Telerik UI Exploitation Enables Cobalt Strike, Cryptomining and Domain-Level Compromise

Sophos investigated attacks beginning in May 2022 in which an unidentified threat actor exploited CVE-2019-18935, a critical deserialization vulnerability in Telerik UI for ASP.NET AJAX, to compromise web servers and deploy Cobalt Strike and XMRig cryptocurrency miners. Exploitation requires obtaining the upload handler’s encryption keys and submitting a malicious mixed-mode DLL to achieve remote code execution. In one incident, attackers reached domain controllers and used malicious Group Policy Objects, scheduled tasks and a persistent WMI event consumer to distribute malware and maintain access. The activity resembled earlier Blue Mockingbird attacks, but differences in payloads and techniques prevented definitive attribution.

Telerik recommends upgrading to R1 2020, version 2020.1.114, or later to address the vulnerability; its documentation also identifies the JavaScriptSerializer deserialization issue. Sophos reported behavioral detections that interrupted malicious PowerShell execution during the investigated attacks. The incidents illustrate the continuing risk from older, unpatched enterprise software, consistent with CISA’s broader advisory on routinely exploited vulnerabilities. Organizations running Telerik should verify deployed versions, prioritize remediation of exposed servers, and investigate suspicious DLL uploads, unexpected Cobalt Strike or XMRig activity, and unauthorized changes to Group Policy, scheduled tasks or WMI persistence mechanisms.