Microsoft Spots Updated Cryptomining Malware Tool Targeting Linux Systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-2725 | Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE CVE-2019-2725 is an easily exploitable injection flaw (CWE-74) in the Web Services subcomponent of Oracle WebLogic Server within Oracle Fusion Middleware, publicly documented as affecting WebLogic 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.3. It is triggered when an unauthenticated remote attacker sends attacker-controlled XML over HTTP to the WebLogic Web Services async response endpoint (the /_async/AsyncResponseService servlet), which processes the input unsafely. Successful attacks give the attacker takeover of the affected WebLogic server (remote code execution); in the 2019 exploitation wave this was used to install cryptocurrency miners and deploy ransomware. Any organization running affected Oracle WebLogic Server versions is exposed, with the greatest risk where the async/Web Services endpoints are reachable, especially on internet-facing servers. Exploitation is confirmed in the wild: CISA added the CVE to its KEV catalog on 2022-01-10 with ransomware use known and requires applying vendor updates, the EPSS probability of exploitation is 100% (100th percentile), and no public PoC is catalogued. Do: Apply Oracle's updates per vendor instructions: this CVE was fixed by Oracle's April 2019 out-of-band WebLogic patch and is covered by subsequent Critical Patch Updates, so bring affected WebLogic 10.3.6.0/12.1.3.0/12.2.1.x servers to a patched level (CISA KEV requires this action). Until patched, restrict or remove the async response service deployments (wls9_async_response.war / wls_wsee_async_response.war, exposing the /_async/AsyncResponseService endpoint) and keep WebLogic ports off the internet. Also review logs for unsolicited POSTs to /_async/AsyncResponseService and for signs of dropped miners or ransomware payloads. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed WebLogic servers (~30,000+ reported in 2019 internet scans), plus a much larger internal install base | |
| CVE-2022-26134 | Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center Atlassian Confluence Server and Data Center contain an unauthenticated remote code execution flaw caused by improper neutralization of expression-language (OGNL) input (CWE-917): an attacker with network access to the application can submit a crafted request that is evaluated as an expression and executed by the server. Successful exploitation lets a remote, unauthenticated attacker run arbitrary code with the privileges of the Confluence process, without any credentials. All organizations running self-managed Confluence Server or Data Center are affected, particularly instances exposed to the internet; Confluence Cloud is not listed among the affected products. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2022-06-02 with ransomware use marked as known, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile). CVSS has not yet been scored in this data, but the KEV listing and known ransomware use make unpatched, internet-facing instances a top-priority patching target. Do: Immediately upgrade to the patched Confluence release specified in Atlassian's 2022-06-02 security advisory, and until patched follow the CISA required action to block all internet traffic to and from affected instances. Because in-the-wild exploitation and ransomware use are confirmed, also hunt for compromise indicators on both patched and unpatched hosts, such as webshells, unexpected child processes of the Confluence service, and unusual outbound connections. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed instances (public scan counts of roughly 60,000-90,000 Confluence Server/Data Center hosts around the June 2022… |
Full article353 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft’s Security Intelligence team has issued a new warning against a known cloud threat actor (TA) group.
Tracked as 8220 and active since early 2017, the group would have now updated its malware toolset to breach Linux servers in order to install crypto miners as part of a long-running campaign.
“The updates include the deployment of new versions of a cryptominer and an IRC bot, as well the use of an exploit for a recently disclosed vulnerability,” the technology giant wrote in a Twitter thread on Thursday.
“The group has actively updated its techniques and payloads over the last year.”
According to Microsoft, the most recent campaign now targets i686 and x86_64 Linux systems and uses RCE exploits for CVE-2022-26134 (Atlassian Confluence Server) and CVE-2019-2725 (Oracle WebLogic) for initial access.
“After initial access, a loader is downloaded,” explained the security experts. “This loader evades detection by clearing log files and disabling cloud monitoring and security tools. Tamper protection capabilities in Microsoft Defender for Endpoint help protect security settings.”
The loader would then download the pwnRig crpytominer and an IRC bot that runs commands from a command-and-control (C2) server. It would then maintain persistence by creating either a cronjob or a script running every 60 seconds as nohup.
According to Microsoft, the malware also features self-propagating capabilities.
“The loader uses the IP port scanner tool ‘masscan’ to find other SSH servers in the network and then uses the GoLang-based SSH brute force tool ‘spirit’ to propagate. It also scans the local disk for SSH keys to move laterally by connecting to known hosts.”
To protect networks against this threat, Microsoft said organizations should secure systems and servers, apply updates, and use good credential hygiene.
“Microsoft Defender for Endpoint on Linux detects malicious behaviors and payloads related to this campaign.”
The news comes days after Akamai suggested the Atlassian Confluence flaw is currently witnessing 20,000 exploitation attempts per day, launched from about 6,000 IPs.
For context, the number represents a substantial decrease when compared to the peak of 100,000 the company witnessed upon the bug disclosure on June 02 2022.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cryptomining-malware-linux-systems/