TellYouThePass Ransomware Exploits Recent PHP RCE Vulnerability to Compromise Servers

The TellYouThePass ransomware gang has been exploiting the recently patched CVE-2024-4577 remote code execution vulnerability in PHP to deliver webshells and execute their ransomware payload on target systems.

The attacks began on June 8, less than 48 hours after PHP maintainers released security updates, utilizing publicly available exploit code. TellYouThePass is notorious for quickly adopting public exploits for widespread vulnerabilities. In November, they exploited an Apache ActiveMQ RCE, and in December 2021, they used the Log4j exploit to breach companies.

In the latest attacks observed by researchers at cybersecurity company Imperva, TellYouThePass leveraged the critical-severity CVE-2024-4577 bug to execute arbitrary PHP code. They used the Windows mshta.exe binary to run a malicious HTML application (HTA) file. This file contained VBScript with a base64-encoded string that decoded into a binary, loading a .NET variant of the ransomware into the host’s memory.

Upon execution, the malware sends an HTTP request to a command-and-control (C2) server disguised as a CSS resource request and encrypts files on the infected machine. It then leaves a ransom note, “READ_ME10.html,” with instructions for the victim on how to restore their files. User posts on the BleepingComputer forum indicate that TellYouThe

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.