Blue Mockingbird activity mines Monero cryptocurrency
This suite of user interface components accelerates the web development process, but some versions are susceptible to a deserialization vulnerability, CVE-2019-18935.
CVE-2019-18935 KEVRansomwarePublic exploit Critical · 9.8 EPSS 99.7%
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
Progress · Telerik UI for ASP.NET AJAX
Official description · NVD
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
83.7 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 1
- Tactics
- 4/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 5 months after disclosure. Public exploit code (PoC-in-GitHub) was available 23 months before disclosure.
- Public exploit codePoC-in-GitHub23 mo before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+5 mo
- Added to CISA KEVknown ransomware use; EU database agrees+23 mo
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
4 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 4Initial AccessTA0001
MITRE CTID mapping of the KEV entry · how it is exploited
CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise.
PersistenceTA0003
Web Shell T1505.003
MITRE CTID mapping of the KEV entry · primary impact
ExfiltrationTA0010
MITRE CTID mapping of the KEV entry · primary impact
ImpactTA0040
Resource Hijacking T1496
MITRE CTID mapping of the KEV entry · primary impact
Lower-confidence links (2)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Drive-by CompromiseT1189 server-side bug exploitable without user interaction; client-execution technique does not fit
- Exploitation for Client ExecutionT1203 server-side bug exploitable without user interaction; client-execution technique does not fit
Detection
0 rules for this CVE · 202 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2019-18935 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploit Public-Facing ApplicationT1190149 general rules
- Arcadyan Router Exploitationscriticaltest
- Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
- Citrix Netscaler Attack CVE-2019-19781criticaltest
- Confluence Exploitation CVE-2019-3398criticaltest
- CVE-2010-5278 Exploitation Attemptcriticaltest
- CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
- CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
- CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest
Web ShellT1505.00335 general rules
- Certificate Request Export to Exchange Webservercriticaltest
- CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest
- Mailbox Export to Exchange Webservercriticaltest
- Oracle WebLogic Exploitcriticaltest
- Solarwinds SUPERNOVA Webshell Accesscriticaltest
- Webshell Remote Command Executioncriticaltest
- WordPress Wp2shell Webshell Plugin Accesscriticalexperimental
- Antivirus - Web Shell Detection Signaturehightest
Exfiltration Over C2 ChannelT10415 general rules
- Equation Group C2 Communicationhightest
- OpenCanary - TFTP Requesthightest
- Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental
- Network Communication Initiated To Portmap.IO Domainmediumtest
- Tunneling Tool Executionmediumtest
Resource HijackingT149613 general rules
- Linux Crypto Mining Pool Connectionshighstable
- Monero Crypto Coin Mining Pool Lookuphighstable
- Network Communication With Crypto Mining Poolhighstable
- Potential Crypto Mining Activityhighstable
- Linux Crypto Mining Indicatorshightest
- Azure Kubernetes Network Policy Changemediumtest
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest
- Azure Kubernetes Secret or Config Object Accessmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 1 threat report1 reportredcanary.com
Reports are matched by finding the exact id CVE-2019-18935 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX