Distribution of EtherRAT Malware Exploiting React2Shell Vulnerability (CVE-2025-55182)
AhnLab SEcurity intelligence Center (ASEC) recently discovered an advanced malware distribution campaign using Node.js while tracking the recently disclosed React2Shell vulnerability. This attack installs EtherRAT through multiple stages, with the ultimate goal of gaining a foothold, stealing information, and stealing cryptocurrency. After the threat actor accessed the IP address
Bypassing Mark of the Web (MoTW) via Windows Shortcuts (LNK): LNK Stomping Technique
Overview While Windows shortcut (LNK) files are designed for user convenience, they have long been exploited as initial access vectors by threat actors. Since Microsoft strengthened its macro-blocking policies in 2022, attackers have increasingly turned to alternative formats such as ISO, RAR, and LNK files in their attacks. LNK files
Zip Slip, Path Traversal Vulnerability during File Decompression
Overview Path traversal or directory traversal vulnerabilities are security vulnerabilities that occur mainly due to improper validation of user inputs. Attackers can read, modify, or even create new files that are originally inaccessible or located in unintended paths using relative or absolute paths. Although these vulnerabilities have been known for
Mark of the Web (MoTW) Bypass Vulnerability
Overview Mark of the Web (MoTW) is a Windows feature that identifies files downloaded from the Internet and displays a security warning, as well as restricts the files to be executed with a warning message or in a protected mode. However, threat actors have been bypassing Mark of the Web
Legacy Driver Exploitation Through Bypassing Certificate Verification
1. Overview In June 2024, the security company CheckPoint-Research (CPR) published a post on a security threat that used the Legacy Driver Exploitation technique. This attack mostly focused on remotely controlling infected systems using the Gh0stRAT malware and causing additional damage. The threat actor distributed malware using a phishing site
Status of Korean Servers Exposed to Ivanti Connect Secure Vulnerabilities (Multiple CVEs)
Multiple vulnerabilities have been disclosed for the Ivanti Connect Secure product, including several with a CVSS score of 9 or higher (CRITICAL). The majority of Ivanti Connect Secure servers operating in Korea have been identified as vulnerable versions. Figure 1. Default connection screen of Ivanti Connect Secure Ivanti
Status of Korean Servers Exposed to Grafana Vulnerability (CVE-2024-9264)
A critical security vulnerability in Grafana was announced and many Korean servers have been identified as using the vulnerable versions. Grafana is widely known as an open-source platform for visualizing and monitoring data. Figure 1. Grafana login screen The CVE-2024-9264 vulnerability disclosed on October 18th, 2024 is a
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178)
AhnLab SEcurity intelligence Center (ASEC) and the National Cyber Security Center (NCSC) have discovered a new zero-day vulnerability in the Microsoft Internet Explorer (IE) browser and have conducted a detailed analysis on attacks that exploit this vulnerability. This post shares the joint analysis report “Operation Code on Toast by TA-RedAnt”
Jenkins Servers in Korea With Exposed Vulnerabilities (CVE-2024-23897, CVE-2024-43044)
Multiple vulnerabilities were announced for Jenkins, a widely used development tool, and some of them are being exploited in actual attacks. It was also found that most Jenkins servers in Korea were exposed to these vulnerabilities. The CVE-2024-23897 vulnerability disclosed earlier this year allows unauthenticated users to read arbitrary files
Distribution of Godzilla WebShell Abusing ViewState (Targeting Financial Sector)
Overview AhnLab SEcurity intelligence Center (ASEC) has recently detected an attack targeting financial sector companies. The threat actor primarily targeted ASP.NET environments with vulnerable configurations, abusing the ViewState feature supported by ASP.NET. ViewState is a fundamental feature of ASP.NET that allows the handling of user input or other data
