Attackers Exploit PHP-CGI Flaw to Target Organizations in Japan
Summary
Talos describes attacks targeting organizations in Japan since January 2025. The unknown attacker exploited CVE-2024-4577 for access, then used Cobalt Strike and other tools for persistence, lateral movement, and credential theft.
Key points
- Talos observed an unknown attacker targeting organizations across several sectors in Japan, with activity dating to at least January 2025.
- Initial access involved exploiting CVE-2024-4577, a remote code execution flaw in PHP-CGI on Windows.
- The attacker used PowerShell to launch Cobalt Strike reverse HTTP shellcode, with the TaoWu kit supporting post-exploitation.
- Observed actions included privilege escalation, registry and scheduled-task persistence, clearing Windows event logs, and network reconnaissance.
- The attacker attempted lateral movement through Group Policy abuse and SSH access, and used Mimikatz to collect passwords and NTLM hashes.
- Talos found exposed command-and-control server files and evidence of a preconfigured script deploying offensive security tools and frameworks.
- Talos did not attribute the activity to the Dark Cloud Shield/You Dun group; it reported moderate confidence that the activity’s aims extend beyond credential harvesting.
Article Details
- Attack Vectors
- Exploited CVE-2024-4577 in Windows PHP-CGI installations to obtain initial access.
- Executed PowerShell through the PHP exploit to download and run an injector that launched Cobalt Strike reverse HTTP shellcode.
- Used Cobalt Strike with TaoWu plugins for post-exploitation, including reconnaissance, privilege escalation, persistence, log clearing, and lateral movement.
- Attempted SSH access using a supplied public key and brute-forced SSH credentials on port 2222.
- Used Mimikatz commands to obtain plaintext passwords and NTLM hashes from memory.
- Defensive Notes
- Patch CVE-2024-4577 and avoid exposing vulnerable Windows PHP-CGI configurations.
- Monitor for suspicious PowerShell execution, Cobalt Strike reverse HTTP activity, and connections involving the reported attacker infrastructure.
- Detect registry Run-key changes, scheduled-task creation, malicious service creation, and clearing of Windows event logs with wevtutil.
- Monitor for JuicyPotato, RottenPotato, SweetPotato, Ladon, SharpGPOAbuse, fscan, Seatbelt, and Mimikatz activity.
- Review SSH authentication and public-key use for unexpected access, particularly attempts involving port 2222.
- The article recommends Cisco security products and keeping Snort rule packs current; it lists Snort 2 SIDs 64632, 64633, 64630, 64631 and Snort 3 SIDs 301157, 301156.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 118[.]31[.]18[.]77 | Second attacker C2 server hosting a Cobalt Strike team server. |
| IPV4 | 192[.]168[.]1[.]1 | Victim-network address shown as the target for scanning; not attacker infrastructure. |
| IPV4 | 38[.]14[.]255[.]23 | Attacker C2 server used to deliver the PowerShell payload and host Cobalt Strike. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe attacker used Mimikatz commands to obtain passwords and NTLM hashes.T1003.001 · LSASS MemoryThe attacker used Mimikatz to dump credentials from memory on victim machines.T1033 · System Owner/User DiscoveryThe attacker gathered system and user information using commands including whoami /all.T1041 · Exfiltration Over C2 ChannelThe article reports exfiltration of credentials through the attacker's C2 channel.T1053 · Scheduled Task/JobThe attacker created Windows scheduled tasks using TaoWu plugins and SharpGPOAbuse.T1068 · Exploitation for Privilege EscalationThe attacker attempted privilege escalation with JuicyPotato, RottenPotato, and SweetPotato.T1070.001 · Clear Windows Event LogsThe attacker cleared Windows event logs using wevtutil.T1112 · Modify RegistryThe attacker modified registry keys, including adding a beacon executable to the Run key.T1543 · Create or Modify System ProcessThe attacker used SharpStay to create a Windows service for persistence.T1570 · Lateral Tool TransferThe attacker uploaded fscan.exe from the C2 server to a victim machine.
CVE
People
Vendors
Alibaba Groupand control (C2) server that deploys a full suite of adversarial tools and frameworks hosted on an Alibaba cloud container Registry, highlighting the potential misuse of such tools for malicious purposes by theCiscoCisco Talos discovered malicious activities conducted by an unknown attacker since as early as January 2025, predominantly targeting organizations in Japan.
Products
Alibaba cloud container Registry (ACR)in the docker container registry called “registry[.]cn-shanghai[.]aliyuncs[.]com”, an Alibaba cloud container Registry (ACR) located in the Shangai, China, region. Asset Reconnaissance Lighthouse (ARL)various publicly available offensive security frameworks and tools, including Vulfocus, Asset Reconnaissance Lighthouse (ARL), Viper C2, Starkiller, BeEF, and Blue-Lotus that are packaged and staged as dockerBeEFframeworks and tools, including Vulfocus, Asset Reconnaissance Lighthouse (ARL), Viper C2, Starkiller, BeEF, and Blue-Lotus that are packaged and staged as docker containers in the docker container registry calledBlue-Lotusand tools, including Vulfocus, Asset Reconnaissance Lighthouse (ARL), Viper C2, Starkiller, BeEF, and Blue-Lotus that are packaged and staged as docker containers in the docker container registry calledCobalt StrikeThe attacker utilizes plugins of the publicly available Cobalt Strike kit "TaoWu" for-post exploitation activities. Giteea pre-configured installer shellscript called “LinuxEnvConfig.sh” from the repository “yijingsec” on Gitee platform (hxxps[://]gitee[.]com/yijingsec/), a Chinese Git-based platform like GitHub. The author hadLinuxEnvConfig.shthat the attacker had downloaded and executed a pre-configured installer shellscript called “LinuxEnvConfig.sh” from the repository “yijingsec” on Gitee platform (hxxps[://]gitee[.]com/yijingsec/), a ChineseMetasploithave continued to see various threat actors abusing publicly available tools, such as Cobalt Strike, Metasploit, ARL, Vulfocus, and PowerShell Empire for their malicious intentions. Still, we found that some of theMicrosoft WindowsThe attacker has exploited the vulnerability CVE-2024-4577, a remote code execution (RCE) flaw in the PHP-CGI implementation of PHP on Windows, to gain initial access to victim machines. PHPThe attacker has exploited the vulnerability CVE-2024-4577, a remote code execution (RCE) flaw in the PHP-CGI implementation of PHP on Windows, to gain initial access to victim machines. PowerShell Empireactors abusing publicly available tools, such as Cobalt Strike, Metasploit, ARL, Vulfocus, and PowerShell Empire for their malicious intentions. Still, we found that some of the tools and frameworks, such asStarkillersecurity frameworks and tools, including Vulfocus, Asset Reconnaissance Lighthouse (ARL), Viper C2, Starkiller, BeEF, and Blue-Lotus that are packaged and staged as docker containers in the docker containerTaoWuThe attacker utilizes plugins of the publicly available Cobalt Strike kit "TaoWu" for-post exploitation activities. Viper C2offensive security frameworks and tools, including Vulfocus, Asset Reconnaissance Lighthouse (ARL), Viper C2, Starkiller, BeEF, and Blue-Lotus that are packaged and staged as docker containers in the dockerVulfocusfacilitates the setup of various publicly available offensive security frameworks and tools, including Vulfocus, Asset Reconnaissance Lighthouse (ARL), Viper C2, Starkiller, BeEF, and Blue-Lotus that are packaged and
Tools
fscan.exethe Windows security, system, and application logs. They further perform network reconnaissance using “fscan.exe” and “Seatbelt.exe” to map out potential lateral movement targets. The attacker has also attempted toJuicyPotatosystem details and user privileges. They execute privilege escalation exploit programs, such as JuicyPotato, RottenPotato, and SweetPotato, to gain SYSTEM-level access. They establish persistence by modifyingLadon.exeLadon.exe BypassUac C:\Windows\Temp\123.exeMimikatz“SharpGPOAbuse.exe” to execute malicious PowerShell scripts across the network. Eventually, they execute Mimikatz commands to dump and exfiltrate passwords and NTLM hashes from memory on the victim’s machine. PHP-CGI_CVE-2024-4577_RCE.pyTo target the vulnerability, the attacker leverages a publicly available exploit Python script “PHP-CGI_CVE-2024-4577_RCE.py”. The script checks to see if a specific URL is vulnerable to the CVE-2024-4577 vulnerability.RottenPotatodetails and user privileges. They execute privilege escalation exploit programs, such as JuicyPotato, RottenPotato, and SweetPotato, to gain SYSTEM-level access. They establish persistence by modifying registry keys,Seatbelt.exesystem, and application logs. They further perform network reconnaissance using “fscan.exe” and “Seatbelt.exe” to map out potential lateral movement targets. The attacker has also attempted to abuse Group PolicySharpGPOAbuse.exelateral movement targets. The attacker has also attempted to abuse Group Policy Objects using “SharpGPOAbuse.exe” to execute malicious PowerShell scripts across the network. Eventually, they execute MimikatzSharpHide.exeThey run “SharpHide.exe”, the utility used to create a hidden registry key.SharpStay.exeThey also run “SharpStay.exe”, a .NET tool used to create a service in the Windows machine.sharpTask.exeThe attacker runs “sharpTask.exe”, a .NET program used to schedule a task on the Windows machine.SweetPotatoprivileges. They execute privilege escalation exploit programs, such as JuicyPotato, RottenPotato, and SweetPotato, to gain SYSTEM-level access. They establish persistence by modifying registry keys, adding scheduled
Countries
Industries
E-commercevarious business verticals, including technology, telecommunications, entertainment, education, and e-commerce, based on our analysis of command and control (C2) server artefacts. Educationin Japan across various business verticals, including technology, telecommunications, entertainment, education, and e-commerce, based on our analysis of command and control (C2) server artefacts. Entertainmentorganizations in Japan across various business verticals, including technology, telecommunications, entertainment, education, and e-commerce, based on our analysis of command and control (C2) server artefacts. Technologythe attacker predominantly targets organizations in Japan across various business verticals, including technology, telecommunications, entertainment, education, and e-commerce, based on our analysis of command andTelecommunicationstargets organizations in Japan across various business verticals, including technology, telecommunications, entertainment, education, and e-commerce, based on our analysis of command and control (C2) server