CVE

CVE-2020-35489

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

Exploitation IoCs 11

Domain codeberg[.]org

Domain opencompiled[.]org

Domain www[.]opencompiled[.]org

Filename patch-mc-0x129.sh

GitHub Repo hpc20235/yawpp

GitHub Repo k0rn66/xmrdropper

GitHub Repo opencompiled-oss/kernel-patch

IP 37[.]120[.]193[.]124

IP 94[.]156[.]177[.]14

Package 0xengine/meow

Package 0xengine/xmlrpc

MITRE ATT&CK TTPs 8

T1005

Data from Local System

Collection

T1027

Obfuscated Files or Information

Defense Evasion

T1059

Command and Scripting Interpreter

Execution

T1071

Application Layer Protocol

Command And Control

T1082

System Information Discovery

Discovery

T1083

File and Directory Discovery

Discovery

T1195

Supply Chain Compromise

Source Articles

Getting a taste of your own medicine: Threat actor MUT-1244 targets offensive actors, leaking hundreds of thousands of credentials | Datadog Security Labs

Threat actor MUT-1244 targets offensive security actors, including pentesters and researchers, using phishing campaigns and trojanized GitHub repositories to deliver a second-stage payload. The payload exfiltrates sensitive data such as SSH keys, AWS credentials, and environment variables. Over 390,000 WordPress credentials were harvested after compromising threat actors who used a trojanized credential checker tool named 'yawpp'. The actor leverages multiple initial access methods, including malicious npm packages and phishing emails, to distribute the same backdoor.

Datadog Security Labs