PlugX Malware Being Distributed via Vulnerability Exploitation
ASEC (AhnLab Security Emergency response Center) has recently discovered the installation of the PlugX malware through the Chinese remote control programs Sunlogin and Awesun’s remote code execution vulnerability. Sunlogin’s remote code execution vulnerability (CNVD-2022-10270 / CNVD-2022-03672) is still being used for attacks even now ever since its exploit code was
Paradise Ransomware Distributed Through AweSun Vulnerability Exploitation
The ASEC analysis team has recently discovered the distribution of Paradise ransomware. The threat actors are suspected to be utilizing a vulnerability exploitation of the Chinese remote control program AweSun. In the past, the team also found and covered the distribution of Sliver C2 and BYOVD through a Sunlogin vulnerability,
Cases of Attacks Targeting Vulnerable Atlassian Confluence Servers
The ASEC analysis team has been monitoring attacks that are targeting vulnerable systems. This post will discuss cases of attacks targeting vulnerable Atlassian Confluence Servers that are not patched. Atlassian’s Confluence is a major collaboration platform used by many companies across the globe. Being a web-based platform, services such as
Windows MSDT Zero-day Vulnerability ‘DogWalk’ Detected by V3
On June 8th, a new Windows Zero-day vulnerability named DogWalk was revealed by Hacker News (thehackernews.com). Similar to that of Follina vulnerability that targeted MS Office document files, this is a vulnerability that occurs from MSDT (Microsoft Support Diagnostic Tool), and it has a risk of copying malware in Windows
Caution! Microsoft Office Zero-day Vulnerability Follina (CVE-2022-30190)
A new vulnerability named Follina (CVE-2022-30190) has been revealed. According to Microsoft, it is a remote code execution vulnerability that occurs when the URL protocol is used to call MSDT in calling applications such as Microsoft Word. With the privileges of the calling application, attackers can run arbitrary codes, install additional
Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped)
In December last year, the vulnerability (CVE-2021-44228) of Java-based logging utility Log4j became a worldwide issue. It is a remote code execution vulnerability that can include the remote Java object address in the log message and send it to the server using Log4j to run the Java object in the
Detection of Log4j Vulnerability (CVE-2021-44228) Using V3 Network Detection
After the reveal of Apache Log4j vulnerability (CVE-2021-44228) on December 10th, 2021, there have been various POCs (Proof of Concept) uploaded on GitHub. The Log4j vulnerability has a huge impact because attackers can insert malicious class addresses and run malicious classes created by them on web servers. AhnLab has updated
![[Announcement] New Log4j Vulnerability (CVE-2021-45105) – Log4j 2.17.0](https://asec.ahnlab.com/wp-content/uploads/2021/12/39_cyber-security_02.png)
[Announcement] New Log4j Vulnerability (CVE-2021-45105) – Log4j 2.17.0
CVE-2021-45105 vulnerability that operates in Log4j 2.16.0 version was additionally revealed on December 18th, 2021 (CVSS 7.5). 1. Vulnerable Versions Log4j 2.0-beta9 to 2.16.0 2. Vulnerability Exploitation Technique Vulnerability exploitations may occur if applications that use Log4j are enabled with the layout pattern and thread context features. The following shows
![[Notice] Log4j Core Affected by Apache Log4j Vulnerability CVE-2021-44228](https://asec.ahnlab.com/wp-content/uploads/2021/12/38_security-alert_01.png)
[Notice] Log4j Core Affected by Apache Log4j Vulnerability CVE-2021-44228
AhnLab recommends security updates for Apache Log4j vulnerability. Apache Log4j Vulnerability Information Vulnerability Vulnerability (CVE-2021-44228, CVSS 10.0) that the attacker can remote code execute via a log message in Log4j 2.x version [1] Vulnerability (CVE-2021-45046, CVSS 3.7) in Log4j 2.x version that allows the attacker to cause Denied of Service
![[Alert] Apache Log4j 2 Vulnerability, Update Recommended](https://asec.ahnlab.com/wp-content/uploads/2021/12/01_security-problem_03-1.png)
[Alert] Apache Log4j 2 Vulnerability, Update Recommended
The Apache Log4j 2 vulnerability (CVE-2021-44228) was revealed on Twitter and Github alongside POC on December 10th, 2021. It is the remote code execution (RCE) vulnerability of the Log4j software, which can include the remote Java object address in the log message and run it in the vulnerable server. Alibaba’s cloud
