VERY IMPORTANT

AlienLabs has seen a number of reports of active exploitation of a vulnerability in Microsoft Sharepoint (CVE-2019-0604). One report by the Saudi Cyber Security Centre appears to be primarily targeted at organisations within the kingdom. An earlier report by the Canadian Cyber Security Centre identified similar deployment of the tiny China Chopper web-shell to gain an initial foothold. AlienLabs has identified malware (https://pastebin.com/bUFPhucz) that is likely an earlier version of the second-stage malware deployed in the Saudi Intrusions. This malware sample was shared by a target in China. The malware receives commands at http://$SERVER/Temporary_Listen_Addresses/SMSSERVICE - and has the ability to: - Execute commands. - Download and upload files. One user on twitter has reported that they have seen exploitation from the IP address 194.36.189[.]177 - which we have also seen acting as a command and control server for malware linked to FIN7. A patch for the vulnerability is available from Microsoft.