New Lucifer DDoS botnet targets Windows systems with multiple exploits

CVE-2014-6287 is an unauthenticated remote code execution flaw in Rejetto HTTP File Server (HFS), a freeware file-sharing web server for Windows: the findMacroMarker function in parserLib.pas mishandles parsing of template macros, allowing code injection (CWE-94). An attacker triggers it by sending a crafted HTTP request whose specially crafted macro/special characters break out of the template parser, causing HFS to execute arbitrary commands or programs on the host. Successful exploitation yields command execution with the privileges of the HFS process, which is typically enough to install malware, ransomware, DDoS botnet components, or cryptocurrency miners on Windows systems. Any Windows host running Rejetto HFS is affected, particularly instances exposed directly to the internet; the source data does not list specific vulnerable version ranges. Exploitation is confirmed: the flaw was added to CISA's KEV on 2022-03-25 and carries a 99.3% EPSS (100th percentile), and related news links HFS exploitation to multi-exploit Windows malware campaigns such as the Lucifer DDoS botnet and the BlackSquid crypto-mining malware.

Do: Upgrade HFS to the current vendor release (public advisories identify 2.3c, build 298, as the fixed build) per vendor instructions, as required by the CISA KEV action. If updating is not immediately possible, remove or restrict direct internet exposure (firewall the HFS port or place the service behind VPN/authentication) and review affected hosts for signs of compromise, such as unexpected cmd.exe/PowerShell child processes, new miner or botnet binaries, and unusual outbound traffic.

CVE-2017-0144 is a remote code execution flaw in the SMBv1 server component of Microsoft Windows, commonly known as EternalBlue, and one of the SMB flaws fixed by Microsoft in the March 2017 MS17-010 bulletin. An attacker who can reach the SMB service over the network sends specially crafted packets that trigger memory corruption in the SMBv1 implementation, gaining the ability to execute arbitrary code on the target without user interaction. Successful exploitation yields full system compromise and has been heavily weaponized for wormable spread and ransomware delivery, notably via the leaked NSA exploit and in the WannaCry/NotPetya-era outbreaks, and the flaw has repeatedly been bundled into botnets and ransomware tooling since. Anyone running unpatched Windows Vista SP2 through Windows 10 1607 / Windows Server 2016 with SMBv1 enabled is affected, as are Siemens medical and laboratory devices (ACUSON ultrasound, syngo SC2000, Tissue Preparation System, VERSANT kPCR systems) whose firmware depends on SMBv1. Exploitation is actively ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with known ransomware use, carries a 99.2% EPSS exploitation probability (100th percentile), and multiple public exploits and PoCs are available.

Do: Apply the Microsoft MS17-010 (March 2017) security updates on every listed Windows version and the corresponding Siemens firmware updates for ACUSON, syngo SC2000, Tissue Preparation System, and VERSANT kPCR devices, per CISA's required action to apply vendor updates. Where patching is not yet possible, disable SMBv1 or block inbound TCP 445 (and UDP 137/138) at network boundaries and isolate legacy/medical systems from the internet. Sweep exposed and legacy hosts for compromise indicators, including DOUBLEPULSAR implants delivered over SMB, as public tooling for detecting and neutralizing this implant is available.

Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue.

Do: Apply Oracle's updates for CVE-2017-10271 per Oracle's instructions (the vendor's required action for this KEV entry). Until patched, restrict network access to WebLogic HTTP/admin ports from untrusted networks and limit or remove access to the XML/WSAT endpoints used for exploitation. Because ransomware operators are known to exploit this flaw, review internet-exposed WebLogic instances for signs of compromise, such as unexpected processes, new scheduled tasks, webshells, or ransomware artifacts.

CVE-2017-8464 is a remote code execution flaw in how the Windows Shell handles .LNK shortcut files, evoking the 2010 Stuxnet-era LNK bug that Microsoft had to fix repeatedly. It is triggered when Windows Explorer, or any other application that parses shortcut icons, processes a crafted .LNK file — for example while browsing a USB drive, network share, or downloaded folder — and the CVSS vector requires user interaction but no privileges. A successful attacker can execute arbitrary code in the context of the logged-on user, with high impact on confidentiality, integrity, and availability. Nearly every Windows release in support at disclosure time is affected, spanning Windows 7 SP1, Windows 8/8.1, Windows RT 8.1, Windows 10 (Gold through 1703), and Windows Server 2008 through 2016. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-10, EPSS assigns a 90% 30-day exploitation probability (100th percentile), public PoCs exist, and headlines tie it to malware campaigns such as Lucifer and BlackSquid.

Do: Apply Microsoft security updates per vendor instructions (released with the June 2017 Patch Tuesday and carried forward in later cumulative/rollup updates) on all affected systems, prioritizing legacy Windows 7/8/RT 8.1 and Server 2008/2012/2016 hosts that remain in service, including any under Extended Security Updates. Since CISA lists this as actively exploited, verify patch status fleet-wide and hunt for suspicious .LNK activity; as interim mitigation, be cautious with untrusted removable media, network shares, and downloaded shortcuts, and consider Microsoft's guidance on disabling shortcut icon display.

CVE-2017-9791 is an improper input validation flaw (CWE-20) in the Struts 1 plugin shipped with Apache Struts 2.1.x and 2.3.x. When a user-supplied field value is passed as a raw message to ActionMessage, it is evaluated as an expression, allowing an unauthenticated attacker to achieve remote code execution with the privileges of the Java web application. Organizations running Struts 2.1.x/2.3.x applications with the Struts 1 plugin enabled are affected, and Oracle has separately shipped patches for Struts bundled in its products. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-02-10) and carries a 98.9% EPSS score (100th percentile), indicating active, widespread exploitation, though no public proof-of-concept is catalogued.

Do: Apply updates per vendor instructions as required by CISA by upgrading Struts 2.1.x/2.3.x to a patched release and, where feasible, disabling or removing the Struts 1 plugin; audit application code for ActionMessage calls that pass unvalidated user input as raw messages. For Oracle products that bundle Struts, apply Oracle's Struts-related security patches. Prioritize internet-facing applications given confirmed in-the-wild exploitation (KEV) and the near-certain near-term exploitation probability (EPSS 98.9%).

CVE-2018-1000861 is a critical flaw (CVSS 3.1: 9.8) in the Stapler web framework used by Jenkins, located in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java, where crafted URLs cause the framework to invoke Java object methods that were never intended to be reachable over HTTP (CWE-502, deserialization of untrusted data). By chaining these unintended method invocations, an unauthenticated remote attacker can achieve code execution on the affected Jenkins instance. All Jenkins releases up to and including 2.153 (weekly line) and 2.138.3 (LTS line) are affected, and Red Hat OpenShift Container Platform deployments that ship bundled Jenkins/Stapler components are also in scope. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-02-10, EPSS assigns a 98.3% probability of exploitation within 30 days, and related reporting documents hackers exploiting this Jenkins flaw, with coverage of the WatchBog cryptomining botnet known to target it. No public proof-of-concept exploit is catalogued and ransomware use is unknown, but the KEV listing alone confirms real-world exploitation.

Do: Upgrade Jenkins to a release newer than 2.153 (weekly) or newer than 2.138.3 (LTS), per vendor instructions (fixed releases are 2.154 / 2.138.4 or later), and apply Red Hat updates for OpenShift Container Platform images that bundle Jenkins. Until patched, keep Jenkins controllers off the open internet, restrict unauthenticated/anonymous access to the Jenkins UI, and review controller logs for crafted URLs that invoke unintended methods on Java objects. Because the flaw is in CISA KEV with a 98.3% EPSS score, treat patching as urgent and check internet-exposed controllers for signs of compromise such as cryptomining activity.

NoneCms V1.3, an open-source Chinese CMS built on the ThinkPHP 5.0.x framework, is vulnerable to unauthenticated remote code execution through the framework's URL dispatcher in thinkphp/library/think/App.php. Because the framework's 's' routing parameter can invoke arbitrary framework classes and methods, an attacker can pass a crafted 'filter' value (e.g., s=index/\think\Request/input&filter=phpinfo&data=1) that is applied to the 'data' argument as a callable, executing attacker-chosen PHP functions or code. Successful exploitation gives full code execution on the web server under the application's privileges, enabling web shells, botnet implants, and ransomware staging without any credentials or user interaction. Any internet-facing deployment of noneCms V1.3 — and, more broadly, applications running the affected ThinkPHP 5.0.x framework (the public PoC references 5.0.23) — is exposed. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), EPSS assigns a 99.5% probability of exploitation within 30 days, and headlines note botnets such as Enemybot and Chinese threat actors chaining ThinkPHP RCEs against CMS servers.

Do: Apply updates per vendor instructions: upgrade noneCms to the latest release and update the bundled ThinkPHP 5.0.x framework to a patched build. Inspect web server and WAF logs for requests using the s=index/\think\Request/input&filter=... pattern and other ThinkPHP route-invocation payloads, and hunt for web shells or post-exploitation artifacts. Until patched, block or strictly validate the 's' and 'filter' query parameters at a WAF/reverse proxy and limit internet exposure of the application.

CVE-2018-7600, widely known as 'Drupalgeddon 2', is an unauthenticated remote code execution flaw in Drupal Core caused by insufficient input validation (CWE-20) in how the CMS processes certain structured request data. It can be triggered through multiple attack vectors, such as crafted parameters submitted to commonly used form and rendering features that are reachable by anonymous users with a single HTTP request. Successful exploitation lets an attacker run arbitrary code under the web application, typically resulting in complete site compromise, and CISA notes the flaw has been used in ransomware operations. Any site running unpatched Drupal 7.x or 8.x core is affected; Drupal's installed base at the time of disclosure was on the order of one million sites. Exploitation is confirmed in the wild (CISA KEV, added 2021-11-03), EPSS assigns a 100% probability of exploitation within 30 days, and no public PoC is recorded in the supplied data.

Do: Upgrade immediately per vendor instructions: Drupal 7.58, 8.5.1, or the corresponding 8.4.6/8.3.9 updates if you remain on older 8.x branches, prioritizing internet-facing sites. Because this flaw has been exploited in the wild and used in ransomware operations, also check patched sites for backdoors, unexpected administrator accounts, modified core files, and rotate credentials.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none