StealthWorker Malware Uses Windows, Linux Bots to Hack Websites

guest · Mar 6, 2019

StealthWorker Malware Uses Windows, Linux Bots to Hack Websites
March 6,2019
https://www.bleepingcomputer.com/ne...are-uses-windows-linux-bots-to-hack-websites/

Hackers are running a new campaign which drops the StealthWorker brute-force malware on Windows and Linux machines that end up being used to brute force other computers in a series of distributed brute force attacks.

As later discovered, the malware is capable of exploiting a number of vulnerabilities in to infiltrate Magento, phpMyAdmin, and cPanel Content Management Systems (CMSs), as well as brute force its way in if everything else fails.

[...] the new campaign switched to a brute force-only approach aiming for any vulnerable host with weak or default credentials.
After a server has been hacked into, the FortiGuard Labs security researcher says that "depending on the system, it can then become another target for embedded skimmers or general data breaches."
Click to expand...

guest · Jun 4, 2020

Bruteforce malware probes login for popular web platforms
June 4, 2020
https://www.bleepingcomputer.com/ne...lware-probes-login-for-popular-web-platforms/

An aggressive tool hitting a sizable number of popular web services and platforms is trying to bruteforce its way in with login combinations obtained from parsing metadata from the target.

The malware looks for various systems for managing content, databases, and file transfers as well as backup files and administrator login paths.
Hitting CMS and services
In an analysis published today, Akamai Security Researcher Larry Cashdollar provides technical details on a piece of malware that is similar to Stealthworker, a Golang-based bruteforce tool that was analyzed in the past by Malwarebytes and Fortinet.

The version analyzed by Cashdollar targets cPanel, widely deployed CMS including WordPress, Drupal, Bitrix, OpenCart, Magento, and services like MySQL, PostgreSQL, SSH, and FTP. Previous analysis mentions phpMyAdmin, too.
Click to expand...

The researcher caught the malware in a honeypot and found that it assigns a role to each infected machine: scanner for other targets or bruteforce the login of an assigned target.
By using multiple machines to run the login attempts, the attackers are likely hoping to bypass bruteforce protections for an increased number of tries. This also allows them to reach a larger number of compromised hosts.
Click to expand...

Akamai: Stealthworker: Golang-based brute force malware still an active threat

guest · Aug 9, 2021

Synology warns of malware infecting NAS devices with ransomware
August 9, 2021
https://www.bleepingcomputer.com/ne...alware-infecting-nas-devices-with-ransomware/

Taiwan-based NAS maker Synology has warned customers that the StealthWorker botnet is targeting their network-attached storage devices in ongoing brute-force attacks that lead to ransomware infections.

According to Synology's PSIRT (Product Security Incident Response Team), Synology NAS devices compromised in these attacks are later used in further attempts to breach more Linux systems.

"These attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware," Synology said in a security advisory.
The company is coordinating with multiple CERT organizations worldwide to take down the botnet's infrastructure by shutting down all detected command-and-control (C2) servers.
Click to expand...

Synology® Investigates Ongoing Brute-Force Attacks From Botnet

Synology PSIRT (Product Security Incident Response Team) has recently seen and received reports on an increase in brute-force attacks against Synology devices. Synology's security researchers believe the botnet is primarily driven by a malware family called "StealthWorker." At present, Synology PSIRT has seen no indication of the malware exploiting any software vulnerabilities.

These attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware. Devices infected may carry out additional attacks on other Linux based devices, including Synology NAS.
Click to expand...

Log in or Sign up

StealthWorker Malware Uses Windows, Linux Bots to Hack Websites

guest Guest

guest Guest

guest Guest

Log in or Sign up

StealthWorker Malware Uses Windows, Linux Bots to Hack Websites

guest Guest

guest Guest

guest Guest

Useful Searches