Vulnerabilityhigh

Praying Mantis APT targets IIS servers with ASP.NET exploits

The RecordDec 10, 2022 · 00:00 UTC (Dec 10, 2022)3 min read3 · 1 read

Read at therecord.media

Analyze CVE-2021-27852 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2021-27852 CVE-2019-18935 CVE-2017-11317

Tags: cve-2021-27852 cve-2019-18935 cve-2017-11317 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2017-11317	Unrestricted File Upload / RCE in Progress Telerik UI for ASP.NET AJAX	9.8	84%	KEVPoC ×2	Aug 23, 2017 KEV Apr 11, 2022
CVE-2019-18935	Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX	9.8	100%	KEVRansomwarePoC ×4	Dec 11, 2019 KEV Nov 3, 2021
CVE-2021-27852	Unauthenticated Deserialization RCE in Checkbox Survey 6 and Earlier	9.8	30%	KEV	May 27, 2021 KEV Apr 11, 2022

From the original article

3 min read at therecord.media

A new advanced persistent threat (APT) group has been seen carrying out attacks against Microsoft IIS web servers using old exploits in ASP. NET applications in order to plant a backdoor and then pivot to companys' internal networks. Tracked as Praying Mantis or TG1021 , the group's attacks have been documented in a report published earlier today by Israeli security firm Sygnia.

The Record

therecord.media

Read the full article at The Record

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.