Hackers Exploit Apache HTTP Server Flaw to Deploy Linuxsys Cryptocurrency Miner
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-0688 | RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys CVE-2020-0688 is a remote code execution vulnerability in Microsoft Exchange Server caused by the validation key not being uniquely created at install time, leaving deployments with a predictable, shared key (CWE-287, improper authentication). A remote attacker who can reach an affected Exchange server and knows the common install-time key can supply maliciously crafted, cryptographically signed payloads that the server trusts, triggering code execution without needing per-server secrets. Successful exploitation gives the attacker code execution on the Exchange server, which can be used to access mail data, move laterally, and stage follow-on activity; CISA notes known use in ransomware campaigns. All organizations running the affected on-premises Microsoft Exchange Server are in scope per CISA's listing, though the affected version range is not specified in the source data. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2021-11-03 with known ransomware use, and EPSS rates 30-day exploitation probability at 100% (top percentile). Do: Apply Microsoft's Exchange security updates addressing CVE-2020-0688 (released in February 2020) to every on-premises Exchange server, per CISA's required action. As an interim mitigation, configure a unique ASP.NET machineKey in each Exchange server's web.config instead of the default shared install-time key, and hunt for indicators of exploitation given the known ransomware use. | 8.8 | 100% | KEV ransomware PoC ×2 |
| masshundreds of thousands of on-premises Exchange servers (≈500,000) | |
| CVE-2021-41773 | Path Traversal to RCE in Apache HTTP Server 2.4.49 Apache HTTP Server contains a path traversal flaw (CWE-22) that lets crafted HTTP requests reach files outside directories configured via Alias-like directives. When files outside those aliased directories are not protected by the default 'require all denied' policy, attackers can read arbitrary files outside the intended root, and if CGI scripts are enabled the traversal can be escalated to remote code execution under the web server account. Anyone running an affected Apache HTTP Server release with such a configuration is exposed; the initial 2.4.50 patch was incomplete, so the flaw's full remediation is tracked under CVE-2021-42013. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days (100th percentile). Do: Upgrade to Apache HTTP Server 2.4.51 or later; do not stop at 2.4.50, since its fix was incomplete (see CVE-2021-42013). As an interim mitigation, ensure directories referenced by Alias-like directives are covered by 'require all denied' and disable or restrict CGI (mod_cgi/mod_cgid) on traversable paths. Review access logs for traversal patterns such as /icons/../ and unexpected CGI invocations, and hunt for webshells or ransomware staging given the known ransomware use. | 9.8 | 100% | KEV ransomware PoC ×6 |
| masson the order of 100,000+ internet-exposed Apache servers | |
| CVE-2023-22527 | Unauthenticated OGNL Template Injection RCE in Atlassian Confluence Data Center/Server Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability (CWE-74) in which attacker-controlled input is evaluated by the application as an OGNL expression. A remote, unauthenticated attacker can trigger the flaw by sending a crafted HTTP request that injects OGNL expressions, which the server then executes. Successful exploitation leads to remote code execution on the host running Confluence, giving the attacker control of the system without any credentials. Any organization running self-hosted Confluence Data Center or Server is potentially affected — the available data does not specify version ranges, so operators should consult Atlassian's advisory — with internet-facing instances at highest risk. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-24 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile). Do: Patch to the fixed release specified in Atlassian's advisory immediately, prioritizing internet-exposed instances, since the flaw is in CISA's KEV with known ransomware use and carries a 100% EPSS. If patching is not immediately possible, apply the vendor's mitigations per the KEV required action — or discontinue/restrict use — for example by limiting unauthenticated access to Confluence from the internet. Review Confluence access and application logs for anomalous unauthenticated requests and indicators of command execution or ransomware activity. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed Confluence instances (order of 10,000–100,000) | |
| CVE-2023-34960 | A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. NVD description · AI analysis pending | 9.8 | 99% |
| — | ||
| CVE-2023-38646 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privil Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2. NVD description · AI analysis pending | 9.8 | 99% |
| — | ||
| CVE-2024-0012 +1 in the same advisory: …9474 | Authentication Bypass in Palo Alto Networks PAN-OS Management Interface CVE-2024-0012 is a critical authentication bypass (CWE-306) in the web management interface of Palo Alto Networks PAN-OS that lets an unauthenticated attacker with network access to that interface gain full PAN-OS administrator privileges. It is triggered simply by sending requests to an exposed management web interface, with no credentials or user interaction required. Once inside, the attacker can perform administrative actions, tamper with device configuration, and chain the bug with the related privilege escalation flaw CVE-2024-9474 for deeper compromise. Only PAN-OS 10.2, 11.0, 11.1 and 11.2 are affected; Cloud NGFW and Prisma Access are not, and risk is greatly reduced when the management interface is restricted to trusted internal IP addresses per vendor best practice. The flaw is being actively exploited: it was added to CISA KEV on 2024-11-18 with known ransomware use, and public reporting describes an ongoing campaign that has compromised more than 2,000 Palo Alto devices using this bug chained with CVE-2024-9474. Do: Upgrade PAN-OS 10.2, 11.0, 11.1 and 11.2 deployments to the patched releases listed in the vendor advisory (security.paloaltonetworks.com/CVE-2024-0012), ensuring the chained privilege escalation bug CVE-2024-9474 is also addressed. Until patched, never expose the management web interface to untrusted networks or the internet, and restrict access to trusted internal IP addresses only. Review device logs and configurations for signs of compromise (unexpected admin activity or configuration changes) and hunt for persistence on any internet-exposed device. | 9.3 group max | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed PAN-OS management interfaces, with 2,000+ devices already confirmed compromised | |
| CVE-2024-36401 | Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection OSGeo GeoServer ships the GeoTools library, which evaluates feature property names directly as XPath expressions without proper neutralization (CWE-95), so attacker-supplied input is executed as code rather than treated as data. A remote, unauthenticated attacker triggers the flaw by sending specially crafted requests to a GeoServer service, causing the injected expression to be evaluated in the server's context. Successful exploitation results in remote code execution on the host running GeoServer, giving the attacker control over the mapping server and any data or credentials it can reach. Any organization running GeoServer is affected, and the underlying GeoTools flaw also extends to dependent applications such as GeoNetwork, which shipped its own fix for an unauthenticated RCE chain affecting government geoportal backends. The flaw is being actively exploited: it was added to CISA KEV on 2024-07-15, and EPSS assigns a 99.8% probability of exploitation within 30 days. Do: Upgrade GeoServer to the fixed releases identified in the OSGeo advisory (2.23.6, 2.24.4 or 2.25.2, or later); where upgrading is not immediately possible, restrict access to GeoServer's public endpoints per vendor mitigations or discontinue use of the product per the KEV required action. Organizations running GeoNetwork or other GeoTools-based applications should apply those vendors' fixes as well. Given active exploitation, hunt for signs of compromise such as unexpected child processes spawned by the GeoServer Java process, new files or services on the host, and unusual map/feature service request patterns. | 9.8 | 100% | KEV PoC ×3 |
| largeTens of thousands of internet-exposed instances (roughly 20,000-40,000 GeoServer endpoints visible in public internet scans), with substantially more internal… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | repositorylinux.com | following the exploitation of the flaw was downloaded from "repositorylinux[.]com," with comments in the source code written in Sundanese, |
| domain | repositorylinux.org | .177[.]152 , is designed to drop a next-stage payload from "repositorylinux[.]org" using curl or wget. The payload is a shell script that's |
Full article1,180 words · extracted from thehackernews.com · click to collapse
Cybersecurity researchers have discovered a new campaign that exploits a known security flaw impacting Apache HTTP Server to deliver a cryptocurrency miner called Linuxsys.
The vulnerability in question is CVE-2021-41773 (CVSS score: 7.5), a high-severity path traversal vulnerability in Apache HTTP Server version 2.4.49 that could result in remote code execution.
"The attacker leverages compromised legitimate websites to distribute malware, enabling stealthy delivery and evasion of detection," VulnCheck's Jacob Baines said in a report shared with The Hacker News.
The infection sequence, observed earlier this month and originating from an Indonesian IP address 103.193.177[.]152, is designed to drop a next-stage payload from "repositorylinux[.]org" using curl or wget.
The payload is a shell script that's responsible for downloading the Linuxsys cryptocurrency miner from five different legitimate websites, suggesting that the threat actors behind the campaign have managed to compromise third-party infrastructure to facilitate the distribution of the malware.
"This approach is clever because victims connect to legitimate hosts with valid SSL certificates, making detection less likely," VulnCheck noted. "Additionally, it provides a layer of separation for the downloader site ('repositorylinux[.]org') since the malware itself isn't hosted there."
The sites also host another shell script named "cron.sh" that ensures that the miner is launched automatically upon a system reboot. Cybersecurity firm said it also identified two Windows executables on the hacked sites, raising the possibility that the attackers are also going after Microsoft's desktop operating system.
It's worth noting that attacks distributing the Linuxsys miner have previously exploited a critical security flaw in OSGeo GeoServer GeoTools (CVE-2024-36401, CVSS score: 9.8), as documented by Fortinet FortiGuard Labs in September 2024.
Interestingly, the shell script dropped following the exploitation of the flaw was downloaded from "repositorylinux[.]com," with comments in the source code written in Sundanese, an Indonesian language. The same shell script has been detected in the wild as far back as December 2021.
Some of the other vulnerabilities exploited to deliver the miner in recent years include -
- CVE-2023-22527, a template injection vulnerability in Atlassian Confluence Data Center and Confluence Server
- CVE-2023-34960, a command injection vulnerability in Chamilo Learning Management Systems (LMS)
- CVE-2023-38646, a command injection vulnerability in Metabase
- CVE-2024-0012 and CVE-2024-9474, are authentication bypass and privilege escalation vulnerabilities in Palo Alto Networks firewalls
"All of this indicates that the attacker has been conducting a long-term campaign, employing consistent techniques such as n-day exploitation, staging content on compromised hosts, and coin mining on victim machines," VulnCheck said.
"Part of their success comes from careful targeting. They appear to avoid low interaction honeypots and require high interaction to observe their activity. Combined with the use of compromised hosts for malware distribution, this approach has largely helped the attacker avoid scrutiny."
The discovery of Linuxsys miner attacks coincides with a new campaign associated with the H2Miner cryptocurrency mining botnet that delivers Kinsing, a remote access trojan (RAT) commonly used to deliver mining malware by targeting a wide variety of Linux-based infrastructure systems.
What makes the attack chain stand out is that it also delivers a Visual Basic Script-based variant of Lcryx ransomware, called Lcrypt0rx, marking the first documented instance of operational overlap between the two malware families.
"Lcryx is a relatively new VBScript-based ransomware strain first observed in November 2024," security researcher Akshat Pradhan said. "This family exhibits several unusual characteristics that suggest it may have been generated using artificial intelligence."
The attacks involve the use of a shell script that terminates processes related to security tools, databases, and other user applications before dropping Kinsing, which then delivers the XMRig miner. It's also designed to kill competing miner processes that may be already running on compromised hosts.
The Lcrypt0rx artifact, for its part, makes Windows Registry modifications to disable the execution of critical tools like System Configuration Utility, Group Policy Editor, Process Explorer, and System Settings Utility. It also turns off security software from Microsoft, Bitdefender, and Kaspersky, and attempts to overwrite the Master Boot Record (MBR) in a destructive move that's meant to render the system unbootable.
In an interesting twist, Lcrypt0rx downloads additional payloads onto the compromised machine prior to encryption, including the same XMRig payload dropped by H2Miner, Cobalt Strike, ConnectWise ScreenConnect, information stealers like Lumma and RustyStealer, and an injector that serves DCRat.
Once the files are encrypted, a ransom note is dropped in several locations, urging victims to pay $1,000 in cryptocurrency within three days, or risk getting their files leaked.
"Despite these actions, the ransomware does not transmit or store the encryption keys locally or remotely," Pradhan said. "Combined with the use of simple XOR encryption, this makes recovery trivial through basic cryptanalysis. The lack of key management, combined with the presence of scare tactics and superficial ransom demands, suggests that Lcrypt0rx operates more as scareware than a serious ransomware threat."
This behavior, Fortinet FortiGuard Labs theorized, is either a collaboration to maximize financial gain, or that it's the work of H2Miner operators themselves or a way for them to use it as a distraction from spotting the mining activity.
The campaign signals the ongoing commodification of cybercrime, as access to pre-built tools and AI-generated code can further lower the barrier to entry, enabling even threat actors with little-to-no technical expertise to launch high-impact attacks at scale.
"Both the H2Miner and Lcrypt0rx chains converge on the deployment of Monero miners, a hallmark of resource hijacking campaigns," Fortinet said. "In cloud environments, this results in significant financial impact, as compromised systems incur elevated compute costs, degraded performance, and increased operational risk."
Exchange Servers Targeted by GhostContainer Backdoor
The development comes as Kaspersky disclosed details of a campaign that's targeting government entities in Asia, likely with a N-day security flaw in Microsoft Exchange Server, to deploy a bespoke backdoor dubbed GhostContainer. It's suspected that the attacks may have exploited a now-patched remote code execution bug in Exchange Server (CVE-2020-0688, CVSS score: 8.8).
The "sophisticated, multi-functional backdoor" can be "dynamically extended with arbitrary functionality through the download of additional modules," the Russian company said, adding "the backdoor grants the attackers full control over the Exchange server, allowing them to execute a range of malicious activities."
The malware is equipped to parse instructions that can execute shellcode, download files, read or delete files, run arbitrary commands, and load additional .NET byte code. It also incorporates a web proxy and tunneling module.
It's suspected that the activity may have been part of an advanced persistent threat (APT) campaign aimed at high-value organizations, including high-tech companies, in Asia.
Not much is known about who is behind the attacks, although they are assessed to be highly skilled owing to their in-depth understanding of Microsoft Exchange Server and their ability to transform publicly available code into advanced espionage tools.
"The GhostContainer backdoor does not establish a connection to any [command-and-control] infrastructure," Kaspersky said. "Instead, the attacker connects to the compromised server from the outside, and their control commands are hidden within normal Exchange web requests."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/07/hackers-exploit-apache-http-server-flaw.html