#web-shells

[ follow ]
#zero-day-exploitation #aspnet-viewstate-deserialization #godzillabluebeam-malware #cobalt-strike-backdoor
Information security
fromSecurityWeek
1 day ago

Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment

A KnowledgeDeliver ASP.NET zero-day enabled ViewState deserialization using hardcoded machineKey values, leading to web shells, Godzilla malware, and Cobalt Strike backdoors.
Information security
fromThe Hacker News
1 day ago

KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

Hard-coded ASP.NET machine keys enabled unauthenticated ViewState deserialization, allowing zero-day exploitation to deploy Godzilla web shells and Cobalt Strike Beacon.
Information security
fromThe Hacker News
5 months ago

JPCERT Confirms Active Command Injection Attacks on Array AG Gateways

A command injection flaw in Array Networks DesktopDirect (ArrayOS ≤9.4.5.8) has been exploited since Aug 2025 to drop web shells; update to 9.4.5.9.
Information security
fromThe Hacker News
6 months ago

Microsoft Detects "SesameOp" Backdoor Using OpenAI's API as a Stealth Command Channel

SesameOp is a backdoor that abuses the OpenAI Assistants API as a covert C2 channel to fetch commands and maintain long-term, espionage-driven persistence on compromised systems.
Information security
fromThe Hacker News
6 months ago

Russian Hackers Target Ukrainian Organizations Using Stealthy Living-Off-the-Land Tactics

Russia-origin threat actors used web shells and living-off-the-land tactics to steal sensitive data and maintain persistent access to Ukrainian networks.
fromThe Hacker News
7 months ago

Chinese Cybercrime Group Runs Global SEO Fraud Ring Using Compromised IIS Servers

Cybersecurity researchers have shed light on a Chinese-speaking cybercrime group codenamed UAT-8099 that has been attributed to search engine optimization (SEO) fraud and theft of high-value credentials, configuration files, and certificate data. The attacks are designed to target Microsoft Internet Information Services (IIS) servers, with most of the infections reported in India, Thailand, Vietnam, Canada, and Brazil, spanning universities, tech firms, and telecom providers. The group was first discovered in April 2025. The targets are primarily mobile users, encompassing both Android and Apple iPhone devices.
Information security
Information security
fromSecurityWeek
8 months ago

GeoServer Flaw Exploited in US Federal Agency Hack

CVE-2024-36401 RCE in GeoServer enabled attackers to breach a federal agency, deploy web shells, move laterally, and maintain persistence for weeks.
[ Load more ]