RCE Vulnerability in PHP CGI Exploited by TellYouThePass (Campaign)
ID: aa0ef20f-b347-5a32-974e-db1fdc69fc87
STIX ID: report--aa0ef20f-b347-5a32-974e-db1fdc69fc87
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2024-06-10
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
...
...
TellYouThePass operators are actively exploiting the critical PHP CGI RCE CVE-2024-4577 since June 8 to drop webshells and a .NET in-memory ransomware deployer via an HTA/VBScript chain executed with mshta.exe; impacted websites have had files encrypted and victims are instructed to pay 0.1 BTC via a READ_ME10.html ransom note.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.