f5_title

Threat Campaigns Changelog

This campaign aims to identify Apache OfBiz servers vulnerable to jndi injection "Log4Shell" which could lead to Remote Code execution.  The threat actor attempted to verify the presence of a JNDI injection vulnerability by sending a crafted payload.

Apache OfBiz 'JNDI' Remote Code Execution - tea

This campaign aims to identify Microsoft SharePoint servers that may have been compromised via the ToolShell exploit chain, by scanning for indicators of a backdoor. The threat actor attempts to verify successful exploitation by scanning for a dropped .aspx web shell.

SharePoint ToolShell Backdoor Scanning - OS

This campaign aims to identify Microsoft SharePoint servers that are vulnerable to the ToolShell exploit chain, which can lead to remote code execution.  The threat actor attempts to verify the authorization bypass vulnerability by sending a specially crafted header.

SharePoint ToolShell Remote Code Execution - lkx

This campaign aims to identify PHPUnit web servers vulnerable to PHPUnit Eval_stdin PHP Remote Code Execution vulnerability. The threat actor instructs the vulnerable server to create a PHP backdoor.

PHPUnit Eval_stdin Remote Code Execution - wong

This campaign aims to identify Apache Tomcat servers vulnerable to Remote Code Execution via JSP upload vulnerability. The threat actor instructs the vulnerable server to create a JSP backdoor.

Apache Tomcat JSP upload via PUT method - ok

This campaign aims to identify and exploit BIG-IP servers vulnerable to BIG-IP iControl REST Remote Code Execution vulnerability.  An attacker can bypass authentication and access the management interface to execute commands. The threat actor instructs the server to download and execute a variation of Mirai botnet.

BigIP iControl REST 'H2H' Remote Code Execution - asdf

BigIP iControl REST 'H2H' Remote Code Execution - oshi

This vulnerability is part of ProxyShell exploit chain which leads to remote code execution on the vulnerable server. Microsoft Exchange fails to properly normalize a user supplied path before passing it to the system backend. This allows an attacker to interact directly with the internal endpoints without any proper authentication.

Microsoft Exchange Pre Authentication Path Confusion - evil

This campaign aims to identify and exploit ThinkCMF servers vulnerable Remote Code Execution vulnerability.  The threat actor instructs the vulnerable server to create a PHP backdoor.

ThinkCMF Remote Code Execution - dd

This campaign aims to identify GeoServer which is vulnerable to Remote Code Execution (RCE). The threat actor attempts to verify the vulnerability with a ping back command.

GeoServer Remote Code Execution - bbox

This campaign aims to identify Apache OfBiz servers vulnerable to Path Traversal which could lead to Server Side Code Injection attacks.  The threat actor instructs the vulnerable server to return the output of an echo command.

Apache OfBiz Path Traversal Code Execution - Wua

This campaign aims to identify ThinkPHP servers that are vulnerable to Remote Code Execution vulnerability. The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

ThinkPHP Remote Code Execution - GhOul

This campaign aims to identify UNA CMS servers vulnerable to PHP Object Injection which leads to RCE. The threat actor instructs the vulnerable server to create a PHP backdoor.

UNA CMS Remote Code Execution - X

This campaign aims to identify servers running Ivanti EPMM vulnerable to Remote Code Execution. The threat actor instructs the server to evaluate an expression to validate vulnerability.

Ivanti EPMM Remote Code Execution - 1234

This campaign aims to identify PHP servers vulnerable to PHP-CGI Remote Command Execution. The threat actor instructs the server to download and execute an unknown malicious file.

PHP-CGI Remote Command Execution - bre

This campaign aims to identify and exploit Kubernetes Ingress NGINX servers which are vulnerable to remote command execution via a malicious AdmissionReview request. The threat actor instructs the device to download and execute TrinityMiner on the target, a mining module tied to the Eternity malware platform.

Kubernetes NGINX Ingress Admission Controller Command Execution - mine

This campaign aims to identify ThinkPHP servers that are vulnerable to Remote Code Execution vulnerability. The threat actor instructs the vulnerable server to return a predefined string.

ThinkPHP Remote Code Execution - Apocalypse

This campaign aims to identify servers using NodeJS traceroute library vulnerable to Command Injection. The threat actor instructs the server to download and execute an unknown malicious file.

NodeJs traceroute Command Injection - cn

Spring Cloud Gateway in the version prior to 3.1.0 and 3.0.6, are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. The threat actor instructs the server to return the output of expr command.

Spring Cloud Gateway 'actuator' Remote Code Execution - cgpu

This campaign aims to identify SAP NetWeaver servers that are vulnerable to a malicious file upload allowing attackers to upload webshells and achieve remote code execution over the server. The threat actor instructs the server to download an unknown malicious file.

SAP NetWeaver Visual Composer RCE - magent

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Equivalence (Internal Dot) vulnerability. The threat actor attempts to upload a deserialization payload that downloads and executes a remote script.

Apache Tomcat Remote Code Execution - 4the

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The threat actor attempts to overwrite the Tomcat user configuration file using path traversal to create an unauthorized administrator account with full access to the server's management interfaces.

Apache Tomcat Remote Code Execution - mhs

Apache Tomcat Remote Code Execution - suop

Apache Tomcat Remote Code Execution - 987

Apache Tomcat Remote Code Execution - swmz

This campaign aims to identify servers running JeecgBoot vulnerable to Remote Code Execution due to deserialization of untrusted data. The threat actor instructs the server to download and execute an unknown malicious file.

JeecgBoot Insecure Deserialization Remote Code Execution - tmpw

This campaign aims to identify PHPUnit web servers vulnerable to PHPUnit Eval_stdin PHP Remote Code Execution vulnerability. The threat actor instructs the server to return a "NightAgent" string in the response to the malicious request.

PHPUnit Eval_stdin Remote Code Execution - NightAgent

PHPUnit Eval_stdin Remote Code Execution - oem

This campaign aims to identify Aviatrix Controller Servers vulnerable to remote code execution. The threat actor instructs the vulnerable device to download and execute an unknown malware.

Aviatrix Controller Remote Code Execution - Kloki

This campaign aims to identify HuangDou UTCMS servers vulnerable to OS Command Injection. The threat actor instructs the server to download and execute an unknown malware.

HuangDou UTCMS Command Injection - wsh

HuangDou UTCMS Command Injection - lol

This campaign aims to identify and exploit MovableType CMS servers vulnerable to OS Command Injection. The threat actor attempts to create a PHP backdoor on the vulnerable server.

MovableType CMS 'handler_to_coderef' XMLRPC Remote Code Execution - master

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the server to download and execute an unknown malware.

PHP-CGI Command Line Argument Injection - hjvhg

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the vulnerable server to create a PHP backdoor.

PHP-CGI Command Line Argument Injection - xrok

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor manipulates the server to include the hostname along with a unique string in its response

PHP-CGI Command Line Argument Injection - se

This campaign aims to identify servers vulnerable to Unauthenticated Remote Code Execution in Apache Hadoop through ResourceManager REST API. The threat actor instructs the vulnerable device to download and execute an unknown malware.

Apache Hadoop Resource Manager Remote Code Execution - Kloki

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - code1

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The device is instructed to download and execute a variant of Mirai IoT malware.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - selfrep

This campaign aims to identify Apache Struts 2 based servers vulnerable to the Jakarta Multipart Parser vulnerability.  The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache Struts2 Jakarta Multipart Parser - 7395

This campaign aims to identify FortiOS, FortiProxy, and FortiSwitchManager servers vulnerable to authentication bypass. The threat actor attempts to add an SSH key to the admin user.

FortiOS 'SSH' Authentication Bypass - 0207

This campaign aims to identify Citrix Virtual Apps and Desktops servers vulnerable to Remote code execution. The threat actor instructs the server to download and execute an unknown malware.

Citrix XEN Remote Code Execution - sxen

PHP-CGI Command Line Argument Injection - az

This campaign aims to identify GeoServer which is vulnerable to Remote Code Execution (RCE). The threat actor instructs the server to download and execute an unknown malware.

GeoServer Remote Code Execution - sh

Spring Boot 2 allows to execute arbitrary commands on the server by chaining exposed Actuators and H2 Database Aliases. This threat actor attempts to download and execute an unknown malware.

Spring Boot Actuator H2 Remote Code Execution - cnc

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute an unknown malicious file.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - success321

This campaign aims to identify Apache NiFi API servers that are vulnerable to Remote Code Execution vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

Apache NiFi API Remote Code Execution - sinbla

This campaign aims to identify WordPress servers using Wordpress plugin MailPoet Newsletters unauthenticated file upload. The threat actor attempts to upload a PHP web shell to the vulnerable server.

WordPress Plugin MailPoet Newsletters Arbitrary File Upload - rock

PHPUnit Eval_stdin Remote Code Execution - Xsam

AjaxPro .NET Package is vulnerable to deserialization of untrusted data which can be abused by an attacker to gain Remote Code Execution.  The threat actor instructs the server to download and execute an unknown malware.

AjaxPro .NET Remote Code Execution - smb

This campaign aims to identify and exploit Microsoft Open Management Infrastructure  servers vulnerable to Remote Code Execution. The threat actor instructs the server to return the output of the "id" command.

Microsoft Open Management Infrastructure RCE - debid

This campaign aims to identify servers vulnerable to PAN-OS GlobalProtect command injection attacks.  The threat actor attempts to verify the vulnerability with a curl command.

PAN-OS GlobalProtect Command Injection - ebana

This campaign aims to identify servers vulnerable to an Authentication Bypass vulnerability which allows an unauthenticated attacker to perform actions with administrator privileges which might lead to remote code execution. The threat actor instructs the vulnerable server to create a PHP backdoor.

PAN-OS Authentication Bypass RCE - palowin

GitLab CE/EE fails to properly sanitize image content before passing it to ExifTool for parsing, leading to remote code execution.  The threat actor instructs the vulnerable server to download and execute an unknown malware.

GitLab 'ExifTool' Unauthenticated Remote Code Execution - fbi

This campaign aims to identify Joomla servers vulnerable to PHP object injection attack.  The vulnerability enables execution of arbitrary PHP code via the deserialization. The threat actor instructs the server to respond with a specific string.

Joomla configuration.php Remote Code Execution - ray666

This campaign aims to identify phpMyAdmin servers vulnerable to phpMyAdmin setup.php PHP Code Injection vulnerability(CVE-2009-1151). The threat actor instructs the server to download a malicious file.

phpMyAdmin configuration code injection - tdx

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

PHP-CGI Remote Command Execution - selfrep

PHP-CGI Command Line Argument Injection - hoho

The campaign aims to identify IIS Servers vulnerable to Front Page exploit. The threat actor attempts to verify the vulnerability with creating a new webpage in the server.

Microsoft IIS Front Page Arbitrary File Write - Thund3rC4sH

This campaign aims to identify Rejetto HTTP File Servers vulnerable to remote code execution via a %00 sequence in a search action. The threat actor instructs the vulnerable device to download and execute an unknown malware.

Rejetto HTTP File Server Remote Code Execution - loki

Rejetto HTTP File Server Remote Code Execution - 5exe

GeoServer Remote Code Execution - Jiffle

This campaign aims to identify Oracle Fusion servers vulnerable to XML External Entity (XXE) injection vulnerability. The threat actor instructs the server to respond with a specific string.

Oracle Fusion Convert Servlet XXE - ong

This campaign aims to identify Rejetto HTTP File Servers vulnerable to remote code execution via a %00 sequence in a search action. The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

Rejetto HTTP File Server Remote Code Execution - shk

AjaxPro .NET Package is vulnerable to deserialization of untrusted data which can be abused by an attacker to gain Remote Code Execution.  The threat actor instructs the server to download and execute an info-stealer malware called Loki.

AjaxPro .NET Remote Code Execution - win

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

Chamilo LMS Unauthenticated Command Injection - Daemon

This campaign aims to identify Apache OfBiz servers vulnerable to Path Traversal which could lead to Server Side Code Injection attacks.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache OfBiz Path Traversal Code Execution - x86

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) which could allow an attacker to modify specific files and then execute OS commands on a vulnerable device. The threat actor attempts to download and execute a variant of the Mirai backdoor.

Zyxel Firewall ZTP Unauthenticated Command Injection - shk

This campaign aims to identify and exploit Zyxel network-attached storage (NAS) devices vulnerable to an unauthenticated Remote Code Execution. The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

Zyxel NAS 'file_upload-cgi' Remote Code Execution - shk

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the server to return a md5 hash representation of a string.

PHP-CGI Command Line Argument Injection - hello

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

PHP-CGI Command Line Argument Injection - xmrig

PHP-CGI Command Line Argument Injection - bad

PHP-CGI Command Line Argument Injection - sc

AjaxPro .NET Remote Code Execution - loki

This campaign aims to identify Kentico CMS servers that are vulnerable to Unsafe Deserialization via SOAPAction which could lead to Remote Code Execution. The threat actor attempts to download and execute an unknown malware.

Kentico CMS Remote Code Execution - echo

This campaign aims to identify and exploit Atlassian Confluence servers vulnerable to unauthenticated OGNL injection vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

Atlassian Confluence 'inline.vm' Remote Code Execution - hi

This campaign aims to identify and exploit vulnerable Weblogic servers using Oracle WebLogic WLS Security Component RCE.   The threat actor instructs the server to download and execute a variation of Mirai botnet.

Oracle WebLogic WLS Security Component RCE - bins

This campaign aims to identify WebLogic servers vulnerable to Oracle WebLogic WLS Security Component RCE vulnerability. The threat actor instructs the server to return a "CVE-2019-2729-POC" string in the response to the malicious request.

Oracle WebLogic WLS Security Component RCE - rev

Adobe ColdFusion are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. The threat actor instructs the server to perform deserialization and execute commands on the host.

Adobe ColdFusion Unauthenticated Remote Code Execution - zdf

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache 'PersistentManager' Remote Code Execution - sys

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - redtail

This campaign aims to identify servers vulnerable to Unauthenticated Remote Code Execution in Apache Hadoop through ResourceManager REST API. The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache Hadoop Resource Manager Remote Code Execution - drooper

GitLab CE/EE fails to properly sanitize image content before passing it to ExifTool for parsing, leading to remote code execution.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

GitLab 'ExifTool' Unauthenticated Remote Code Execution - lol

This campaign aims to identify servers vulnerable to PAN-OS GlobalProtect command injection attacks.  The threat actor instructs the vulnerable server to transfer the configuration file to a location accessible for download.

PAN-OS GlobalProtect Command Injection - base

This campaign aims to identify servers vulnerable to PAN-OS GlobalProtect command injection attacks.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Threat Campaigns Changelogs

Objective