Security researchers have detected a significant increase in these exploitation attempts over the past two weeks, with attackers leveraging vulnerabilities that have existing patches but remain undeployed on vulnerable systems. Security teams have reported that over 12,000 servers worldwide remain vulnerable to these attacks despite patches being available for several months, highlighting the ongoing challenge of timely patch management across organizations. Cisco Talos researchers identified that the UAT-5918 group employs a multi-stage attack methodology, first scanning for vulnerable instances before deploying exploit code tailored to the specific server version detected. A sophisticated threat actor tracked as UAT-5918 has been observed actively exploiting known vulnerabilities in web and application servers that remain unpatched across multiple organizations. Organizations in financial services, healthcare, and critical infrastructure have been disproportionately targeted in this campaign, with attackers deploying custom malware after successful exploitation. Organizations are strongly advised to apply available security patches immediately and implement network monitoring for suspicious traffic patterns matching the UAT-5918 signature. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The attackers are specifically targeting CVE-2024-4321 and CVE-2024-5879, both medium to high severity vulnerabilities that allow for remote code execution and privilege escalation on affected systems. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Their analysis reveals that the attackers use a command-and-control infrastructure distributed across multiple geographic regions to evade detection and maintain persistence. Analysis of command-and-control traffic shows data being exfiltrated via encrypted channels to servers primarily hosted in Eastern Europe and Southeast Asia. The attackers also utilize a custom-built framework that automates exploitation across multiple vulnerable services.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 21 Mar 2025 10:25:13 +0000