OTX Threat: Telerik UI 취약점을 악용한 웹쉘 설치 및 스캐너 실행 공격 사례

Multiple attack campaigns exploiting CVE-2019-18935, a remote code execution vulnerability in unpatched Telerik UI for ASP.NET AJAX servers, have been identified. The first case involved exploiting the vulnerability to execute a reverse shell connecting to 206.82.6.22, attempting privilege escalation using Potato-family tools like SweetPotato, and installing a Godzilla-style memory-based web shell CVEs: CVE-2019-18935 Sectors: Government