CVE-2024-4577: How Hackers Are Exploiting PHP Vulnerabilities in Windows Systems

Bitdefender Labs has been tracking a surge in cyberattacks exploiting CVE-2024-4577, a critical vulnerability in PHP running on Windows-based systems in CGI mode. This flaw enables remote attackers to execute arbitrary code by manipulating character encoding conversions. Since Bitdefender’s initial advisory in June 2024, the exploitation of this vulnerability has increased, with significant attack activity observed in Taiwan, Hong Kong, Brazil, Japan, and India.

Threat actors have been using this vulnerability to modify firewall rules on compromised systems, likely as part of an ongoing cyber battle between rival cryptojacking groups. Additionally, attackers are leveraging “Living Off The Land” (LOTL) techniques—using built-in Windows tools to avoid detection—making these attacks particularly stealthy and difficult to stop.

Beyond cryptojacking, there are growing concerns that ransomware groups could exploit CVE-2024-4577 to gain initial access to target systems. This article explores the latest developments in this exploit campaign, the attack techniques being used, and what organizations can do to protect themselves.

the Exploit Campaign

– CVE-2024-4577 Explained: This vulnerability stems from

Geographical Targeting: The highest exploit detections have been reported in Taiwan (54.65%), Hong Kong (27.06%), and Brazil (16.39%), with minor activity in Japan and India.
Firewall Manipulation: Attackers have been observed modifying firewall settings on infected servers, potentially to block competitors’ access to compromised machines.

– Potential Motivations:

Cryptojacking Rivalry: Competing cybercriminal groups blocking each other’s access to hijacked resources.
Unauthorized Remote Management: Administrators (or attackers) using the exploit for server maintenance, though this is highly risky.
Vigilante Activity: Less likely but possible, where individuals try to counteract the exploit.

– Common Attack Techniques:

Living Off The Land (LOTL) Attacks: Using built-in Windows tools like PowerShell and certutil.exe to evade detection.
Cryptojacking Malware: 5% of attacks deploy XMRig, a popular Monero mining tool.
Quasar RAT Deployment: Remote Access Trojans (RATs) being used for system control.
MSI-Based Payloads: Attackers are using malicious MSI installers to infect systems.
FTP-Based Delivery: Some malware samples are being delivered via old-school FTP techniques.

The campaign is evolving, and researchers warn that ransomware groups could leverage CVE-2024-4577 for more devastating attacks. Organizations should take immediate action to secure their PHP installations and monitor suspicious system activity.

What Undercode Says:

Bitdefender’s findings highlight a disturbing trend in cybercrime, where vulnerabilities like CVE-2024-4577 become battlegrounds for multiple threat actors. Here’s our analysis of the key takeaways:

1. The Rise of Cryptojacking Rivalries

Cryptojacking has grown beyond a passive threat; cybercriminals now actively fight for control over compromised servers.
Evidence suggests that attackers block rival mining operations by modifying firewall rules, a behavior reminiscent of past cyber conflicts, like those seen with the LemonDuck malware group.
Since cryptojacking is a low-risk, high-reward attack, we expect these rivalries to intensify, leading to new countermeasures from attackers (e.g., rootkits to hide mining activity).

2. Expanding Beyond Cryptojacking: Ransomware Risks

Cryptojacking is not the only danger posed by this exploit. Initial Access Brokers (IABs) could sell compromised systems to ransomware affiliates.
Unlike cryptojacking, which is low-profile, ransomware is high-impact and could cause severe financial damage to victims.
Attackers may be delaying ransomware deployment after gaining access, meaning some compromised systems could already be “prepped” for future ransomware attacks.

Living Off The Land (LOTL) Attacks Make Detection Harder

– The use of built-in tools like PowerShell, certutil.exe, and msiexec.exe allows attackers to operate without triggering antivirus alerts.
– Since these are legitimate Windows tools, organizations must monitor command-line behavior rather than relying solely on signature-based detection.
– Admins should implement restrictive policies to limit the execution of suspicious scripts and unknown MSI installations.

4. The Role of Initial Access Brokers (IABs)

About 15% of detected exploits involve basic reconnaissance, often preliminary scans from IABs assessing server value before selling access.
IABs act as middlemen, making it easier for ransomware groups to focus solely on deployment.
Organizations should detect and block early-stage reconnaissance attempts before attackers escalate privileges.

The Future of Exploitation: More Stealth, More Automation

– Expect automated exploitation tools to become more sophisticated, combining machine learning and scripting to detect and exploit new targets faster.
– Cybercriminals may use self-spreading worms to automate attacks, requiring zero human intervention after the initial compromise.
– The increasing use of botnets could allow mass exploitation, turning compromised systems into launchpads for larger-scale attacks.

6. Actionable Defense Strategies

Patch Immediately: Update PHP installations to mitigate CVE-2024-4577.

– Monitor Network Traffic: Look for

References:

Reported By: https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-update-mass-exploitation-cve-2024-4577
Extra Source Hub:
https://www.discord.com
Wikipedia
Undercode AI