PHP-CGI Vulnerability Exploited in Attacks Targeting Japan (Campaign)

Researchers identified an active campaign targeting organizations across Japanese sectors that leverages CVE-2024-4577 (PHP-CGI RCE on Windows) to achieve remote code execution and retrieve Cobalt Strike shellcode via PowerShell. The attackers use sophisticated post-exploitation TTPs — Potato privilege escalation (Juicy/Sweet/RottenPotato), persistence (registry modifications, scheduled tasks, malicious services via sharpTask/SharpStay/SharpHide), reconnaissance (fscan, Seatbelt), GPO abuse (SharpGPOAbuse) and credential theft (Mimikatz) — with tool hosting observed on Alibaba Cloud.