Ankura CTIX FLASH Update - August 23, 2024

Malware Activity

New Windows Backdoor Msupedge Exploits Known PHP Vulnerability

Researchers have discovered a new malware named Msupedge used as a backdoor to Windows systems by exploiting a remote code execution (RCE) vulnerability in PHP (CVE-2024-4577). This new backdoor was discovered on Windows systems at a university in Taiwan following a cybersecurity attack. The PHP vulnerability exploited by Msupedge impacts PHP installations running in CGI mode and allows for unauthenticated attackers to execute arbitrary code on the system. The vulnerability also primarily affects Windows installations using Chinese or Japanese languages. The backdoor comes in the form of two dynamic link libraries: "weblog.dll" and "wmiclnt.dll". A unique feature of the backdoor is its use of DNS tunnelling to communicate with the attacker's command-and-control (C2) server, which allows data to be encapsulated within DNS queries to avoid detection. The commands supported by Msupedge