Nansh0u campaign already infected 50K MS
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-4113 | Local Privilege Escalation in Microsoft Win32k Kernel Component (CVE-2014-4113) CVE-2014-4113 is a privilege escalation flaw (CWE-264) in Win32k, the kernel-mode component of Microsoft Windows; Microsoft's description is unspecified, but the flaw allows an attacker to gain elevated privileges on the host. It is triggered by executing a specially crafted application locally on an affected system, typically by an attacker who has already obtained a foothold with limited user rights. Successful exploitation yields higher-privilege (kernel/administrator-level) execution, letting the attacker fully compromise the machine and evade user-level restrictions — a common second stage chained after an initial intrusion. Any Microsoft Windows system of the era whose Win32k component was not patched by Microsoft's October 2014 security updates is affected. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-04), carries a very high EPSS score (87%, ~100th percentile), and public reporting has tied it to threat-actor activity (APT3's Operation Double Tap); no public PoC is catalogued. Do: Apply Microsoft's October 2014 security updates — or any later cumulative/rollup updates — on all Windows systems, per CISA's required action, prioritizing internet-exposed and high-value hosts listed in the KEV catalog. Confirm the patched Win32k file version on legacy machines that may have missed these updates. Because this is a local privilege escalation typically chained after an initial foothold, also restrict local execution of untrusted code and limit user privileges on any systems that cannot be patched. | — | 87% | KEV |
| masshundreds of millions of Windows installations of the affected era (Win32k ships with every Windows client/server OS of that period); the count of… |
Full article555 words · extracted from securityaffairs.com · click to collapse
Guardicore Labs uncovered a widespread cryptojacking campaign tracked as Nansh0u and aimed at Windows MS-SQL and PHPMyAdmin servers.
Security experts at Guardicore Labs uncovered a widespread cryptojacking campaign leveraging a malware dubbed Nansh0u. The malicious code aimed at Windows MS-SQL and PHPMyAdmin servers worldwide.
According to the experts, the malicious campaign is being carried out by a Chinese APT group.
According to the experts Nansh0u malware has already infected nearly 50,000 servers worldwide. Threat actors also delivered a sophisticated kernel-mode rootkit on compromised systems to prevent the malware from being terminated.
“During the past two months, the Guardicore Labs team has been closely following a China-based campaign which aimed to infect Windows MS-SQL and PHPMyAdmin servers worldwide.” reads the report published by Guardicore.
“Breached machines include over 50,000 servers belonging to companies in the healthcare, telecommunications, media and IT sectors. Once compromised, the targeted servers were infected with malicious payloads. These, in turn, dropped a crypto-miner and installed a sophisticated kernel-mode rootkit to prevent the malware from being terminated.”
The attacks date back to February 26, experts observed over seven hundred new victims per day. Researchers discovered 20 versions of malicious payloads, with new payloads created at least once a week and immediately involved in the campaign after their creation time.
Threat actors use to launch brute-force attacks against previously identified Windows MS-SQL and PHPMyAdmin servers that are exposed online.
Once successfully logged in with administrative privileges, threat actors execute a sequence of MS-SQL commands that allow them to download malicious payload from a remote file server and execute it with SYSTEM privileges.
Attackers used two exploits tracked as apexp.exe and apexp2012.exe that trigger the privilege escalation vulnerability CVE-2014-4113. The exploits allow running any executable with SYSTEM privileges.
“Using this Windows privilege, the attacking exploit injects code into the winlogon process. The injected code creates a new process which inherits winlogon’s SYSTEMprivileges, providing equivalent permissions as the prior version.” continues the analysis.
The payloads used in this campaign were droppers used to deliver a cryptocurrency miner to mine TurtleCoin cryptocurrency.
Experts observed many payloads dropping a kernel-mode driver using ransom file names and placed them in AppData/Local/Temp. The compile time for these files suggests that it had been created in 2016, but most AV engines still not detect them as malicious.
The driver had a digital signature issued by the top Certificate Authority Verisign.
“We can confidently say that this campaign has been operated by Chinese attackers.” concludes the report.
“We base this hypothesis on the following observations:
- The attacker chose to write their tools with EPL, a Chinese-based programming language.
- Some of the file servers deployed for this campaign are HFSs in Chinese.
- Many log files and binaries on the servers included Chinese strings, such as 结果-去重复 (“duplicates removed”) in logs containing breached machines, or 开始 (“start”) in the name of the script initiating port scans.”
Experts also published a list of IoCs (indicators of compromise) and a free PowerShell-based script that could be used by Windows admins to check whether their systems are infected or not.
If you appreciate my effort in spreading cybersecurity awareness, please vote
for Security Affairs in the section “Your Vote for the Best EU Security
Tweeter”
Thank you
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – nansh0u malware, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/86306/hacking/nansh0u-campaign.html