New DNS-Based Backdoor Threat Discovered at Taiwanese University
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-4577 | OS Command Injection in Windows PHP-CGI Allows Remote Code Execution CVE-2024-4577 is an OS command injection flaw (CWE-78) in Windows-based PHP when it runs in CGI mode, allowing arbitrary code execution on the server. It is triggered when attacker-supplied characters in HTTP requests are mishandled by Windows' character-encoding conversion as the OS invokes php-cgi, letting attackers inject command-line arguments to the PHP interpreter; this bypasses the decade-old fix for CVE-2012-1823. A successful attacker gains the ability to run arbitrary commands and code in the context of the web server. Affected systems are PHP running on Windows through the CGI interface; deployments that do not use PHP-CGI on Windows are not described as affected in the source data. Exploitation is active: the flaw was added to CISA KEV on 2024-06-12 with known ransomware use, and EPSS assigns roughly 100% probability of exploitation within 30 days. Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use: upgrade Windows PHP-CGI deployments to a PHP release that fixes CVE-2024-4577 per PHP Group advisories, or stop using CGI mode on Windows (e.g., switch to FastCGI) and apply any vendor-recommended workarounds. Given known ransomware abuse, review web server access logs for exploitation attempts (notably %AD-encoded soft hyphens and injected -d/-s arguments in php-cgi query strings) and prioritize patching internet-facing Windows hosts. | 9.8 | 100% | KEV ransomware PoC ×11 |
| large≈10,000–100,000 internet-exposed Windows PHP-CGI systems |
Full article318 words · extracted from infosecurity-magazine.com · click to collapse
A newly identified security threat utilizing a rarely seen DNS-based communication method has been discovered by threat analysts in an attack targeting a Taiwanese university.
The backdoor, dubbed Backdoor.Msupedge and identified by Symantec, communicates with a command-and-control (C2) server by using DNS traffic, a technique known but infrequently employed by cybercriminals.
Msupedge operates as a dynamic link library (DLL) and has been found installed in specific file paths within the compromised systems. The DLL can execute commands received through DNS queries; a method that not only helps it evade detection but also facilitates stealthy control over infected machines.
Among the most distinctive features of Msupedge is its ability to modify its behavior based on the resolved IP address from the DNS query. Specifically, the third octet of the resolved IP address is used as a switch to determine the command to be executed, ranging from creating processes to downloading files or making the system sleep for a specified duration.
Symantec explained that this new backdoor supports several commands, including:
-
Creating a process via DNS TXT records
-
Downloading files from URLs received through DNS
-
Inducing sleep modes in the infected machine for up to 24 hours
-
Removing temporary files
The initial intrusion is believed to have occurred through the exploitation of a recent PHP vulnerability (CVE-2024-4577), which impacts all PHP versions installed on Windows. This flaw, a CGI argument injection vulnerability, can lead to remote code execution, making it a serious concern for administrators managing Windows-based web servers.
Read more on CVE-2024-4577: Ransomware Surges Annually Despite Law Enforcement Takedowns
“Symantec has seen multiple threat actors scanning for vulnerable systems in recent weeks. To date, we have found no evidence allowing us to attribute this threat and the motive behind the attack remains unknown,” the company wrote.
To protect against this threat, the security firm has included a list of indicators of compromise (IOC) in its latest advisory about Msupedge.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/dns-based-backdoor-taiwanese/