XAMPP

Reported Context (2)

The problem is that Apache distributions, such as XAMPP, by default, run both the database service and web service under the same user account. Huntress traces web intrusion using Nezha and Ghost RAT across 100+ potential victims
The attack scenarios include configurations running PHP under CGI mode or exposing the PHP binary, such as in XAMPP installations that are vulnerable by default. PHP CGI Flaw CVE-2024-4577 Exploited to Deploy TellYouThePass Ransomware

CVE (2)

Malware (2)

Threat Actors (1)

MITRE ATT&CK (13)

Vendors (1)

Products (6)

Tools (6)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.