f5_title

Threat Campaigns Changelog

This campaign aims to identify PHPUnit web servers vulnerable to PHPUnit Eval_stdin PHP Remote Code Execution vulnerability. The threat actor instructs the server to return a "NightAgent" string in the response to the malicious request.

PHPUnit Eval_stdin Remote Code Execution - NightAgent

This campaign aims to identify PHPUnit web servers vulnerable to PHPUnit Eval_stdin PHP Remote Code Execution vulnerability. The threat actor instructs the vulnerable server to create a PHP backdoor.

PHPUnit Eval_stdin Remote Code Execution - oem

This campaign aims to identify Aviatrix Controller Servers vulnerable to remote code execution. The threat actor instructs the vulnerable device to download and execute an unknown malware.

Aviatrix Controller Remote Code Execution - Kloki

This campaign aims to identify HuangDou UTCMS servers vulnerable to OS Command Injection. The threat actor instructs the server to download and execute an unknown malware.

HuangDou UTCMS Command Injection - wsh

HuangDou UTCMS Command Injection - lol

This campaign aims to identify and exploit MovableType CMS servers vulnerable to OS Command Injection. The threat actor attempts to create a PHP backdoor on the vulnerable server.

MovableType CMS 'handler_to_coderef' XMLRPC Remote Code Execution - master

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the server to download and execute an unknown malware.

PHP-CGI Command Line Argument Injection - hjvhg

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the vulnerable server to create a PHP backdoor.

PHP-CGI Command Line Argument Injection - xrok

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor manipulates the server to include the hostname along with a unique string in its response

PHP-CGI Command Line Argument Injection - se

This campaign aims to identify servers vulnerable to Unauthenticated Remote Code Execution in Apache Hadoop through ResourceManager REST API. The threat actor instructs the vulnerable device to download and execute an unknown malware.

Apache Hadoop Resource Manager Remote Code Execution - Kloki

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - code1

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The device is instructed to download and execute a variant of Mirai IoT malware.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - selfrep

This campaign aims to identify Apache Struts 2 based servers vulnerable to the Jakarta Multipart Parser vulnerability.  The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache Struts2 Jakarta Multipart Parser - 7395

This campaign aims to identify FortiOS, FortiProxy, and FortiSwitchManager servers vulnerable to authentication bypass. The threat actor attempts to add an SSH key to the admin user.

FortiOS 'SSH' Authentication Bypass - 0207

This campaign aims to identify Citrix Virtual Apps and Desktops servers vulnerable to Remote code execution. The threat actor instructs the server to download and execute an unknown malware.

Citrix XEN Remote Code Execution - sxen

PHP-CGI Command Line Argument Injection - az

This campaign aims to identify GeoServer which is vulnerable to Remote Code Execution (RCE). The threat actor instructs the server to download and execute an unknown malware.

GeoServer Remote Code Execution - sh

Spring Boot 2 allows to execute arbitrary commands on the server by chaining exposed Actuators and H2 Database Aliases. This threat actor attempts to download and execute an unknown malware.

Spring Boot Actuator H2 Remote Code Execution - cnc

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute an unknown malicious file.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - success321

This campaign aims to identify Apache NiFi API servers that are vulnerable to Remote Code Execution vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

Apache NiFi API Remote Code Execution - sinbla

This campaign aims to identify WordPress servers using Wordpress plugin MailPoet Newsletters unauthenticated file upload. The threat actor attempts to upload a PHP web shell to the vulnerable server.

WordPress Plugin MailPoet Newsletters Arbitrary File Upload - rock

PHPUnit Eval_stdin Remote Code Execution - Xsam

AjaxPro .NET Package is vulnerable to deserialization of untrusted data which can be abused by an attacker to gain Remote Code Execution.  The threat actor instructs the server to download and execute an unknown malware.

AjaxPro .NET Remote Code Execution - smb

This campaign aims to identify and exploit Microsoft Open Management Infrastructure  servers vulnerable to Remote Code Execution. The threat actor instructs the server to return the output of the "id" command.

Microsoft Open Management Infrastructure RCE - debid

This campaign aims to identify servers vulnerable to PAN-OS GlobalProtect command injection attacks.  The threat actor attempts to verify the vulnerability with a curl command.

PAN-OS GlobalProtect Command Injection - ebana

This campaign aims to identify servers vulnerable to an Authentication Bypass vulnerability which allows an unauthenticated attacker to perform actions with administrator privileges which might lead to remote code execution. The threat actor instructs the vulnerable server to create a PHP backdoor.

PAN-OS Authentication Bypass RCE - palowin

GitLab CE/EE fails to properly sanitize image content before passing it to ExifTool for parsing, leading to remote code execution.  The threat actor instructs the vulnerable server to download and execute an unknown malware.

GitLab 'ExifTool' Unauthenticated Remote Code Execution - fbi

This campaign aims to identify Joomla servers vulnerable to PHP object injection attack.  The vulnerability enables execution of arbitrary PHP code via the deserialization. The threat actor instructs the server to respond with a specific string.

Joomla configuration.php Remote Code Execution - ray666

This campaign aims to identify phpMyAdmin servers vulnerable to phpMyAdmin setup.php PHP Code Injection vulnerability(CVE-2009-1151). The threat actor instructs the server to download a malicious file.

phpMyAdmin configuration code injection - tdx

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

PHP-CGI Remote Command Execution - selfrep

PHP-CGI Command Line Argument Injection - hoho

The campaign aims to identify IIS Servers vulnerable to Front Page exploit. The threat actor attempts to verify the vulnerability with creating a new webpage in the server.

Microsoft IIS Front Page Arbitrary File Write - Thund3rC4sH

This campaign aims to identify Rejetto HTTP File Servers vulnerable to remote code execution via a %00 sequence in a search action. The threat actor instructs the vulnerable device to download and execute an unknown malware.

Rejetto HTTP File Server Remote Code Execution - loki

Rejetto HTTP File Server Remote Code Execution - 5exe

This campaign aims to identify GeoServer which is vulnerable to Remote Code Execution (RCE). The threat actor attempts to verify the vulnerability with a ping back command.

GeoServer Remote Code Execution - Jiffle

This campaign aims to identify Oracle Fusion servers vulnerable to XML External Entity (XXE) injection vulnerability. The threat actor instructs the server to respond with a specific string.

Oracle Fusion Convert Servlet XXE - ong

This campaign aims to identify Rejetto HTTP File Servers vulnerable to remote code execution via a %00 sequence in a search action. The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

Rejetto HTTP File Server Remote Code Execution - shk

AjaxPro .NET Package is vulnerable to deserialization of untrusted data which can be abused by an attacker to gain Remote Code Execution.  The threat actor instructs the server to download and execute an info-stealer malware called Loki.

AjaxPro .NET Remote Code Execution - win

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

Chamilo LMS Unauthenticated Command Injection - Daemon

This campaign aims to identify Apache OfBiz servers vulnerable to Path Traversal which could lead to Server Side Code Injection attacks.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache OfBiz Path Traversal Code Execution - x86

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) which could allow an attacker to modify specific files and then execute OS commands on a vulnerable device. The threat actor attempts to download and execute a variant of the Mirai backdoor.

Zyxel Firewall ZTP Unauthenticated Command Injection - shk

This campaign aims to identify and exploit Zyxel network-attached storage (NAS) devices vulnerable to an unauthenticated Remote Code Execution. The threat actor instructs the vulnerable device to download and execute a variant of a Mirai malware.

Zyxel NAS 'file_upload-cgi' Remote Code Execution - shk

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the server to return a md5 hash representation of a string.

PHP-CGI Command Line Argument Injection - hello

This campaign aims to identify PHP servers vulnerable to PHP-CGI command line argument injection (CVE-2024-4577). The threat actor instructs the server to download and execute an XMR cryptocurrency miner.

PHP-CGI Command Line Argument Injection - xmrig

PHP-CGI Command Line Argument Injection - bad

PHP-CGI Command Line Argument Injection - sc

AjaxPro .NET Remote Code Execution - loki

This campaign aims to identify Kentico CMS servers that are vulnerable to Unsafe Deserialization via SOAPAction which could lead to Remote Code Execution. The threat actor attempts to download and execute an unknown malware.

Kentico CMS Remote Code Execution - echo

This campaign aims to identify and exploit Atlassian Confluence servers vulnerable to unauthenticated OGNL injection vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

Atlassian Confluence 'inline.vm' Remote Code Execution - hi

This campaign aims to identify and exploit vulnerable Weblogic servers using Oracle WebLogic WLS Security Component RCE.   The threat actor instructs the server to download and execute a variation of Mirai botnet.

Oracle WebLogic WLS Security Component RCE - bins

This campaign aims to identify WebLogic servers vulnerable to Oracle WebLogic WLS Security Component RCE vulnerability. The threat actor instructs the server to return a "CVE-2019-2729-POC" string in the response to the malicious request.

Oracle WebLogic WLS Security Component RCE - rev

Adobe ColdFusion are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. The threat actor instructs the server to perform deserialization and execute commands on the host.

Adobe ColdFusion Unauthenticated Remote Code Execution - zdf

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache 'PersistentManager' Remote Code Execution - sys

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - redtail

This campaign aims to identify servers vulnerable to Unauthenticated Remote Code Execution in Apache Hadoop through ResourceManager REST API. The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache Hadoop Resource Manager Remote Code Execution - drooper

GitLab CE/EE fails to properly sanitize image content before passing it to ExifTool for parsing, leading to remote code execution.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

GitLab 'ExifTool' Unauthenticated Remote Code Execution - lol

This campaign aims to identify servers vulnerable to PAN-OS GlobalProtect command injection attacks.  The threat actor instructs the vulnerable server to transfer the configuration file to a location accessible for download.

PAN-OS GlobalProtect Command Injection - base

This campaign aims to identify servers vulnerable to PAN-OS GlobalProtect command injection attacks.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

PAN-OS GlobalProtect Command Injection - redtail

PAN-OS GlobalProtect Command Injection - shk782

This campaign aims to identify Weaver EOffice web servers vulnerable to arbitrary file read due to improper handling of user input.   This threat actor tries to read sensitive files on the vulnerable server.

Weaver EOffice Arbitrary File Read - olns

This campaign aims to identify WordPress servers using Bricks Plugin vulnerable to unauthenticated remote code execution. The threat actor instructs the vulnerable server to create a PHP backdoor.

WordPress Bricks Remote Code Execution - CRxR

This campaign aims to identify and exploit ZZZPHP CMS servers vulnerable to Remote Code Execution. The threat actor attempts to verify the vulnerability with a ping back command.

ZZZPHP CMS Remote Code Execution - poc

This campaign aims to identify Fortinet SSL VPN servers vulnerable to 'XORtigate' Remote Code Execution (CVE-2023-27997). The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Fortinet 'XORtigate' Remote Code Execution - fort

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.  A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

VMWare Worksapce 'Freemarker' Remote Code Execution - vm

VMWare Worksapce 'Freemarker' Remote Code Execution - redtail

PHPUnit Eval_stdin Remote Code Execution - Predator

This campaign aims to identify WordPress servers that are vulnerable to WordPress LearnPress Plugin Remote Code Execution vulnerability. The threat actor attempts to verify the vulnerability with a curl command.

WordPress LearnPress Plugin Remote Code Execution - i0x

This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a variation of Mirai botnet.

Drupal 'Drupalgeddon2' RCE - spread

This campaign aims to identify and exploit Cisco IOS XE servers vulnerable to unauthenticated Remote Code Execution. The threat actor instructs the server to return the output of the server version command.

Cisco IOS XE Remote Code Execution - py

This campaign aims to identify WordPress servers that are vulnerable to WordPress Cherry Plugin Arbitrary File Upload vulnerability. The threat actor instructs the server to create a PHP backdoor.

WordPress CherryPlugin Arbitrary File Upload - Keluarga

The RightNow Theme for WordPress is vulnerable to arbitrary file upload. The threat actor instructs the vulnerable server to create a PHP backdoor.

WordPress RightNow Theme Arbitrary File Upload - DS

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor tries to upload a webshell on the vulnerable server.

Chamilo LMS Unauthenticated Command Injection - Mantodkaz

This campaign aims to identify Laravel servers that are vulnerable to Laravel Debug Mode Remote Code Execution vulnerability. The threat actor instructs the server to download and install a XMRig crypto miner.

Laravel Debug Mode Remote Code Execution - dummy23

This campaign aims to identify Chamilo LMS web servers vulnerable to command injection via a SOAP API call with a crafted PowerPoint name. The threat actor attempts to download and execute an unknown malware.

Chamilo LMS Unauthenticated Command Injection - xyz

Kibana is vulnerable to prototype pollution bug within the Upgrade Assistant which can lead to Remote Code execution. The threat actor attempts to verify the vulnerability with a ping back command.

Kibana Prototype Pollution Remote Code Execution - oast

Spring Cloud Gateway in the version prior to 3.1.0 and 3.0.6, are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. The threat actor attempts to download and execute an unknown malware.

Spring Cloud Gateway 'actuator' Remote Code Execution - edu.pl

This campaign aims to identify JBoss servers vulnerable to Remote Code Execution when JMX Invoker is exposed with the default configuration. The threat actor attempts to download and execute an unknown malware.

JBoss JMXInvokerServlet JMXInvoker - svchost

The vulnerability is due to insufficient sanitizing of user supplied inputs in the application. This indicates an attack attempt to exploit an Arbitrary File Upload Vulnerability in Seeyon Office Anywhere.

Seeyon Office Anywhere Arbitrary File Upload - 2W9v

Apache Hadoop Resource Manager Remote Code Execution - skid

Apache HTTP Server 'cgi-bin' Path Traversal RCE - multi

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.  The threat actor tries to upload a webshell on the vulnerable server.

Spring Core 'Spring4Shell' Remote Code Execution - decoder

This campaign aims to identify Jenkins servers vulnerable to Jenkins Script Security Plugin Remote Code Execution vulnerability (CVE-2019-1003000). The threat actor instructs the server to create a new token for GitHub and add a new malicious repository for resolving dependencies.

Jenkins ACL Bypass and Metaprogramming RCE - oast

This campaign aims to identify servers using 'js2py' library which is vulnerable to RCE by abusing js2py functionality. The threat actor attempts to verify the vulnerability with a ping back command.

Js2Py Library Remote Code Execution - YyVI

The campaign aims to identify Roxy-WI servers vulnerable to multiple unauthenticated Remote Code Execution vulnerabilities. The threat actor tries to read sensitive files on the vulnerable server.

Roxy-WI Unauthenticated Remote Code Execution - edupl

This campaign aims to exploit servers running vBulletin (v5.0.0 - v5.5.4) vulnerable to vBulletin Pre-Auth patch bypass Remote Code Execution vulnerability. The threat actor attempts to create a PHP backdoor on the vulnerable server.