China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Summary
China-linked hackers have successfully compromised servers of a US government-affiliated organization by chaining two exploits: PHP2Shell and Fragnesia. These exploits allowed the attackers to gain root access to firewalls on the targeted servers.
IFF Assessment
FOE
The exploitation of vulnerabilities by threat actors to gain unauthorized access to critical infrastructure is detrimental to defenders.
Defender Context
This incident highlights the ongoing threat posed by sophisticated threat actors, potentially nation-state affiliated, targeting critical infrastructure. Defenders should be vigilant about known vulnerabilities in firewall software and related components, and ensure robust patching and hardening practices are in place to mitigate chained exploit attacks.