# CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS Servers

> AhnLab ASEC documented two ongoing attack cases exploiting the CVE-2019-18935 .NET deserialization vulnerability in Telerik UI for ASP.NET AJAX (RadAsyncUpload component, versions prior to 2020.1.114) on unpatched Windows IIS servers. One campaign installed a memory-resident Godzilla-style web shell and the SweetPotato privilege-escalation tool after gaining w3wp.exe-level code execution; a second campaign deployed a Rust-based WordPress vulnerability scanner for reconnaissance.

- **Published:** 2026-09-28T00:00:00Z
- **Last reviewed:** 2026-09-28T02:02:02.597Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2726
- **ID:** TL-2026-2726
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2019-18935, CVE-2017-11317

## Description

Progress Telerik UI for ASP.NET AJAX contains a critical .NET deserialization vulnerability (CVE-2019-18935, CVSS 3.1 9.8) in the RadAsyncUpload file-upload handler, present in versions from 2011.1.315 through 2019.3.1023 (fixed default type whitelisting shipped in 2020.1.114 / R1 2020). Exploitation typically chains CVE-2017-11317, which breaks the hard-coded AES key protecting RadAsyncUpload's encrypted `rauPostData` configuration parameter (default value `PrivateKeyForEncryptionOfRadAsyncUploadConfiguration`), letting an attacker forge and decrypt the parameter, upload an arbitrary mixed-mode assembly to a writable path, and then submit a second crafted request that deserializes a `System.Configuration.Install.AssemblyInstaller` gadget pointed at that assembly's `Path` property. When deserialized, the CLR loads the DLL and invokes its `DllMain`, yielding remote code execution in the context of the IIS worker process `w3wp.exe`.

AhnLab's ASEC documented two distinct, ongoing attack cases against unpatched IIS servers exploiting this chain. In the first, the attacker executed a reverse shell that opened a Windows socket back to a remote server at 206.82.6[.]22:80, redirected the socket as stdin/stdout/stderr, and spawned `cmd.exe` for interactive remote command execution. The attacker then queried the host (hostname, user privileges, running processes) before deploying SweetPotato, a local-service-to-SYSTEM privilege-escalation tool that bundles RottenPotato, JuicyPotato, and PrintSpoofer-style Print Spooler RPC abuse: it stands up a fake named pipe, forces the SYSTEM-privileged spooler service to connect to it via `RpcRemoteFindFirstPrinterChangeNotificationEx()`, and impersonates the resulting SYSTEM token via `SeImpersonatePrivilege`/`SeAssignPrimaryTokenPrivilege` to launch an elevated process. With SYSTEM access, the attacker installed a Godzilla-style memory-resident web shell: a DLL (observed as `godmemshell.Dll`) is injected into the Telerik ASP.NET application, where it registers a malicious `VirtualPathProvider` handler that serves a virtual ASPX endpoint existing only in worker-process memory, with no file ever written to disk. The web shell receives AES-encrypted .NET payloads over HTTP, decrypts and JIT-loads them in memory, stores session state in cookies, and re-encrypts responses before returning them, giving the operator persistent, largely fileless command execution, file transfer, and (per public Godzilla tooling) Mimikatz/PetitPotam-class post-exploitation capability.

In the second, separate attack case, the actor used the same CVE-2019-18935 initial-access vector to deploy a purpose-built Rust binary that functions as an internet-wide WordPress reconnaissance scanner. After compromise, the tool retrieves a candidate target list from a remote server (observed fetching `Ins.txt` from 65.98.5[.]158:31337) and asynchronously probes roughly 53 candidate URL paths per host looking for an exposed, unfinished WordPress installation/configuration page (`/wp-admin/setup-config.php` or `/wp-admin/install.php`) that would allow an unauthenticated attacker to complete setup and seize the site. Additional scanner configuration and target lists were retrieved from 2.59.133[.]147:31338 (`ins.txt`, `sm.json`) and 45.138.16[.]187:31337 (`bb.json`, `cofuz.json`). Results — vulnerable URLs and their public IPs — are exfiltrated as a `red.txt` attachment sent via the Telegram Bot API, using Telegram as a low-friction, encrypted-by-default C2/exfiltration channel that blends into normal HTTPS traffic.

CVE-2019-18935 has a long history of in-the-wild abuse: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 and notes it has been used in ransomware campaigns; Red Canary's Blue Mockingbird activity cluster (documented May 2020, active since at least December 2019) exploited the same flaw to drop XMRig Monero-mining DLLs via the `Telerik.Web.UI.WebResource.axd` endpoint, persisting via COR_PROFILER COM hijacking, modified Windows services, and scheduled tasks; and CISA/FBI/MS-ISAC's joint advisory AA23-074A (published 2023-03-15) documented exploitation of the same vulnerability against a U.S. federal civilian executive branch IIS server between November 2022 and January 2023 by two separate intrusion sets, including the cybercriminal group XE Group. ASEC's current reporting states that unpatched-Telerik attack cases 'continue to be observed,' and does not attribute the two 2026 cases to a named actor.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.003 Windows Command Shell
- T1505.003 Web Shell
- T1134.001 Token Impersonation/Theft
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1102.002 Bidirectional Communication
- T1059.001 PowerShell
- T1027 Obfuscated Files or Information
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service

## Sources

- [Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability](https://asec.ahnlab.com/en/95561/)
- [CVE-2019-18935 Detail](https://nvd.nist.gov/vuln/detail/CVE-2019-18935)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2019-18935](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18935)
- [AA23-074A: Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a)
- [MAR-10413062-1.v1 Telerik Vulnerability in U.S. Government IIS Server](https://www.cisa.gov/news-events/analysis-reports/ar23-074a)
- [Blue Mockingbird activity mines Monero cryptocurrency](https://redcanary.com/blog/threat-intelligence/blue-mockingbird-cryptominer/)
- [CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Progress Telerik UI](https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui)
- [CVE-2019-18935 RCE exploit for a .NET JSON deserialization vulnerability in Telerik UI for ASP.NET AJAX](https://github.com/noperator/CVE-2019-18935)
- [SweetPotato: Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019](https://github.com/CCob/SweetPotato)
- [GodzillaMemoryShellProject.NET](https://github.com/BeichenDream/GodzillaMemoryShellProject.NET)
- [Distribution of Godzilla WebShell Abusing ViewState (Targeting Financial Sector)](https://asec.ahnlab.com/en/85088/)
- [Telerik UI Remote Code Execution via Insecure Deserialization (CVE-2019-18935)](https://threatprotect.qualys.com/2020/05/08/telerik-ui-remote-code-execution-via-insecure-deserialization-cve-2019-18935/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2726