The hackers behind the Androxgh0st malware are creating a powerful botnet, U.S. cybersecurity agencies warned on Tuesday.
On Tuesday, the FBI and Cybersecurity and Infrastructure Security Agency released a joint advisory on the malware, saying multiple ongoing investigations have allowed them to assess the tactics used by the threat actors deploying it.
The malware dates back to December 2022, when researchers at Lacework said they saw it used in campaigns to steal a wide variety of credentials.
Env files, which are commonly sought by threat actors because they store credentials and tokens.
The malware is used as part of an effort to scan and search for websites with specific vulnerabilities.
The malware also searches for websites using the Laravel framework - a tool used for the development of web applications.
Once the botnet finds websites using Laravel, hackers try to determine if certain files are exposed and contain credentials.
The advisory notes that Laravel is affected by CVE-2018-15133 - a vulnerability used by the botnet to access usernames, passwords, and other credentials for services like email and AWS accounts.
SMTP is used by mail servers to send, receive, and relay outgoing email between senders and receivers.
CISA added the vulnerability to its catalog of Known Exploited Vulnerabilities on Tuesday.
Federal civilian agencies have until February 6 to patch it.
Cybersecurity expert John Smith said AndroxGh0st is another example of the growing threats to cloud infrastructure.
The malware is used for cryptojacking, spamming, or malicious email campaigns and exploits unpatched vulnerabilities in web applications to move laterally and maintain persistence by creating accounts and elevating permissions.
Smith noted that because AndroxGh0st is exploiting exposed.
Env files and unpatched vulnerabilities, users are advised to inspect and monitor cloud environments regularly for any exposures and have a very aggressive policy for out-of-band patching.
Qualys' Ken Dunham noted that Fortinet reports around 40,000 compromised hosts as part of the botnet.
Southeast Asian casino industry supercharging cyber fraud, UN says.
Jonathan has worked across the globe as a journalist since 2014.
Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia.
He previously covered cybersecurity at ZDNet and TechRepublic.
This Cyber News was published on therecord.media. Publication date: Tue, 16 Jan 2024 22:20:50 +0000