Exploit / PoChigh
Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser | 9.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 11e2d7a8d678cd72e6e5286ccfb4c833 | l@kaspersky.com . Indicators of compromise Host-based: MD5: 11e2d7a8d678cd72e6e5286ccfb4c833 Files created: /root/.config/StoreService /root/.config/Sto |
From the original article
6 min read at securelist.com
During an incident response performed by Kaspersky’s Global Emergency Response Team ( GERT ) and GReAT, we uncovered a novel multiplatform threat named “NKAbuse”. The malware utilizes NKN technology for data exchange between peers, functioning as a potent implant, and equipped with both flooder and backdoor capabilities. Written in Go, it is flexible enough to generate binaries compatible with various architectures.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.