NexurAI
The MFT and web-app data-theft flaws ransomware crews weaponized at scale.
A SQL injection in MOVEit Transfer let the Cl0p group deploy a webshell and mass-exfiltrate data from hundreds of organizations.
Progress MOVEit Transfer (SQL injection) · 2023
The attacker exploits the SQLi to install the 'human2.aspx' webshell, then uses it to enumerate and steal files stored in MOVEit.
Look for human2.aspx (or similarly named) files in the MOVEit webroot, anomalous DB service account activity, and large outbound transfers from the MOVEit host.
Apply Progress's patches, hunt for the known IOCs/webshells, rotate MOVEit service credentials, and review file access logs for exfiltration.
A crafted Content-Type header triggers OGNL expression evaluation - unauthenticated RCE, and the root cause of the Equifax breach.
Apache Struts 2 (Jakarta Multipart parser) · 2017
The attacker sends a malicious Content-Type header containing an OGNL expression; the Struts parser evaluates it and runs the embedded command.
Alert on Content-Type headers containing '%{' / 'ognl' / '(#cmd=', and Java app servers spawning shells; WAF signatures exist.
Upgrade Struts, add a WAF rule for OGNL in headers, and inventory apps using the vulnerable parser.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.