Tag: viewstate

2 Attack Reports | 0 Vulnerabilities

Attack reports

Code injection attacks using publicly disclosed ASP.NET machine keys

An unattributed threat actor has been observed exploiting publicly disclosed ASP.NET machine keys to perform ViewState code injection attacks, delivering the Godzilla post-exploitation framework. Over 3,000 publicly disclosed keys have been identified as potentially vulnerable to this attack method…
viewstate
godzilla
post-exploitation
iis
web servers
code injection
2025-02-06
asp.net
machine keys
Published: February 6, 2025
Downloadable IOCs: 0

Deserialization of VIEWSTATE: how an “unpatched” vulnerability plays into the hands of pro-government groups

At the end of 2023, the Solar 4RAYS team was investigating an attack on a Russian telecom company by an Asian advanced persistent threat (APT) group named Obstinate Mogwai (translated as "Stubborn Demon" in English). This group was persistent, repeatedly infiltrating the network until all entry poi…
apt
cybercrime
2024-05-20
asp
viewstate
telco
Published: May 20, 2024
Downloadable IOCs: 9
Click here to see more Attack Reports