BlackSquid malware uses multiple exploits to drop cryptocurrency miners
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-6287 | Unauthenticated RCE in Rejetto HTTP File Server (HFS) via Template Macro Parsing CVE-2014-6287 is an unauthenticated remote code execution flaw in Rejetto HTTP File Server (HFS), a freeware file-sharing web server for Windows: the findMacroMarker function in parserLib.pas mishandles parsing of template macros, allowing code injection (CWE-94). An attacker triggers it by sending a crafted HTTP request whose specially crafted macro/special characters break out of the template parser, causing HFS to execute arbitrary commands or programs on the host. Successful exploitation yields command execution with the privileges of the HFS process, which is typically enough to install malware, ransomware, DDoS botnet components, or cryptocurrency miners on Windows systems. Any Windows host running Rejetto HFS is affected, particularly instances exposed directly to the internet; the source data does not list specific vulnerable version ranges. Exploitation is confirmed: the flaw was added to CISA's KEV on 2022-03-25 and carries a 99.3% EPSS (100th percentile), and related news links HFS exploitation to multi-exploit Windows malware campaigns such as the Lucifer DDoS botnet and the BlackSquid crypto-mining malware. Do: Upgrade HFS to the current vendor release (public advisories identify 2.3c, build 298, as the fixed build) per vendor instructions, as required by the CISA KEV action. If updating is not immediately possible, remove or restrict direct internet exposure (firewall the HFS port or place the service behind VPN/authentication) and review affected hosts for signs of compromise, such as unexpected cmd.exe/PowerShell child processes, new miner or botnet binaries, and unusual outbound traffic. | — | 99% | KEV |
| largetens of thousands of internet-exposed HFS instances (order of ~40,000-70,000, estimate) | |
| CVE-2017-12615 | Unauthenticated RCE in Apache Tomcat 7 on Windows via HTTP PUT (CVE-2017-12615) Apache Tomcat 7.0.0 through 7.0.79 running on Windows with HTTP PUT enabled on the Default servlet (the readonly initialisation parameter set to false, which is not the default configuration) allows an unauthenticated attacker to upload a JSP file via a specially crafted PUT request (CWE-434), bypassing the extension check (e.g. via trailing-slash or case variations). The uploaded JSP can then be requested, and any code it contains is executed in the Tomcat server context, giving the attacker unauthenticated remote code execution. Only Tomcat 7 deployments on Windows with PUTs enabled are directly affected; because bundled Tomcat is also shipped in products from Red Hat (JBoss Enterprise Web Server, RHEL variants) and NetApp, those vendors issued advisories as well. This flaw is closely related to CVE-2017-12617, which was reported and patched around the same time. Exploitation is confirmed in the wild: it was added to CISA KEV on 2022-03-25 with known ransomware use, has two public proof-of-concept references, and EPSS assigns a 99.6% probability of exploitation within 30 days. Do: Upgrade Tomcat beyond the affected 7.0.0–7.0.79 range per vendor instructions (Apache Tomcat directly, or via Red Hat JBoss Enterprise Web Server/RHEL and NetApp bundled-product advisories), prioritizing internet-facing Windows servers since the issue is KEV-listed with known ransomware use. If patching must be delayed, ensure the Default servlet readonly parameter remains at its default (true) to disable PUT, or block PUT requests at a reverse proxy/WAF on Windows Tomcat hosts. Also check affected Windows hosts for unexpectedly uploaded .jsp files and review access logs for PUT requests that created JSPs, as indicators of compromise. | 8.1 | 100% | KEV ransomware PoC ×2 |
| large≈10,000–100,000 exposed systems (Tomcat 7 on Windows with non-default PUT enabled) | |
| CVE-2017-8464 | Remote Code Execution in Microsoft Windows Shell via crafted .LNK shortcuts CVE-2017-8464 is a remote code execution flaw in how the Windows Shell handles .LNK shortcut files, evoking the 2010 Stuxnet-era LNK bug that Microsoft had to fix repeatedly. It is triggered when Windows Explorer, or any other application that parses shortcut icons, processes a crafted .LNK file — for example while browsing a USB drive, network share, or downloaded folder — and the CVSS vector requires user interaction but no privileges. A successful attacker can execute arbitrary code in the context of the logged-on user, with high impact on confidentiality, integrity, and availability. Nearly every Windows release in support at disclosure time is affected, spanning Windows 7 SP1, Windows 8/8.1, Windows RT 8.1, Windows 10 (Gold through 1703), and Windows Server 2008 through 2016. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-10, EPSS assigns a 90% 30-day exploitation probability (100th percentile), public PoCs exist, and headlines tie it to malware campaigns such as Lucifer and BlackSquid. Do: Apply Microsoft security updates per vendor instructions (released with the June 2017 Patch Tuesday and carried forward in later cumulative/rollup updates) on all affected systems, prioritizing legacy Windows 7/8/RT 8.1 and Server 2008/2012/2016 hosts that remain in service, including any under Extended Security Updates. Since CISA lists this as actively exploited, verify patch status fleet-wide and hunt for suspicious .LNK activity; as interim mitigation, be cautious with untrusted removable media, network shares, and downloaded shortcuts, and consider Microsoft's guidance on disabling shortcut icon display. | 8.8 | 90% | KEV PoC ×2 |
| masshundreds of millions of Windows devices |
Full article632 words · extracted from securityaffairs.com · click to collapse
A new piece of malware appeared in the threat landscape, dubbed BlackSquid it targets web servers with several exploits to deliver cryptocurrency miners.
Security experts at Trend Micro have discovered a new Monero cryptomining miner, dubbed BlackSquid, that is targeting web servers, network drives, and removable drives.
The new piece of malware leverages many exploits to compromise target systems and implements evasion techniques to avoid detection.
According to the experts, BlackSquid has worm-like propagation capabilities and it can be used to launch brute-force attacks.
“This malware, which we named BlackSquid after the registries created and main component file names, is particularly dangerous for several reasons.” states Trend Micro. “It employs anti-virtualization, anti-debugging, and anti-sandboxing methods to determine whether to continue with installation or not. It also has wormlike behavior for lateral propagation.”
The peculiarity of the BlackSquid malware is the employment of a set of the most dangerous exploits
While many forms of malicious code will employ one or two exploits for known vulnerabilities in popular systems, BlackSquid differs in this regard.
The list of exploits used by the malware includes EternalBlue, DoublePulsar; exploits for CVE-2014-6287, Tomcat arbitrary file upload vulnerability CVE-2017-12615, CVE-2017-8464; and three ThinkPHP exploits for different versions of the framework.
The threat is delivered via infected webpages, exploits, or through removable network drives.
BlackSquid leverages the GetTickCount API to randomly select IP addresses of a web server and to attempt to infect them.
The malware implements anti-virtualization, anti-debugging, and anti-sandboxing methods to determine whether to deliver the miner or not.
“Simultaneous with its attacks, BlackSquid also downloads and executes two XMRig cryptocurrency-mining components.! continues the analysis. “The miner in resource is the primary miner used, but it also determines if the targeted system has a video card. If the system checks for Nvidia and AMD video cards using WQL (WMI Query Language, where WMI stands for Windows Management Instrumentation), the malware downloads the second component into the system to mine for graphics processing unit (GPU) resource.”
The malware halts the infection routine if at least one of the following conditions is met:
- The victim’s username is included in a list of common sandbox usernames:
- The disk drive model is equal to one included in a specific list;
- The device driver, process, and/or dynamic link library is one of a specific list used by the malicious code.
BlackSquid exploits the EternalBlue-DoublePulsar exploits (MS17-010 SMB RCE exploit) to propagate through the target network. The malware uses the remote code execution (RCE) flaw to gain the same user rights as the local system user.
If the infected system has a video card such as Nvidia and AMD video cards using WQL (WMI Query Language, where WMI stands for Windows Management Instrumentation), the malicious code downloads a second component into the system to mine for graphics processing unit (GPU) resource.
Trend Micro says that the majority of BlackSquid attacks have, so far, been detected in Thailand and the United States. The last week of May is the most active period on record.
The presence of coding errors and skipped routine suggests that BlackSquid is still in the process of development and testing.
“Given its evasion techniques and the attacks it is capable of, BlackSquid is a sophisticated piece of malware that may cause significant damage to the systems it infects. If successful, this malware may enable an attacker to escalate unauthorized access and privileges, steal proprietary information, render hardware and software useless, or launch attacks on an organization (or even from an organization into another).” concludes Trend Micro.
“But considering the erroneous code and purposely skipped routines, we also think that the cybercriminals behind this malware are likely in the development and testing stages;”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – BlackSquid, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/86597/malware/blacksquid-cryptocurrency-miners.html