Vulnerabilitycritical
FreakOut! Ongoing Botnet Attack Exploiting Recent Linux Vulnerabilities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-28188 | Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php… | 9.8 | 96% | PoC ×2 | |
| CVE-2020-7961 | Deserialization RCE in Liferay Portal via JSON Web Services | 9.8 | 100% | KEVPoC | KEV |
| CVE-2021-3007 | Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content… | 9.8 | 75% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gxbrowser.net | on installed. "The malware, downloaded from the site hxxp://gxbrowser[.]net, is an obfuscated Python script which contains polymorphi |
| url | http://gxbrowser.net | d version installed. "The malware, downloaded from the site hxxp://gxbrowser[.]net, is an obfuscated Python script which contains polymorphi |
From the original article
2 min read at thehackernews.com
An ongoing malware campaign has been found exploiting recently disclosed vulnerabilities in network-attached storage (NAS) devices running on Linux systems to co-opt the machines into an IRC botnet for launching distributed denial-of-service (DDoS) attacks and mining Monero cryptocurrency.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.