Malwarehigh
Earth Lusca's New SprySOCKS Linux Backdoor Targets Government Entities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-18935 | Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2019-9621 | Unauthenticated SSRF in Synacor Zimbra Collaboration Suite ProxyServlet | 7.5 | 81% | KEVPoC ×4 | KEV |
| CVE-2019-9670 | XML External Entity (XXE) Injection in Synacor Zimbra Collaboration Suite (ZCS) | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2021-22205 | Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205) | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-39952 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through… | 9.8 | 100% | ||
| CVE-2022-40684 | Admin-Interface Auth Bypass in Fortinet FortiOS, FortiProxy & FortiSwitchManager | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Sep 19, 2023 Endpoint Security / Malware The China-linked threat actor known as Earth Lusca has been observed targeting government entities using a never-before-seen Linux backdoor called SprySOCKS. Earth Lusca was first documented by Trend Micro in January 2022, detailing the adversary's attacks against public and private sector entities across Asia, Australia, Europe, North America.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.