Vulnerabilityhigh

Muhstik Botnet Targeting Redis Servers Using Recently Disclosed Vulnerability

Security Affairsby @securityaffairsMar 28, 2022 · 20:43 UTC (Mar 28, 2022)2 min read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-0543 CVE-2019-2725 CVE-2017-10271 CVE-2018-7600

Tags: cve-2022-0543 cve-2019-2725 cve-2017-10271 cve-2018-7600 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2017-10271	Unauthenticated Remote Code Execution in Oracle WebLogic Server	7.5	100%	KEVRansomwarePoC ×3	Oct 19, 2017 KEV Feb 10, 2022
CVE-2018-7600	Unauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2)	9.8	100%	KEVRansomwarePoC ×4	Mar 29, 2018 KEV Nov 3, 2021
CVE-2019-2725	Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE	9.8	100%	KEVRansomwarePoC	Apr 26, 2019 KEV Jan 10, 2022
CVE-2022-0543	Lua Sandbox Escape in Debian-packaged Redis Enables Unauthenticated RCE	10.0	99%	KEVPoC	Feb 18, 2022 KEV Mar 28, 2022

From the original article

2 min read at securityaffairs.com

The Muhstik botnet has been observed targeting Redis servers exploiting the recently disclosed CVE-2022-0543 vulnerability. Muhstik is a botnet that is known to use web application exploits to compromise IoT devices, it has been around for at least 2018. Botnet operators monetize their efforts via XMRig combined with DDoS-for-hire services.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.