Apache Tomcat Vulnerability “Ghostcat” Attracting Threat Actor Attention

Flashpoint analysts observed that a vulnerability identified as CVE-2020-1938 has been attracting threat actor attention since its public disclosure on February 20, 2020. Originally discovered by Chinese security firm Chaitin Technologies, the vulnerability was reported to the Chinese National Vulnerability Database (CNVD) on January 6, 2020, over a month prior to its public disclosure.

March 20, 2020