{“lastseen”:”2026-05-22T10:05:08″,”description”:”\\n\\nIn 2025, we observed pervasive SSH tunnel activity, which has remained active into 2026, affecting many government organizations and commercial companies in Russia and Belarus. Behind some of this activity is Cloud Atlas, a group we have known since 2014. During our investigation, we identified new tools used by this group, as well as indicators of compromise.\\n\\nThe group is back to sending out archives containing malicious shortcuts that launch PowerShell scripts. This technique is employed in addition to the previously described use of malicious documents, which exploit an old vulnerability in the Microsoft Office Equation Editor process (CVE-2018-0802) to download and execute malicious code. We have observed the use of third-party public utilities (Tor\/SSH\/RevSocks) to gain a foothold in infected systems and create additional backup control channels.\\n\\n## Technical details\\n\\n### Initial infection\\n\\nAs for the primary compromise, Cloud Atlas remains consistent in using phishing. In the observed campaigns, the attackers emailed a ZIP archive containing an LNK file as an attachment.\\n\\n\\n\\nMalware execution flow\\n\\nAttackers use LNK shortcuts to covertly execute PowerShell scripts hosted on external resources. The command line of the shortcut:\\n\\n\\n\\nExample of the PowerShell script downloaded and executed by the shortcut:\\n\\n\\n\\nExample of the PowerShell script downloaded by the shortcut\\n\\nActions performed by the downloaded PowerShell:\\n\\nStep | Action | Description \\n—|—|— \\n1 | Drops \\”$temp\\\\fixed.ps1\\” | Pre-staging: places the main payload locally in advance to ensure an execution capability independent of subsequent network connectivity or C2 availability. \\n2 | Creates \\”Run\\” registry key \\”YandexBrowser_setup\\” for \\”$temp\\\\fixed.ps1\\” startup  | Early persistence: guarantees execution upon the next logon or reboot. If the script is interrupted during later stages, the payload will still activate automatically. \\n3 | Downloads and drops \\”$temp\\\\rar.zip\\” \\nExtracts \\”*.pdf\\” from the downloaded \\”$temp\\\\rar.zip\\” | Payload delivery: retrieves the decoy archive from the remote server to prepare user-facing content for the distraction phase. \\n4 | Extracts \\”*.pdf\\” from the downloaded \\”$temp\\\\rar.zip\\” | Decoy preparation: unpacks the legitimate-looking document so it can be executed silently without requiring user interaction. \\n6 | Opens extracted decoy document \\”*.pdf\\” with user’s default software | User distraction: opens a convincing document to maintain user engagement and creates a legitimate workflow appearance to buy additional 30\u2013120 seconds for background operations. \\n6 | Executes \\”taskkill.exe \/F \/Im winrar.exe\\” | Process concealment: terminates the archive extractor to prevent the user from seeing the archive contents or noticing unexpected file extraction activity. \\n7 | Searches and deletes \\”rar.zip\\”, \\”*.pdf.zip\\” and \\”*.pdf.lnk\\” | Anti-forensic cleanup: removes the initial infection artifacts before activating the main payload, reducing the number of disk traces available for incident response or EDR correlation. \\n8 | Executes \\”$temp\\\\fixed.ps1\\” | Controlled execution: launches the main payload only after persistence is secured, the user is distracted, and access traces are cleaned up. \\n \\n#### Fixed.ps1 (loader)\\n\\nThe primary purpose of the Fixed.ps1 script is to deliver and install subsequent malware onto the compromised system, specifically VBCloud and PowerShower. Fixed.ps1 establishes persistence (by adding itself to registry Run keys), creates a decoy for the user (by opening a PDF document), and executes the next stages of the attack.\\n\\n#### Fixed.ps1::Payload (VBCloud dropper)\\n\\n\\n\\nExample of the fixed.ps1::Payload (VBCloud dropper)\\n\\nThis module functions as a dropper for the VBCloud backdoor. It drops two files onto the infected machine:\\n\\n * video.vbs: the loader of the backdoor,VBCloud::Launcher. This is a VBScript that decrypts the contents of video.mds (typically using RC4 with a hardcoded key) and executes it in memory.\\n * video.mds: the encrypted body of the backdoor, VBCloud::Backdoor. This is the main module that connects to a C2 server to receive additional scripts or execute built-in commands. This backdoor is designed to function as a stealer, specifically targeting files with extensions of interest (such as DOC, PDF, XLS) and exfiltrating them.\\n\\n\\n\\n#### Fixed.ps1::Payload (PowerShower)\\n\\nThis module installs a second backdoor called PowerShower on the system. We don’t have the specific script that performs this installation, but we assume it’s performed by a script similar to fixed.ps1::Payload (VBCloud dropper).\\n\\nUnlike VBCloud, which focuses on file theft, PowerShower is primarily used for network reconnaissance and lateral movement within the victim’s infrastructure. PowerShower can perform the following tasks:\\n\\n * Collect information about running processes, administrator groups, and domain controllers.\\n * Download and execute PowerShell scripts from the C2 server.\\n * Conduct \\”Kerberoasting\\” attacks (stealing password hashes of Active Directory accounts).\\n\\n\\n\\nPowerShower is dropped onto the system via the path ‘C:\\\\Users\\\\\\\\[username]\\\\Pictures\\\\googleearth.ps1′.\\n\\n\\n\\nContents of the googleearth.ps1(PowerShower)\\n\\n### PowerShower::Payload (credential grabber)\\n\\nPowerShower downloads an additional script for stealing credentials. It performs the following actions:\\n\\n * Creates a Volume Shadow Copy of the C:\\\\ drive.\\n * Copies the SAM (stores local user password hashes) and SECURITY system files from this shadow copy to C:\\\\Users\\\\Public\\\\Documents\\\\, disguising them as PDF files.\\n * The script is launched in several stages. To execute with high privileges, the script uses a UAC bypass technique via fodhelper.exe (a built-in Windows utility). This allows PowerShell to run as an administrator without directly prompting the user, which could otherwise raise suspicion.\\n\\n\\n\\nThe full launch chain looks like this:\\n\\n\\n\\nThe full Base64-decoded script is given below.\\n\\n\\n\\n### Multi-user RDP by patching termsrv.dll\\n\\nMoving laterally across the victim’s network, the attackers executed a suspicious PowerShell script named rdp_new.ps1 (MD5 1A11B26DD0261EF27A112CE8B361C247):\\n\\n\\n\\nThe script is designed to allow multiple RDP sessions in Windows 10 by patching the termsrv.dll file. Termsrv.dll is the core Windows library that enforces Remote Desktop Services rules.\\n\\nBy default, Windows limits the number of simultaneous RDP sessions. Removing this restriction allows attackers to operate on the machine in the background without disconnecting the legitimate user, thereby reducing the likelihood of detection.\\n\\nAt first, the script enables RDP on the firewall and downgrades the RDP security settings:\\n\\n\\n\\nBefore modifying termsrv.dll, the script takes ownership and assigns itself full permissions. Then the script finds the sequence of bytes `39 81 3C 06 00 00 ?? ?? ?? ?? ?? ??` and replaces it with `B8 00 01 00 00 89 81 38 06 00 00 90`. After these manipulations, the script restarts the RDP service.\\n\\n\\n\\nExample of script\\n\\nThe patched version allows multiple concurrent logins so attackers can stay connected without disrupting the legitimate user, thereby reducing suspicion.\\n\\n### Reverse SSH tunneling\\n\\nAs mentioned above, during this wave of attacks, the adversaries widely deployed reverse SSH tunnels to many hosts of interest. The compromised machine initiates an SSH connection to an attacker-controlled server, which allows attackers to bypass standard firewall rules via establishing outbound connections.\\n\\nThat way, even if the primary backdoor is discovered, the attackers can maintain control through the SSH tunnel.\\n\\nTo install a reverse SSH tunnel on a victim’s host, the attackers run VBS scripts via PAExec or PsExec.\\n\\nWe’ve seen three types of scripts:\\n\\n * Gen.vbs (WriteToSchedulerGenerateKey.vbs) generates key for SSH tunnel.\\n * Run.vbs (WriteToSchedulerRunSSH.vbs) runs reverse SSH tunnel.\\n * Kill.vbs (WriteToSchedulerKillSSH.vbs) stops reverse SSH tunnel via taskkill.exe.\\n\\n\\n\\n\\n\\nTo achieve persistence, the attackers added a new scheduled task in Windows:\\n\\n\\n\\nIn some cases, before establishing a reverse SSH tunnel, attackers set new access permissions to the folder containing the private key to prevent the legitimate user or system administrators from easily accessing or modifying it:\\n\\n\\n\\n### Patched OpenSSH\\n\\nSome OpenSSH binaries used by the attackers had their imports modified. Instead of libcrypto.dll, the SSH executable imports syruntime.dll, which was placed in the same folder as the binary. This was likely done to evade detection and ensure stealth.\\n\\n\\n\\nIn addition, we found a portable version of OpenSSH, presumably compiled by the adversaries:\\n\\n\\n\\n### RevSocks\\n\\nIn addition to Reverse SSH tunnels, the attackers installed RevSocks using the same infrastructure. RevSocks is an alternative tool to SSH for establishing tunnels and proxy connections, written in Golang. This tool allows direct connection to workstations on the local network. It also allows attackers to gain access to other segments of the victim’s network by using the machine as a gateway. In some cases, C2 addresses were hardcoded into the binary; in other cases, the C2 was passed in command line arguments.\\n\\n\\n\\nThere were also reverse SOCKS samples with hardcoded C2 addresses:\\n\\n\\n\\n### Tor tunneling\\n\\nTo maintain control over the compromised host, the Tor network was used in some cases. A minimal set of a Tor executable and configuration files, necessary for launching HiddenService, was copied to the system directories of infected devices. The name of the Tor Browser executable file was modified. As a result, the infected machine was accessible via RDP from the Tor network when accessing the generated .onion domain. \\nBelow is an example of a configuration file for routing connections from Tor to RDP ports on the local network, as well as example command lines for logging into Tor.\\n\\n\\n\\nExample of TOR configuration file\\n\\n### \\n\\n### PowerCloud\\n\\nWe analyzed a new Cloud Atlas tool, PowerCloud. It collects user data with administrator privileges and writes this information to Google Sheets in Base64 format.\\n\\nThe tool represents an obfuscated PowerShell script. In most cases, it is packaged into an executable file using the PS2EXE utility, but we have also encountered variants in the form of a separate PowerShell script.\\n\\n\\n\\nTo find administrators on the victim host, the tool executes the following command:\\n\\n\\n\\nThis information is appended with the computer name and current date, the data is encoded in base64, and then the collected data is added to an existing Google Sheet.\\n\\n\\n\\nPowerCloud script\\n\\n### Browser checker\\n\\nAdditionally, the attackers used another PowerShell script (MD5 5329F7BFF9D0D5DB28821B86C26D628F), compiled into an executable file via PS2EXE, which checks whether browser processes (Chrome, Edge, Firefox, and other) are running. This helps detect when the user is working on the computer. This can be used to choose the optimal time for conducting attacks (for example, when the user is away but their browser is still open) or simply to gather information about the victim’s habits.\\n\\nThe information about running browsers is written to a log file on the local host.\\n\\n\\n\\nFragment of the deobfuscated script\\n\\n## Victims\\n\\nAccording to our telemetry, in late 2025 and early 2026, the identified targets of the described malicious activities are located in Russia and Belarus. The targeted industries mostly include government agencies and diplomatic entities.\\n\\nWe attribute the activity described in this report to the Cloud Atlas APT group with a high degree of confidence. The group used techniques and tools described previously, such as the initial access vector, the Python script for information gathering, and the Tor application for forwarding ports to the Tor network. The victim profile and geography also matches the Cloud Atlas targets.\\n\\nWe couldn’t help but notice some parallels with recent Head Mare activity. The PhantomHeart backdoor (available in Russian only), attributed to Head Mare and used to create an SSH tunnel, was placed in directories actively used by Cloud Atlas:\\n\\n * C:\\\\Windows\\\\ime\\n * C:\\\\Windows\\\\System32\\\\ime\\n * C:\\\\Windows\\\\pla\\n * C:\\\\Windows\\\\inf\\n * C:\\\\Windows\\\\migration\\n * C:\\\\Windows\\\\System32\\\\timecontrolsvc\\n * C:\\\\Windows\\\\SKB\\n\\n\\n\\nHowever, TTPs are still differentiated.\\n\\n## Conclusion\\n\\nFor more than ten years, the Cloud Atlas group has continued its activities and expanded its arsenal. Over the course of last year, many targeted campaigns in general were found to employ ReverseSocks, SSH and Tor, and the use of these utilities was no exception for Cloud Atlas. Creating such backup control channels using publicly available utilities significantly complicates the complete disruption of attackers’ actions on compromised systems. We will continue to closely monitor the group’s activity and describe their new tools and techniques.\\n\\n## Indicators of compromise\\n\\n**PowerCloud \\n** \\n7A95360B7E0EB5B107A3D231ABBC541A C:\\\\Windows\\\\wininet.exe \\nC0D1EAA15A2CEFBAB9735787575C8D8E C:\\\\Windows\\\\LiveKernelReports\\\\update.exe \\nD5B38B252CF212A4A32763DE36732D40 C:\\\\Windows\\\\ime\\\\imejp\\\\dicts\\\\i39884.exe \\n3C75CEDB1196DF5EAB91F31411ED4B33 C:\\\\pla\\\\reports.exe \\n42AC350BFBC5B4EB0FEDBA16C81919C7 C:\\\\ProgramData\\\\update_[redacted].exe \\n493B901D1B33EB577DB64AADD948F9CE C:\\\\Windows\\\\migration\\\\wtr\\\\MicrosoftBrowser.exe \\n2CABB721681455DAE1B6A26709DEF453 C:\\\\Windows\\\\pla\\\\reports\\\\winlog.exe \\n1B39E86EB772A0E40060B672B7F574F1 C:\\\\Windows\\\\System32\\\\timecontrolsvc\\\\vmnetdrv64.exe \\n1D401D6E6FC0B00AAA2C65A0AC0CFD6B C:\\\\Windows\\\\setup\\\\scripts\\\\install\\\\software\\\\activation\\\\aact\\\\dfsvc.exe \\n40A562B8600F843B717BC5951B2E3C29 C:\\\\Windows\\\\branding\\\\scat.exe \\nF721A76DEB28FD0B80D27FCE6B8F5016 C:\\\\Windows\\\\ime\\\\imekr\\\\dicts\\\\dfsvc.exe \\nD3C8AFD22BAA306FF659DB1FAC28574A C:\\\\ProgramData\\\\update_[redacted].exe \\n6D7B2D1172BBDB7340972D844F6F0717 C:\\\\Users\\\\\\\\[redacted]\\\\AppData\\\\Local\\\\1c\\\\1cv8\\\\1cv8ud.exe \\nC:\\\\Users\\\\\\\\[redacted]\\\\AppData\\\\Local\\\\1c\\\\1cv8\\\\svc.exe \\n9769F43B9DE8D19E803263267FA6D62E C:\\\\Users\\\\\\\\[redacted]\\\\AppData\\\\Local\\\\1c\\\\1cv8\\\\1cv8ud.exe \\n63B6BE9AE8D8024A40B200CCCB438F1D C:\\\\Windows\\\\notepad.exe \\n6AA586BCC45CA2E92A4F0EF47E086FA1 C:\\\\Windows\\\\splwow32.exe \\nEBA3BCDB19A7E256BF8E2CC5B9C1CCA9 C:\\\\Users\\\\\\\\[redacted]\\\\Desktop\\\\soc\\\\stant.exe \\nB4E183627B7399006C1BC47B3711E419 C:\\\\WINDOWS\\\\ime\\\\service.exe \\nF56B31A4B47AD3365B18A7E922FBA1A8 dfsvc.exe \\nF6F62456FB0FCC396FB654CBED339BC3 – \\n25C8ED0511375DCA57EF136AC3FA0CCA C:\\\\branding\\\\dwmw.exe\\n\\n**Browser checker**\\n\\n5329F7BFF9D0D5DB28821B86C26D628F C:\\\\ProgramData\\\\checker_[redacted].exe\\n\\n**ReverseSocks**\\n\\n2B4BA4FACF8C299749771A3A4369782E C:\\\\Windows\\\\PLA\\\\System\\\\bounce.exe \\nC:\\\\Windows\\\\pla\\\\print_status.exe \\nBA9CE06641067742F2AFC9691FAFF1DC C:\\\\ProgramData\\\\hp\\\\client.exe \\nFB0F8027ACF1B1E47E07A63D8812ED50 C:\\\\Windows\\\\System32\\\\timecontrolsvc\\\\vmnetdrv64.exe \\nBBF1FA694122E07635DEEAC11AD712F8 C:\\\\Windows\\\\System32\\\\HostManagement.exe \\nF301AA3D62B5095EEC4D8E34201A4769 C:\\\\Windows\\\\ime\\\\imejp\\\\msfu.exe \\nF9C3BBE108566D1A6B070F9C5FB03160 C:\\\\Windows\\\\ime\\\\imetc\\\\help\\\\IMTCEN14.exe\\n\\n**Malicious MS Office documents**\\n\\n369B75BDCDED16469EDE7AB8BEDCFAE1 \\n9EAAE9491F6A50D6DF0BE393734A44CB \\n3E6E9DF00A764B348EC611EE8504ACA0 \\n9BD788F285E32A05E6591D1EB36EBFFC \\nF42085522EC2EBB16EDCF814E7C330AD \\n2042EB5D52F0B535A1CE6B6F954C8C2B \\n2AA1E9765EF6B00B94A9B6BE0041436A \\n36120F5E9411BCBAC7104EF3FA964ED2 \\n5000A353399500BC78381DC95B6ED2DC \\n579A9952D31CAD801A3988DBE7914CE7 \\n867B634588C0FD6B26684D502C15AB03 \\n38FA4306FA4406BA31CF171AF4D36E34 \\n83EDDE9F7EEEFAC0363413972F35572B \\nCC751619BFEC0DC4607C17112B9E3B2C \\nA632858F14B36F03D0F213F5F5D6BFF2 \\n097CA205AD9E3B72018750280904718C \\n69121C36EB8BF77962DCA825FCFFD873 \\nC5702EB250F855C8C872FFFB9BB656ED \\nED34F5A136FBA4FDEA976570FAA33ED7 \\n0577DB70844E88B32B954906E2F20798 \\n28ECF8FB6719E14231B94B4D37629B0E \\n0857C84B62289A1A9F29E19244E9A499 \\n0C514E137860F489E3801213460EF938 \\n50568B1F9335A7E3BA4E5DF035A8FB86 \\n7F776AD200287D6DE14A29158C457179 \\n51F7F794ED43FB90D0F8EBBB5EFFE628 \\nB8C753DD254509FBA5077FFD5067EAB0 \\nBC3739DEC8CD8F54F3F60A85F3ED600E \\nEC076CD21C483A40156F4E40D08DADED \\n216CB7F31D383C0DD892B284DF05A495 \\n116F59E70A9DF97F4ADAEA71EECB1E9A \\n7242AC065B50BCDE9308756B49DBADCB \\n8158552950D2E13B075001CE0C52AA97 \\nA75DBED984963B9AB21309C5B2F8FD9B \\n0320DD389FDBAB25D46792BD2817675E \\n5339D1A666F3E40FE756505CF1D87D4B \\n67D7E3AEEB673BF60C59361C12A4ED81 \\n89572F0ED20791A5AC9FC4267D67CCB0 \\nB6AAE073E7BFEBF4D643C2BBEB5C02E1 \\n344CA9EA07CD4AC90EF27F8890D4EC05\\n\\n### **Domains and IPs**\\n\\n**Reverse SSH\/Socks domains**\\n\\ntenkoff[.]org \\ncloudguide[.]in \\ngoverru[.]com \\nkufar[.]org \\nultimatecore[.]net \\nspbnews[.]net \\nonedrivesupport[.]net\\n\\n**Malicious and compromised domains used in MS Office documents**\\n\\namerikastaj[.]com \\nbigbang[.]me \\npaleturquoise-dragonfly-364512.hostingersite[.]com \\nwizzifi[.]com \\ntotallegacy[.]org \\nmamurjor[.]com \\nlandscapeuganda[.]com \\nlafortunaitalian.co[.]uk \\nkommando[.]live \\ninternationalcommoditiesllc[.]com \\nhumanitas[.]si \\nfishingflytackle[.]com \\nfirsai.tipshub[.]net \\nalnakhlah.com[.]sa \\nallgoodsdirect.com[.]au \\nagenciakharis.com[.]br\\n\\n**Powershell payload staging**\\n\\nistochnik[.]org \\nznews[.]neti \\ninvestika-club[.]com \\n194.102.104[.]207 \\n46.17.45[.]56 \\n46.17.45[.]49 \\n46.17.44[.]125 \\n46.17.44[.]212 \\n185.22.154[.]73 \\n194.87.196[.]163 \\n195.58.49[.]9 \\n93.125.114[.]193 \\n93.125.114[.]57 \\n45.87.219[.]116 \\n37.228.129[.]224 \\n185.53.179[.]136 \\n185.126.239[.]77 \\n5.181.21[.]75 \\n146.70.53[.]171 \\n45.15.65[.]134 \\n185.250.181[.]207 \\n81.30.105[.]71\\n\\n### **File paths**\\n\\n**VBS scripts**\\n\\nWriteToSchedulerKillSSH.vbs \\nCreate_task_day.vbs \\nWriteToSchedulerGenerateKey.vbs \\nC:\\\\Windows\\\\INF\\\\Run.vbs \\nc:\\\\Windows\\\\INF\\\\install.vbs \\nUpdate.vbs \\nc:\\\\Windows\\\\PLA\\\\System\\\\Gen.vbs \\nC:\\\\Windows\\\\INF\\\\GenK.vbs \\nc:\\\\Windows\\\\PLA\\\\System\\\\Kill.vbs \\nc:\\\\Windows\\\\PLA\\\\System\\\\Run.vbs\\n\\n**ssh.exe**\\n\\nc:\\\\Windows\\\\ime\\\\imejp\\\\Asset.exe \\nc:\\\\Windows\\\\PLA\\\\System\\\\conhosts.exe \\nc:\\\\Windows\\\\INF\\\\BITS\\\\esentprf.exe \\nc:\\\\Windows\\\\INF\\\\MSDTC\\\\RuntimeBrokers.exe \\nc:\\\\Windows\\\\inf\\\\diagnostic.exe\\n\\n**ReverseSocks**\\n\\nC:\\\\Windows\\\\PLA\\\\System\\\\bounce.exe \\nC:\\\\ProgramData\\\\hp\\\\client.exe \\nC:\\\\Windows\\\\System32\\\\timecontrolsvc\\\\vmnetdrv64.exe\\n\\n**Tor client**\\n\\nC:\\\\Windows\\\\Resources\\\\Update\\\\Intel.exe \\nC:\\\\Windows\\\\INF\\\\package.exe”,”published”:”2026-05-22T09:12:13″,”modified”:”2026-05-22T09:12:13″,”type”:”securelist”,”title”:”Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload”,”source”:””,”references”:””,”id”:”SECURELIST:2FCB8D07E3287A4A6D4C4DC2D658F98F”,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[“CVE-2018-0802″],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:9.3,”severity”:”HIGH”,”vector”:”AV:N\/AC:M\/Au:N\/C:C\/I:C\/A:C”,”version”:”2.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/securelist.com\/cloud-atlas-2026\/119895\/”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-22T10:05:08″,”description”:”\\n\\nIn 2025, we observed pervasive SSH tunnel activity, which has remained active into 2026, affecting many government organizations and commercial companies in Russia and Belarus….<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,55,12,15,13,136,7,11,5],"class_list":["post-56305","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-cvss-93","tag-exploit","tag-high","tag-news","tag-securelist","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n