Until a patch is released, administrators should immediately apply the workaround detailed in our post:

2⃣ The initial access was creative. The actor exploited a misconfigured, public-facing phpMyAdmin panel. They then used a log poisoning technique to write a one-liner PHP web shell (China Chopper) to disk, bypassing authentication and gaining initial command execution.

The gift that keeps on giving.

As more companies deploy the Huntress SIEM, we've enjoyed finding the "Door Rattlers"🚪

We see an attacker failing to log in across a number of environments and then eventually succeeding in 1 organization.

Stopping attacks at initial access ❤️

netscan.exe, psexec.exe, mstsc.exe, netsh.exe, reg.exe

Attackers love taking over M365 identities 😬 In the past ~60 days, Huntress has tracked phishing pages used to steal M365 sessions. Seeing `.com` isn't surprising but having `.online` in second place caught my eye 👀

Interested in Adversary in the Middle attacks? www.huntress.com/blog/unmaski...

When the SOC sees an RDP login and the source IP is a datacenter.