T1608.001Resource Development
Upload Malware
Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable Ingress Tool Transfer…
CVEs11
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.11
Reports0
CVEs linked to Upload Malware
11 CVEs, by priority. Each link shows its badge.- CVE-2021-44228Apache Log4j2 Remote Code Execution VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%90.0priority
- CVE-2019-0604Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 4 reportsMITRE CTID mapping of the KEV entry · primary impact99.9%Top 0.03%88.8priority
- CVE-2024-20353Cisco ASA and FTD Denial of Service VulnerabilityCisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)KEVPublic exploitHigh · 8.6T1608.001Upload MalwareT1190Exploit Public-Facing Application+2 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity69.8%Top 0.63%85.0priority
- CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow VulnerabilityFortinet · Multiple ProductsKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1133External Remote Services+5 moreMITRE CTID mapping of the KEV entry · follow-on activity30.9%Top 1.7%79.5priority
- CVE-2024-37085VMware ESXi Authentication Bypass VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity26.8%Top 2%77.6priority
- CVE-2023-33246Apache RocketMQ Command Execution VulnerabilityApache · RocketMQKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+1 moreMITRE CTID mapping of the KEV entry · follow-on activity96.6%Top 0.12%69.8priority
- CVE-2024-54085AMI MegaRAC SPx Authentication Bypass by Spoofing VulnerabilityAMI · MegaRAC SPxKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1068Exploitation for Privilege Escalation+3 moreMITRE CTID mapping of the KEV entry · primary impact60.7%Top 0.85%69.7priority
- CVE-2025-4632Samsung MagicINFO 9 Server Path Traversal VulnerabilitySamsung · MagicINFO 9 ServerKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+2 moreMITRE CTID mapping of the KEV entry · follow-on activity24.1%Top 2.2%69.4priority
- CVE-2025-32706Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact2.3%Top 16%65.2priority
- CVE-2025-32709Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact1.8%Top 21%64.2priority
- CVE-2025-32701Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact1.4%Top 27%58.0priority