f5_title

Threat Campaigns

This campaign aims to identify SaltStack Salt API servers vulnerable to Remote Code Execution.  An unauthenticated user with network access to the Salt API can use shell injections to run code on the Salt-API using the SSH client.

SaltStack Salt API Shell Command Injection

SaltStack Salt API allows an unauthenticated user to access the wheel_asyn module which allow to create files in a dedicate directory on the system. The same module is also vulnerable to path traversal, which allows the user to create files in arbitrary locations on the system and could lead to a remote code execution.

SaltStack Salt API pillar_roots.write Remote Command Execution

This campaign aims to identify and exploit servers vulnerable to VMware vCenter vSAN Remote Code Execution. The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

VMware vCenter vSAN Remote Code Execution - KKve

VMware View Planner logupload API endpoint fails to properly sanitize user supplied input. This allows the attacker to escape the dedicated  upload folder and upload files to any arbitrary locations on the system which can lead to Remote Code Execution.

VMware View Planner logupload Remote Code Execution

The VMware vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN (vSAN) Health Check plug-in which is enabled by default in VMware vCenter Server.

VMware vCenter vSAN Remote Code Execution

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

VMWare Worksapce 'Freemarker' Remote Code Execution - vm

This campaign aims to identify VMware vCenter servers vulnerable to VMware vCenter Unauthenticated Tar File Upload which leads to Remote Code Execution. Once a server is compromised, it is infected with a N3Cr0m0rPh malware and joins the effort of scanning and compromising new victims. In addition, a Monero cryptocurency miner is downloaded and executed on the affected server.

VMware vCenter Unauthenticated Tar File Upload - N3Cr0m0rPh

This campaign aims to identify and exploit servers vulnerable to VMWare NSX Manager Remote Code Execution. The threat actor attempts to verify the vulnerability with a ping back command.

VMWare NSX Manager 'XStream' Remote Code Execution - sub

VMWare NSX Manager 'XStream' Remote Code Execution - odx

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution. The threat actor attempts to verify the vulnerability with a ping back command.

VMWare Aria Operations Unauthenticated RCE - oast

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

VMWare Worksapce 'Freemarker' Remote Code Execution

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. The threat actor attempts to download and execute a script that installs a crypto miner.

VMWare Worksapce 'Freemarker' Remote Code Execution - one

VMWare NSX Manager 'XStream' Remote Code Execution - aiitzf

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

VMWare Worksapce 'Freemarker' Remote Code Execution - Anan

vSphere Client component of VMware vCenter is vulnerable to directory traversal which allows an unauthenticated user to access restricted resources. This access can lead to Remote Code Execution on the device.

VMware vCenter NetScaler Directory Traversal RCE

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. The threat actor instructs the vulnerable server to download and execute a malicious PowerShell script.

VMWare Worksapce 'Freemarker' Remote Code Execution - bea_wls

VMWare Worksapce 'Freemarker' Remote Code Execution - redtail

This campaign aims to exploit Horde Imp, an application that comes with the Horde GroupWare/Webmail suite.  The application contains a remote code execution vulnerability that allows a threat actor to issue unauthenticated IMAP requests to arbitrary hosts. The threat actor tries to download a malicious file on the vulnerable server.

Horde Imp Unauthenticated Remote Command Execution - Down

BIG-IP virtual servers with a configuration using the HTTP Explicit Proxy functionality and/or SOCKS profile are vulnerable to an unauthenticated, remote attack that allows modification of BIG-IP system configuration, extraction of sensitive system files, and possible remote command execution on the BIG-IP system.

BIG-IP Virtual Server 'HTTP Explicit Proxy' RCE

This campaign exploits the Uploadify plugin to upload a code based on the vulnerability disclosed in https://www.exploit-db.com/exploits/11218/. The threat actor uses the vulnerability to upload a remote control tool (backdoor). First, a small exploit is sent to the uploading page which can be one of the 24 URLs found in our systems. When uploaded, the script downloads one of administration web-shell panel variants which then upgrades its versions.

Uploadify Arbitrary File Upload - shell Uploadet

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to create a file in the server's file system.

Drupal 'Drupalgeddon2' RCE - tee

A botnet named Muhstik, attempts to identify Drupal servers that are vulnerable to "Drupalgeddon2" (CVE-2018-7600). Once the vulnerability is found, Muhstik tries to install malware on the vulnerable server in order to add it to the botnet network. The botnet is used in order to perform Cryptocurrency mining and DDoS attacks.

Drupal 'Drupalgeddon2' RCE -  Muhstik

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor attempts to upload a PHP backdoor to the vulnerable server.

Drupal 'Drupalgeddon2' RCE - romanian flag

This campaign aims to identify Drupal web servers vulnerable to Drupal REST Module Remote Code Execution vulnerability (CVE-2019-6340). The threat actor instructs the server to calculate the MD5 checksum of the string 'HelloDrupal' and send it back to the threat actor.

Drupal REST Module Remote Code Execution - HelloDrupal

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server create a file as an indication for successfully compromising the server.

Drupal 'Drupalgeddon2' RCE - COPYRIGHT

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability. The threat actor instructs the server to download and execute a cryptocurrency miner.

Drupal 'Drupalgeddon2' RCE - logo7

Drupal 'Drupalgeddon2' RCE - lic.txt

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a DDos malware.

Drupal 'Drupalgeddon2' RCE - jpg extension

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor tries to create a non-executable file on the vulnerable server.

Drupal 'Drupalgeddon2' RCE - xJesterino

This campaign aims to identify Drupal web servers vulnerable to Drupal REST Module Remote Code Execution vulnerability (CVE-2019-6340). The threat actor instructs the server to download and execute a DDos malware.

Drupal REST Module Remote Code Execution - FCG

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a cryptocurrency miner.   The same threat actor was previously detected exploiting Drupal REST Module RCE vulnerability (CVE-2019-6340).

Drupal 'Drupalgeddon2' RCE - exec48ne

This campaign aims to identify Drupal web servers vulnerable to Drupal REST Module Remote Code Execution vulnerability (CVE-2019-6340).

Drupal REST Module Remote Code Execution

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a variation of Mirai botnet.

Drupal 'Drupalgeddon2' RCE - bootnoot

Drupal 'Drupalgeddon2' RCE - kurd php

This campaign aims to identify Drupal web servers vulnerable to Drupal REST Module Remote Code Execution vulnerability (CVE-2019-6340).  The threat actor instructs the server to download and execute a malicious file.

Drupal REST Module Remote Code Execution - dev tcp

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to return a specific string.

Drupal 'Drupalgeddon2' RCE - 998 988

This campaign aims to identify Drupal web servers vulnerable to Drupal REST Module Remote Code Execution vulnerability. The threat actor instructs the server to create a PHP backdoor and connect to a server controlled by the threat actor.  The threat actor was previously detected exploiting Drupalgeddon2 RCE vulnerability (CVE-2018-7600).

Drupal REST Module Remote Code Execution - Suhosin

Drupal 'Drupalgeddon2' RCE - spread

Drupal 'Drupalgeddon2' RCE - yassinexhd

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the device to execute a reverse shell to a remote server. This campaign is part of "N3Cr0m0rPh" IRC bot spreading system.

Drupal 'Drupalgeddon2' RCE - N3Cr0m0rPh

Drupal 'Drupalgeddon2' RCE - htaccess

Drupal 'Drupalgeddon2' RCE - k.php

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the vulnerable server to return a "B374K" string.

Drupal 'Drupalgeddon2' RCE - B374K

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a malicious bash script.  The same threat actor was previously detected exploiting ElasticSearch Search Groovy Sandbox Bypass vulnerability.

Drupal 'Drupalgeddon2' RCE - virtualretard

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a malicious file.

Drupal 'Drupalgeddon2' RCE - dev tcp

Drupal 'Drupalgeddon2' RCE - multipart

This campaign aims to identify Drupal web servers vulnerable to Drupal REST Module Remote Code Execution vulnerability (CVE-2019-6340).  The threat actor instructs the server crate an HTML page with a specific string as an indication for successfully compromising the server.

Drupal REST Module Remote Code Execution - H1RUK4

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor attempts to infect the server with an IRC DDoS malware.

Drupal 'Drupalgeddon2' RCE - BArNEr

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability. The threat actor instructs the server to download and execute a malicious bash script.

Drupal 'Drupalgeddon2' RCE - pido

Drupal 'Drupalgeddon2' RCE -  bash dash

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to create a reverse shell to a remote server.

Drupal 'Drupalgeddon2' RCE - exphub

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to return a specific string as an indicator of compromise.

Drupal 'Drupalgeddon2' RCE - AssassinGooo

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a malware. Once the malware is executed, the server will become a part of Sysrv-hello botnet. The botnet is using publicly available exploits to target popular application such as Jupyter, WordPress, Jenkins, Redis, Apache Solr and more. In addition, the malware is using the vulnerable server to mine Monero cryptocurrency.

Drupal 'Drupalgeddon2' RCE - Sysrv-hello

Drupal 'Drupalgeddon2' RCE - hobnoob

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs to echo the string 'HelloDrupal' and send it back to the threat actor.

Drupal 'Drupalgeddon2' RCE - HelloDrupal

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to return a md5 hash representation of a string.

Drupal 'Drupalgeddon2' RCE - die md5

This campaign aims to identify Drupal web servers vulnerable to Drupal REST Module Remote Code Execution vulnerability. The threat actor instructs the server to download and execute a cryptocurrency miner.

Drupal REST Module Remote Code Execution - exec48ne

This campaign aims to identify Drupal servers vulnerable to Drupal REST Module Remote Code Execution vulnerability.   The threat actor instructs the server to return the output of the "whoami" or "php -v" command.

Drupal REST Module Remote Code Execution - whoami

Drupal 'Drupalgeddon2' RCE - wolf

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to create a PHP backdoor and connect to a server controlled by the threat actor.

Drupal 'Drupalgeddon2' RCE - Suhosin

Drupal 'Drupalgeddon2' RCE - spki

This campaign aims to identify Drupal web servers vulnerable to Drupal REST Module Remote Code Execution vulnerability (CVE-2019-6340). The threat actor instructs the server to download and execute a malicious VBScript.

Drupal REST Module Remote Code Execution - index.bek

This campaign aims to identify Joomla servers vulnerable to PHP object injection attack.  The vulnerability enables execution of arbitrary PHP code via the deserialization of HTTP User-Agent header. The threat actor instructs the server to create a PHP backdoor.

Joomla RCE PHP object injection - xo

This campaign aims to identify Joomla servers vulnerable to PHP object injection attack.  The vulnerability enables execution of arbitrary PHP code via the deserialization. The threat actor instructs the server to respond with a specific string.

Joomla configuration.php Remote Code Execution - ray666

Joomla RCE PHP object injection - 3X

This campaign aims to identify Joomla servers vulnerable to PHP object injection attack.  The vulnerability enables execution of arbitrary PHP code via the deserialization of HTTP User-Agent header. The threat actor instructs the server to return the output of  the "phpinfo" function.

Joomla RCE PHP object injection - phpinfo

This campaign aims to exploit Joomla servers vulnerable to a Privileged Account Registration. The threat actor attempts to create a new Administrator account on the vulnerable system.

Joomla 'user.register' Privileged Account Registration - nulthink

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.

Joomla RCE PHP object injection - SimplePie

This campaign aims to identify Joomla servers vulnerable to PHP object injection attack.  The vulnerability enables execution of arbitrary PHP code via the deserialization of HTTP User-Agent header. The threat actor instructs the server to respond with a specific string.

Joomla RCE PHP object injection - zero

Joomla 'user.register' Privileged Account Registration - pasqualetroisi03

This campaign aims to identify Joomla servers vulnerable to PHP object injection attack.  The vulnerability enables execution of arbitrary PHP code via the deserialization of HTTP X-Forwarded-For header. The threat actor instructs the server to return a md5 hash representation of a string.

Joomla RCE PHP object injection - die md5

Joomla RCE PHP object injection - 04x

Joomla 'user.register' Privileged Account Registration - u1337

This campaign aims to identify WordPress servers using Wordpress plugin MailPoet Newsletters unauthenticated file upload. The threat actor attempts to upload a PHP web shell to the vulnerable server.

WordPress Plugin MailPoet Newsletters Arbitrary File Upload - rock

This campaign aims to identify WordPress servers that are vulnerable to WordPress delete-all-comments Plugin Arbitrary File Upload vulnerability. The threat actor instructs the server to download a malicious file from Pastebin.  This malicious file created a backdoor for the threat actor.

WordPress delete-all-comments Plugin Arbitrary File Upload - keyCode

The RightNow Theme for WordPress is vulnerable to arbitrary file upload. The threat actor instructs the vulnerable server to create a PHP backdoor.

WordPress RightNow Theme Arbitrary File Upload - DS

This campaign attempts to exploit a Remote Command Execution vulnerability in WordPress systems via Multiple URLs.
 Advisory reveals new exploitation vectors for PHP mail()
 function discovered by the author that allow to exploit the vulnerability on a
 most popular MTA (Mail Transfer Agent) - Exim which can be found installed by
 default on many system such as Debian or Ubuntu, as opposed to rarely used
 Sendmail MTA that has been thought to be a requirement for mail() injection
 attacks to date.

WordPress RCE - double slash

This campaign aims to identify WordPress servers that are vulnerable to WordPress Social Warfare Plugin Remote Code Execution vulnerability. The threat actor instructs the server to return the result of the "ls" command.

WordPress Social Warfare Plugin RCE - id

This campaign aims to identify Wordpress websites hosted on SiteGround which are vulnerable to the SG Optimizer insecure plugin vulnerability.  The threat actor tries to modify the htaccess file and create a backdoor on a vulnerable website.

SiteGround SG Optimizer Insecure Plugin - htaccess

This campaign aims to identify WordPress servers that are vulnerable to WordPress LearnPress Plugin Remote Code Execution vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

WordPress LearnPress Plugin Remote Code Execution - i0x

This campaign aims to identify WordPress servers vulnerable to WordPress MailPress Plugin Remote Code Execution. WordPress MailPress Plugin is vulnerable to PHP code injection via "subject" parameter.

WordPress MailPress Plugin Remote Code Execution

This campaign aims to identify WordPress servers that are vulnerable to WordPress File Manager Plugin Remote Code Execution vulnerability. The threat actor attempts to upload a PHP web shell to the vulnerable server.

WordPress File Manager Plugin Remote Code Execution - payl04dz

This campaign aims to identify WordPress servers that are vulnerable to WordPress Social Warfare Plugin Remote Code Execution. The threat actor instructs the server to return the output of the "phpinfo" function.

WordPress Social Warfare Plugin RCE - speadk

This campaign aims to identify WordPress servers that are vulnerable to WordPress File Manager Plugin Remote Code Execution vulnerability. The threat actor instructs the server to download a PHP web shell from a popular text storage site.

WordPress File Manager Plugin Remote Code Execution - kiri

This campaign aims to identify WordPress servers vulnerable to WordPress 'timthumb.php' Remote File Inclusion. The threat actor attempts to upload a PHP backdoor to the vulnerable server. This backdoor allows the attacker to upload additional files directly to the server, without the need of exploit the vulnerability again.

WordPress 'timthumb.php' Remote File Inclusion - shell php

This campaign aims to identify and exploit known public vulnerabilities in popular CMS platforms such as WordPress, Joomla and Prestashop. The threat actor instructs the server to download a malicious file from a domain controlled by the threat actor.

CMS Vulnerability Scanner - Gassrini

This campaign aims to identify WordPress servers using Easy WP SMTP Plugin. The threat actor attempts to access the debug file of Easy WP SMTP Plugin which contains sensitive information such as the content of the "reset password" email. The attacker can use this information to compromise the system.

WordPress Easy WP SMTP Plugin Debug File Disclosure

This campaign uses WordPress Vulnerability Scanner to identify and exploit known public vulnerabilities related to WordPress AIT CSV Import/Export plugin. The threat actor, once successful, uploads a PHP backdoor to the vulnerable WordPress server.

WordPress AIT Plugin Arbitrary File Upload - acier

This campaign aims to identify WordPress servers that are vulnerable to WordPress File Manager Plugin Remote Code Execution vulnerability. The threat actor instructs the vulnerable server to create a PHP backdoor.

WordPress File Manager Plugin Remote Code Execution - navigation

This campaign attempts to compromise WordPress websites by brute force attacking publicly known Local File Inclusion vulnerabilities in WordPress plugins. Using this attack, the threat actor attempts to fetch the content of the WordPress configuration file (wp-config.php) from the server.

WordPress Config BruteForcer - Triple dash

This campaign aims to identify WordPress servers vulnerable to WordPress MobileApp Plugin Remote Code Execution. The threat actor instructs the vulnerable server to create a PHP file that returns an md5 hash representation of a string.

WordPress MobileApp Plugin Remote Code Execution - Ruby md5

WordPress File Manager Plugin Remote Code Execution - Intrud3r

This campaign aims to identify WordPress servers that are vulnerable to WordPress Social Warfare Plugin Remote Code Execution vulnerability. The threat actor instructs the server to return the output of the "phpinfo" function.

WordPress Social Warfare Plugin RCE - wpaa

This campaign aims to identify WordPress servers that are vulnerable to WordPress Cherry Plugin Arbitrary File Upload vulnerability. The threat actor instructs the server to create a PHP backdoor.

WordPress CherryPlugin Arbitrary File Upload - Thumbs

WordPress File Manager Plugin Remote Code Execution - xsswp

This campaign aims to identify WordPress servers using Bricks Plugin vulnerable to unauthenticated remote code execution. The threat actor instructs the vulnerable server to create a PHP backdoor.

WordPress Bricks Remote Code Execution - CRxR

WordPress Plugin Simple File List is prone to a vulnerability that lets attackers upload arbitrary files which can lead to Remote Code Execution. The threat actor instructs the server to return a specific string in response to the malicious request.

WordPress Plugin Simple File List Arbitrary File Upload - wrs

This campaign attempts to identify and exploit vulnerable WordPress instances using WordPress Plugin WP Symposium 14.11 Arbitrary File Upload (CVE-2014-10021) vulnerability. The attack consists of an attempt to upload malicious PHP file to the server. The content of this PHP file is obfuscated using a tool named "Free Online PHP Obfuscator" in order to make detection and analysis  of the payload more difficult .

WordPress Plugin WP Symposium 14.11 Arbitrary File Upload - FOPO

This campaign aims to identify WordPress servers that are vulnerable to WordPress dzs-zoomsounds Plugin Remote Code Execution vulnerability. The threat actor instructs the vulnerable server to create a PHP backdoor.

WoredPress dzs-zoomsounds Plugin Remote Code Execution - Psych0.WorM

This campaign attempts to identify and exploit vulnerable WordPress servers using Adning Advertising Plugin 1.5.5 Arbitrary File Upload vulnerability. The threat actor instructs the vulnerable server to create a PHP backdoor.

Threat Campaigns

Objective

References