Wednesday, May 22, 2024

FreakOut Malware that Exploits Critical Vulnerabilities in Linux Devices

Check Point Research (CPR) encountered that ongoing attacks involve a new malware variant, called ‘FreakOut.’

The purpose behind these attacks is to create an IRC botnet. An IRC botnet is a collection of machines infected with malware that can be controlled remotely via an IRC channel to execute malicious commands.

It is used for malicious activities, such as launching DDoS attacks on other organizations’ networks, or for crypto-mining activity on infected machines, which can potentially shut down entire systems infected. The attacks are aimed at Linux devices.

The malware also comes with extensive capabilities consist of port scanning, information gathering, creation and sending of data packets, network sniffing, and the capability to launch DDoS and network flooding attacks.

Linux devices that run on of the following Products which have Vulnerabilities exploited by FreakOut malware

  • TerraMaster TOS (TerraMaster Operating System), a well-known vendor of data storage devices
  • Zend Framework, a popular collection of library packages, used for building web applications
  • Liferay Portal, a free, open-source enterprise portal, with features for developing web portals and websites

The attack exploits the following CVE’s :

  • CVE-2020-28188 – released 28/12/20 – TerraMaster TOS
  • CVE-2021-3007 – released 3/1/21 – Zend Framework
  • CVE-2020-7961 – released 20/03/20 – Liferay Portal

Patches are available for all products impacted in these CVEs.



  • TerraMaster TOS Command Injection (CVE-2020-28188).
  • Liferay Portal Insecure Deserialization (CVE-2020-7961).
  • Zend Framework Remote Code Execution (CVE-2021-3007).
  • CMD Injection Over HTTP


  • Win32.IRC.G
  • TC.a
  • Win32.N3Cr0m0rPh.TC.a
  • Win32.N3Cr0m0rPh.TC.b
  • Win32.N3Cr0m0rPh.TC.c
  • Win32.N3Cr0m0rPh.TC.d

For TerraMaster, the fixes will be implemented in version 4.2.07.

Liferay Portal users should upgrade to Liferay Portal 7.2 CE GA2 (7.2.1) or later. The maintainer no longer supports the Zend framework, and the lamins-http vendor released a relevant patch for this vulnerability should use 2.14.x bugfix release (patch).

FreakOut’s Impact

Researchers found evidence from the attack campaign’s main C&C server that around 185 devices had been hacked.

The geographies that were most targeted were North America and Western Europe. Industry sectors´ most targeted were finance, government and healthcare organizations.

Security Guidelines to Stay Protected

  • Users check and patch their servers and Linux devices
  • Intrusion Prevention Systems (IPS) prevent attempts to exploit weaknesses in vulnerable systems or applications. Updated IPS helps your organization stay protected.
  • Conventional signature-based Anti-Virus is a highly efficient solution for preventing known attacks.
  • Comprehensive advanced endpoint protection at the highest security level is crucial to avoid security breaches and data compromises


The threat actor behind the attack, named “Freak”, managed to infect many devices in a short period and incorporated them into a botnet, which in turn could be used for DDoS attacks and crypto-mining.

These attack campaigns emphasize the importance and significance of checking and protecting assets as an on-going basis. Therefore this ongoing campaign can spread quickly.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Also Read

NSA Revealed A Russian APT28 Hackers Made Previously Undisclosed Stealthy “Drovorub” Linux Malware

BootHole Vulnerability Affects Millions of Windows and Linux Systems – Allows Attackers to Install Stealthy Malware


Latest articles

Hackers Claiming Access to Qatar National Bank Database

A group of hackers has claimed to have accessed the database of Qatar National...

Cloud-Based Malware Attack Abusing Google Drive & Dropbox

A phishing email with a malicious zip attachment initiates the attack. The zip contains...

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles