Security researchers at Bitdefender Labs have detected a significant surge in exploitation attempts targeting a critical PHP vulnerability that allows attackers to execute malicious code on Windows-based systems. The vulnerability, tracked as CVE-2024-4577, has been actively exploited since June 2024, with attackers primarily deploying cryptocurrency miners and remote access tools on compromised servers. Beyond cryptocurrency mining, attackers are deploying remote access tools like Quasar RAT, giving them extensive control over compromised systems. Another 15% focus on system reconnaissance, where attackers employ “Living Off The Land” techniques using built-in Windows command-line tools to gather information about the compromised system. In a curious development, researchers have documented attempts to modify firewall configurations on vulnerable servers to block access to known malicious IPs associated with the exploit. Commands discovered by Bitdefender show attackers creating firewall rules to block both inbound and outbound connections to specific IP addresses, including known Monero mining servers. While the vulnerability frequently leverages multi-byte character sets common in Asian languages, security experts emphasize that systems worldwide remain at risk. “The most concerning pattern we’re seeing is the deployment of cryptocurrency miners, which accounts for about 5% of detected attacks,” noted Bitdefender researchers. This unusual pattern suggests a possible “cryptojacking rivalry” where competing malicious actors are battling for control of compromised systems. With ransomware affiliates and initial access brokers actively seeking vulnerabilities like CVE-2024-4577, organizations are advised to implement continuous monitoring and proactive threat hunting to detect potential compromise before more damaging attacks can occur. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Approximately 15% of detected exploits involve basic vulnerability checks using simple commands like “whoami” to verify system exploitability.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Mar 2025 12:10:29 +0000