Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability

The ASEC report (https://asec.ahnlab.com/en/95561/) describes two confirmed Korea-based attack cases exploiting CVE-2019-18935 in unpatched Telerik UI for ASP.NET AJAX servers. The attacker used a .NET deserialization vulnerability in RadAsyncUpload to load a malicious DLL into the w3wp.exe process, achieving remote code execution with the web server's privileges. In the first incident the payload executed a reverse shell that connected to 206.82.6.22 on TCP port 80, queried host information, and deployed SweetPotato-family privilege escalation before injecting a Godzilla-style memory web shell into IIS memory without writing an .aspx file. The second incident used the same vulnerability only to launch a Rust-based scanner that queried 53 candidate WordPress paths (including /wp-admin/setup-config.php) and exfiltrated results via Telegram bot api.telegram.org/bot8930981923:AAGatbhK2_eiLMNtnWHkq33E6u7clhMPj5Q/sendMessage.

This story matters because CVE-2019-18935 is not a theoretical leftover: it is a critical .NET deserialization flaw (CVSS 9.8) with active exploitation telemetry documented by Red Canary in May 2020 and by CISA in advisory AA23-074A (June 2023), both referencing malicious DLL uploads to C:\Windows\Temp\ executed through w3wp.exe. The ASEC cases add a new twist: the attacker combined the Telerik entry point with in-memory web-shell persistence (no file artifact) and a scanner that searches externally exposed WordPress configuration pages, meaning a single compromised IIS server can become both a persistent control point and a reconnaissance node for additional targets. The low-trust threadlinqs repost (masto:117346158208578262) claims 9 detections and 23 IOCs but provides no verified attribution, so those counts should not be treated as confirmed.

Defenders must upgrade Telerik UI for ASP.NET AJAX to version 2020.1.114 or later, inspect IIS access logs for POST requests to /Telerik.Web.UI.WebResource.axd with query string type=rau (status codes 200 followed by 500), and review Windows security event logs for new child processes spawned by w3wp.exe, specifically cmd.exe or powershell.exe. Check C:\Windows\Temp\ for DLL files with Unix Epoch-based names such as 1667206973.2270932.dll, and search IIS memory for fileless Godzilla-style web shells that register malicious request-handling functions through VirtualPathProvider. Restrict access to exposed WordPress setup-config.php and install.php pages, block outbound TCP port 80 connections to 206.82.6.22, and monitor for Telegram bot traffic to api.telegram.org from server processes.

Watch for additional ASEC updates that expand the Korea case details, new IOCs published through AhnLab TIP, or CISA updates that link these attacks to broader APT campaigns. A shift from memory-only web shells to file-based persistence, or scanner results showing broader WordPress targeting beyond Korea, would change the exposure assessment significantly.