Malwarecritical

AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services

The Hacker Newsby @TheHackersNewsDec 18, 2024 · 10:49 UTC (Dec 18, 2024)3 min read3 · 2 reads

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-41773 CVE-2018-15133 CVE-2017-9841 CVE-2014-2120 CVE-2018-10561 CVE-2018-10562 CVE-2021-26086 CVE-2021-41277 CVE-2022-1040 CVE-2022-21587 CVE-2023-1389 CVE-2024-4577 CVE-2024-36401 CVE-2022-22947 CVE-2023-25717

Tags: cve-2021-41773 cve-2018-15133 cve-2017-9841 cve-2014-2120 cve-2018-10561 malware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2014-2120	Cross-Site Scripting in Cisco ASA WebVPN Login Page	—	23%	KEV	— KEV Nov 12, 2024
CVE-2017-9841	Unauthenticated Remote Code Execution in PHPUnit eval-stdin.php	9.8	100%	KEV	Jun 27, 2017 KEV Feb 15, 2022
CVE-2018-10562 +1 related CVE CVE-2018-10561	Unauthenticated RCE in Dasan GPON Routers (CVE-2018-10562)	9.8	100%	KEVRansomwarePoC ×2	May 4, 2018 KEV Mar 31, 2022
CVE-2018-15133	Deserialization RCE in Laravel Framework via X-XSRF-TOKEN Header	8.1	77%	KEVPoC	Aug 9, 2018 KEV Jan 16, 2024
CVE-2021-26086	Path Traversal File Read in Atlassian Jira Server and Data Center	5.3	100%	KEVPoC	Aug 16, 2021 KEV Nov 12, 2024
CVE-2021-41277	Unauthenticated Local File Inclusion in Metabase GeoJSON Map API	7.5	97%	KEV	Nov 17, 2021 KEV Nov 12, 2024
CVE-2021-41773	Path Traversal to RCE in Apache HTTP Server 2.4.49	9.8	100%	KEVRansomwarePoC ×6	Oct 5, 2021 KEV Nov 3, 2021
CVE-2022-1040	Authentication Bypass Leading to Unauthenticated RCE in Sophos Firewall (SFOS)	9.8	100%	KEVPoC ×2	Mar 25, 2022 KEV Mar 31, 2022
CVE-2022-21587	Unauthenticated Arbitrary File Upload in Oracle E-Business Suite	9.8	98%	KEVRansomwarePoC	Oct 18, 2022 KEV Feb 2, 2023
CVE-2022-22947	Unauthenticated RCE in VMware Spring Cloud Gateway	10.0	98%	KEVPoC ×2	Mar 3, 2022 KEV May 16, 2022
CVE-2023-1389	Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution	8.8	100%	KEVPoC ×2	Mar 15, 2023 KEV May 1, 2023
CVE-2023-25717	Unauthenticated RCE via Command Injection in Ruckus Wireless Admin ≤10.4	9.8	98%	KEVPoC	Feb 13, 2023 KEV May 12, 2023
CVE-2024-36401	Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection	9.8	100%	KEVPoC ×3	Jul 1, 2024 KEV Jul 15, 2024
CVE-2024-4577	OS Command Injection in Windows PHP-CGI Allows Remote Code Execution	9.8	100%	KEVRansomwarePoC ×11	Jun 9, 2024 KEV Jun 12, 2024

From the original article

3 min read at thehackernews.com

 Ravie Lakshmanan  Nov 08, 2024 IoT Security / Vulnerability The threat actors behind the AndroxGh0st malware are now exploiting a broader set of security flaws impacting various internet-facing applications, while also deploying the Mozi botnet malware.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.