Capoae Malware Ramps Up: Uses Multiple Vulnerabilities and Tactics to Spread

guest · Sep 21, 2021

New Capoae Malware Infiltrates WordPress Sites and Installs Backdoored Plugin
September 21, 2021
https://thehackernews.com/2021/09/new-capoae-malware-infiltrates.html

A recently discovered wave of malware attacks has been spotted using a variety of tactics to enslave susceptible machines with easy-to-guess administrative credentials to co-opt them into a network with the goal of illegally mining cryptocurrency.

"The malware's primary tactic is to spread by taking advantage of vulnerable systems and weak administrative credentials. Once they've been infected, these systems are then used to mine cryptocurrency," Akamai security researcher Larry Cashdollar said in a write-up published last week.
The PHP malware — codenamed "Capoae" (short for "Сканирование," the Russian word for "Scanning") — is said to be delivered to the hosts via a backdoored addition to a WordPress plugin called "download-monitor," which gets installed after successfully brute-forcing WordPress admin credentials.
Click to expand...

"The Capoae campaign's use of multiple vulnerabilities and tactics highlights just how intent these operators are on getting a foothold on as many machines as possible," Cashdollar said.
Click to expand...

Akamai: Capoae Malware Ramps Up: Uses Multiple Vulnerabilities and Tactics to Spread

Recently, there has been a plethora of UPX packed crypto-mining malware written in Golang targeting Linux systems and web applications popping up in the news. The malware’s primary tactic is to spread by taking advantage of vulnerable systems and weak administrative credentials. Once they’ve been infected, these systems are then used to mine cryptocurrency. I’ve named the sample I examined for this post ‘Capoae,’ based on the code’s output to my terminal.

Keeping an eye out for higher than normal system resource consumption, odd/unexpected running processes, suspicious artifacts (files, crontab entries, SSH keys, etc.), and suspicious access log entries, etc., will help you potentially identify compromised machines.
Click to expand...

Log in or Sign up

Capoae Malware Ramps Up: Uses Multiple Vulnerabilities and Tactics to Spread

guest Guest

Log in or Sign up

Capoae Malware Ramps Up: Uses Multiple Vulnerabilities and Tactics to Spread

guest Guest

Useful Searches