Cyber Risks · Unit 42 Palo Alto Networks

Fake CVE-2023-40477 Proof of Concept Leads to VenomRAT

Summary: An actor using the alias whalersplonk committed a fake proof-of-concept script for the WinRAR RCE tracked as CVE-2023-40477 to GitHub on Aug. 21, 2023, four days after the vulnerability was publicly reported on Aug. 17. The script does not exploit WinRAR; it is built on public PoC code for the GeoServer SQL injection CVE-2023-25157 and runs an infection chain that installs a VenomRAT payload with a scheduled task named Windows.Gaming.Preview that reruns every three minutes.
What you should know: Unit 42 found the checkblacklistwords[.]eu domain used in the chain was created at least 10 days before the CVE went public, so the infrastructure and payload were ready before the lure existed - and the actor's instructional video drew 121 views from people who download and run exploit code.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-25157 CVE-2023-40477
Related: Geo Server Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026