SecuriTricks - CVE-2021-34473

The BadPilot campaign: Multiyear global access operation

A Russian state actor subgroup within Seashell Blizzard has conducted a global access operation called the BadPilot campaign since 2021. The group exploits vulnerabilities in Internet-facing infrastructure to gain persistent access to high-value targets across various sectors worldwide. Their tacti…

persistence

credential theft

CVE-2024-1709

CVE-2021-34473

vulnerability exploitation

Published: February 12, 2025

Downloadable IOCs: 0

ProxyLogon and ProxyShell Used to Target Government Mail Servers in Asia, Europe, and South America

This analysis describes the identification of a server likely exploiting ProxyLogon and ProxyShell vulnerabilities to gain unauthorized access to government email servers across Asia, Europe, and South America. The threat actor leveraged open-source exploit code to infiltrate systems and steal sens…

Published: July 5, 2024

Downloadable IOCs: 4

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

An analysis reveals long-term espionage operations by a Chinese advanced persistent threat (APT) group against at least seven governmental entities across the Middle East, Africa and Asia since late 2022. The threat actor attempts to obtain sensitive and classified information about diplomatic and …

Published: May 23, 2024

Downloadable IOCs: 28

Tag: CVE-2021-34473

Attack reports

The BadPilot campaign: Multiyear global access operation

ProxyLogon and ProxyShell Used to Target Government Mail Servers in Asia, Europe, and South America

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia