AvosLocker Ransomware Abuses Driver File to Disable AV and Scans for Log4shell
According to the analysis, the suspected entry point is via the Zoho ManageEngine ADSelfService Plus (ADSS) exploit. Due to the lack of network traffic details, TrendMicro could not identify the exact CVE ID of the security gap the attacker used.
However, there are some indications that they abused the same vulnerability previously documented by Synacktiv during a pentest, CVE-2021-40539.
The gap they observed was particularly similar to the creation of JSP files (test.jsp), execution of keytool.exe with “null” parameters to run a crafted Java class/code.
Featured Resources
blog
Using Continuous Threat Exposure Management to Enable Business Partnership
This is Part 4 of our five-part series on Continuous Threat Exposure Management (CTEM). Effective cybersecurity is not just about
Podcast
Security Validation: A Deep Dive
Security Ledger’s Paul Roberts and Cymulate Field CTO, David Kellerman discuss the evolving need for security validation technology. In an
blog
Security Validation: A Deep Dive with Cymulate Field CTO, David Kellerman
In an era when cyber threats come from every dark corner at an alarming rate, staying vigilant and ahead of
Subscribe to Our Blog
Subscribe now to get the latest insights, expert tips and updates on threat exposure validation.
Subscribe