Hackers Exploit Jira, Exim Linux Servers to "Keep the Internet Safe'

guest · Jul 22, 2019

Hackers Exploit Jira, Exim Linux Servers to "Keep the Internet Safe'
July 22, 2019
https://www.bleepingcomputer.com/ne...exim-linux-servers-to-keep-the-internet-safe/

Hackers are exploiting vulnerable Jira and Exim servers with the end goal of infecting them with a new Watchbog Linux Trojan variant and using the resulting botnet as part of a Monero cryptomining operation.
Targeted Exim and Jira vulnerabilities
The newest variant spotted by Intezer Labs' researcher polarply on VirusTotal uses a malicious payload designed to exploit the 12-day old Jira template injection vulnerability tracked as CVE-2019-11581 that leads to remote code execution.
As per a Shodan search from today, there are more than 1,610,000 unpatched Exim servers that could be affected by this attack, as well as over 54,000 vulnerable Atlassian JIRA servers as per BinaryEdge.

What makes it highly dangerous is that this variant is not detected by any of the scanning engines on VirusTotal seeing that the Watchbog sample spotted by polarply has an AV detection ratio of 0/55 — more info is available on Intezer Analyze.
Click to expand...

There is one more thing that makes this particular Watchbog variant special besides the no VirusTotal detections and switching targets to Jira and Exim servers: the malicious script it uses to drop the coinminer on compromised Linux servers also includes a contact note for its victims.

While in previous versions of the malware, the attackers would only offer their services to remove the infection promising to send their victims a "cleanup script," "the source of entry and patch," this variant's note says that the attackers' mission is to "keep the internet safe."
Click to expand...

Log in or Sign up

Hackers Exploit Jira, Exim Linux Servers to "Keep the Internet Safe'

guest Guest

Log in or Sign up

Hackers Exploit Jira, Exim Linux Servers to "Keep the Internet Safe'

guest Guest

Useful Searches