Security News > 2022 > June > Hackers exploit three-year-old Telerik flaws to deploy Cobalt Strike
A threat actor known as 'Blue Mockingbird' targets Telerik UI vulnerabilities to compromise servers, install Cobalt Strike beacons, and mine Monero by hijacking system resources.
The flaw leveraged by the attacker is CVE-2019-18935, a critical severity deserialization that leads to remote code execution in the Telerik UI library for ASP.NET AJAX. The same threat actor was seen targeting vulnerable Microsoft IIS servers that used Telerik UI in May 2020, by which time a year had passed since security updates were made available by the vendor.
To exploit CVE-2019-18935, the attackers must acquire the encryption keys that protect Telerik UI's serialization on the target.
The payload used in the recent attacks is a Cobalt Strike beacon, a stealthy, legitimate penetration testing tool Blue Mockingbird abuses for executing encoded PowerShell commands.
The script uses common AMSI-bypassing techniques to evade Windows Defender detection to download and load a Cobalt Strike DLL onto memory.
The deployment of Cobalt Strike opens the way to easy lateral movement within the compromised network, data exfiltration, account takeover, and deployment of more potent payloads such as ransomware.
News URL
Related news
- Hackers Exploit Job Boards, Stealing Millions of Resumes and Personal Data (source)
- Hackers exploit Ivanti SSRF flaw to deploy new DSLog backdoor (source)
- Hackers exploit critical RCE flaw in Bricks WordPress site builder (source)
- Hackers exploit 14-year-old CMS editor on govt, edu sites for SEO poisoning (source)
- Hackers Exploit ConnectWise ScreenConnect Flaws to Deploy TODDLERSHARK Malware (source)
- Hackers Exploit Misconfigured YARN, Docker, Confluence, Redis Servers for Crypto Mining (source)
- Hackers exploit WordPress plugin flaw to infect 3,300 sites with malware (source)
- Magnet Goblin Hacker Group Leveraging 1-Day Exploits to Deploy Nerbian RAT (source)
- Hackers exploit Windows SmartScreen flaw to drop DarkGate malware (source)
- Hackers exploit Aiohttp bug to find vulnerable networks (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2019-12-11 | CVE-2019-18935 | Deserialization of Untrusted Data vulnerability in Telerik UI for Asp.Net Ajax Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. | 9.8 |