Thursday, March 28, 2024

Hackers Exploiting ThinkPHP Vulnerability To Expand Hakai and Yowai Botnets

Threat actors actively exploiting the patched ThinkPHP remote code execution vulnerability to gain control over the web servers.

Trend Micro observed the new campaign in which the Cybercriminals exploiting ThinkPHP Vulnerability to expand the Hakai and Yowai Botnets.

In this campaign threat, actors used botnets to breach websites using the vulnerability in the framework invoke function method to execute malicious code on the server.

“Cybercriminals use websites created using the PHP framework to breach web servers via dictionary attacks on default credentials and gain control of these routers for distributed denial of service attacks (DDoS).” reads Trend Micro blog post.

ThinkPHP
Default Credentials

According to researchers, Yowai botnet has the same configuration table as like the Mirai variants and additionally adds the ThinkPHP exploit with other vectors.

Yowai carries out communication with command and control server over port 6 to receive commands and once it infects the router, then it launches a dictionary attack to infect other devices.

All the infected devices then turn to be a part of the botnet and the threat actors use the botnet to launch highly intensive DDoS attacks.

Along with ThinkPHP Vulnerability Yowai exploiting following vulnerabilities that includes CVE-2014-8361, a Linksys RCE, CVE-2018-10561, CCTV-DVR RCE.

Hakai botnet previously targets only IoT devices, in this new campaign it adds a number of exploits including ThinkPHP, D-Link DSL-2750B router vuln, CVE-2015-2051, CVE-2014-8361, and CVE-2017-17215.

Hakai and Yowai can easily be abused by cybercriminals to breach web servers and attack websites, researchers concluded.

Related Read

Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server

Hackers Offering DDoS-for-Hire Service Powered by Bushido Botnet in Dark Web Markets

Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles