Commando Cat Cryptojacking Attacks Target Misconfigured Docker Instances
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-20062 | Unauthenticated Remote Code Execution in ThinkPHP-based noneCms 1.3 NoneCms V1.3, an open-source Chinese CMS built on the ThinkPHP 5.0.x framework, is vulnerable to unauthenticated remote code execution through the framework's URL dispatcher in thinkphp/library/think/App.php. Because the framework's 's' routing parameter can invoke arbitrary framework classes and methods, an attacker can pass a crafted 'filter' value (e.g., s=index/\think\Request/input&filter=phpinfo&data=1) that is applied to the 'data' argument as a callable, executing attacker-chosen PHP functions or code. Successful exploitation gives full code execution on the web server under the application's privileges, enabling web shells, botnet implants, and ransomware staging without any credentials or user interaction. Any internet-facing deployment of noneCms V1.3 — and, more broadly, applications running the affected ThinkPHP 5.0.x framework (the public PoC references 5.0.23) — is exposed. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), EPSS assigns a 99.5% probability of exploitation within 30 days, and headlines note botnets such as Enemybot and Chinese threat actors chaining ThinkPHP RCEs against CMS servers. Do: Apply updates per vendor instructions: upgrade noneCms to the latest release and update the bundled ThinkPHP 5.0.x framework to a patched build. Inspect web server and WAF logs for requests using the s=index/\think\Request/input&filter=... pattern and other ThinkPHP route-invocation payloads, and hunt for web shells or post-exploitation artifacts. Until patched, block or strictly validate the 's' and 'filter' query parameters at a WAF/reverse proxy and limit internet exposure of the application. | 9.8 | 100% | KEV PoC ×2 |
| nicheunknown exact count; plausibly on the order of hundreds to a few thousand self-hosted sites, with at least some internet-exposed instances | |
| CVE-2019-9082 | Unauthenticated RCE in ThinkPHP < 3.2.4 (Open Source BMS, ZzzCMS zzzphp) CVE-2019-9082 is an unauthenticated remote code execution flaw (CWE-94 code injection, CWE-306 missing authentication) in ThinkPHP versions before 3.2.4, as shipped in Open Source BMS v1.1.1 and other ThinkPHP-based products. An attacker triggers it by sending a crafted HTTP GET request to the route public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=<command>, which makes the framework invoke the system function with attacker-controlled arguments. Because no authentication is required, any remote attacker who can reach the web application can execute arbitrary operating-system commands with the privileges of the web server, typically gaining a foothold for data theft, ransomware, or botnet/cryptomining implants. Affected users are operators of ThinkPHP-based sites and applications, specifically ThinkPHP prior to 3.2.4, Open Source BMS v1.1.1, and ZzzCMS zzzphp as listed by CISA. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2021-11-03), has a 97.4% EPSS probability of exploitation within 30 days, and threat-actor activity against old ThinkPHP flaws — including a Chinese threat actor since October 2023 and the DirtyMoe wormable botnet — keeps pressure on unpatched servers. Do: Upgrade ThinkPHP to version 3.2.4 or later (or a currently supported maintained branch) and update Open Source BMS beyond v1.1.1 and zzzphp to vendor-patched releases, per CISA's required action. Check access logs for requests to the invokefunction route (public/?s=index/\think\app/invokefunction with call_user_func_array/system) and hunt for signs of follow-on webshell, botnet, or cryptomining activity, given active abuse by Chinese-linked actors and the DirtyMoe botnet. As interim mitigation, block or restrict the invokefunction route at a WAF/reverse proxy for unauthenticated users; remediation is mandatory under BOD 22-01 because the flaw is in KEV. | 8.8 | 97% | KEV PoC ×3 |
| massOn the order of hundreds of thousands of internet-exposed ThinkPHP instances, plus additional downstream Open Source BMS and zzzphp deployments |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | anondns.net | ry using a curl or wget command from a C&C server ("leetdbs.anondns[.]net/z") by means of a shell script. The binary is suspected t |
Full article440 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 07, 2024Cryptojacking / Vulnerability
The threat actor known as Commando Cat has been linked to an ongoing cryptojacking attack campaign that leverages poorly secured Docker instances to deploy cryptocurrency miners for financial gain.
"The attackers used the cmd.cat/chattr docker image container that retrieves the payload from their own command-and-control (C&C) infrastructure," Trend Micro researchers Sunil Bharti and Shubham Singh said in a Thursday analysis.
Commando Cat, so named for its use of the open-source Commando project to generate a benign container, was first documented earlier this year by Cado Security.
The attacks are characterized by the targeting of misconfigured Docker remote API servers to deploy a Docker image named cmd.cat/chattr, which is then used as a basis to instantiate a container and break out of its confines using the chroot command, and gain access to the host operating system.
The final step entails retrieving the malicious miner binary using a curl or wget command from a C&C server ("leetdbs.anondns[.]net/z") by means of a shell script. The binary is suspected to be ZiggyStarTux, an open-source IRC bot based on the Kaiten (aka Tsunami) malware.
"The significance of this attack campaign lies in its use of Docker images to deploy cryptojacking scripts on compromised systems," the researchers said. "This tactic allows attackers to exploit vulnerabilities in Docker configurations while evading detection by security software."
The disclosure comes as Akamai revealed that years-old security flaws in ThinkPHP applications (e.g., CVE-2018-20062 and CVE-2019-9082) are being exploited by a suspected Chinese-speaking threat actor to deliver a web shell dubbed Dama as part of a campaign that has been underway since October 17, 2023.
"The exploit attempts to retrieve additional obfuscated code from another compromised ThinkPHP server to gain initial foothold," Akamai researchers Ron Mankivsky and Maxim Zavodchik said. "After successfully exploiting the system, the attackers will install a Chinese language web shell named Dama to maintain persistent access to the server."
The web shell is equipped with several advanced capabilities to gather system data, upload files, scan network ports, escalate privileges, and navigate the file system, the latter of which enables threat actors to perform operations like file editing, deletion, and timestamp modification for obfuscation purposes.
"The recent attacks originated by a Chinese-speaking adversary highlight an ongoing trend of attackers using a fully fledged web shell, designed for advanced victim control," the researchers noted. "Interestingly, not all targeted customers were using ThinkPHP, which suggests that the attackers may be indiscriminately targeting a broad range of systems."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/06/commando-cat-cryptojacking-attacks.html