CTI · reviewed · 2026-09-28

Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1100 Web Shell Persistence
• T1059 Command and Scripting Interpreter Execution
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1082 System Information Discovery Discovery
• T1102 Web Service Command and Control

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• 45.77.212.12 ipv4 · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: IIS Worker Process Spawning Shell Interpreters
id: a492a4da-7ea2-43e2-b266-2e845f3ff8ae
status: experimental
description: Detects the IIS worker process (w3wp.exe) spawning command interpreters, the execution pattern observed when attackers exploit CVE-2019-18935 in Telerik UI for ASP.NET AJAX to run reverse shells, SweetPotato privilege escalation, and a Rust scanner from the web server process (ASEC, 2026).
references:
  - https://asec.ahnlab.com/en/95561/
  - https://intel.threadlinqs.com/threat/TL-2026-2726
author: Tia N. List
date: 2026-09-28
tags:
  - attack.t1059
  - attack.t1100
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
  condition: selection
falsepositives:
  - Legitimate IIS applications invoking command-line tools or scripts during deployment or build tasks
level: high

YARA-X raw

rule Telerik_Cve_2019_18935_Telegram_Scanner {
    meta:
        author = "Tia N. List"
        date = "2026-09-28"
        status = "experimental"
        description = "Scanner tooling deployed after CVE-2019-18935 Telerik UI exploitation: a Rust scanner queries exposed WordPress setup pages and exfiltrates results through a hardcoded Telegram bot API token. Derived from case analysis (ASEC, 2026) — NOT validated against a live sample."
        reference = "https://asec.ahnlab.com/en/95561/"
        falsepositives = "Analyst or incident-response tooling that embeds the same strings; the unique Telegram bot token is the high-confidence anchor"
    strings:
        $token = "8930981923:AAGatbhK2_eiLMNtnWHkq33E6u7clhMPj5Q" ascii
        $tg_api = "api.telegram.org" ascii nocase
        $tg_send = "/sendMessage" ascii
        $telerik = "Telerik.Web.UI.WebResource.axd" ascii nocase
        $wp_probe = "setup-config.php" ascii nocase
    condition:
        $token or (2 of ($tg_api, $tg_send, $telerik, $wp_probe))
}

References

• https://asec.ahnlab.com/en/95561/
• https://intel.threadlinqs.com/threat/TL-2026-2726