Malwarehigh
10-Year-Old 'RUBYCARP' Romanian Hacker Group Surfaces with Botnet
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-3129 | Unauthenticated RCE in Laravel Ignition error-page package (facade/ignition) | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | juicessh.pro | ated to comprise over 600 hosts, with the IRC server ("chat.juicessh[.]pro") created on May 1, 2023. It heavily relies on IRC for ge |
From the original article
2 min read at thehackernews.com
A threat group of suspected Romanian origin called RUBYCARP has been observed maintaining a long-running botnet for carrying out crypto mining, distributed denial-of-service (DDoS), and phishing attacks. The group, believed to be active for at least 10 years, employs the botnet for financial gain, Sysdig said in a report shared with The Hacker News.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.