CVE-2021-44207

Vulnerability updated 15 days ago (2024-11-29T13:41:49.709Z)
Download STIX
Preview STIX
CVE-2021-44207 is a significant software vulnerability that was exploited by APT41, a prolific Chinese state-sponsored espionage group known for targeting both public and private sector organizations. This flaw in the USAHerds web application's design or implementation mirrors a previously reported vulnerability in Microsoft Exchange Server (CVE-2020-0688), wherein the applications used a static validationKey and decryptionKey (collectively known as the machineKey) by default. In three investigations during 2021, APT41 exploited this zero-day vulnerability, which allowed them to successfully compromise at least six U.S. state government networks. This vulnerability was part of a broader trend of China-nexus intrusion sets heavily targeting Remote Code Execution (RCE) vulnerabilities and leveraging zero-day vulnerabilities. Other notable instances include the exploitation of CVE-2021-44228 by APT41, UNC3886's use of a local zero-day vulnerability in FortiOS (CVE-2022-41328) to deploy custom malware families on Fortinet and VMware systems in September 2022, and UNC4841's targeting of a Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) to gain access to ESG appliances and deploy additional malware. In September 2022, two Microsoft Exchange zero-day vulnerabilities, tracked as CVE-2022-41040 and CVE-2022-41082, were also exploited by an unidentified China-nexus intrusion set. These incidents underscore the persistent threat posed by such groups and the importance of addressing software vulnerabilities promptly. For further information regarding deserialization exploits, Mandiant has provided resources including a new hunting rule generation tool ‘HeySerial’ and a blog post titled "Now You Serial, Now You Don’t — Systematically Hunting for Deserialization Exploits".
Description last updated: 2024-05-04T18:49:46.806Z
What's your take? (Question 1 of 4)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Zero Day
Malware
Exploit
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The APT41 Threat Actor is associated with CVE-2021-44207. APT41, also known as Winnti, is a threat actor suspected to be originating from China, with its activities dating back to as early as 2012. It has targeted organizations in at least 14 countries and has been associated with the use of at least 46 different code families and tools. The group's activiUnspecified
2
Associated Vulnerabilities
To see the evidence that has resulted in these vulnerability associations, create a free account
Alias DescriptionAssociation TypeVotes
The CVE-2021-44228 Vulnerability is associated with CVE-2021-44207. CVE-2021-44228, also known as the Log4Shell vulnerability, is a significant flaw in Apache's Log4j software. Disclosed in December 2021, it quickly became one of the most severe bugs due to its widespread usage and potential for exploitation. Various Advanced Persistent Threat (APT) actors attemptedUnspecified
2
Source Document References
Information about the CVE-2021-44207 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more