Researchers have discovered a new malware named Msupedge used as a backdoor to Windows systems by exploiting a remote code execution (RCE) vulnerability in PHP (CVE-2024-4577). This new backdoor was discovered on Windows systems at a university in Taiwan following a cybersecurity attack. The PHP vulnerability exploited by Msupedge impacts PHP installations running in CGI mode and allows for unauthenticated attackers to execute arbitrary code on the system. The vulnerability also primarily affects Windows installations using Chinese or Japanese languages. The backdoor comes in the form of two dynamic link libraries: “weblog.dll” and “wmiclnt.dll”. A unique feature of the backdoor is its use of DNS tunnelling to communicate with the attacker’s command-and-control (C2) server, which allows data to be encapsulated within DNS queries to avoid detection. The commands supported by Msupedge include process creation, file download, and file creation and deletion. Currently, the threat actor and motive behind the attack on the Taiwanese university is unknown. The PHP vulnerability used in the attack has also been exploited by other threat groups, and the proof-of-concept (PoC) code for the exploit has been posted to GitHub by WatchTowr Labs. CTIX analysts recommend that organizations ensure the latest patches for PHP are applied to their systems. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.