Threat actors actively exploiting the patched ThinkPHP remote code execution vulnerability to gain control over the web servers.
Trend Micro observed the new campaign in which the Cybercriminals exploiting ThinkPHP Vulnerability to expand the Hakai and Yowai Botnets.
In this campaign threat, actors used botnets to breach websites using the vulnerability in the framework invoke function method to execute malicious code on the server.
“Cybercriminals use websites created using the PHP framework to breach web servers via dictionary attacks on default credentials and gain control of these routers for distributed denial of service attacks (DDoS).” reads Trend Micro blog post.
According to researchers, Yowai botnet has the same configuration table as like the Mirai variants and additionally adds the ThinkPHP exploit with other vectors.
Yowai carries out communication with command and control server over port 6 to receive commands and once it infects the router, then it launches a dictionary attack to infect other devices.
All the infected devices then turn to be a part of the botnet and the threat actors use the botnet to launch highly intensive DDoS attacks.
Along with ThinkPHP Vulnerability Yowai exploiting following vulnerabilities that includes CVE-2014-8361, a Linksys RCE, CVE-2018-10561, CCTV-DVR RCE.
Hakai botnet previously targets only IoT devices, in this new campaign it adds a number of exploits including ThinkPHP, D-Link DSL-2750B router vuln, CVE-2015-2051, CVE-2014-8361, and CVE-2017-17215.
Hakai and Yowai can easily be abused by cybercriminals to breach web servers and attack websites, researchers concluded.
Hackers Offering DDoS-for-Hire Service Powered by Bushido Botnet in Dark Web Markets
Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack
A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…
Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…
The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…
Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…
A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…