In a concerning revelation, cybersecurity firm eSentire’s Threat Response Unit (TRU) has detected active exploitation of a six-year-old vulnerability, CVE-2019-18935, in Progress Telerik UI for ASP.NET AJAX.
This flaw, which affects Internet Information Services (IIS) servers, enables malicious actors to gain unauthorized remote access and execute commands, posing a significant threat to unpatched systems.
The vulnerability remains a critical attack vector despite its age, underscoring the persistent challenge of legacy vulnerabilities in enterprise environments.
The exploitation process begins with threat actors probing IIS servers for an active file upload handler.
Once confirmed, they deploy a customized proof-of-concept (PoC) exploit to upload a reverse shell.
The reverse shell is a mixed-mode .NET assembly designed to establish a connection with a command-and-control (C2) server using Windows Sockets.
Upon gaining access, adversaries escalate their activities by executing reconnaissance commands, enumerating users, and leveraging tools like “cmd.exe” within the IIS worker process (w3wp.exe).
The reverse shells are often deposited in temporary directories with filenames resembling randomized numerical patterns, e.g., [10 digits].[6 digits].dll.
Additionally, attackers are deploying the JuicyPotatoNG privilege escalation tool under misleading file names like “PingCaler.exe” and “JuicyPotatoNG.exe” in public directories.
Batch scripts such as “rdp.bat” and “user.bat” have also been observed, though their specific functionalities remain unclear.
eSentire’s TRU identified these attacks in early January 2025 through suspicious activity logs within IIS servers.
For instance, IIS access logs displayed requests to vulnerable endpoints (Telerik.Web.UI.WebResource.axd) with specific query parameters, signaling exploitation attempts. Upon detection, the cybersecurity firm’s.
Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free
Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations by…
Cybersecurity researchers continue to track sophisticated "Click Fix" style distribution campaigns that deliver the notorious…
In a novel and concerning development, multiple U.S. organizations have reported receiving suspicious physical letters…
The cybersecurity landscape has recently been impacted by the emergence of the Strela Stealer malware,…
A recent discovery by the Socket Research Team has unveiled a malicious PyPI package named…
A recent cybersecurity threat has emerged where unknown attackers are exploiting a critical remote code…