In a security investigation conducted it was determined that a botnet known as “KashmirBlack” has infected thousands of websites since November 2019 and continues to grow actively, attacking content management systems (CMS) such as WordPress, Joomla !, Drupal and others. . The main objective of this botnet is to infect the websites and use the servers for cryptocurrency mining, redirect legitimate site traffic to spam pages and to a lesser degree, display web distortions.<\/p>\n\n\n\n
According to the researchers, this botnet started out very small, but after months of constant growth, it has grown into a giant network capable of attacking thousands of sites per day. This is due to its well-designed infrastructure, which facilitates its expansion and the addition of exploits or payloads without much effort, in addition to using sophisticated methods to disguise itself and go unnoticed, protecting its operation.<\/p>\n\n\n\n
The main purpose of KashmirBlack is to use the resources of compromised systems (CPU, GPU) for Monero cryptocurrency mining and redirect legitimate website traffic to spam pages. The exploitation begins by making use of the PHPUnit RCE vulnerability (CVE-2017-9841) to infect clients with the payload that will later communicate with the C2 server.<\/p>\n\n\n\n
On the other hand, during the investigation period, it was possible to see that the botnet has taken advantage of 16 known vulnerabilities in addition to the one we have already seen and addressed in different systems, some of them very critical:<\/p>\n\n\n\n
\u25b8Remote code execution in PHPUnit – CVE-2017-9841.<\/em><\/strong><\/p>\n\n\n\n \u25b8JQuery File Upload Vulnerability – CVE-2018-9206.<\/em><\/strong><\/p>\n\n\n\n \u25b8Command injection in ELFinder – CVE-2019-9194.<\/em><\/strong><\/p>\n\n\n\n \u25b8Remote file upload vulnerability in Joomla!<\/em><\/strong><\/p>\n\n\n\n \u25b8Local File Inclusion vulnerability in Magento – CVE-2015-2067.<\/em><\/strong><\/p>\n\n\n\n \u25b8Magento web form loading vulnerability.<\/em><\/strong><\/p>\n\n\n\n \u25b8CMS Plupload arbitrary file upload vulnerability.<\/em><\/strong><\/p>\n\n\n\n \u25b8Vulnerability in Yeager CMS – CVE-2015-7571.<\/em><\/strong><\/p>\n\n\n\n \u25b8RFI (Remote File Inclusion) vulnerability in WordPress TimThumb – CVE-2011-4106.<\/em><\/strong><\/p>\n\n\n\n \u25b8Uploadify remote code execution vulnerability.<\/em><\/strong><\/p>\n\n\n\n \u25b8Remote Code Execution in vBulletin Widget – CVE-2019-16759.<\/em><\/strong><\/p>\n\n\n\n \u25b8Remote code execution in WordPress install.php – CVE-2011-4899.<\/em><\/strong><\/p>\n\n\n\n \u25b8Brute force attack on WordPress xmlrpc.php Login.<\/em><\/strong><\/p>\n\n\n\n \u25b8Multiple remote code execution vulnerabilities in WordPress plugins and themes.<\/em><\/strong><\/p>\n\n\n\n \u25b8File upload vulnerability in Webdav.<\/em><\/strong><\/p>\n\n\n\n Also check: In a security investigation conducted it was determined that a botnet known as “KashmirBlack” has infected thousands of websites since November 2019 and continues to grow actively, attacking content management systems (CMS) such as WordPress, Joomla !, Drupal and others. . The main objective of this botnet is to infect the websites and use the […]<\/p>\n","protected":false},"author":1,"featured_media":2833,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14,10],"tags":[186,36],"class_list":["post-2830","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-botnets","category-cybersecurity","tag-botnets","tag-cybersecurity"],"yoast_head":"\n
Gafgyt is a botnet that uses Mirai DDoS modules<\/a>
FreakOut \u2013 A Botnet targeting Linux<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"