CTI · reviewed · 2026-10-02

Pakistani IP Chains CVE-2017-9841 and CVE-2021-41773 in Active Exploitation

Full story & timeline

MITRE ATT&CK

• T1595 Active Scanning Reconnaissance
• T1190 Exploit Public-Facing Application Initial Access

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• 138.2.102.66 ipv4 · active
• 160.250.132.238 ipv4 · expired
• 165.99.207.153 ipv4 · active
• 194.233.84.90 ipv4 · active
• 213.209.159.154 ipv4 · expired
• 45.78.224.85 ipv4 · active
• 47.236.173.77 ipv4 · expired
• 49.0.202.115 ipv4 · active
• 89.126.211.166 ipv4 · active

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://cyberveille.ch/map/
• https://www.imperva.com/blog/the-resurrection-of-phpunit-rce-vulnerability/
• https://blog.qualys.com/vulnerabilities-threat-research/2021/10/27/apache-http-server-path-traversal-remote-code-execution-cve-2021-41773-cve-2021-42013
• https://blog.cloudflare.com/helping-apache-servers-stay-safe-from-zero-day-path-traversal-attacks/