• Search for:
    26Dec, 2023
    MySQL Servers, Docker Hosts Infected With DDoS Malware

    Attackers are targeting MySQL servers and Docker hosts to plant malware capable of launching distributed denial-of-service (DDoS) attacks, according to a warning from researchers at the AhnLab Security Emergency Response Center.

    According to AhnLab, attacks targeting MySQL on Windows have increased in frequency with vulnerable MySQL servers infected with ‘Ddostf’, a DDoS-capable botnet of Chinese origin that has been around since at least 2016.

    Malicious attackers, AhnLab warns, scan the internet for publicly-accessible MySQL servers using the TCP port 3306, and then attempt to compromise them either using weak credentials or exploiting known vulnerabilities.

    The attackers then upload a malicious DLL as a UDF (User-Defined Function) library, which allows them to execute commands on the infected system and to deploy and execute the Ddostf malware.

    Targeting both Linux and Windows environments, Ddostf achieves persistence and then collects system information and sends it to the command-and-control (C&C) server. It then waits for commands to launch DDoS attacks such as SYN, UDP, and HTTP GET/POST floods.

    “Although most of the commands supported by Ddostf are similar to those from typical DDoS bots, a distinctive feature of Ddostf is its ability to connect to a newly received address from the C&C server and execute commands there for a certain period,” AhnLab explained.

    The malware appears to be designed solely for launching DDoS attacks and the researchers believe the threat actor is operating a DDoS-for-hire service.

    OracleIV DDoS-capable malware

    Separately, Cado Security is warning in a new report that Docker hosts are being targeted with the OracleIV DDoS-capable malware, via the Docker Engine API, an HTTP API served by Docker Engine.

    Attackers are scanning for publicly-exposed instances of the Docker Engine API to deploy a malicious container that hosts Python malware compiled as an ELF executable.

    According to Cado, the accidentally exposed Docker Engine API instances have been a popular target for attackers in recent years, especially for deploying cryptocurrency miners. “Once a valid endpoint is discovered, it’s trivial to pull a malicious image and launch a container from it to carry out any conceivable objective. Hosting the malicious container in Dockerhub, Docker’s container image library, streamlines this process even further,” the company said.

    Cado said it observed attackers making HTTP POST requests to retrieve a malicious image from Dockerhub and spawn a container from it. The malicious Docker image, Cado says, has over 3,000 pulls and appears to be updated regularly.

    Baked within the image, OracleIV supports commands for UDP, UDP_PPS, SSL, SYN, HTTP/GET, and SLOW flood attacks, although some of the functions are not working.

    Resource : https://www.securityweek.com/mysql-servers-docker-hosts-infected-with-ddos-malware/

    18Jul, 2022
    Info Security News – Password recovery tool infects industrial systems with Salty malware

    Password Recovery Tool infects industrial systems with Salty malware.

    A threat actor is infecting industrial control systems (ICS) to create a botnet through password “cracking” software for programmable logic controllers (PLCs).

    Advertised on various social media platforms, the password recovery tools promise to unlock PLC and HMI (human-machine interface) terminals from Automation Direct, Omron, Siemens, Fuji Electric, Mitsubishi, LG, Vigor, Pro-Face, Allen Bradley, Weintek, ABB, and Panasonic.

    Security researchers at industrial cybersecurity company Dragos analyzed one incident impacting DirectLogic PLCs from Automation Direct and discovered that the “cracking” software was exploiting a known vulnerability in the device to extract the password.

    But behind the scenes the tool also dropped Sality, a piece of malware that creates a peer-to-peer botnet for various tasks that require the power of distributed computing to complete faster (e.g. password cracking, cryptocurrency mining).

    Dragos researchers found that the exploit used by the malicious program was limited to serial-only communications. However, they also found a way to recreate it over Ethernet, which increases the severity.

    After examining the Sality-laced software, Dragos informed Automation Direct of the vulnerability and the vendor released appropriate mitigations. The threat actor’s campaign is ongoing, though, and administrators of PLC from other vendors should be aware of the risk of using password cracking software in ICS environments.

    Regardless of how legitimate the reason for using them is, operational technology engineers should avoid password cracking tools, especially if their source is unknown.

    For scenarios where there is a need to recover a password (because you forgot it, or the individual that had it is no longer your colleague), Dragos recommends contacting them or the device vendor for instructions and guidance.

    Sality P2P botnet

    Sality is an old piece of malware that continues to evolve with features that allows it to terminate processes, open connections to remote sites, download additional payloads, or steal data from the host.

    The malware can also inject itself into running processes and abuse the Windows auto-run function to copy itself onto network shares, external drives, and removable storage devices that could carry it to other systems.

    The specific sample analyzed by Dragons appears to be focused on stealing cryptocurrency. The researchers say that the malware added a payload that hijacked the contents in the clipboard to divert cryptocurrency transactions.

    However, a more advanced attacker could use this point of entry to create more serious damage by disrupting operations.

    In this particular case, the victim grew suspicious after running the malicious software because the CPU usage level grew to 100% and Windows Defender issued multiple threat alerts.

    Recourse : https://www.bleepingcomputer.com/news/security/password-recovery-tool- infects-industrial-systems-with-sality-malware/