Hackers exploit Aiohttp bug to find vulnerable networks

The report describes ShadowSyndicate scanning for and attempting to exploit CVE-2024-23334, a high-severity aiohttp path traversal fixed in aiohttp 3.9.2; a public PoC and exploitation instructions were released in late February/early March, analysts observed scanning from IPs linked to the actor, and roughly 44,170 internet-exposed aiohttp instances exist worldwide—though vulnerable versions and confirmed breaches are not yet established.