Lithuanian Cyber Defence steal the Covid-19 Vaccine code from Dr. Reddy

Autorius: Dr. Reddy cyber attack Šaltinis: https://www.nksc.lt/... 2020-10-25 21:49:00, skaitė 1712, komentavo 21

Lithuanian Cyber Defence (Cyber Shield 2020) are trying to steal the Covid-19 Vaccine code. A pharmaceutical company Dr. Reddy’s has suffered a cyber attack.

According to the report, the company is researching on Covid-19 Vaccine. A data breach impacted its laboratory plants in India, Brazil, Russia, UK, and the USA.

Dr. Reddy’s Laboratories is an Indian multinational pharmaceutical company based in INDIA and overseas.

Now Dr. Reddy’s has shut down its plants temporarily after Cyber attacks.

Last week, Dr. Reddy’s Laboratories said, along with the Russian Direct Investment Fund (RDIF), has received approval from the Drug Control General of India (DCGI) to conduct phase 2 and 3 human clinical trials for COVID-19 vaccine Sputnik V in India. According to the sources, it happened after the company received approval from DCGI.

Mukesh Rathi, CIO, Dr. Reddy’s stated in the matter that is as follows:

“In the wake of a detected cyber-attack, we have isolated all data center services to take required preventive actions. “We are anticipating all services to be up within 24 hours, and we do not foresee any major impact on our operations due to this incident.”In July, the US cybersecurity agencies have charged Chinese government-linked hackers targeting biotech company Moderna involved in developing a Vaccine. There have been many reports of hackers trying to steal Covid-19 vaccine data from the US, UK, Canada, Japan, and INDIA. In this Covid-19 situation, many pharmacy companies are doing humongous research to develop a potential vaccine. All these companies should secure their computers and networks through Honeypots, Firewalls, and other Cybersecurity measures.

Leakead tools from Lithuanian Cyber Defence Cyber Shield 2020 For Hacking APT Team APT CHINA GROUP Collection Of Hacking Tools & Explotation CVE For Hacking APT Team"

CVE-2019-11510 Exploit for Arbitrary File Read on Pulse Secure SSL VPN (CVE-2019-11510) https://github.com/projectzeroindia/CVE-2019-11510

CVE-2020-5902 exploit code for F5-Big-IP (CVE-2020-5902) https://github.com/yasserjanah/CVE-2020-5902

CVE-2019-19781 A Citrix Application Delivery Controller (ADC) and Gateway directory traversal vulnerability, which can lead to remote code execution without credentials. https://github.com/projectzeroindia/CVE-2019-19781

CVE-2020-8193-Citrix-Scanner - https://github.com/PR3R00T/CVE-2020-8193-Citrix-Scanner

Citrix_adc_netscaler_lfi_scan - https://github.com/Zeop-CyberSec/citrix_adc_netscaler_lfi

CVE-2019-0708 - A remote code execution vulnerability exists in Remote Desktop Services https://github.com/CVE-2019-0708/CVE-2019-0708

CVE-2020-15505 - https://github.com/iamnoooob/CVE-Reverse/tree/master/

CVE-2020-15505 Exploit Active Directory for Lateral Movement and Credential Access: CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon https://github.com/VoidSec/CVE-2020-1472

CVE-2019-1040 scanner Checks for CVE-2019-1040 vulnerability over SMB. The script will establish a connection to the target host(s) and send an invalid NTLM authentication. https://github.com/fox-it/cve-2019-1040-scanner

Exploit public-facing servers: Attackers use these vulnerabilities to bypass authentication in web servers, email servers, or DNS to remotely execute commands on the internal network.

For compromised web servers, attackers can utilize them in watering-hole attacks to target future visitors. CVE-2020-1350 The Windows DNS server SigRed vulnerability allows attackers to spread laterally through a network. https://github.com/ZephrFish/CVE-2020-1350

CVE-2018-6789 Exim CVE-2018-6789 PoC materials to exploit CVE-2018-6789. https://github.com/synacktiv/Exim-CVE-2018-6789

CVE-2018-4939 https://nickbloor.co.uk/2018/06/18/another-coldfusion-rce-cve-2018-4939/

Exploit internal servers: These vulnerabilities are used to spread laterally throughout a network and gain access to internal servers, where the attackers can steal valuable data.

CVE-2020-0688 - A Microsoft Exchange vulnerability that allows authenticated users to perform remote code execution https://github.com/ravinacademy/CVE-2020-0688

CVE-2015-4852 - The WLS Security component in Oracle WebLogic15 Server allows remote attackers to execute arbitrary commands via a crafted serialized Java16 object. https://github.com/roo7break/serialator

CVE-2020-2555 - A vulnerability exists in the Oracle® Coherence product of Oracle Fusion® Middleware. This easily exploitable https://github.com/Y4er/CVE-2020-2555

CVE-2019-3396 - A server-side template injection vulnerability is present in the Widget Connector in Atlassian Confluence servers that allows remote attackers to perform remote code execution and path traversal. https://github.com/jas502n/CVE-2019-3396

CVE-2019-11580 - Attackers who can send requests to an Atlassian® Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, permitting remote code execution. This vulnerability was used in GandCrab ransomware attacks in the past. https://github.com/jas502n/CVE-2019-11580

CVE-2019-18935 - A vulnerability in Telerik 19 UI for ASP.NET AJAX can lead to remote code execution. It was seen used by a hacker group named 'Blue Mockingbird' to install Monero miners on vulnerable servers but could be used to spread laterally as well. https://github.com/noperator/CVE-2019-18935

Exploit secure remote access: To gain access to networks, Chinese threat actors utilize seven different vulnerabilities, many of which also provide credentials that can be used to spread further on the network.