Node2Shell Remote Code Execution Vulnerability Exploited by Ransomware Groups

• •Node2Shell vulnerability allows remote code execution.
• •Exploited by ransomware groups, including North Korean actors.
• •Included in CISA's KEV list, indicating urgent need for mitigation.

The Node2Shell vulnerability allows remote code execution and has been exploited by ransomware groups, including those linked to North Korea. This vulnerability is included in the CISA Known Exploited Vulnerabilities (KEV) list. The vulnerability is associated with Google Brotli's unchecked return value. FortiRecon's Adversary Centric Intelligence service provides insights into the discussions surrounding this vulnerability on the dark web and social media. Organizations are urged to assess their risk and respond proactively to mitigate potential impacts. The vulnerability affects multiple systems, and proof-of-concept exploits are available. Current exploitation status is confirmed, with observed in the wild.