Exim Mining Worm

A new unnamed worm has been observed exploiting the recently disclosed Exim vulnerability, CVE-2019-10149, to install cryptocurrency miners on affected mail servers.

Threat ID:: CC-3104
Category:: Worm
Threat Severity:: Medium
Threat Vector:: Vulnerability
Published:: 19 June 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

A new unnamed worm has been observed exploiting the recently disclosed Exim vulnerability, CVE-2019-10149, to install cryptocurrency miners on affected mail servers.

Affected platforms

The following platforms are known to be affected:

Exim

Exim mail servers - Versions prior to 4.92

Threat details

The worm identifies new target servers using a Python-based port scanning module. It will then execute an initial script to install itself on the new servers. Several scripts are then downloaded and executed to create cronjobs in order to maintain persistence and download other payloads. The worm will also add its own RSA authentication key to the server's root directory.

At the time of publication, only a cryptocurrency mining module has been seen being installed by the worm, although it is possible that other payloads may be installed in the future.

For further information:

CVE-2019-10149

Remediation steps

Type	Step
	Exim released an update to address CVE-2019-10149. Organisations are encouraged to apply this update immediately. Additionally, to prevent and detect an infection, ensure that: A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails. All operating systems, anti-virus and other security products are kept up-to-date. Regular anti-virus and security scans are performed on your organisation’s estate. All day-to-day computer activities such as email and internet are performed using non-administrative accounts. Strong password policies are in place. Network, proxy and firewall logs should be monitored for suspicious activity. User accounts accessed from affected devices should be reset on a clean computer. Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Type

Step

Exim released an update to address CVE-2019-10149. Organisations are encouraged to apply this update immediately.

Additionally, to prevent and detect an infection, ensure that:

A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
All operating systems, anti-virus and other security products are kept up-to-date.
Regular anti-virus and security scans are performed on your organisation’s estate.
All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
Strong password policies are in place.
Network, proxy and firewall logs should be monitored for suspicious activity.
User accounts accessed from affected devices should be reset on a clean computer.
Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

CVE Vulnerabilities

Status

CVE-2019-10149

Last edited: 14 February 2020 2:45 pm