Hackers deployed new malware against university in Taiwan

Researchers discovered a new backdoor named Msupedge used in an attack on a Taiwanese university that likely exploited CVE-2024-4577 in PHP to achieve remote code execution; the malware uses DNS tunneling for stealthy command-and-control, and multiple actors have been observed scanning for the vulnerability. The report also references contemporaneous campaigns attributed to suspected Chinese state-sponsored groups (RedJuliett, APT41) and highlights the challenge of detecting DNS-based C2 traffic.