Microsoft Warns of Cryptomining Malware Campaign Targeting Linux Servers

A cloud menace actor group tracked as 8220 has up to date its malware toolset to breach Linux servers with the intention of installing crypto miners as part of a extensive-operating campaign.

“The updates incorporate the deployment of new variations of a crypto miner and an IRC bot,” Microsoft Security Intelligence said in a sequence of tweets on Thursday. “The group has actively current its procedures and payloads above the past year.”

8220, energetic considering that early 2017, is a Chinese-talking, Monero-mining risk actor so named for its preference to connect with command-and-handle (C2) servers in excess of port 8220. It really is also the developer of a software named whatMiner, which has been co-opted by the Rocke cybercrime team in their attacks.

In July 2019, the Alibaba Cloud Security Crew uncovered an excess change in the adversary’s tactics, noting its use of rootkits to hide the mining program. Two yrs later, the gang resurfaced with Tsunami IRC botnet variants and a customized “PwnRig” miner.

Now according to Microsoft, the most recent marketing campaign hanging i686 and x86_64 Linux programs has been noticed weaponizing remote code execution exploits for the freshly disclosed Atlassian Confluence Server (CVE-2022-26134) and Oracle WebLogic (CVE-2019-2725) for initial entry.

This action is succeeded by the retrieval of a malware loader from a distant server which is developed to drop the PwnRig miner and an IRC bot, but not just before using measures to evade detection by erasing log information and disabling cloud checking and security program.

Besides obtaining persistence by suggests of a cron position, the “loader employs the IP port scanner tool ‘masscan’ to obtain other SSH servers in the network, and then takes advantage of the GoLang-based SSH brute force resource ‘spirit’ to propagate,” Microsoft explained.

The results arrive as Akamai revealed that the Atlassian Confluence flaw is witnessing a continuous 20,000 exploitation tries for each day that are launched from about 6,000 IPs, down from a peak of 100,000 in the instant aftermath of the bug disclosure on June 2, 2022. 67% of attacks are explained to have originated from the U.S.

“In the guide, commerce accounts for 38% of the attack action, followed by higher tech and economic products and services, respectively,” Akamai’s Chen Doytshman explained this week. “These top rated 3 verticals make up additional than 75% of the activity.”

The attacks variety from vulnerability probes to determine if the focus on program is prone to injection of malware these as web shells and crypto miners, the cloud security business famous.

“What is particularly about is how considerably of a change upward this attack style has garnered more than the final many weeks,” Doytshman additional. “As we have found with similar vulnerabilities, this CVE-2022-26134 will very likely keep on to be exploited for at the very least the next pair of years.”

Identified this write-up intriguing? Observe THN on Facebook, Twitter  and LinkedIn to go through additional unique content we put up.

Some sections of this post are sourced from:
thehackernews.com