Cybersecurity researchers have found a brand new marketing campaign that exploits a identified safety flaw impacting Apache HTTP Server to ship a cryptocurrency miner referred to as Linuxsys.
The vulnerability in query is CVE-2021-41773 (CVSS rating: 7.5), a high-severity path traversal vulnerability in Apache HTTP Server model 2.4.49 that would end in distant code execution.
“The attacker leverages compromised reputable web sites to distribute malware, enabling stealthy supply and evasion of detection,” VulnCheck stated in a report shared with The Hacker Information.
The an infection sequence, noticed earlier this month and originating from an Indonesian IP tackle 103.193.177[.]152, is designed to drop a next-stage payload from “repositorylinux[.]org” utilizing curl or wget.
The payload is a shell script that is accountable for downloading the Linuxsys cryptocurrency miner from 5 completely different reputable web sites, suggesting that the menace actors behind the marketing campaign have managed to compromise third-party infrastructure to facilitate the distribution of the malware.
“This strategy is intelligent as a result of victims hook up with reputable hosts with legitimate SSL certificates, making detection much less possible,” VulnCheck famous. “Moreover, it offers a layer of separation for the downloader web site (‘repositorylinux[.]org’) because the malware itself is not hosted there.”
The websites additionally host one other shell script named “cron.sh” that ensures that the miner is launched routinely upon a system reboot. Cybersecurity agency stated it additionally recognized two Home windows executables on the hacked websites, elevating the likelihood that the attackers are additionally going after Microsoft’s desktop working system.
It is value noting that assaults distributing the Linuxsys miner have beforehand exploited a crucial safety flaw in OSGeo GeoServer GeoTools (CVE-2024-36401, CVSS rating: 9.8), as documented by Fortinet FortiGuard Labs in September 2024.
Curiously, the shell script dropped following the exploitation of the flaw was downloaded from “repositorylinux[.]com,” with feedback within the supply code written in Sundanese, an Indonesian language. The identical shell script has been detected within the wild way back to December 2021.
A number of the different vulnerabilities exploited to ship the miner in recent times embrace –
- CVE-2023-22527, a template injection vulnerability in Atlassian Confluence Knowledge Heart and Confluence Server
- CVE-2023-34960, a command injection vulnerability in Chamilo Studying Administration Programs (LMS)
- CVE-2023-38646, a command injection vulnerability in Metabase
- CVE-2024-0012 and CVE-2024-9474, are authentication bypass and privilege escalation vulnerabilities in Palo Alto Networks firewalls
“All of this means that the attacker has been conducting a long-term marketing campaign, using constant strategies similar to n-day exploitation, staging content material on compromised hosts, and coin mining on sufferer machines,” VulnCheck stated.
“A part of their success comes from cautious focusing on. They seem to keep away from low interplay honeypots and require excessive interplay to watch their exercise. Mixed with using compromised hosts for malware distribution, this strategy has largely helped the attacker keep away from scrutiny.”
Alternate Servers Focused by GhostContainer Backdoor
The event comes as Kaspersky disclosed particulars of a marketing campaign that is focusing on authorities entities in Asia, possible with a N-day safety flaw in Microsoft Alternate Server, to deploy a bespoke backdoor dubbed GhostContainer. It is suspected that the assaults could have exploited a now-patched distant code execution bug in Alternate Server (CVE-2020-0688, CVSS rating: 8.8).
The “refined, multi-functional backdoor” might be “dynamically prolonged with arbitrary performance via the obtain of extra modules,” the Russian firm stated, including “the backdoor grants the attackers full management over the Alternate server, permitting them to execute a variety of malicious actions.”
The malware is provided to parse directions that may execute shellcode, obtain recordsdata, learn or delete recordsdata, run arbitrary instructions, and cargo extra .NET byte code. It additionally incorporates an online proxy and tunneling module.
It is suspected that the exercise could have been a part of a sophisticated persistent menace (APT) marketing campaign geared toward high-value organizations, together with high-tech firms, in Asia.
Not a lot is understood about who’s behind the assaults, though they’re assessed to be extremely expert owing to their in-depth understanding of Microsoft Alternate Server and their capability to rework publicly out there code into superior espionage instruments.
“The GhostContainer backdoor doesn’t set up a connection to any [command-and-control] infrastructure,” Kaspersky stated. “As a substitute, the attacker connects to the compromised server from the skin, and their management instructions are hidden inside regular Alternate internet requests.”
