CyberSecurityBoard
Sponsor Register Login

CISA and FBI Reveal Known Androxgh0st Malware IoCs and TTPs

CISA and FBI released an advisory on Androxgh0st malware IoCs and warned about hackers using this threat to steal credentials.
Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats.
Prioritize patching known exploited vulnerabilities in internet-facing systems.
The Cybersecurity and Infrastructure Security Agency also urged System Admins to update Apache servers running versions 2.4.49 or 2.4.50.
Roxgh0st is a Python-written malware that hackers use to create a botnet that scans for and exploits vulnerable networks.
Laravel Framework - Threat actors use the Laravel web app to check if the domain's root-level.
Env files contain credentials and tokens that hackers will attempt stealing.
In some Laravel frameworks, hackers can exploit CVE-2018-15133 for remote code execution.
Amazon Web Services [AWS], Microsoft Office 365, and SendGrid are some of the high-profile applications that could be affected.
CISA says hackers can use Androxgh0st malware to abuse the Simple Mail Transfer Protocol.
CISA and FBI`s analysis lead to revealing a series of IoCs you can use to detect an Androxgh0st malware infection in your system.
Check the entire list of Androxgh0st malware IoCs here.
CISA`s advisory on Androxgh0st malware once again stresses that patching known vulnerabilities timely is a system`s first line of defense.
Vendors have already released patches for all three CVEs the advisory mentions.
In only a few clicks with Heimdal`s Patch & Asset Management.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, and Youtube, for more cybersecurity news and topics.
If you liked this post, you will enjoy our newsletter.
Get cybersecurity updates you'll actually want to read directly in your inbox.


This Cyber News was published on heimdalsecurity.com. Publication date: Thu, 18 Jan 2024 22:43:05 +0000


Cyber News related to CISA and FBI Reveal Known Androxgh0st Malware IoCs and TTPs

CISA and FBI Reveal Known Androxgh0st Malware IoCs and TTPs - CISA and FBI released an advisory on Androxgh0st malware IoCs and warned about hackers using this threat to steal credentials. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to ...
9 months ago Heimdalsecurity.com
CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
5 months ago Securityaffairs.com
Androxgh0st Malware Botnet Steals AWS, Microsoft Credentials and More - The Federal Bureau of Investigation and Cybersecurity & Infrastructure Security Agency warned in a joint advisory about a threat actor deploying a botnet that makes use of the Androxgh0st malware. This malware is capable of collecting cloud ...
9 months ago Techrepublic.com
Hackers Building AndroxGh0st Botnet to Target AWS, O365, Feds Warn - The bad actors behind the Androxgh0st malware are building a botnet they can use to identify victims and exploit vulnerable networks to steal confidential information from such high-profile cloud applications as Amazon Web Services, Microsoft Office ...
9 months ago Securityboulevard.com
Imperva Uncovers New IoCs for AndroxGh0st Botnet - On January 16, a joint alert from FBI and CISA warned about a concerning development: the emergence of a botnet driven by AndroxGh0st malware targeting vulnerable applications and web servers. RoxGh0st is a Python-based malware, first seen in late ...
9 months ago Imperva.com
US Gov Issues Warning for Androxgh0st Malware Attacks - The US cybersecurity agency CISA and the FBI have issued a joint advisory warning about the Androxgh0st malware creating a botnet to identify and target vulnerable networks. Written in Python, the agencies said the malware primarily targets. Env ...
9 months ago Securityweek.com
CISA: AWS, Microsoft 365 Accounts Under Active 'Androxgh0st' Attack - The FBI and the US Cybersecurity and Infrastructure Security Agency have issued an alert about a malware campaign targeting Apache webservers and websites using the popular Laravel Web application framework, leveraging known bugs for initial ...
9 months ago Darkreading.com
CISA and FBI Release Known IOCs Associated with Androxgh0st Malware - Today, CISA and the Federal Bureau of Investigation released a joint Cybersecurity Advisory, Known Indicators of Compromise Associated with Androxgh0st Malware, to disseminate known indicators of compromise and tactics, techniques, and procedures ...
9 months ago Cisa.gov
FBI: ALPHV ransomware raked in $300 million from over 1,000 victims - The ALPHV/BlackCat ransomware gang has made over $300 million in ransom payments from more than 1,000 victims worldwide as of September 2023, according to the Federal Bureau of Investigation. In the joint advisory published today in collaboration ...
10 months ago Bleepingcomputer.com
US Congress Report Calls for Privacy Reforms After FBI Surveillance 'Abuses' - The FBI and the Biden administration at large have lobbied Congress to reauthorize the 702 program as is, ignoring calls for reform that have grown louder since the beginning of the year, manifesting this month in the form of a comprehensive privacy ...
11 months ago Wired.com
Androxgh0st malware hackers creating large botnet, CISA and FBI warn - The hackers behind the Androxgh0st malware are creating a powerful botnet, U.S. cybersecurity agencies warned on Tuesday. On Tuesday, the FBI and Cybersecurity and Infrastructure Security Agency released a joint advisory on the malware, saying ...
9 months ago Therecord.media
FBI: Beware of cloud-credential thieves building botnets The Register - Crooks are exploiting years-old vulnerabilities to deploy Androxgh0st malware and build a cloud-credential stealing botnet, according to the FBI and the Cybersecurity and Infrastructure Security Agency. In a joint warning issued on Tuesday, the US ...
9 months ago Go.theregister.com
From DarkGate to AsyncRAT: Malware Detected and Shared As Unit 42 Timely Threat Intelligence - This article summarizes the malware families seen by Unit 42 and shared with the broader threat hunting community through our social channels. We also included a number of posts about the cybercrime group TA577 - who have distributed multiple malware ...
10 months ago Unit42.paloaltonetworks.com
Know your enemies: An approach for CTI teams ~ VirusTotal Blog - VirusTotal's Threat Landscape can be a valuable source of operational and tactical threat intelligence for CTI teams, for instance helping us find the latest malware trends used by a given Threat Actor to adjust our intelligence-led security posture ...
7 months ago Blog.virustotal.com
CISA pledges to resolve issues with threat sharing system after watchdog report - On Friday, the Department of Homeland Security’s Office of the Inspector General published a report on Automated Indicator Sharing (AIS) — which was used to spread cyber threat intelligence and was mandated as part of a 2015 law. The nation’s ...
1 month ago Therecord.media
How to Extract Malware Configurations in a Sandbox - The most sought-after source of these indicators is malware configurations. Malware Sandboxing Leader ANY.RUN handles the heavy lifting of phishing and malware analysis for SOC and DFIR teams and also helps 300,000 professionals use the platform to ...
9 months ago Gbhackers.com
Types of Malware and How To Prevent Them - Malware is one of the biggest security threats to any type of technological device, and each type of malware uses unique tactics for successful invasions. Even if you've downloaded a VPN for internet browsing, our in-depth guide discusses the 14 ...
4 months ago Pandasecurity.com
FBI: Androxgh0st malware botnet steals AWS, Microsoft credentials - CISA and the FBI warned today that threat actors using Androxgh0st malware are building a botnet focused on cloud credential theft and using the stolen information to deliver additional malicious payloads. First spotted by Lacework Labs in 2022, the ...
9 months ago Bleepingcomputer.com
FBI disrupts Moobot botnet used by Russian military hackers - The FBI took down a botnet of small office/home office routers used by Russia's Main Intelligence Directorate of the General Staff in spearphishing and credential theft attacks targeting the United States and its allies. This network of hundreds of ...
8 months ago Bleepingcomputer.com
PixPirate: The Brazilian financial malware you can't see, part one - The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan malware that heavily utilizes anti-research techniques. Within IBM Trusteer, we saw several different ...
9 months ago Securityintelligence.com
How to Remove Malware + Viruses - Malware removal can seem daunting after your device is infected with a virus, but with a careful and rapid response, removing a virus or malware program can be easier than you think. We created a guide that explains exactly how to rid your Mac or PC ...
6 months ago Pandasecurity.com
How the FBI seized BlackCat ransomware's servers - An unsealed FBI search warrant revealed how law enforcement hijacked the ALPHV/BlackCat ransomware operations websites and seized the associated URLs. Today, the US Department of Justice confirmed that they seized websites for the ALPHV ransomware ...
10 months ago Bleepingcomputer.com
Stemming the Tide: Solving the Challenge of Password Reuse and Password-Stealing Malware - Password stealing malware is again rising with several attacks making the news cycle in recent months. A new password-stealing malware named Ov3r Stealer was discovered on Facebook Ads, spreading by way of fake job opportunities. Further analysis ...
5 months ago Cybersecurity-insiders.com
Stemming the Tide: Solving the Challenge of Password Reuse and Password-Stealing Malware - Password stealing malware is again rising with several attacks making the news cycle in recent months. A new password-stealing malware named Ov3r Stealer was discovered on Facebook Ads, spreading by way of fake job opportunities. Further analysis ...
5 months ago Cybersecurity-insiders.com
Stemming the Tide: Solving the Challenge of Password Reuse and Password-Stealing Malware - Password stealing malware is again rising with several attacks making the news cycle in recent months. A new password-stealing malware named Ov3r Stealer was discovered on Facebook Ads, spreading by way of fake job opportunities. Further analysis ...
5 months ago Cybersecurity-insiders.com

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)