{"id":"teamt5-threatsonar-upload-attacks-feb-2026","category":"patch","status":"closed","title":"TeamT5 ThreatSonar Anti-Ransomware upload flaw CVE-2024-7694 exploited; fixes available","tldr":"Attackers used a flaw in TeamT5 ThreatSonar Anti-Ransomware to run commands on its server after gaining administrator access. Update to 3.5.0 or later, or apply Hotfix-20240715. TeamT5 says all affected customers have updated.","summary":"CVE-2024-7694 affects TeamT5 ThreatSonar Anti-Ransomware 3.4.5 and earlier, an organisational security product. An attacker who already has administrator privileges on its management platform can upload a malicious file and run commands on the server; opening a file is not required. TWCERT/CC specifies version 3.5.0 or later, or Hotfix-20240715, as the fix. TeamT5’s linked July 2024 notice instead describes account-creation and password-change weaknesses, so the descriptions differ, although its February 2026 statement identifies that notice as the relevant remediation advisory. CISA listed the CVE as exploited on 17 February 2026. TeamT5 subsequently told SecurityWeek that the observed attacks occurred in 2024 against a few customers, who were notified and helped to patch. It considered Chinese groups Slime57 and Slime62 the likely attackers. On 22 February, TeamT5 said all affected customers had migrated from vulnerable releases. No later incident development was found in the search through 3 November 2026.","action":"If your business or family office uses ThreatSonar Anti-Ransomware, ask IT to confirm version 3.5.0 or later, or installation of Hotfix-20240715. Families who do not use this organisational security product have nothing to update for this flaw.","product":"TeamT5 ThreatSonar Anti-Ransomware","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2024-7694"],"tags":["teamt5","threatsonar","file-upload","command-execution","exploited"],"affected":["TeamT5 ThreatSonar Anti-Ransomware 3.4.5 and earlier"],"fixed":["ThreatSonar Anti-Ransomware 3.5.0 or later","Hotfix-20240715 for affected installations"],"matches":[],"sources":[{"kind":"advisory","title":"[Vulnerability Notice - 20240715] ThreatSonar Anti-Ransomware","url":"https://teamt5.org/en/support/vulnerability-notification/vulnerability-notice-threat-sonar-anti-ransomware-20240715","by":"TeamT5","date":"2024-07-15"},{"kind":"advisory","title":"TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload","url":"https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html","by":"TWCERT/CC","date":"2024-08-12"},{"kind":"post","title":"TeamT5 Statement Regarding CISA’s KEV Catalog Updates","url":"https://teamt5.org/en/posts/team-t5-cisa-kev/","by":"TeamT5","date":"2026-02-22"},{"kind":"advisory","title":"CISA Adds Four Known Exploited Vulnerabilities to Catalog","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40a4268","by":"CISA","date":"2026-02-17"},{"kind":"news","title":"CISA: Hackers Exploiting Vulnerability in Product of Taiwan Security Firm TeamT5","url":"https://www.securityweek.com/cisa-hackers-exploiting-vulnerability-in-product-of-taiwan-security-firm-teamt5/","by":"SecurityWeek","date":"2026-02-18"},{"kind":"news","title":"Taiwan Security Firm Confirms Flaw Flagged by CISA Likely Exploited by Chinese APTs","url":"https://www.securityweek.com/taiwan-security-firm-confirms-flaw-flagged-by-cisa-likely-exploited-by-chinese-apt/","by":"SecurityWeek","date":"2026-02-24"}],"started":"2026-02-17","closed":"2026-02-24","created":"2026-11-03T22:27:45.676Z","updated":"2026-11-03T22:27:45.676Z","cve_notes":[{"cve":"CVE-2024-7694","name":"Arbitrary file upload in ThreatSonar Anti-Ransomware","what":"Insufficient checks on uploaded files in ThreatSonar Anti-Ransomware let a remote attacker with platform administrator privileges upload malicious files and run system commands on its server.","severity":"high","cvss":7.2}],"timeline":[{"at":"2026-02-24","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"TeamT5 told SecurityWeek the attacks occurred in 2024, affected a few customers and prompted notification and remediation assistance. It attributed them with uncertainty to Chinese groups it calls Slime57 and Slime62.","url":"https://www.securityweek.com/taiwan-security-firm-confirms-flaw-flagged-by-cisa-likely-exploited-by-chinese-apt/","by":"SecurityWeek","patch":null},{"at":"2026-02-22","added":"2026-11-03T22:23:55.101Z","kind":"vendor-revised","text":"TeamT5 said it had helped all affected customers update and that no customer systems remained in service with the affected release.","url":"https://teamt5.org/en/posts/team-t5-cisa-kev/","by":"TeamT5","patch":null},{"at":"2026-02-17","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2024-7694 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40a4268","by":"CISA","patch":null},{"at":"2024-08-12","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"TWCERT/CC published CVE-2024-7694, describing an upload flaw requiring administrator privileges. It specified version 3.5.0 or later, or Hotfix-20240715, as the remedy.","url":"https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html","by":"TWCERT/CC","patch":null},{"at":"2024-07-15","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"TeamT5 published a notice covering ThreatSonar Anti-Ransomware 3.4.5 and earlier and offered Hotfix-240715. It said cloud customers had already been patched on 12 July.","url":"https://teamt5.org/en/support/vulnerability-notification/vulnerability-notice-threat-sonar-anti-ransomware-20240715","by":"TeamT5","patch":"patched"}],"url":"https://hard.fyi/live/teamt5-threatsonar-upload-attacks-feb-2026/","json":"https://hard.fyi/api/live?id=teamt5-threatsonar-upload-attacks-feb-2026"}