#ParsedReport #CompletenessMedium
01-09-2026

EtherHiding Exposed: What Security Leaders Need to Know

https://www.guidepointsecurity.com/blog/etherhiding_exposed_what_security_leaders_need_to_know/

Report completeness: Medium

Threats:
Etherhiding_technique
Clickfix_technique
Regre_ssh_ion_vuln

Victims:
E commerce, Professional services, Retail logistics

Industry:
E-commerce, Government, Retail, Financial, Logistic

Geo:
Iran, North korean

CVEs:
CVE-2024-6387 [Vulners]
CVSS V3.1: 8.1,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- sonicwall sma_6200_firmware (-)

CVE-2023-4911 [Vulners]
CVSS V3.1: 7.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- netapp bootstrap_os (-)

CVE-2022-2586 [Vulners]
CVSS V3.1: 7.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- linux linux_kernel (<4.14.316, <4.19.256, <5.4.211, <5.10.137, <5.15.61)

CVE-2023-0386 [Vulners]
CVSS V3.1: 7.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- debian debian_linux (10.0)

CVE-2023-44487 [Vulners]
CVSS V3.1: 7.5,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- siemens simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware (*)


TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1036, T1102.001, T1176, T1189, T1204.004, T1568, T1584.004

IOCs:
Domain: 19
IP: 1
Coin: 5
Url: 2
BrowserExtension: 1
Hash: 7
Email: 0

Soft:
WordPress

Algorithms:
xor, sha256

Win API:
Polygon

Languages:
powershell