Attackers Turn Elasticsearch Databases Into DDoS Bots

guest · Jul 23, 2019

Attackers Turn Elasticsearch Databases Into DDoS Bots
A recently detected attack campaign is attempting to ensnare Elasticsearch clusters into a distributed denial of service (DDoS) botnet
July 23, 2019
https://www.securityweek.com/attackers-turn-elasticsearch-databases-ddos-bots

As part of the attack, the threat actor searches for exposed or publicly accessible Elasticsearch databases/servers. A shell is invoked with an attacker-crafted search query with encoded Java commands and then the first malicious script is downloaded.

The first-stage script attempts to shut down the firewall and any competing cryptocurrency mining programs already running on the target server. Next, a second-stage script is retrieved, likely from a compromised website.
The actor behind these attacks is believed to be using expendable domains to quickly swap URLs when they are detected. By abusing compromised websites, the attackers can evade detection, Trend Micro says.

The second-stage script has functions similar to those of the first, as it too attempts to stop the firewall. It also removes certain files, likely associated with competing malware, along with various configuration files from the /tmp directory.
Click to expand...

The final payload is a backdoor capable of stealing system information and launching DDoS attacks. The threat was previously observed using an exploit for CVE-2017-5638, a remote-code-execution vulnerability in Apache Struts 2.

The assaults on Elasticsearch servers are relatively straightforward and profit-driven, Trend Micro says.
Click to expand...

Trend Micro: Multistage Attack Delivers BillGates/Setag Backdoor, Can Turn Elasticsearch Databases into DDoS Botnet ‘Zombies’

Log in or Sign up

Attackers Turn Elasticsearch Databases Into DDoS Bots

guest Guest

Log in or Sign up

Attackers Turn Elasticsearch Databases Into DDoS Bots

guest Guest

Useful Searches