Russian SVR exploits another set of publicly known Vulnerabilities

Threat Advisories

Russian SVR exploits another set of publicly known Vulnerabilities


For a detailed advisory, download the pdf file here.

In accordance with the earlier Threat Advisory released by the Hive Pro threat research team, the Russian SVR aka APT29  continues exploitation of known vulnerabilities to target organizations globally. The threat actors have now expanded their TTPs using multiple publicly available exploit and the Silver framework. The new set of victims include sectors such as governments, think-tank, policy, and energy  by deploying an open-source tool Silver which allows the SVR to gain persistence on compromised infrastructure.

The Techniques used by the APT29 includes:

  • Active Scanning(T1595.002)
  • Exploit PublicFacing Application(T1190)
  • Supply Chain Compromise: Compromise Software Supply Chain(T1195.002)
  • Trusted Relationship(T1199)
  • Command and Scripting Interpreter: Visual Basic(T1059.005)
  • Server Software Component: Web Shell(T1505.003)
  • Valid Accounts(T1078)

The 7 vulnerabilities targeted are:

  • CVE-2019-1653 – Cisco Small Business RV320 and RV325 Routers
  • CVE-2019-2725 – Oracle WebLogic Server
  • CVE-2019-7609 – Kibana
  • CVE-2020-5902 – F5 Big-IP
  • CVE-2020-14882 – Oracle WebLogic Server
  • CVE-2021-21972 – VMware vSphere
  • CVE-2021-26855 – Microsoft Exchange Server

Actor Details

Name: APT 29 
Known as: Cozy Bear, The Dukes, Group 100, Yttrium, Iron Hemlock, Minidionis, CloudLook, Grizzly Steppe, CozyCar, CozyDuke 
Origin: Russia
Targeted Locations: Austria, Brazil, China, France, Germany, Hungary, Japan, Mexico, Netherlands, New Zealand, Norway, Portugal, South Korea, Spain, Turkey, Ukraine, United States, Uzbekistan
Targeted Sectors: Academic, Aerospace, Energy, Extractive, Financial Services, Government, Industrials, Engineering, Insurance, Media, NGOs, Nonprofits Oil and Gas, Pharmaceuticals, Technology

Vulnerability Details

For details, please refer to the pdf version of the advisory here

Patch Links