Malwarecritical
Earth Lusca expands its arsenal with SprySOCKS Linux malware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-18935 | Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2019-9621 | Unauthenticated SSRF in Synacor Zimbra Collaboration Suite ProxyServlet | 7.5 | 81% | KEVPoC ×4 | KEV |
| CVE-2019-9670 | XML External Entity (XXE) Injection in Synacor Zimbra Collaboration Suite (ZCS) | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2021-22205 | Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205) | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2021-31207 | Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE | 6.6 | 100% | KEVRansomwarePoC | KEV |
CVE-2021-34473+1 related CVE | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-39952 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through… | 9.8 | 100% | ||
| CVE-2022-40684 | Admin-Interface Auth Bypass in Fortinet FortiOS, FortiProxy & FortiSwitchManager | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
From the original article
3 min read at securityaffairs.com
China-linked threat actor Earth Lusca used a new Linux malware dubbed SprySOCKS in a recent cyber espionage campaign. Researchers from Trend Micro, while monitoring the activity of the China-linked threat actor Earth Lusca , discovered an encrypted file hosted on a server under the control of the group. Additional analysis led to the discovery of a previously unknown Linux backdoor tracked as SprySOCKS.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.