Internet Storm Center Spotlight


Title: PoetRAT malware evolves to be slimmer, faster and harder to detect

Description: Cisco Talos is tracking the behavior of the attackers behind the PoetRAT threat, who continue to target public and private entities in Azerbaijan. They observed multiple new campaigns indicating a change in the actor's capabilities and showing their maturity toward better operational security. This actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. The malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document. Previous versions of PoetRAT deployed a Python interpreter to execute the included source code which resulted in a much larger file size compared to the latest version's switch to Lua script.


Snort SIDs: 53689 - 53691

Title: Emotet now using poltiically charged emails

Description: The infamous Emotet botnet is now using lure documents that disguise themselves as being from the Democratic National Committee. Attackers sent emails to numerous American organizations last week with the title "Team Blue Take Action." If the user opens the attachment, it asks them to enable macros. Once enabled, the file then downloads Emotet and a few other malicious tools. Emotet went quiet in early 2020, but has since reemerged and changed up its tactics since the summer.


Snort SIDs: 55870 - 55874

Internet Storm Center Entries

The U.S. Cybersecurity and Infrastructure Security Agency released an alert last week that it expects distributed denial-of-service attacks to disrupt websites that post election results, but will not affect voting.

A group of American citizens living outside the U.S. are suing election officials in seven states, arguing that they should have the ability to return their absentee ballots electronically.

Visa says networks belonging to two hospitality merchants were attacked in May and June with point-of-sale malware that attempted to skim credit card information.

A British service that helps organizations raise money says a data breach may have led to the theft of donors' bank account information and passwords for the site.

Facebook says it shut down several accounts that Chinese threat actors hijacked to host malicious ads, spending $4 million of victims' money on ads for diet pills, fake designer handbags and more.

Hospital chain Universal Health Services says it's made "substantial progress" in restoring its services after an apparent cyber attack last week.

The United Nations' agency for international shipping had to curtail some of its services late last week after a cyber attack after the organization had originally reported "technical issues" on Sept. 30.

A cellular service provider's website has reportedly become infected with credit card-skimming malware that sends data back to a server controlled by the criminals.

GitHub released new code-scanning functionality that allows developers to detect potential vulnerabilities in their projects before making them public.

Recent CVEs


This is a list of recent vulnerabilities for which exploits are

available. System administrators can use this list to help in

prioritization of their remediation activities. The Qualys Vulnerability

Research Team compiles this information based on various exploit

frameworks, exploit databases, exploit kits and monitoring of internet


ID: CVE-2020-1350

Title: Microsoft Windows DNS Server Remote Code Execution Vulnerability

Vendor: Microsoft

Description: A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability.

CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

ID: CVE-2020-1472

Title: Microsoft Netlogon Elevation of Privilege Vulnerability

Vendor: Microsoft

Description: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.

CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

ID: CVE-2020-0688

Title: Microsoft Exchange Validation Key Remote Code Execution Vulnerability

Vendor: Microsoft

Description: A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time. Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which runs as SYSTEM.

CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

ID: CVE-2020-3566

Title: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

Vendor: Cisco

Description: A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes.

CVSS v3 Base Score: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

ID: CVE-2020-0618

Title: Microsoft SQL Server Remote Code Execution Vulnerability

Vendor: Microsoft

Description: A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests. An attacker who successfully exploited this vulnerability could execute code in the context of the Report Server service account.

To exploit the vulnerability, an authenticated attacker would need to submit a specially crafted page request to an affected Reporting Services instance.

CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

ID: CVE-2020-15675

Title: Mozilla Firefox User-After-Free Vulnerability

Vendor: Mozilla

Description: A user-after-free vulnerability exists in WebCGL in Mozilla Firefox. When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash.

CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

ID: CVE-2020-8243

Title: Pulse Connect Secure Arbitrary Code Execution Vulnerability

Vendor: PulseSecure

Description: A vulnerability exists in the Pulse Connect Secure admin web interface that could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.

CVSS v3 Base Score: 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Prevalent Malware Files


SHA 256: 1eef72aa566ba6c76b33f9d430d7233e358392382bfb3db81ca4f28d74f415a5

MD5: 01a607b4d69c549629e6f0dfd3983956


Typical Filename: wupxarch.exe

Claimed Product: N/A

Detection Name: W32.Auto:1eef72aa56.in03.Talos

SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5

MD5: 8c80dd97c37525927c1e549cb59bcbf3


Typical Filename: Eter.exe

Claimed Product: N/A

Detection Name:

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b

MD5: 799b30f47060ca05d80ece53866e01cc


Typical Filename: mf2016341595.exe

Claimed Product: N/A

Detection Name: Win.Downloader.Generic::1201

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f

MD5: e2ea315d9a83e7577053f52c974f6a5a


Typical Filename: Tempmf582901854.exe

Claimed Product: N/A

Detection Name: Win.Dropper.Agentwdcr::1201

SHA 256: 1a8a17b615799f504d1e801b7b7f15476ee94d242affc103a4359c4eb5d9ad7f

MD5: 88781be104a4dcb13846189a2b1ea055


Typical Filename: UltraSearchApp

Claimed Product: N/A

Detection Name: Win.Trojan.Generic::sso.talos