New BoSSaBoTv2 botnet targeting vulnerable Servers

Status
Not open for further replies.

Petrovic

Level 64
Thread author
Verified
Honorary Member
Top Poster
Well-known
Apr 25, 2013
5,354
Trustwave has detected a new series of attacks on servers worldwide based on the exploitation of old CGI-PHP vulnerability to spread BoSSaBoTv2 botnet.
It was 2012 when security experts discovered a security flaw (CVE-2012-1823) in some PHP builds that could be exploited by a threat actor to remotely execute commands on the affected server, if PHP was configured as a CGI script (PHP-CGI) at the time.

Security experts have recently discovered that the old CGI-PHP vulnerability is now exploited on a large scale to recruit machines for a botnet used with a primary purpose to mine Bitcoin. The researchers have detected different reconnaissance activities on a large scale, attackers were scanning for the above flaws in an automated fashion, and the operations were linked to various attacks over the years.



Trustwave, analyzing the traffic related to the spike in scanning activities detected in August, has noticed an uptick in attacks targeting the PHP-CGI vulnerability to deploy the BoSSaBoTv2 bot. In the same period, a researcher discovered an ad online offering the source code to BoSSaBoTv2 and just a few weeks later the malware was having risen in Internet again.

Once infected the machine, the BoSSaBoTv2 malware allows a remote attacker to control the servers using a shell or IRC. As explained in the blog post it could be used for Bitcoin mining as well as for DDoS attacks.

“Notice some of these features including bundling a Bitcoin Miner program. This is interesting as this shows another aspect how an attacker is looking to abuse their access to a compromised web server. They can siphon off local system resources such as CPU and RAM in attempts to create Bitcoins. Here are some of the commands for downloading and running the Bitcoin miner -” reports the post from Trustwave about the mining feature implemented in the BoSSaBoTv2 malware.

Full Article
 
  • Like
Reactions: viktik
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top