DirtyMoe Botnet Gains New Exploits in Wormable Module to Spread Rapidly

CVE-2017-0144 is a remote code execution flaw in the SMBv1 server component of Microsoft Windows, commonly known as EternalBlue, and one of the SMB flaws fixed by Microsoft in the March 2017 MS17-010 bulletin. An attacker who can reach the SMB service over the network sends specially crafted packets that trigger memory corruption in the SMBv1 implementation, gaining the ability to execute arbitrary code on the target without user interaction. Successful exploitation yields full system compromise and has been heavily weaponized for wormable spread and ransomware delivery, notably via the leaked NSA exploit and in the WannaCry/NotPetya-era outbreaks, and the flaw has repeatedly been bundled into botnets and ransomware tooling since. Anyone running unpatched Windows Vista SP2 through Windows 10 1607 / Windows Server 2016 with SMBv1 enabled is affected, as are Siemens medical and laboratory devices (ACUSON ultrasound, syngo SC2000, Tissue Preparation System, VERSANT kPCR systems) whose firmware depends on SMBv1. Exploitation is actively ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with known ransomware use, carries a 99.2% EPSS exploitation probability (100th percentile), and multiple public exploits and PoCs are available.

Do: Apply the Microsoft MS17-010 (March 2017) security updates on every listed Windows version and the corresponding Siemens firmware updates for ACUSON, syngo SC2000, Tissue Preparation System, and VERSANT kPCR devices, per CISA's required action to apply vendor updates. Where patching is not yet possible, disable SMBv1 or block inbound TCP 445 (and UDP 137/138) at network boundaries and isolate legacy/medical systems from the internet. Sweep exposed and legacy hosts for compromise indicators, including DOUBLEPULSAR implants delivered over SMB, as public tooling for detecting and neutralizing this implant is available.

CVE-2018-0147 is a critical (CVSS 9.8) Java deserialization flaw in Cisco Secure Access Control System (ACS), Cisco's enterprise AAA appliance used for TACACS+/RADIUS network access control. The vulnerability arises from insecure deserialization of user-supplied content: an unauthenticated, remote attacker can trigger it by sending a crafted serialized Java object to the affected software. Successful exploitation allows the attacker to execute arbitrary commands on the device with root privileges, giving full control of the AAA appliance. All Cisco ACS releases prior to release 5.8 patch 9 are affected. The flaw is confirmed exploited in the wild - it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25 and recent reporting notes old Cisco vulnerabilities being actively exploited - though no public proof-of-concept is known and ransomware use is undetermined.

Do: Upgrade affected ACS deployments to release 5.8 patch 9 or later per Cisco's instructions (Bug ID CSCvh25988) and treat KEV-listed devices as a patching priority; since ACS is end-of-life, plan migration to Cisco ISE for long-term remediation. In the meantime, restrict network reachability of ACS management interfaces and verify installed ACS version/patch level via the appliance admin console.

An elevation of privilege vulnerability exists in the Windows kernel's Win32k component, which fails to properly handle objects in memory (an uninitialized-variable condition). A local attacker who can already execute limited code on a target machine can trigger the flaw to gain kernel-level execution and elevate to SYSTEM privileges, giving full control of the host. Affected platforms are Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 1507 and 1607, and Windows Server 2008, 2012 and 2016. The bug was patched in Microsoft's December 2019 Patch Tuesday after being actively exploited as a zero-day, including in the WizardOpium campaign attributed to a North Korea-linked actor. It is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-10, with known ransomware use) and carries a high EPSS of 74.3%.

Do: Apply the December 2019 security updates (or later cumulative updates) from Microsoft per CISA's required action. Because Windows 7/8.1 and Server 2008/2012 are past end of support and Server 2016 support is winding down, prioritize migration to supported Windows versions. Hunt for signs of local privilege escalation and follow-on activity, since this bug was used as a zero-day and appears in ransomware attack chains.

CVE-2019-2725 is an easily exploitable injection flaw (CWE-74) in the Web Services subcomponent of Oracle WebLogic Server within Oracle Fusion Middleware, publicly documented as affecting WebLogic 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.3. It is triggered when an unauthenticated remote attacker sends attacker-controlled XML over HTTP to the WebLogic Web Services async response endpoint (the /_async/AsyncResponseService servlet), which processes the input unsafely. Successful attacks give the attacker takeover of the affected WebLogic server (remote code execution); in the 2019 exploitation wave this was used to install cryptocurrency miners and deploy ransomware. Any organization running affected Oracle WebLogic Server versions is exposed, with the greatest risk where the async/Web Services endpoints are reachable, especially on internet-facing servers. Exploitation is confirmed in the wild: CISA added the CVE to its KEV catalog on 2022-01-10 with ransomware use known and requires applying vendor updates, the EPSS probability of exploitation is 100% (100th percentile), and no public PoC is catalogued.

Do: Apply Oracle's updates per vendor instructions: this CVE was fixed by Oracle's April 2019 out-of-band WebLogic patch and is covered by subsequent Critical Patch Updates, so bring affected WebLogic 10.3.6.0/12.1.3.0/12.2.1.x servers to a patched level (CISA KEV requires this action). Until patched, restrict or remove the async response service deployments (wls9_async_response.war / wls_wsee_async_response.war, exposing the /_async/AsyncResponseService endpoint) and keep WebLogic ports off the internet. Also review logs for unsolicited POSTs to /_async/AsyncResponseService and for signs of dropped miners or ransomware payloads.

CVE-2019-9082 is an unauthenticated remote code execution flaw (CWE-94 code injection, CWE-306 missing authentication) in ThinkPHP versions before 3.2.4, as shipped in Open Source BMS v1.1.1 and other ThinkPHP-based products. An attacker triggers it by sending a crafted HTTP GET request to the route public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=<command>, which makes the framework invoke the system function with attacker-controlled arguments. Because no authentication is required, any remote attacker who can reach the web application can execute arbitrary operating-system commands with the privileges of the web server, typically gaining a foothold for data theft, ransomware, or botnet/cryptomining implants. Affected users are operators of ThinkPHP-based sites and applications, specifically ThinkPHP prior to 3.2.4, Open Source BMS v1.1.1, and ZzzCMS zzzphp as listed by CISA. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2021-11-03), has a 97.4% EPSS probability of exploitation within 30 days, and threat-actor activity against old ThinkPHP flaws — including a Chinese threat actor since October 2023 and the DirtyMoe wormable botnet — keeps pressure on unpatched servers.

Do: Upgrade ThinkPHP to version 3.2.4 or later (or a currently supported maintained branch) and update Open Source BMS beyond v1.1.1 and zzzphp to vendor-patched releases, per CISA's required action. Check access logs for requests to the invokefunction route (public/?s=index/\think\app/invokefunction with call_user_func_array/system) and hunt for signs of follow-on webshell, botnet, or cryptomining activity, given active abuse by Chinese-linked actors and the DirtyMoe botnet. As interim mitigation, block or restrict the invokefunction route at a WAF/reverse proxy for unauthenticated users; remediation is mandatory under BOD 22-01 because the flaw is in KEV.