New Cryptojacking Malware Targeting Apache, Oracle, Redis Servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-3088 | Unauthenticated Arbitrary File Upload Leading to RCE in Apache ActiveMQ Fileserver CVE-2016-3088 is an improper input-validation flaw (CWE-434) in the Fileserver web application bundled with Apache ActiveMQ 5.x, which lets anyone upload files to the broker without authenticating. An attacker triggers it by sending an HTTP PUT request that uploads an attacker-controlled file (typically a crafted JSP) and then an HTTP MOVE request that relocates that file into a directory served by the embedded web console, where the Jetty web container executes it. This yields unauthenticated remote code execution with the privileges of the ActiveMQ process (CVSS 3.1: 9.8 critical, network-vector, no privileges or user interaction required). Any deployment of ActiveMQ 5.x prior to 5.14.0 is affected, and internet-exposed brokers are the most directly at risk. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10), has a public PoC on Exploit-DB, a 98.5% EPSS score, and has been used by real-world malware such as the XBash ransomware/miner and the Pro-Ocean crypto-mining campaign. Do: Upgrade to Apache ActiveMQ 5.14.0 or later, ideally a current supported release per vendor instructions. If upgrading is not immediately possible, disable or remove the Fileserver web application or restrict network access to the embedded Jetty web console (default TCP 8161) so it is not internet-exposed. Check web-access logs for suspicious HTTP PUT/MOVE requests against /fileserver/ and for unexpected JSP or script files in the web console directories, which would indicate prior compromise. | 9.8 | 99% | KEV PoC |
| largetens of thousands of internet-exposed ActiveMQ brokers (public scans index on the order of 10,000-100,000 exposed instances) | |
| CVE-2017-10271 | Unauthenticated Remote Code Execution in Oracle WebLogic Server Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue. Do: Apply Oracle's updates for CVE-2017-10271 per Oracle's instructions (the vendor's required action for this KEV entry). Until patched, restrict network access to WebLogic HTTP/admin ports from untrusted networks and limit or remove access to the XML/WSAT endpoints used for exploitation. Because ransomware operators are known to exploit this flaw, review internet-exposed WebLogic instances for signs of compromise, such as unexpected processes, new scheduled tasks, webshells, or ransomware artifacts. | 7.5 | 100% | KEV ransomware PoC ×3 |
| large≈tens of thousands of internet-exposed WebLogic Server instances (total deployed install base likely higher, including internal-only servers) |
Full article455 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 01, 2021
A financially-motivated threat actor notorious for its cryptojacking attacks has leveraged a revised version of their malware to target cloud infrastructures using vulnerabilities in web server technologies, according to new research.
Deployed by the China-based cybercrime group Rocke, the Pro-Ocean cryptojacking malware now comes with improved rootkit and worm capabilities, as well as harbors new evasion tactics to sidestep cybersecurity companies' detection methods, Palo Alto Networks' Unit 42 researchers said in a Thursday write-up.
"Pro-Ocean uses known vulnerabilities to target cloud applications," the researchers detailed. "In our analysis, we found Pro-Ocean targeting Apache ActiveMQ (CVE-2016-3088), Oracle WebLogic (CVE-2017-10271) and Redis (unsecure instances)."
"Once installed, the malware kills any process that uses the CPU heavily, so that it's able to use 100% of the CPU and mine Monero efficiently."
First documented by Cisco Talos in 2018, Rocke has been found to distribute and execute crypto-mining malware using a varied toolkit that includes Git repositories and different payloads such as shell scripts, JavaScript backdoors, as well as portable executable files.
While prior variants of the malware banked on the capability to target and remove cloud security products developed by Tencent Cloud and Alibaba Cloud by exploiting flaws in Apache Struts 2, Oracle WebLogic, and Adobe ColdFusion, Pro-Ocean has expanded the breadth of those attack vectors by aiming at Apache ActiveMQ, Oracle WebLogic, and Redis servers.
Besides its self-spreading features and better hiding techniques that allow it to stay under the radar and spread to unpatched software on the network, the malware, once installed sets about uninstalling monitoring agents to dodge detection and removing other malware and miners from the infected systems.
To achieve this, it takes advantage of a native Linux feature called LD_PRELOAD to mask its malicious activity, a library named Libprocesshider to stay hidden, and uses a Python infection script that takes the machine's public IP to infect all machines in the same 16-bit subnetwork (e.g., 10.0.X.X).
Pro-Ocean also works to eliminate competition by killing other malware and miners, including Luoxk, BillGates, XMRig, and Hashfish, running on the compromised host. In addition, it comes with a watchdog module written in Bash that ensures persistence and takes care of terminating all processes that utilize more than 30% of the CPU with the goal of mining Monero efficiently.
"This malware is an example that demonstrates that cloud providers' agent-based security solutions may not be enough to prevent evasive malware targeted at public cloud infrastructure," Unit 42 researcher Aviv Sasson said. "This sample has the capability to delete some cloud providers' agents and evade their detection."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/02/new-cryptojacking-malware-targeting.html