Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
ID: 3c51f76e-3ade-5fd9-ab97-4a4f720e4689
STIX ID: report--3c51f76e-3ade-5fd9-ab97-4a4f720e4689
Feed Name: Palo Alto Networks Unit 42
Threat Score
Unit42 analyzes CL-CRI-1040—linked with Microsoft’s Storm-2603—and describes Project AK47, a malware toolkit (AK47C2 backdoor with DNS/HTTP C2, AK47/X2ANYLOCK ransomware, and DLL sideloading loaders) used in active exploitation of recent SharePoint (ToolShell) vulnerabilities; the report provides technical protocol details, IoCs, links to LockBit 3.0 affiliate artifacts and a Warlock leak site, and recommended mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.