On January 16, a joint alert from FBI and CISA warned about a concerning development: the emergence of a botnet driven by AndroxGh0st malware targeting vulnerable applications and web servers.
RoxGh0st is a Python-based malware, first seen in late 2022, designed to target Laravel.
Env files and steal credentials for AWS, Microsoft Office 365, and other applications.
CVE-2021-41773, path traversal in Apache HTTP Server.
CVE-2018-15133, deserialization of untrusted data in Laravel Framework.
In 2024, Imperva Threat Research has seen over 30,000 unique sites targeted in attacks attempting to exploit these vulnerabilities, predominantly in the Financial Services and Business industries.
Since late 2023, Imperva Threat Research has monitored activity from threat actors associated with the AndroxGh0st malware disclosed in CISA's report.
We can attribute this activity to the criminal group based on two key factors: the unique signature of these events aligns with CISA's disclosure, and the identical nature of one of the payloads observed to those mentioned in the report.
CISA-disclosed payload. In addition to the CISA-disclosed payload, Imperva Threat Research discovered an additional payload containing the PHP webshell in a base64 encoded form, presumably to overcome RFI mitigations on the target host.
Additional payload discovered by Imperva Threat Research.
In another notable deviation from CISA's findings, our team also detected exploitation of an unmentioned vulnerability: the Drupal Core vulnerability CVE-2019-6340, which the AndroxGh0st threat actors used to deploy webshells.
We observed the threat actors use of the same proxy IPs deploying the same webshell within a similar time frame, exploiting both the Drupal and PHPUnit vulnerabilities.
Imperva Threat Research observed the group attempting to use a WS02 vulnerability to deploy and interact with JSP webshells.
Most notably we observed the group attempting to interact with these webshells to deploy XMRig cryptominer malware, using one of the documented URLs from CISA's disclosure.
In our ongoing commitment to cybersecurity, we have implemented robust measures to safeguard against a wide array of vulnerabilities identified in the recent FBI security warning and this blog.
We continue to advocate for regular application patching and updates as a best practice in cybersecurity.
This Cyber News was published on www.imperva.com. Publication date: Thu, 01 Feb 2024 17:13:04 +0000