One of the most recent examples of this onslaught lies in a critical vulnerability discovered in PHP (versions 8.1.*, before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8). The vulnerability is caused by the way PHP and CGI handlers parse certain Unicode characters, which can enable an attacker to achieve remote code execution (RCE). This vulnerability is incredibly simple to exploit, and we have observed a wide variety of threat actors taking advantage of the flaw to target vulnerable devices. Author: AlienVault
Related Tags:
RedTail
Muhstik
cve-2024-4577
T1120
cryptominer
T1091
XMRig
Gh0st RAT
vulnerability
Associated Indicators:
A646EBF85AFA29AE1C77458C575B5E4B0B145D813DB028435D33B522EDCCDC0E
9753DF3EA4B9948C82310F64FF103685F78AF85E3E08BB5F0D0D44047C63C315
AB897157FDEF11B267E986EF286FD44A699E3699A458D90994E020619653D2CD
0D70A044732A77957EAAF28D9574D75DA54AE430D8AD2E4049BD182E13967A6F
2C602147C727621C5E98525466B8EA78832ABE2C3DE10F0B33CE9A4ADEA205EB
1AE2FEF05798F0F27E9DE76FCEF0217F282090FAB1BA750623CA36B413151434
9E28F942262805B5FB59F46568FED53FD4B7DBF6FAF666BEDAF6FF22DD416572
185.172.128.93
156.67.218.115