f5_title

Threat Campaigns Changelog

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache 'PersistentManager' Remote Code Execution - sys

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - redtail

This campaign aims to identify and exploit Atlassian Confluence servers vulnerable to unauthenticated OGNL injection vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

Atlassian Confluence 'inline.vm' Remote Code Execution - hi

This campaign aims to identify Weaver EOffice web servers vulnerable to arbitrary file read due to improper handling of user input.   This threat actor tries to read sensitive files on the vulnerable server.

Weaver EOffice Arbitrary File Read - olns

This campaign aims to identify PHPUnit web servers vulnerable to PHPUnit Eval_stdin PHP Remote Code Execution vulnerability. The threat actor instructs the vulnerable server to create a PHP backdoor.

PHPUnit Eval_stdin Remote Code Execution - Predator

This campaign aims to identify WordPress servers that are vulnerable to WordPress LearnPress Plugin Remote Code Execution vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

WordPress LearnPress Plugin Remote Code Execution - i0x

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a variation of Mirai botnet.

Drupal 'Drupalgeddon2' RCE - spread

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

VMWare Worksapce 'Freemarker' Remote Code Execution - redtail

This campaign aims to identify Fortinet SSL VPN servers vulnerable to 'XORtigate' Remote Code Execution (CVE-2023-27997). The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Fortinet 'XORtigate' Remote Code Execution - fort

This campaign aims to identify and exploit Cisco IOS XE servers vulnerable to unauthenticated Remote Code Execution. The threat actor instructs the server to return the output of the server version command.

Cisco IOS XE Remote Code Execution - py

This campaign aims to identify Kentico CMS servers that are vulnerable to Unsafe Deserialization via SOAPAction which could lead to Remote Code Execution. The threat actor attempts to download and execute an unknown malware.

Kentico CMS Remote Code Execution - echo

AjaxPro .NET Package is vulnerable to deserialization of untrusted data which can be abused by an attacker to gain Remote Code Execution.  The threat actor instructs the server to download and execute an info-stealer malware called Loki.

AjaxPro .NET Remote Code Execution - loki

This campaign aims to identify WordPress servers that are vulnerable to WordPress Cherry Plugin Arbitrary File Upload vulnerability. The threat actor instructs the server to create a PHP backdoor.

WordPress CherryPlugin Arbitrary File Upload - Keluarga

The RightNow Theme for WordPress is vulnerable to arbitrary file upload. The threat actor instructs the vulnerable server to create a PHP backdoor.

WordPress RightNow Theme Arbitrary File Upload - DS

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor tries to upload a webshell on the vulnerable server.

Chamilo LMS Unauthenticated Command Injection - Mantodkaz

This campaign aims to identify Laravel servers that are vulnerable to Laravel Debug Mode Remote Code Execution vulnerability. The threat actor instructs the server to download and install a XMRig crypto miner.

Laravel Debug Mode Remote Code Execution - dummy23

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor attempts to download and execute an unknown malware.

Chamilo LMS Unauthenticated Command Injection - xyz

Kibana is vulnerable to prototype pollution bug within the Upgrade Assistant which can lead to Remote Code execution. The threat actor attempts to verify the vulnerability with a ping back command.

Kibana Prototype Pollution Remote Code Execution - oast

Spring Cloud Gateway in the version prior to 3.1.0 and 3.0.6, are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. The threat actor attempts to download and execute an unknown malware.

Spring Cloud Gateway 'actuator' Remote Code Execution - edu.pl

This campaign aims to identify JBoss servers vulnerable to Remote Code Execution when JMX Invoker is exposed with the default configuration. The threat actor attempts to download and execute an unknown malware.

JBoss JMXInvokerServlet JMXInvoker - svchost

The vulnerability is due to insufficient sanitizing of user supplied inputs in the application. This indicates an attack attempt to exploit an Arbitrary File Upload Vulnerability in Seeyon Office Anywhere.

Seeyon Office Anywhere Arbitrary File Upload - 2W9v

This campaign aims to identify servers vulnerable to Unauthenticated Remote Code Execution in Apache Hadoop through ResourceManager REST API. The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache Hadoop Resource Manager Remote Code Execution - skid

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute an unknown malicious file.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - multi

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.  The threat actor tries to upload a webshell on the vulnerable server.

Spring Core 'Spring4Shell' Remote Code Execution - decoder

This campaign aims to identify Jenkins servers vulnerable to Jenkins Script Security Plugin Remote Code Execution vulnerability (CVE-2019-1003000). The threat actor instructs the server to create a new token for GitHub and add a new malicious repository for resolving dependencies.

Jenkins ACL Bypass and Metaprogramming RCE - oast

This campaign aims to identify servers using 'js2py' library which is vulnerable to RCE by abusing js2py functionality. The threat actor attempts to verify the vulnerability with a ping back command.

Js2Py Library Remote Code Execution - YyVI

The campaign aims to identify Roxy-WI servers vulnerable to multiple unauthenticated Remote Code Execution vulnerabilities. The threat actor tries to read sensitive files on the vulnerable server.

Roxy-WI Unauthenticated Remote Code Execution - edupl

This campaign aims to exploit servers running vBulletin (v5.0.0 - v5.5.4) vulnerable to vBulletin Pre-Auth patch bypass Remote Code Execution vulnerability. The threat actor attempts to create a PHP backdoor on the vulnerable server.

vBulletin Pre-Auth Patch Bypass Remote Code Execution - 0x

This campaign aims to identify and exploit MovableType CMS servers vulnerable to OS Command Injection. The threat actor attempts to create a PHP backdoor on the vulnerable server.

MovableType CMS 'handler_to_coderef' XMLRPC Remote Code Execution - bdkr

This campaign aims to identify ThinkPHP servers that are vulnerable to Remote Code Execution vulnerability (CVE-2022-47945). The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

ThinkPHP 'pearcmd' Remote Code Execution - foxm

Adobe ColdFusion are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. The threat actor instructs the server to perform deserialization and execute command execution on the host.

Adobe ColdFusion Unauthenticated Remote Code Execution - 765

This campaign aims to identify and exploit servers vulnerable to Zoho ManageEngine SAMLResponse Remote Code Execution. The threat actor attempts to verify the vulnerability with a ping back command.

Zoho ManageEngine SAMLResponse RCE - oast

This campaign aims to identify WebLogic servers vulnerable to Console Path Traversal Remote Code Execution (CVE-2020-14882).   The threat actor instructs the server to download and execute a variation of Mirai botnet.

Oracle WebLogic Console Path Traversal RCE - down

This campaign aims to identify JBoss servers vulnerable to JBoss ReadOnlyAccessFilter of HTTP Invoker Deserialization vulnerability (CVE-2017-12149).   The threat actor instructs the server to perform deserialization and execute command execution on the host.

JBoss ReadOnlyAccessFilter of HTTP Invoker Deserialization - element

This campaign aims to identify MOVEit Transfer web applications that are vulnerable to SQL Injection which can lead to RCE. The threat actor attempts to Leverage the SQL injection to perform multiple unauthenticated actions against MOVEit Transfer database.

MOVEit Transfer Remote Code Execution - test.com

pyLoad is vulnerable to Python code injection due to the pyimport functionality exposed through the js2py library. The threat actor attempts to verify the vulnerability with a ping back command.

pyLoad Remote Code Execution - oast

This campaign aims to identify CuppaCMS web servers vulnerable to arbitrary file read due to improper handling of user input.   This threat actor tries to read sensitive files on the vulnerable server.

CuppaCMS Arbitrary File Read - 2RhC

This campaign aims to identify Chamilo LMS servers vulnerable to unauthenticated OS command injection. The threat actor instructs the server to download and execute a Perl-based IRC bot malware used for DDoS attacks.

Chamilo Unauthenticated Command Injection - sepax

This campaign aims to identify ThinkPHP servers that are vulnerable to Remote Code Execution vulnerability. The threat actor instructs the server to download and execute a variant of Mirai malware.

ThinkPHP Remote Code Execution - proxys

WordPress Plugin Simple File List is prone to a vulnerability that lets attackers upload arbitrary files which can lead to Remote Code Execution. The threat actor instructs the server to return a specific string in response to the malicious request.

WordPress Plugin Simple File List Arbitrary File Upload - wrs

MOVEit Transfer Remote Code Execution - asdf

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. The threat actor instructs the vulnerable server to download and execute a malicious PowerShell script.

VMWare Worksapce 'Freemarker' Remote Code Execution - bea_wls

This campaign aims to identify PHP servers vulnerable to PHP-CGI Remote Command Execution. The threat actor instructs the server to download and execute a Perl-based IRC bot malware used for DDoS attacks.

PHP-CGI Remote Command Execution - scan.pl

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability. The threat actor instructs the device to download and execute an XMRig cryptocurrency miner.

ElasticSearch Search Groovy Sandbox Bypass - Linux2.6

This campaign aims to identify and exploit servers vulnerable to Pentaho Business Remote Code Execution. The threat actor attempts to verify the vulnerability with a ping back command.

Pentaho Business Remote Code Execution - oast

This campaign aims to identify Hashicorp Consul web servers vulnerable to command injection via Services API. The threat actor attempts to verify the vulnerability with a ping back command.

Consul Remote Command Execution - ns

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor instructs the server to return the result of a "uname" command.

Chamilo LMS Unauthenticated Command Injection - fedor

SAP NetWeaver LM Configuration Wizard does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions. This campaign attempts to leverage this vulnerability in order to create an administrator account on the SAP system.

SAP RECON Remote Code Execution - PwD8890

GitLab CE/EE fails to properly sanitize image content before passing it to ExifTool for parsing, leading to remote code execution.  The threat actor manipulates the vulnerable server to download and execute a variant of Mirai malware.

GitLab 'ExifTool' Unauthenticated Remote Code Execution - gitlab

This campaign aims to identify servers that are using XStream library that is vulnerable to Unsafe Deserialization which leads to Remote code execution. The threat actor attempts to verify the vulnerability with a curl command.

XStream 'XML' Remote Code Execution - Xmc1yC

This campaign aims to identify and exploit servers vulnerable to VMWare NSX Manager Remote Code Execution. The threat actor attempts to verify the vulnerability with a ping back command.

VMWare NSX Manager 'XStream' Remote Code Execution - sub

Jenkins ACL Bypass and Metaprogramming RCE - createTokenByPassword

This campaign aims to identify Jenkins servers vulnerable to Jenkins Script Security Plugin Remote Code Execution vulnerability (CVE-2019-1003000). The threat actor instructs the server to download and execute a cryptocurrency miner.

Jenkins ACL Bypass and Metaprogramming RCE - Rocke

This campaign aims to identify WordPress servers vulnerable to WordPress Easy SMTP Plugin Authentication Bypass. The threat actor attempts to inject a malicious JavaScript code snippet to the website content.  The JavaScript script will redirect the website visitors to a malicious phishing site.

WordPress Easy SMTP Plugin Authentication Bypass - some

GitLab 'ExifTool' Unauthenticated Remote Code Execution - RAZA

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts.

Zimbra Collaboration Arbitrary File Upload

This campaign aims to identify servers that are using XStream library that is vulnerable to Unsafe Deserialization which leads to Remote code execution. The threat actor attempts to verify the vulnerability with a ping back command.

XStream 'XML' Remote Code Execution - oast

This campaign aims to identify and exploit BIG-IP servers vulnerable to BIG-IP TMUI Remote Code Execution vulnerability.  The threat actor instructs the server to download and execute a Mirai malware.

BIG-IP TMUI Remote Code Execution - ljc

VMWare NSX Manager 'XStream' Remote Code Execution - odx

PHPUnit Eval_stdin Remote Code Execution - emperor

This campaign uses WordPress Vulnerability Scanner to identify and exploit known public vulnerabilities related to WordPress plugins.  The threat actor, once successful, uploads a PHP backdoor to the vulnerable WordPress server.

WordPress Vulnerability Scanner - you4321

Drupal 'Drupalgeddon2' RCE - spki

This campaign aims to identify WordPress servers that are vulnerable to WordPress dzs-zoomsounds Plugin Remote Code Execution vulnerability. The threat actor instructs the vulnerable server to create a PHP backdoor.

WoredPress dzs-zoomsounds Plugin Remote Code Execution - Psych0.WorM

PHPUnit Eval_stdin Remote Code Execution - suk

This reconnaissance campaign targets servers vulnerable to Lanling OA treexml.tmpl remote command execution vulnerability. The threat actor instructs the server to ping a domain hosted/controlled by the threat actor.

Lanling OA treexml.tmpl Remote Code Execution - oast

This campaign aims to identify Apache Struts2 servers vulnerable to Apache Struts 2 Jakarta Multipart Parser vulnerability (CVE-2017-5638). The threat actor instructs the server to download and execute a crypto currency miner. This campaign related to "Apache Struts2 Jakarta Multipart Parser - crontab" campaign.

Apache Struts2 Jakarta Multipart Parser - certutil

This campaign targets REST Plugins that uses XStreamHandler with an instance of XStream for deserialization without any type filtering. This leads to Remote Code Execution when deserializing XML payloads. The threat actor is using a tool written for metasploit framework.

Apache Struts2 REST Plugin XStream Remote Code Execution - metasploit

The REST Plugin is uses a XStreamHandler with an instance of XStream for deserialization, without any type filtering,  which can lead to Remote Code Execution when deserializing XML payloads. This campaign is based off a known tool, available from exploit-db.com, and is numbered 42627. The indentation of the payload sent from the tool is slightly different from the original payload.

Apache Struts2 REST Plugin XStream Remote Code Execution - 42627

This campaign aims to identify Apache Struts2 servers vulnerable to Apache Struts2 REST Plugin XStream Remote Code Execution vulnerability (CVE-2017-9805). The threat actor instructs the server to download and execute a malicious file.

Apache Struts2 REST Plugin XStream Remote Code Execution - Go-http-client

This campaign aims to identify the Fuel CMS platform that is vulnerable to Pre-Auth Remote Code Execution. The threat actor instructs the server to return the /etc/passwd file, containing the users of the target system.

FuelCMS 'filter' Pre-Auth Remote Code Execution - passwd

This campaign uses a variation of the Mirai botnet, and attempts to identify Dasan GPON Routers that are vulnerable to Remote Code Execution (CVE-2018-10562). Once the vulnerability is found, the threat actor tries to install malware on the vulnerable server in order to add it to the botnet network.

Dasan GPON Routers Remote Code Execution - Go http 1.1

This campaign attempts to identify and compromise Dasan GPON Routers that are vulnerable to Remote Code Execution (CVE-2018-10561). Upon successful exploitation, the Mozi IoT malware will be installed on the device, and will be instructed to scan specific segments of the internet for similar targets.

Dasan GPON Routers Remote Code Execution - Mozi

This campaign aims to identify Dasan GPON Routers vulnerable to Remote Code Execution (CVE-2018-10562). The threat actor instructs the vulnerable router to send an HTTP request to a remote C&C server.

Dasan GPON Routers Remote Code Execution - killy

This campaign attempts to identify Dasan GPON Routers that are vulnerable to Remote Code Execution (CVE-2018-10562). The threat actor uses a botnet named Ronin. Once the vulnerability is found, Ronin tries to install malware on the vulnerable server in order to add it to the botnet network.

Dasan GPON Routers Remote Code Execution - Ronin

Roxy-WI Unauthenticated Remote Code Execution - ref

This campaign aims to identify Apache Apisix servers vulnerable to Remote Code Execution via 'batch-requests' plugin (CVE-2022-24112).  An unauthenticated user can abuse the 'batch-requests' plugin to send requests to bypass the IP restriction of the Admin API, resulting in remote code execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache Apisix 'batch-requests' Remote Code Execution - as

Spring Cloud Gateway in the version prior to 3.1.0 and 3.0.6, are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. The threat actor instructs the server to download and execute a DDoS malware.

Spring Cloud Gateway 'actuator' Remote Code Execution - miami

This campaign aims to identify applications running Nette framework that are vulnerable to command injection. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Nette Framework Remote Code Execution - oshi

The campaign aims to identify IIS Servers compromised with Frebniis Malware by abusing a feature within Microsoft Internet Information Services (IIS).

Microsoft IIS - Frebniis Backdoor

GitLab 'ExifTool' Unauthenticated Remote Code Execution - vt

This campaign aims to identify and exploit known public vulnerabilities in popular CMS platforms such as WordPress, Joomla, Drupal, OsCommerce and Magento by using the NekoBot Vulnerability Scanner.