TeamT5 ThreatSonar Anti-Ransomware upload flaw CVE-2024-7694 exploited; fixes available
Attackers used a flaw in TeamT5 ThreatSonar Anti-Ransomware to run commands on its server after gaining administrator access. Update to 3.5.0 or later, or apply Hotfix-20240715. TeamT5 says all affected customers have updated.
If your business or family office uses ThreatSonar Anti-Ransomware, ask IT to confirm version 3.5.0 or later, or installation of Hotfix-20240715. Families who do not use this organisational security product have nothing to update for this flaw.
What’s happening
CVE-2024-7694 affects TeamT5 ThreatSonar Anti-Ransomware 3.4.5 and earlier, an organisational security product. An attacker who already has administrator privileges on its management platform can upload a malicious file and run commands on the server; opening a file is not required. TWCERT/CC specifies version 3.5.0 or later, or Hotfix-20240715, as the fix. TeamT5’s linked July 2024 notice instead describes account-creation and password-change weaknesses, so the descriptions differ, although its February 2026 statement identifies that notice as the relevant remediation advisory. CISA listed the CVE as exploited on 17 February 2026. TeamT5 subsequently told SecurityWeek that the observed attacks occurred in 2024 against a few customers, who were notified and helped to patch. It considered Chinese groups Slime57 and Slime62 the likely attackers. On 22 February, TeamT5 said all affected customers had migrated from vulnerable releases. No later incident development was found in the search through 3 November 2026.
- What
- Flaw
- Affects
- TeamT5 ThreatSonar Anti-Ransomware
- Affected
- TeamT5 ThreatSonar Anti-Ransomware 3.4.5 and earlier
- Fixed in
- ThreatSonar Anti-Ransomware 3.5.0 or later
Hotfix-20240715 for affected installations - Since
- 17 Feb 2026
- Closed
- 24 Feb 2026
Timeline
- Update
TeamT5 told SecurityWeek the attacks occurred in 2024, affected a few customers and prompted notification and remediation assistance. It attributed them with uncertainty to Chinese groups it calls Slime57 and Slime62.
- Vendor revised
TeamT5 said it had helped all affected customers update and that no customer systems remained in service with the affected release.
- CISA added
CISA added CVE-2024-7694 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.
- Made public
TWCERT/CC published CVE-2024-7694, describing an upload flaw requiring administrator privileges. It specified version 3.5.0 or later, or Hotfix-20240715, as the remedy.
- New fixFixed
TeamT5 published a notice covering ThreatSonar Anti-Ransomware 3.4.5 and earlier and offered Hotfix-240715. It said cloud customers had already been patched on 12 July.
Sources
- [Vulnerability Notice - 20240715] ThreatSonar Anti-RansomwareTeamT5 · 15 July 2024
- TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File UploadTWCERT/CC · 12 Aug 2024
- TeamT5 Statement Regarding CISA’s KEV Catalog UpdatesTeamT5 · 22 Feb 2026
- CISA Adds Four Known Exploited Vulnerabilities to CatalogCISA · 17 Feb 2026
- CISA: Hackers Exploiting Vulnerability in Product of Taiwan Security Firm TeamT5SecurityWeek · 18 Feb 2026
- Taiwan Security Firm Confirms Flaw Flagged by CISA Likely Exploited by Chinese APTsSecurityWeek · 24 Feb 2026