Monday, March 4, 2024

Capoae Malware Attacking Linux systems & Web Apps Using Multiple Vulnerabilities

A senior security researcher Larry Cashdollar, has detected malware that is dubbed Capoae on Thursday, and this malware by exploiting the multiple vulnerabilities is attacking the Linux systems and several web applications. 

The Capoae malware was actually written in the Golang programming language, and it has soon become the firm favorite since it has cross-platform capabilities.

Moreover, it also spreads through identified bugs and weak official credentials. However, the vulnerabilities that were exploited by Capoae append:- 

The main motive of the malware is to grow by taking advantage of vulnerable systems and weak administrative credentials as we hinted above. 

Apart from spreading crypto-mining malware attacks, the cyber security analysts also found that the SIRT honeypots were also affected by PHP malware that appeared through a backdoored which is an extension to a WordPress plugin called “Download-monitor.”

Now to deploy the main Capoae payload to /tmp this plugin was used as a channel, and once done, then a 3MB UPX packed binary was decoded. And all these steps were executed to install XMRig to mine Monero (XMR) cryptocurrency.

What is in the binary?

After detecting the malware, cybersecurity authorities initiated a strong investigation to know all the details about these vulnerabilities. And to do so, they unpacked the malware along with ‘upx -d’, to have a proper look at the actual binary structure. 

Here the researchers declared that they have found many key details regarding the vulnerabilities, and they noticed that the main structure reveals that it has functions that are targeting a handful of well-known vulnerabilities and has content management frameworks. 

The Golang malware can be found in VirusTotal with an origin date of 8/9/2021:-

$ ./redress -compiler Capoae 

Compiler version: go1.15.4 (2020-11-05T21:21:32Z)

However, this Capoae campaign’s use of several vulnerabilities and different methods during the attack highlights that how intent these threat actors are on getting a foothold on as many machines as they can.


The most important point is that the techniques that were used by the threat actors, were the same methods that are recommended for most companies to keep their systems and networks secure. 

But, one can understand if they got attacked or not by seeing:- 

  • High system resource use
  • Accidental or unrecognizable system processes in administration
  • Unfamiliar log entries or artifacts

This type of campaign is quite dangerous for the organization, that’s why every user must have a brief knowledge regarding this kind of attack, and how they will overcome it efficiently.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates


Latest articles

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles