Hackers deployed new malware against university in Taiwan
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-4577 | OS Command Injection in Windows PHP-CGI Allows Remote Code Execution CVE-2024-4577 is an OS command injection flaw (CWE-78) in Windows-based PHP when it runs in CGI mode, allowing arbitrary code execution on the server. It is triggered when attacker-supplied characters in HTTP requests are mishandled by Windows' character-encoding conversion as the OS invokes php-cgi, letting attackers inject command-line arguments to the PHP interpreter; this bypasses the decade-old fix for CVE-2012-1823. A successful attacker gains the ability to run arbitrary commands and code in the context of the web server. Affected systems are PHP running on Windows through the CGI interface; deployments that do not use PHP-CGI on Windows are not described as affected in the source data. Exploitation is active: the flaw was added to CISA KEV on 2024-06-12 with known ransomware use, and EPSS assigns roughly 100% probability of exploitation within 30 days. Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use: upgrade Windows PHP-CGI deployments to a PHP release that fixes CVE-2024-4577 per PHP Group advisories, or stop using CGI mode on Windows (e.g., switch to FastCGI) and apply any vendor-recommended workarounds. Given known ransomware abuse, review web server access logs for exploitation attempts (notably %AD-encoded soft hyphens and injected -d/-s arguments in php-cgi query strings) and prioritize patching internet-facing Windows hosts. | 9.8 | 100% | KEV ransomware PoC ×11 |
| large≈10,000–100,000 internet-exposed Windows PHP-CGI systems |
Full article328 words · extracted from therecord.media · click to collapse
Researchers have uncovered a previously unseen backdoor which was used in an attack on a university in Taiwan. To infect their victims, the malware operators likely exploited a recently patched PHP vulnerability tracked as CVE-2024-4577, according to researchers at the cybersecurity firm Symantec. The vulnerability primarily affects Windows installations using Chinese and Japanese languages. Successful exploitation of the vulnerability can lead to remote code execution, Symantec said. Researchers have observed multiple threat actors scanning for vulnerable systems in recent weeks. “To date, we have found no evidence allowing us to attribute this threat, and the motive behind the attack remains unknown,” they added. What is special about the malware, which they dubbed Msupedge, is that it uses a technique called Domain Name System (DNS) tunneling to communicate with a server controlled by the hacker. Compared to more obvious methods like HTTP or HTTPS tunneling, this technique can be harder to detect because DNS traffic is generally considered benign and is often overlooked by security tools. Earlier in June, researchers discovered a campaign by suspected Chinese state-sponsored hackers, known as RedJuliett, targeting dozens of organizations in Taiwan, including universities, state agencies, electronics manufacturers, and religious organizations. Like many other Chinese threat actors, the group likely targeted vulnerabilities in internet-facing devices such as firewalls and enterprise VPNs for initial access because these devices often have limited visibility and security solutions, researchers said. In August, a Taiwanese government-affiliated research institute working on sensitive technologies was breached by one of China’s most infamous hacker groups, APT41. The hackers deployed the ShadowPad malware and several additional tools were written in Simplified Chinese.
No previous article
No new articles
Daryna Antoniuk
is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/hackers-malware-university-taiwan-backdoor