New NextCry Ransomware targets Nextcloud instances on Linux servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-11043 | Buffer Overflow in PHP-FPM Enables Unauthenticated RCE on nginx Stacks CVE-2019-11043 is a buffer overflow (CWE-120/CWE-787) in PHP's FastCGI Process Manager (PHP-FPM) affecting PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11. In certain FPM configurations — commonly web servers such as nginx that split PATH_INFO via fastcgi_split_path_info without validating that the requested PHP script exists — an unauthenticated remote attacker can send a crafted request that makes PHP-FPM write past allocated buffers into the space reserved for FCGI protocol data. This corruption of the FastCGI protocol state allows the attacker to execute arbitrary code with the privileges of the PHP-FPM worker on the hosting web server. Anyone running a vulnerable PHP-FPM behind an affected configuration is exposed, including Linux distribution packages (Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, Red Hat Software Collections), Tenable.sc deployments, and QNAP NAS devices running vulnerable PHP. The flaw is being actively exploited in the wild — it is in CISA's KEV with known ransomware use (including campaigns such as NextCry targeting Nextcloud instances on Linux servers) — and a public proof-of-concept exploit exists, consistent with its 99.8% EPSS score. Do: Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later (or apply your distribution's/vendor's patched packages — CISA's KEV required action is to apply updates per vendor instructions; QNAP users should apply QNAP's released updates). As an interim mitigation, harden the nginx fastcgi_split_path_info configuration (prefix the regex with '^' and use try_files to confirm the script exists) or disable PATH_INFO where it is not needed. Prioritize internet-facing web servers, shared hosting, and QNAP/Nextcloud instances for patching and check them for compromise, given active ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×3 |
| masson the order of millions of sites/servers plausibly exposed (PHP runs on a large majority of websites and nginx+PHP-FPM is among the most common production… |
Full article627 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 18, 2019
NextCry is a new ransomware that was spotted by researchers while encrypting data on Linux servers in the wild.
Security experts spotted new ransomware dubbed NextCry that targets the clients of the NextCloud file sync and share service.
The name comes from the extensions the ransomware appends to the filenames of encrypted files. The malicious code targets Nextcloud instances and it is currently undetected by antivirus engines.
“xact64, a Nextcloud user, posted on the BleepingComputer forum some details about the malware in an attempt to find a way to decrypt personal files.” reads the post published by BleepingComputer that reported the news.
The user explained that even if his system was backed up, the synchronization process had started to update files on a laptop with the encrypted version on the server.
“I realized immediately that my server got hacked and those files got encrypted.” said xact64. “The first thing I did was pull the server to limit the damage that was being done (only 50% of my files got encrypted)”
The user has provided the case SHA1 to BleepingComputer and the popular malware researcher Michael Gillespie analyzed it confirming that the threat is new and uses Base64 to encode the file names. Gillespie added that the ransomware uses the AES-256 algorithm to encrypt the files and that the key is encrypted with an RSA-2048 public key embedded in the code of the ransomware.
NextCry is a Python script that has been compiled in a Linux ELF binary using the pyInstaller.
The ransomware demands a ransom of BTC 0.025 (roughly $210 at the time of writing). The analysis of the balance for the bitcoin wallet provided by crooks revealed that no one has paid the ransom until now.
Below the ransom note dropped by the ransomware after the files have been encrypted.
“YOU HAVE BEEN HACKED YOUR FILES HAVE BEEN ENCRYPTED USING A STRONG AES-256 ALGORITHM – SEND 0.025 BTC TO THE FOLLOWING WALLET wallet address AND AFTER PAY CONTACT their email TO RECOVER THE KEY NECESSARY TO DECRYPT YOUR FILES”
The analysis of the compiled script extracted by another member of the BleepingComputer forum confirmed that the malicious code was designed to targets NextCloud users.
Once executed, the NextCry ransomware reads the NextCloud service’s config.php file in order to find the NextCloud file share and sync data directory. Then the malware deletes some folders that could be used to restore files and then encrypts all the files in the data directory.
Four days ago, another user that goes online with the handle ‘alexpw‘ published on the platform’s support page a message that describes the way his instance, running the latest version of the software, was infected. According to ‘ialexpw‘, he had been locked via SSH.
“Just a warning. It seems there’s a vuln somewhere as my instance of NextCloud got taken over today. My server was locked down already, using SSH keys and NextCloud was up to date.” wrote the users.
The description shared by Alex suggests that attackers have exploited some vulnerabilities in the server.
On October 24, Nextcloud released an urgent alert for the CVE-2019-11043 RCE in NGINX, experts warn of the availability of a public exploit for the issue.
“In the last 24 hours, a new security risk has emerged around NGINX, documented in CVE-2019-11043. This exploit allows for remote code execution on some NGINX and php–fpm configurations. If you do not run NGINX, this exploit does not effect you.” reads the alert.
“Unfortunately the default Nextcloud NGINX configuration is also vulnerable to this attack.”
Nextcloud admins are recommended to upgrade their PHP packages and NGINX configuration file to the latest version.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – NextCry ransomware, malware)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/94004/malware/nextcry-ransomware-nextcloud-instances.html