Feds Warn of AndroxGh0st Botnet Targeting AWS, Azure, and Office 365 Credentials

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) warned that menace actors deploying the AndroxGh0st malware are making a botnet for “victim identification and exploitation in goal networks.”

A Python-based mostly malware, AndroxGh0st was very first documented by Lacework in December 2022, with the malware inspiring numerous comparable instruments like AlienFox, GreenBot (aka Maintance), Legion, and Predator.

The cloud attack resource is capable of infiltrating servers susceptible to recognized security flaws to access Laravel ecosystem documents and steal qualifications for significant-profile applications these kinds of as Amazon Web Services (AWS), Microsoft Office 365, SendGrid, and Twilio.

Some of the notable flaws weaponized by the attackers involve CVE-2017-9841 (PHPUnit), CVE-2021-41773 (Apache HTTP Server), and CVE-2018-15133 (Laravel Framework).

“AndroxGh0st has several characteristics to allow SMTP abuse which includes scanning, exploitation of exposed creds and APIs, and even deployment of web shells,” Lacework stated. “For AWS particularly, the malware scans for and parses AWS keys but also has the means to generate keys for brute-power attacks.”

These attributes make AndroxGh0st a strong danger that can be used to download additional payloads and keep persistent obtain to compromised methods.

The enhancement comes fewer than a week following SentinelOne uncovered a connected-but-distinct software termed FBot that is currently being employed by attackers to breach web servers, cloud solutions, content material management programs (CMS), and SaaS platforms.

It also follows an warn from NETSCOUT about a substantial spike in botnet scanning action considering the fact that mid-November 2023, touching a peak of approximately 1.3 million unique units on January 5, 2024. A bulk of the source IP addresses are associated with the U.S., China, Vietnam, Taiwan, and Russia.

“Investigation of the action has uncovered a rise in the use of cheap or no cost cloud and hosting servers that attackers are working with to develop botnet start pads,” the organization stated. “These servers are employed by way of trials, totally free accounts, or very low-charge accounts, which give anonymity and nominal overhead to sustain.”

Discovered this short article appealing? Observe us on Twitter  and LinkedIn to browse a lot more special articles we publish.

Some parts of this write-up are sourced from:
thehackernews.com