Attacks involving critical GFI KerioControl firewall bug reported

Attacks exploiting the vulnerability not only deployed the SPAWN malware previously launched by Chinese state-backed intrusions involving Ivanti Connect Secure bugs but also the novel PHASEJAM and DRYHOOK payloads in an attempt to compromise databases with credentials, API keys, VPN sessions, and certificates, a report from Mandiant researchers revealed.