8f766dea3afd410ebcd5df5994a3c571

'Pickers.aspx' webshell MD5 from CISA AA22-264A Appendix A. Used by the HomeLand Justice operators for persistence after initial access via CVE-2019-0604 on an Internet-facing SharePoint server roughly 14 months before the July 2022 destructive attack on Albanian government networks.

first seen

Apr 30, 2021

publisher

CISA