Loading story…
A compromised library website on a Taiwanese academic network was used to host the BiFrost backdoor after attackers allegedly exploited Apache Tomcat's Ghostcat vulnerability, CVE-2020-1938. TeamT5 said the exposed Tomcat 7.0.73 server had the AJP service on port 8009 enabled, allowing the attackers to upload a Linux BiFrost payload disguised as a PNG file named md.png and turn the site into a malware distribution point. The malware was identified as an ELF executable, communicated with relay IP 107.191.61.247, and used a modified RC4 algorithm for encrypted traffic.
TeamT5 attributed the activity to the China-linked HUAPI group, also tracked as PLEAD, which has a history of targeting Taiwan and other countries. The underlying Ghostcat flaw affects Tomcat's AJP connector and can allow arbitrary file reads, JSP processing, and, in some upload scenarios, remote code execution when the AJP port is reachable by untrusted users. Apache has recommended upgrading to Tomcat 9.0.31, 8.5.51, 7.0.100, or later, along with hardened AJP defaults, to prevent malicious file uploads and remote control of exposed servers.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2020-1938 was updated. The record continued to document Apache's mitigation guidance and affected Tomcat versions.
CVE-2020-1938 was published describing an Apache Tomcat AJP connector vulnerability that could allow arbitrary file reads and, in some cases, remote code execution. The issue affected multiple Tomcat 7, 8.5, and 9 versions where AJP was enabled by default and exposed to untrusted users.
A malware sample later identified as a Linux BiFrost backdoor was uploaded to VirusTotal with MD5 hash 8fd3925dadf37bebcc8844214f2bcd18. At the time of upload, only six antivirus engines detected it.
TeamT5 reported that a library website on a Taiwanese academic network had been compromised and used to host a Linux BiFrost backdoor disguised as a PNG file, likely after exploitation of Ghostcat on an exposed Tomcat 7.0.73 server with AJP port 8009 enabled. The firm attributed the malware to the China-linked HUAPI threat actor and identified relay IP 107.191.61.247 and modified RC4-encrypted communications as key technical details.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tomcat maintainers disclosed and patched **CVE-2024-50379**, a critical remote code execution flaw tied to the default servlet when write access is enabled. The bug is a **TOCTOU race condition** during JSP compilation that can let an unauthenticated attacker upload specially crafted files and execute code on vulnerable servers under specific conditions. The issue affects Tomcat `11.0.x` before `11.0.2`, `10.1.x` before `10.1.34`, and `9.0.x` before `9.0.98`. Advisories also addressed **CVE-2024-54677**, a separate denial-of-service issue in Tomcat sample web applications caused by unrestricted total upload size. Defenders were urged to upgrade immediately to `11.0.2`, `10.1.34`, or `9.0.98`, and to review deployments that expose write-enabled default servlet functionality or retain sample applications in production.
Jul 24, 2026
Apache Tomcat released security updates addressing several vulnerabilities across supported branches, including **CVE-2026-59083**, an incorrect URL decoding flaw in `RewriteValve` that can let attackers bypass security constraints in some configurations, and **CVE-2026-59084**, a documentation-related weakness that left `EncryptInterceptor` deployments without clearly defined secure configuration requirements. Apache said affected versions span Tomcat 11, 10.1, 9.0, and 8.5 releases, with some unsupported end-of-life versions potentially exposed as well. Separate Tomcat advisories also described additional patched issues, including **CVE-2026-53434**, an invalid CRL configuration vulnerability rated **CVSS 9.1**, **CVE-2026-50229**, a cross-site scripting flaw in the Number Guess example, and other fixes tracked as **CVE-2026-53404**, **CVE-2026-55276**, **CVE-2026-55955**, and **CVE-2026-55956**. Organizations were urged to test and deploy updated releases, with Apache recommending upgrades to **11.0.24**, **10.1.57**, and **9.0.120** to remediate the newly disclosed issues.
Aug 28, 2026
Apache disclosed **CVE-2026-59083**, a vulnerability in Tomcat's `RewriteValve` caused by incorrect URL decoding of hex-encoded characters that can let attackers bypass security controls in some configurations. The issue is classified as **CWE-177** and was described as low severity by Apache, though the CVE record notes network attackability with low attack complexity, no privileges required, and no user interaction. Apache said the flaw affects supported Tomcat branches **11.0.0-M1 through 11.0.23**, **10.1.0-M1 through 10.1.56**, and **9.0.0.M1 through 9.0.119**, with reports also listing **8.5.0 through 8.5.100** as affected. Apache and downstream advisories urged users to upgrade to fixed releases **11.0.24**, **10.1.57**, or **9.0.120**, while warning that older unsupported versions may also be vulnerable; versions before **8.0.0** were noted as unaffected in the oss-security disclosure. The vulnerability was published through Apache security pages, the Apache mailing list, and `oss-security`, with the CVE entry updated to include affected-version details, a CVSS v3.1 vector, and a CISA SSVC assessment.
Aug 28, 2026