Tag: CVE-2024-38213

3 Attack Reports | 1 Vulnerabilities

Attack reports

Targeted activity UAC-0212 against developers and suppliers of automation and process control solutions

In 2024-2025, UAC-0212, a subcluster of UAC-0002 (Sandworm), launched targeted cyberattacks against Ukrainian critical infrastructure and related industries. The actor employed new tactics, exploiting CVE-2024-38213 to deliver malware through PDF documents. Tools like SECONDBEST, EMPIREPAST, SPARK,…
sandworm
supply chain
CVE-2024-38213
2025-02-26
crookbag
Published: February 26, 2025
Linked vulnerabilities : CVE-2024-38213 (CVSS 6.5)
Downloadable IOCs: 112

The RAT race: What happens when RATs go undetected

This analysis explores a sophisticated cyberattack attempt involving multiple Remote Access Tools (RATs) and a stealer. The attack chain begins with an email containing an exploit for CVE-2024-38213, bypassing Windows' Mark of the Web security feature. The malware uses WebDav directories and Cloudf…
xworm
rat
dcrat
CVE-2024-38213
2024-11-30
purelog stealer
Published: November 30, 2024
Downloadable IOCs: 0

CVE-2024-38213: From Crumbs to Full Compromise in a Stealthy Cyber Attack

A targeted email campaign exploiting CVE-2024-38213 has been uncovered, disguised as communication related to the Gas Infrastructure Europe Annual Conference in Munich. The attack bypasses standard security protocols to deploy LummaStealer malware, stealing sensitive data. The vulnerability, known …
xworm
phishing
asyncrat
venomrat
formbook
CVE-2024-38213
2024-11-08
copy2pwn
darkgate rat
lummastealer
Published: November 8, 2024
Downloadable IOCs: 0
Click here to see more Attack Reports

Vulnerabilities

CVE-2024-38213

6.5
    Windows
Published: August 13, 2024
Click here to see more Vulnerabilities