Update: CVE-2024-4577 quickly weaponized to distribute Ransomware

Tags

External References

• https://www.imperva.com/
• https://otx.alienvault.com/

Description

The report describes an attack campaign leveraging the CVE-2024-4577 vulnerability to deliver the "TellYouThePass" ransomware. The attackers use the vulnerability to execute arbitrary PHP code and run a malicious HTML application that loads a .NET variant of the ransomware into memory. Upon execution, the ransomware contacts a command-and-control server, enumerates directories, terminates processes, encrypts files, and leaves a ransom note.

Date