Threat actorhigh
From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-17562 | Unauthenticated RCE in Embedthis GoAhead Web Server via CGI LD_PRELOAD injection | 8.1 | 97% | KEVPoC ×3 | KEV |
| CVE-2017-9805 | XML Deserialization RCE in Apache Struts 2 REST Plugin | 8.1 | 99% | KEVPoC | KEV |
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) | 10.0 | 100% | KEVRansomwarePoC ×9 | KEV |
| CVE-2022-26134 | Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gleeze.com | designed to establish contact with a remote server ("mimosa.gleeze[.]com"). BartBlaze told The Hacker News that the activity dates |
| ipv4 | 38.180.83.166 | hed communications with a command-and-control (C2) server ("38.180.83[.]166"). Subsequently, the attackers were observed executing a |
From the original article
5 min read at thehackernews.com
A China-linked threat actor has been attributed to a cyber attack targeting an U. S. non-profit organization with an aim to establish long-term persistence, as part of broader activity aimed at U.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.