f5_title

Threat Campaigns Changelog

GitLab CE/EE fails to properly sanitize image content before passing it to ExifTool for parsing, leading to remote code execution.  The threat actor instructs the vulnerable server to download and execute an unknown malware.

GitLab 'ExifTool' Unauthenticated Remote Code Execution - fbi

This campaign aims to identify Joomla servers vulnerable to PHP object injection attack.  The vulnerability enables execution of arbitrary PHP code via the deserialization. The threat actor instructs the server to respond with a specific string.

Joomla configuration.php Remote Code Execution - ray666

This campaign aims to identify phpMyAdmin servers vulnerable to phpMyAdmin setup.php PHP Code Injection vulnerability(CVE-2009-1151). The threat actor instructs the server to download a malicious file.

phpMyAdmin configuration code injection - tdx

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

PHP-CGI Remote Command Execution - selfrep

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the server to download and execute an unknown malware.

PHP-CGI Command Line Argument Injection - hoho

The campaign aims to identify IIS Servers vulnerable to Front Page exploit. The threat actor attempts to verify the vulnerability with creating a new webpage in the server.

Microsoft IIS Front Page Arbitrary File Write - Thund3rC4sH

This campaign aims to identify Rejetto HTTP File Servers vulnerable to remote code execution via a %00 sequence in a search action. The threat actor instructs the vulnerable device to download and execute an unknown malware.

Rejetto HTTP File Server Remote Code Execution - loki

Rejetto HTTP File Server Remote Code Execution - 5exe

This campaign aims to identify GeoServer which is vulnerable to Remote Code Execution (RCE). The threat actor attempts to verify the vulnerability with a ping back command.

GeoServer Remote Code Execution - Jiffle

This campaign aims to identify Oracle Fusion servers vulnerable to XML External Entity (XXE) injection vulnerability. The threat actor instructs the server to respond with a specific string.

Oracle Fusion Convert Servlet XXE - ong

This campaign aims to identify Rejetto HTTP File Servers vulnerable to remote code execution via a %00 sequence in a search action. The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

Rejetto HTTP File Server Remote Code Execution - shk

AjaxPro .NET Package is vulnerable to deserialization of untrusted data which can be abused by an attacker to gain Remote Code Execution.  The threat actor instructs the server to download and execute an info-stealer malware called Loki.

AjaxPro .NET Remote Code Execution - win

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

Chamilo LMS Unauthenticated Command Injection - Daemon

This campaign aims to identify Apache OfBiz servers vulnerable to Path Traversal which could lead to Server Side Code Injection attacks.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache OfBiz Path Traversal Code Execution - x86

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) which could allow an attacker to modify specific files and then execute OS commands on a vulnerable device. The threat actor attempts to download and execute a variant of the Mirai backdoor.

Zyxel Firewall ZTP Unauthenticated Command Injection - shk

This campaign aims to identify and exploit Zyxel network-attached storage (NAS) devices vulnerable to an unauthenticated Remote Code Execution. The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

Zyxel NAS 'file_upload-cgi' Remote Code Execution - shk

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the server to return a md5 hash representation of a string.

PHP-CGI Command Line Argument Injection - hello

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

PHP-CGI Command Line Argument Injection - xmrig

PHP-CGI Command Line Argument Injection - bad

PHP-CGI Command Line Argument Injection - sc

AjaxPro .NET Remote Code Execution - loki

This campaign aims to identify Kentico CMS servers that are vulnerable to Unsafe Deserialization via SOAPAction which could lead to Remote Code Execution. The threat actor attempts to download and execute an unknown malware.

Kentico CMS Remote Code Execution - echo

This campaign aims to identify and exploit Atlassian Confluence servers vulnerable to unauthenticated OGNL injection vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

Atlassian Confluence 'inline.vm' Remote Code Execution - hi

This campaign aims to identify and exploit vulnerable Weblogic servers using Oracle WebLogic WLS Security Component RCE.   The threat actor instructs the server to download and execute a variation of Mirai botnet.

Oracle WebLogic WLS Security Component RCE - bins

This campaign aims to identify WebLogic servers vulnerable to Oracle WebLogic WLS Security Component RCE vulnerability. The threat actor instructs the server to return a "CVE-2019-2729-POC" string in the response to the malicious request.

Oracle WebLogic WLS Security Component RCE - rev

Adobe ColdFusion are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. The threat actor instructs the server to perform deserialization and execute commands on the host.

Adobe ColdFusion Unauthenticated Remote Code Execution - zdf

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache 'PersistentManager' Remote Code Execution - sys

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - redtail

This campaign aims to identify servers vulnerable to Unauthenticated Remote Code Execution in Apache Hadoop through ResourceManager REST API. The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache Hadoop Resource Manager Remote Code Execution - drooper

GitLab CE/EE fails to properly sanitize image content before passing it to ExifTool for parsing, leading to remote code execution.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

GitLab 'ExifTool' Unauthenticated Remote Code Execution - lol

This campaign aims to identify servers vulnerable to PAN-OS GlobalProtect command injection attacks.  The threat actor instructs the vulnerable server to transfer the configuration file to a location accessible for download.

PAN-OS GlobalProtect Command Injection - base

This campaign aims to identify servers vulnerable to PAN-OS GlobalProtect command injection attacks.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

PAN-OS GlobalProtect Command Injection - redtail

PAN-OS GlobalProtect Command Injection - shk782

This campaign aims to identify Weaver EOffice web servers vulnerable to arbitrary file read due to improper handling of user input.   This threat actor tries to read sensitive files on the vulnerable server.

Weaver EOffice Arbitrary File Read - olns

This campaign aims to identify WordPress servers using Bricks Plugin vulnerable to unauthenticated remote code execution. The threat actor instructs the vulnerable server to create a PHP backdoor.

WordPress Bricks Remote Code Execution - CRxR

This campaign aims to identify and exploit ZZZPHP CMS servers vulnerable to Remote Code Execution. The threat actor attempts to verify the vulnerability with a ping back command.

ZZZPHP CMS Remote Code Execution - poc

This campaign aims to identify Fortinet SSL VPN servers vulnerable to 'XORtigate' Remote Code Execution (CVE-2023-27997). The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Fortinet 'XORtigate' Remote Code Execution - fort

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

VMWare Worksapce 'Freemarker' Remote Code Execution - vm

VMWare Worksapce 'Freemarker' Remote Code Execution - redtail

This campaign aims to identify PHPUnit web servers vulnerable to PHPUnit Eval_stdin PHP Remote Code Execution vulnerability. The threat actor instructs the vulnerable server to create a PHP backdoor.

PHPUnit Eval_stdin Remote Code Execution - Predator

This campaign aims to identify WordPress servers that are vulnerable to WordPress LearnPress Plugin Remote Code Execution vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

WordPress LearnPress Plugin Remote Code Execution - i0x

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a variation of Mirai botnet.

Drupal 'Drupalgeddon2' RCE - spread

This campaign aims to identify and exploit Cisco IOS XE servers vulnerable to unauthenticated Remote Code Execution. The threat actor instructs the server to return the output of the server version command.

Cisco IOS XE Remote Code Execution - py

This campaign aims to identify WordPress servers that are vulnerable to WordPress Cherry Plugin Arbitrary File Upload vulnerability. The threat actor instructs the server to create a PHP backdoor.

WordPress CherryPlugin Arbitrary File Upload - Keluarga

The RightNow Theme for WordPress is vulnerable to arbitrary file upload. The threat actor instructs the vulnerable server to create a PHP backdoor.

WordPress RightNow Theme Arbitrary File Upload - DS

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor tries to upload a webshell on the vulnerable server.

Chamilo LMS Unauthenticated Command Injection - Mantodkaz

This campaign aims to identify Laravel servers that are vulnerable to Laravel Debug Mode Remote Code Execution vulnerability. The threat actor instructs the server to download and install a XMRig crypto miner.

Laravel Debug Mode Remote Code Execution - dummy23

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor attempts to download and execute an unknown malware.

Chamilo LMS Unauthenticated Command Injection - xyz

Kibana is vulnerable to prototype pollution bug within the Upgrade Assistant which can lead to Remote Code execution. The threat actor attempts to verify the vulnerability with a ping back command.

Kibana Prototype Pollution Remote Code Execution - oast

Spring Cloud Gateway in the version prior to 3.1.0 and 3.0.6, are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. The threat actor attempts to download and execute an unknown malware.

Spring Cloud Gateway 'actuator' Remote Code Execution - edu.pl

This campaign aims to identify JBoss servers vulnerable to Remote Code Execution when JMX Invoker is exposed with the default configuration. The threat actor attempts to download and execute an unknown malware.

JBoss JMXInvokerServlet JMXInvoker - svchost

The vulnerability is due to insufficient sanitizing of user supplied inputs in the application. This indicates an attack attempt to exploit an Arbitrary File Upload Vulnerability in Seeyon Office Anywhere.

Seeyon Office Anywhere Arbitrary File Upload - 2W9v

Apache Hadoop Resource Manager Remote Code Execution - skid

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute an unknown malicious file.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - multi

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.  The threat actor tries to upload a webshell on the vulnerable server.

Spring Core 'Spring4Shell' Remote Code Execution - decoder

This campaign aims to identify Jenkins servers vulnerable to Jenkins Script Security Plugin Remote Code Execution vulnerability (CVE-2019-1003000). The threat actor instructs the server to create a new token for GitHub and add a new malicious repository for resolving dependencies.

Jenkins ACL Bypass and Metaprogramming RCE - oast

This campaign aims to identify servers using 'js2py' library which is vulnerable to RCE by abusing js2py functionality. The threat actor attempts to verify the vulnerability with a ping back command.

Js2Py Library Remote Code Execution - YyVI

The campaign aims to identify Roxy-WI servers vulnerable to multiple unauthenticated Remote Code Execution vulnerabilities. The threat actor tries to read sensitive files on the vulnerable server.

Roxy-WI Unauthenticated Remote Code Execution - edupl

This campaign aims to exploit servers running vBulletin (v5.0.0 - v5.5.4) vulnerable to vBulletin Pre-Auth patch bypass Remote Code Execution vulnerability. The threat actor attempts to create a PHP backdoor on the vulnerable server.

vBulletin Pre-Auth Patch Bypass Remote Code Execution - 0x

This campaign aims to identify and exploit MovableType CMS servers vulnerable to OS Command Injection. The threat actor attempts to create a PHP backdoor on the vulnerable server.

MovableType CMS 'handler_to_coderef' XMLRPC Remote Code Execution - bdkr

This campaign aims to identify ThinkPHP servers that are vulnerable to Remote Code Execution vulnerability (CVE-2022-47945). The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

ThinkPHP 'pearcmd' Remote Code Execution - foxm

Adobe ColdFusion are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. The threat actor instructs the server to perform deserialization and execute command execution on the host.

Adobe ColdFusion Unauthenticated Remote Code Execution - 765

This campaign aims to identify and exploit servers vulnerable to Zoho ManageEngine SAMLResponse Remote Code Execution. The threat actor attempts to verify the vulnerability with a ping back command.

Zoho ManageEngine SAMLResponse RCE - oast

This campaign aims to identify WebLogic servers vulnerable to Console Path Traversal Remote Code Execution (CVE-2020-14882).   The threat actor instructs the server to download and execute a variation of Mirai botnet.

Oracle WebLogic Console Path Traversal RCE - down

This campaign aims to identify JBoss servers vulnerable to JBoss ReadOnlyAccessFilter of HTTP Invoker Deserialization vulnerability (CVE-2017-12149).   The threat actor instructs the server to perform deserialization and execute command execution on the host.

JBoss ReadOnlyAccessFilter of HTTP Invoker Deserialization - element

This campaign aims to identify MOVEit Transfer web applications that are vulnerable to SQL Injection which can lead to RCE. The threat actor attempts to Leverage the SQL injection to perform multiple unauthenticated actions against MOVEit Transfer database.

MOVEit Transfer Remote Code Execution - test.com

pyLoad is vulnerable to Python code injection due to the pyimport functionality exposed through the js2py library. The threat actor attempts to verify the vulnerability with a ping back command.

pyLoad Remote Code Execution - oast

This campaign aims to identify CuppaCMS web servers vulnerable to arbitrary file read due to improper handling of user input.   This threat actor tries to read sensitive files on the vulnerable server.

CuppaCMS Arbitrary File Read - 2RhC

This campaign aims to identify Chamilo LMS servers vulnerable to unauthenticated OS command injection. The threat actor instructs the server to download and execute a Perl-based IRC bot malware used for DDoS attacks.

Chamilo Unauthenticated Command Injection - sepax

This campaign aims to identify ThinkPHP servers that are vulnerable to Remote Code Execution vulnerability. The threat actor instructs the server to download and execute a variant of Mirai malware.

ThinkPHP Remote Code Execution - proxys

WordPress Plugin Simple File List is prone to a vulnerability that lets attackers upload arbitrary files which can lead to Remote Code Execution. The threat actor instructs the server to return a specific string in response to the malicious request.

WordPress Plugin Simple File List Arbitrary File Upload - wrs

MOVEit Transfer Remote Code Execution - asdf

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. The threat actor instructs the vulnerable server to download and execute a malicious PowerShell script.

VMWare Worksapce 'Freemarker' Remote Code Execution - bea_wls

This campaign aims to identify PHP servers vulnerable to PHP-CGI Remote Command Execution. The threat actor instructs the server to download and execute a Perl-based IRC bot malware used for DDoS attacks.

PHP-CGI Remote Command Execution - scan.pl

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability. The threat actor instructs the device to download and execute an XMRig cryptocurrency miner.

ElasticSearch Search Groovy Sandbox Bypass - Linux2.6

This campaign aims to identify and exploit servers vulnerable to Pentaho Business Remote Code Execution. The threat actor attempts to verify the vulnerability with a ping back command.

Pentaho Business Remote Code Execution - oast

This campaign aims to identify Hashicorp Consul web servers vulnerable to command injection via Services API. The threat actor attempts to verify the vulnerability with a ping back command.

Consul Remote Command Execution - ns

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor instructs the server to return the result of a "uname" command.