Hackers exploit progress with WhatsUp RCE vulnerability in the wild

TLDR:

Key Points:

• Progress WhatsUp Gold RCE vulnerability being actively exploited in the wild
• Attackers using vulnerabilities “CVE-2024-6670” and “CVE-2024-6671” with CVSS scores of 9.8

Cybersecurity researchers at Trend Micro recently discovered hackers exploiting the Progress WhatsUp Gold RCE vulnerability in the wild. The attacks, observed since August 30, 2024, exploited vulnerabilities marked as “Critical” with CVSS scores of 9.8. These vulnerabilities allowed attackers to retrieve encrypted passwords through SQL injection in single-user configurations.

Attackers abused the Active Monitor PowerShell Script function within the NmPoller.exe process to execute malicious code, bypassing typical access indicators. They attempted to install remote administration tools like RATs, pointing towards a potential ransomware attack. A security patch was released on August 16, 2024, for the vulnerabilities, but a proof-of-concept was reported on GitHub two weeks later, leading to exploitation within hours.

Organizations are advised to apply patches immediately upon release to mitigate risks. Mitigations include restricting corporate service access, using MFA, applying patches promptly, and more.