{"id":4230,"date":"2025-02-10T06:24:53","date_gmt":"2025-02-10T06:24:53","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/veracore-zero-day-exploited-for-persistent-web-shells\/"},"modified":"2025-02-10T06:24:54","modified_gmt":"2025-02-10T06:24:54","slug":"veracore-zero-day-exploited-for-persistent-web-shells","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/veracore-zero-day-exploited-for-persistent-web-shells\/","title":{"rendered":"VeraCore zero-day exploited for persistent web shells"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Feb 10, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Vulnerability \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors have been observed exploiting multiple security flaws in various software products, including Progress Telerik UI for ASP.NET AJAX and Advantive VeraCore, to drop reverse shells and web shells, and maintain persistent remote access to compromised systems.<\/p>\n

The zero-day exploitation of security flaws in VeraCore has been attributed to a threat actor known as XE Group<\/a>, a cybercrime group likely of Vietnamese origin that’s known to be active since at least 2010.<\/p>\n

“XE Group transitioned from credit card skimming to targeted information theft, marking a significant shift in their operational priorities,” cybersecurity firm Intezer said<\/a> in a report published in collaboration with Solis Security.<\/p>\n

“Their attacks now target supply chains in the manufacturing and distribution sectors, leveraging new vulnerabilities and advanced tactics.”<\/p>\n

\"Cybersecurity\"<\/a><\/center><\/div>\n

The vulnerabilities in question are listed below –<\/p>\n