\u043c \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0435 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u0438 \u0432 \u043e\u0434\u043d\u0438 \u0438 \u0442\u0435 \u0436\u0435 \u0434\u043d\u0438 \u043d\u0435\u0434\u0435\u043b\u0438\u00bb, \u2014 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b.\n\n\u00ab\u0412 \u0446\u0435\u043b\u043e\u043c, RIG EK \u0432\u0435\u0434\u0451\u0442 \u043e\u0447\u0435\u043d\u044c \u043f\u043b\u043e\u0434\u043e\u0442\u0432\u043e\u0440\u043d\u044b\u0439 \u0431\u0438\u0437\u043d\u0435\u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a\u0430\u043a \u0443\u0441\u043b\u0443\u0433\u0438, \u0438\u043c\u0435\u044f \u0436\u0435\u0440\u0442\u0432 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443, \u0432\u044b\u0441\u043e\u043a\u043e\u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0441 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c\u044b\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e\u00bb, \u2014 \u043f\u043e\u0434\u0432\u0435\u043b\u0438 \u0438\u0442\u043e\u0433 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 PRODAFT.\n\n#RIGExploitKit #\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\n\n\ud83d\udd14 ITsec NEWS", "url": "https://t.me/itsec_news/2284"}, {"timestamp": "2023-10-19T13:24:59Z", "date_only": false, "value": "2023-10-19T13:24:59.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/itsec_news/3476", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "b88fb2a6-0cdb-40ed-9db5-538fb6ed814e", "content": "\u200b\u26a1\ufe0f\u041e\u0442 MATA \u043d\u0438\u0447\u0435\u0433\u043e \u0445\u043e\u0440\u043e\u0448\u0435\u0433\u043e: \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438 \u043f\u0430\u0440\u0430\u043b\u0438\u0437\u0443\u044e\u0442 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0415\u0432\u0440\u043e\u043f\u044b.\n\n\ud83d\udcac \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 Explorer \u2014 \u043d\u043e\u0432\u044b\u0439 \u0442\u0440\u043e\u044f\u043d\u0441\u043a\u0438\u0439 \u043a\u043e\u043d\u044c \u0434\u043b\u044f \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u044b.\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 MATA \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u0438\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043d\u0435\u0444\u0442\u0435\u0433\u0430\u0437\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u0430 \u0438 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u044b \u0441 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u043c\u0430\u0439 2023 \u0433\u043e\u0434\u0430. \u041e\u0431 \u044d\u0442\u043e\u043c \u0437\u0430\u044f\u0432\u0438\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432 \u043d\u043e\u0432\u043e\u043c \u043e\u0442\u0447\u0451\u0442\u0435.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043c\u0430\u043d\u0443\u0442\u044c \u0436\u0435\u0440\u0442\u0432, \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0432 \u0438\u0445 \u0441\u043a\u0430\u0447\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-26411 (CVSS: 7.5) \u0432 Internet Explorer \u0434\u043b\u044f \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f.\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a MATA \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0442\u0440\u043e\u044f\u043d \u0438 \u0438\u043d\u0444\u043e\u0441\u0442\u0438\u043b\u0435\u0440, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0438 \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0441\u0442\u044c \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0435\u0442\u044f\u0445. \u041d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f MATA \u0441\u0445\u043e\u0436\u0430 \u0441 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 \u0441\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 Lazarus, \u043d\u043e \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043f\u043e \u0432\u0441\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432.\n\n\u0412 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u043f\u043e\u0441\u043b\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0434\u0432\u0443\u0445 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 MATA, \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f (Command and Control, C2) \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439, \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043d\u0435\u043f\u0440\u0430\u0432\u043e\u043c\u0435\u0440\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c. \u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0433\u043e \u041f\u041e, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u043a \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0443 \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0438 \u0441\u0432\u043e\u0435 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043e\u0442 \u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0435 \u043a\u043e \u0432\u0441\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0432\u0443\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u0430\u043d\u0435\u043b\u044f\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0438\u0445 \u0434\u043b\u044f \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e.\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0442\u0440\u0435\u0445 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e MATA \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438. \u041d\u043e\u0432\u0435\u0439\u0448\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442:\n\n\u043e\u0431\u0448\u0438\u0440\u043d\u044b\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0440\u0430\u0441\u0441\u0442\u043e\u044f\u043d\u0438\u0438, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u043f\u0440\u044f\u043c\u043e\u0433\u043e \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430;\n\n\u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 (TCP, SSL, PSSL \u0438 PDTLS), \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 MATA \u0431\u043e\u043b\u0435\u0435 \u0433\u0438\u0431\u043a\u043e\u0439 \u0438 \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0439 \u043a \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0435;\n\n\u043f\u0440\u043e\u043a\u0441\u0438 (SOCKS4, SOCKS5, HTTP+web, HTTP+NTLM), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0444\u0438\u043b\u044c\u0442\u0440\u044b \u0438 \u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0438\u0441\u0442\u0438\u043d\u043d\u043e\u0435 \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430.\n\n\u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0435\u0449\u0435 75 \u043a\u043e\u043c\u0430\u043d\u0434, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0441\u0431\u043e\u0440\u043e\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u043e\u0439, \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u043a\u0441\u0438 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043c\u0430\u043d\u0434.\n\n\u0414\u0440\u0443\u0433\u0438\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u043d\u0430\u0445\u043e\u0434\u043a\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u043d\u043e\u0432\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u044a\u0435\u043c\u043d\u044b\u0435 \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a USB, \u0434\u043b\u044f \u0438\u043d\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u0443\u043a\u0438, \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u044b \u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0440\u0430\u043d\u0435\u0435 \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u043b\u0430 MATA \u0441 \u0433\u0440\u0443\u043f\u043f\u043e\u0439 Lazarus, \u043d\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043d\u0435 \u0443\u0432\u0435\u0440\u0435\u043d\u044b \u0432 \u0441\u0432\u044f\u0437\u0438 MATA \u0441 \u0434\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439.\n\n\ud83d\udd14 ITsec NEWS", "url": "https://t.me/itsec_news/3476"}, {"timestamp": "2023-10-19T19:40:05Z", "date_only": false, "value": "2023-10-19T19:40:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/true_secator/4986", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "9fefd592-9f5d-4997-b8a9-ccef94263c4e", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e\u0431 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 MATA, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2022 \u043f\u043e \u043c\u0430\u0439 2023 \u0433\u043e\u0434\u0430, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043d\u0435\u0444\u0442\u0435\u0433\u0430\u0437\u043e\u0432\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0432 \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u0435.\n\n\u0412 \u0445\u043e\u0434\u0435 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u0435\u0432\u044b\u0435 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0434\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0436\u0435\u0440\u0442\u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c CVE-2021-26411 \u0432 Internet Explorer \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u0439.\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 MATA \u0441\u043e\u0447\u0435\u0442\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0442\u0440\u043e\u044f\u043d \u0438 \u0438\u043d\u0444\u043e\u043a\u0440\u0430\u0434 \u0434\u043b\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0441\u0442\u0438 \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0435\u0442\u044f\u0445. \u041f\u0440\u0438\u0447\u0435\u043c \u0432\u0435\u0440\u0441\u0438\u044f MATA \u0432 \u044d\u0442\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0431\u044b\u043b\u0430 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c \u0441 \u0441\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u043e\u0439 Lazarus, \u043d\u043e \u0441 \u043d\u043e\u0432\u044b\u043c\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043f\u0430\u043b\u0430 \u0432 \u043f\u043e\u043b\u0435 \u0437\u0440\u0435\u043d\u0438\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022 \u0433\u043e\u0434\u0430 \u043f\u043e\u0441\u043b\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u0432\u0443\u0445 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 MATA, \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0441 C2 \u0432\u043d\u0443\u0442\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438 \u0441\u043e\u0431\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0433\u043e \u041f\u041e, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u043a \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0420\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u043b\u0438 \u0437\u043e\u043d\u0443 \u0441\u0432\u043e\u0435\u0433\u043e \u0432\u043b\u0438\u044f\u043d\u0438\u044f \u0441 \u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u0434\u043e \u0432\u0441\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438.\n\n\u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u043b\u0430\u0441\u044c \u0438 \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0432\u0443\u043c \u043f\u0430\u043d\u0435\u043b\u044f\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: \u043e\u0434\u043d\u0430 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a, \u0430 \u0434\u0440\u0443\u0433\u0430\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f, \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044f \u0438\u043c \u043e\u043d\u0438 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u0437\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0441\u0440\u0435\u0434\u0438 \u0435\u0435 \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439.\n\n\u0412 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445, \u043a\u043e\u0433\u0434\u0430 \u0446\u0435\u043b\u044c\u044e \u0431\u044b\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Linux, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 MATA \u0434\u043b\u044f Linux \u0432 \u0432\u0438\u0434\u0435 \u0444\u0430\u0439\u043b\u0430 ELF, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d 3-\u043c\u0443 \u043f\u043e\u043a\u043e\u043b\u0435\u043d\u0438\u044e \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430\u0442\u0430 Windows.\n\n\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0438\u0437\u0443\u0447\u0438\u043b\u0430 \u0442\u0440\u0438 \u043d\u043e\u0432\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 MATA: \u043e\u0434\u043d\u0430 (v3) \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0437 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u043f\u043e\u043a\u043e\u043b\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u043e\u0441\u044c \u0432 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445, \u0432\u0442\u043e\u0440\u0430\u044f (v4) \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 MataDoor \u0438 \u0442\u0440\u0435\u0442\u044c\u044f (v5) \u0431\u044b\u043b\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u0441 \u043d\u0443\u043b\u044f.\n\n\u041f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0432\u0435\u0440\u0441\u0438\u044f MATA \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0444\u043e\u0440\u043c\u0435 DLL \u0438 \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u043c\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u043d\u043e\u0433\u043e\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044c\u043d\u044b\u0435 (TCP, SSL, PSSL, PDTLS) \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u043a\u0441\u0438 (SOCKS4, SOCKS5, HTTP+web, HTTP+NTLM) \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n\n23 \u043a\u043e\u043c\u0430\u043d\u0434\u044b MATA \u043f\u044f\u0442\u043e\u0433\u043e \u043f\u043e\u043a\u043e\u043b\u0435\u043d\u0438\u044f \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430\u0442\u043e\u043c \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0435\u0449\u0435 75 \u043a\u043e\u043c\u0430\u043d\u0434, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441\u043e \u0441\u0431\u043e\u0440\u043e\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438 \u0438 \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u043e\u0439, \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u043a\u0441\u0438 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438.\n\n\u0418\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u043d\u0430\u0445\u043e\u0434\u043e\u043a - \u043d\u043e\u0432\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u044a\u0435\u043c\u043d\u044b\u0435 \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0438\u043d\u0444\u043e\u0441\u0442\u0438\u043b\u043b\u0435\u0440\u044b, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0435 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0444\u0430\u0439\u043b\u044b cookie, \u0441\u043d\u0438\u043c\u043a\u0438 \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b EDR/\u043e\u0431\u0445\u043e\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u043e\u0431\u043e\u0448\u043b\u0438 EDR \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f CVE-2021-40449, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u00a0CallbackHell. \u0415\u0441\u043b\u0438 \u044d\u0442\u043e\u0442 \u043c\u0435\u0442\u043e\u0434 \u043e\u0431\u0445\u043e\u0434\u0430 \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u043b, \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u043b\u0438\u0441\u044c \u043d\u0430\u00a0\u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435\u00a0\u043c\u0435\u0442\u043e\u0434\u044b BYOVD.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u041b\u041a \u0440\u0430\u043d\u0435\u0435 \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u043b\u0430\u00a0MATA \u0441 Lazarus, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0441\u043b\u043e\u0436\u043d\u043e \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u043e\u0441\u0442\u0438 \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c.\n\n\u041d\u043e\u0432\u044b\u0435 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u0438 \u043c\u0435\u0442\u043e\u0434\u044b MATA, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f TTLV, \u043c\u043d\u043e\u0433\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0440\u0443\u043a\u043e\u043f\u043e\u0436\u0430\u0442\u0438\u044f, \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0445\u043e\u0436\u0438 \u043d\u0430 \u0442\u0435, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0410\u0420\u0422 Purple, Magenta \u0438 Green Lambert.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u043e\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0438 \u0432\u0435\u0440\u0441\u0438\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 MATA \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0434\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0440\u0435\u0434\u043a\u043e, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430.\n\n\u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0432 \u043f\u043e\u043b\u043d\u043e\u043c \u043e\u0442\u0447\u0435\u0442\u0435.", "url": "https://t.me/true_secator/4986"}, {"timestamp": "2023-10-24T05:49:16Z", "date_only": false, "value": "2023-10-24T05:49:16.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3df4d9fd-8c38-4820-951b-9b7b2b1d1305", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "b930a88e-169d-4687-816b-ca2f3e70e8ca"}, {"timestamp": "2023-12-13T01:23:33.794Z", "date_only": false, "value": "2023-12-13T01:23:33.794427Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-26411", "record": "GSD-2021-26411", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-29T17:15:59.767Z", "date_only": false, "value": "2023-12-29T17:15:59.767", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-26411", "record": "GSD-2021-26411", "field": "namespaces.nvd.nist.gov.cve.lastModified"}, {"timestamp": "2024-04-30T17:11:44Z", "date_only": false, "value": "2024-04-30T17:11:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/3279", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "1307b307-6d71-4be5-b20a-d269337695c1", "content": "#Analytics\nTop 10 Most Used Vulnerabilities of the Month (April 1-30)\n\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\nhttps://t.me/cybersecuritytechnologies/1515\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\nCVE-2021-22893 Pulse SecureVPN RCE\nhttps://t.me/cybersecuritytechnologies/3185\nCVE-2021-28310 - Win32k EoP Vulnerability\nhttps://t.me/cybersecuritytechnologies/3124\nCVE-2021-26411 - IE mshtml UAF\nhttps://t.me/cybersecuritytechnologies/2908\nCVE-2021-22204 - DjVu improper neutralization of user data\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\nhttps://t.me/cybersecuritytechnologies/3126\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability\nhttps://t.me/cybersecuritytechnologies/3156\nCVE-2021-28480/28482 - MS Exchange Server RCE\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange", "url": "https://t.me/CyberSecurityTechnologies/3279"}, {"timestamp": "2024-08-03T20:26:25.344Z", "date_only": false, "value": "2024-08-03T20:26:25.344Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2021-26411", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-12-24T20:23:00.352Z", "date_only": false, "value": "2024-12-24T20:23:00.352870Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971010", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "2baf9dc3-7ebf-47db-9aeb-84dbe64095cf", "url": "https://feedsin.space/feed/CISAKevBot/items/2971010"}, {"timestamp": "2025-02-23T02:09:53Z", "date_only": false, "value": "2025-02-23T02:09:53.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "08d48d6f-9eb0-4f30-8698-ebc950b40e87"}, {"timestamp": "2025-07-07T20:47:11Z", "date_only": false, "value": "2025-07-07T20:47:11.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3df4d9fd-8c38-4820-951b-9b7b2b1d1305", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "07e890cf-4d80-42bc-94ec-3f0725a06ccb"}, {"timestamp": "2025-08-31T03:00:47Z", "date_only": false, "value": "2025-08-31T03:00:47.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "c2406983-6bed-4ece-8b02-0922047c582e"}, {"timestamp": "2025-11-07T13:18:51Z", "date_only": false, "value": "2025-11-07T13:18:51.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/6b192856-ccd6-43e7-8fb9-0314baaa8b6d", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "e8b11c20-72dc-4fc7-b4db-158076c3a51a"}, {"timestamp": "2026-02-02T12:28:52.640Z", "date_only": false, "value": "2026-02-02T12:28:52.640771Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/004fced9-0b07-4290-8f4f-49a1290e3cdb", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "51036e8e-e774-4980-974f-a092f5e50273", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/004fced9-0b07-4290-8f4f-49a1290e3cdb"}, {"timestamp": "2026-02-02T12:28:52.640Z", "date_only": false, "value": "2026-02-02T12:28:52.640771Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/004fced9-0b07-4290-8f4f-49a1290e3cdb", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "c009dbd6-2e98-4ec1-ab98-b9b03cef85b6", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/004fced9-0b07-4290-8f4f-49a1290e3cdb"}, {"timestamp": "2026-02-02T13:24:01Z", "date_only": false, "value": "2026-02-02T13:24:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-26411", "field": "timestamps.recorded_at", "uuid": "e600c8bb-80da-4173-bd70-469bd085d89c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-17T14:55:31.245Z", "date_only": false, "value": "2026-03-17T14:55:31.245207Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=560", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "cc16a4f7-14b9-4d16-82a5-92a0428db4d8", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=560"}, {"timestamp": "2026-06-19T12:47:51.315Z", "date_only": false, "value": "2026-06-19T12:47:51.315575Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a467cb48-bb0f-4cd8-ad48-7e0b8de64b69", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "c7865d48-59d0-48ab-87c7-1ae9d8f18bde", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a467cb48-bb0f-4cd8-ad48-7e0b8de64b69"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-26411", "field": "timestamps.recorded_at", "uuid": "333a11c1-209f-4289-a818-a3e66892e8b3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:13:13.893Z", "date_only": false, "value": "2026-06-23T11:13:13.893668Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/333a11c1-209f-4289-a818-a3e66892e8b3", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "89576271-03c3-4d74-bf33-6373b4ca6013", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/333a11c1-209f-4289-a818-a3e66892e8b3"}, {"timestamp": "2026-06-23T14:04:36.162Z", "date_only": false, "value": "2026-06-23T14:04:36.162108Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/93c032c4-95fe-4508-8e5d-5034f91204d0", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "7ad0703a-da6b-4e50-9c04-73feebfbf660", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/93c032c4-95fe-4508-8e5d-5034f91204d0"}, {"timestamp": "2026-07-12T22:00:16.416Z", "date_only": false, "value": "2026-07-12T22:00:16.416623Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pleyades_it/9420", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "818e8a64-fa10-4f1c-b7ae-e8391dc9c4ff", "url": "https://t.me/pleyades_it/9420"}, {"timestamp": "2026-07-13T00:00:40.253Z", "date_only": false, "value": "2026-07-13T00:00:40.253421Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pleyades_it/9420", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "df64e111-ede7-4a47-9f85-f01182a8dd0e", "url": "https://t.me/pleyades_it/9420"}, {"timestamp": "2026-07-14T00:00:52.069Z", "date_only": false, "value": "2026-07-14T00:00:52.069065Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pleyades_it/9420", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "cc591da2-bdd4-4f06-be52-6f87776baab2", "url": "https://t.me/pleyades_it/9420"}, {"timestamp": "2026-07-29T12:02:57.341Z", "date_only": false, "value": "2026-07-29T12:02:57.341953Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/1276", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "632afb25-e3b1-4ec8-bf97-92a68dd1bb33", "url": "https://t.me/reverseame/1276"}, {"timestamp": "2026-07-29T12:02:59.172Z", "date_only": false, "value": "2026-07-29T12:02:59.172140Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/1062", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "c8c3cd21-6264-474e-9b79-17aaf725876a", "url": "https://t.me/reverseame/1062"}, {"timestamp": "2026-07-30T00:02:46.793Z", "date_only": false, "value": "2026-07-30T00:02:46.793823Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/1276", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "f956c5e1-b5d9-44b2-b594-c300bafb9420", "url": "https://t.me/reverseame/1276"}, {"timestamp": "2026-07-30T00:02:48.721Z", "date_only": false, "value": "2026-07-30T00:02:48.721872Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/1062", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "d4e2c925-4ed9-406a-8183-dc6bf9d14a99", "url": "https://t.me/reverseame/1062"}, {"timestamp": "2026-08-03T11:13:06.234Z", "date_only": false, "value": "2026-08-03T11:13:06.234765Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/reverseame/1276", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "5cc85e59-ef4a-44cc-8004-cb8f83a64658", "url": "https://t.me/reverseame/1276"}, {"timestamp": "2026-08-03T12:12:27.246Z", "date_only": false, "value": "2026-08-03T12:12:27.246543Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/reverseame/1062", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "726bf5ea-5ec6-46b4-a0c7-02e3a0c3f289", "url": "https://t.me/reverseame/1062"}, {"timestamp": "2026-08-04T00:00:40.659Z", "date_only": false, "value": "2026-08-04T00:00:40.659871Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/reverseame/1062", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "f68e88af-b860-42c8-98dc-5fbf5811d811", "url": "https://t.me/reverseame/1062"}, {"timestamp": "2026-08-04T00:00:43.247Z", "date_only": false, "value": "2026-08-04T00:00:43.247536Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/reverseame/1276", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "527bce65-44e8-4a74-8c03-c737b54d92cf", "url": "https://t.me/reverseame/1276"}, {"timestamp": "2026-08-12T03:55:30.330Z", "date_only": false, "value": "2026-08-12T03:55:30.330990Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-26411", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-12T03:55:30.330Z", "date_only": false, "value": "2026-08-12T03:55:30.330990Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-26411", "record": "FKIE_CVE-2021-26411", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-12T21:08:59.510Z", "date_only": false, "value": "2026-08-12T21:08:59.510177Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3msvzzjfz4q27", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "80ae1f1e-b14e-4f7a-83d8-99d99bc137f8", "url": "https://bsky.app/profile/vulnsea.com/post/3msvzzjfz4q27"}, {"timestamp": "2026-08-19T16:30:50.407Z", "date_only": false, "value": "2026-08-19T16:30:50.407Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "cve-2021-26411", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-19T18:31:28Z", "date_only": false, "value": "2026-08-19T18:31:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C5RH-MMR6-C7CH", "record": "GHSA-C5RH-MMR6-C7CH", "field": "modified"}, {"timestamp": "2026-09-01T17:00:51.510Z", "date_only": false, "value": "2026-09-01T17:00:51.510254Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/3093", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "41966ed2-b671-4c07-b6bd-687e0a62407b", "url": "https://t.me/cissp/3093"}, {"timestamp": "2026-09-01T17:00:55.182Z", "date_only": false, "value": "2026-09-01T17:00:55.182709Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/2941", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "568f3ced-4972-4092-9184-ce40dcda099c", "url": "https://t.me/cissp/2941"}, {"timestamp": "2026-09-01T20:02:33.182Z", "date_only": false, "value": "2026-09-01T20:02:33.182967Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/16766", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "e885d232-1dcd-46a2-bb9f-bed6eb51aabf", "url": "https://t.me/hacking_Attack/16766"}, {"timestamp": "2026-09-11T10:00:05.200Z", "date_only": false, "value": "2026-09-11T10:00:05.200762Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/2941", "record": "CVE-2021-26411", "field": "creation_timestamp", "uuid": "3484479d-8077-45dd-8fd9-b817041a9d26", "url": "https://t.me/cissp/2941"}, {"timestamp": "2026-10-01T20:31:07.692Z", "date_only": false, "value": "2026-10-01T20:31:07.692Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2021-26411", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-01T20:31:07.692Z", "date_only": false, "value": "2026-10-01T20:31:07.692Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-26411", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-01T21:17:16.540Z", "date_only": false, "value": "2026-10-01T21:17:16.540", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-26411", "record": "FKIE_CVE-2021-26411", "field": "lastModified"}]}