Golang Mining Worm Targeting Linux Servers

A new unnamed Golang based worm has been observed targeting Linux servers. The worm installs a cryptocurrency miner and attempts to spread to other systems.

Threat ID:: CC-3135
Category:: Worm
Threat Severity:: Low
Threat Vector:: Vulnerability
Published:: 9 July 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

A new unnamed Golang based worm has been observed targeting Linux servers. The worm installs a cryptocurrency miner and attempts to spread to other systems.

Affected platforms

The following platforms are known to be affected:

Linux

Linux servers with one or more of the following enabled or installed:

SSH
Redis Database services - All versions
ThinkPHP - Versions prior to 3.2.4
Atlassian Confluence Server and Confluence Data Center:
- Versions prior to 6.6.12
- Versions from 6.7.0 prior to version 6.12.3
- Versions 6.13.0 prior to version 6.13.3
- Version 6.14.0 prior to 6.14.2
Drupal:
- Versions 8.2.x and earlier
- Versions 7.x prior to version 7.58
- Versions 8.3.x prior to version 8.3.9
- Versions 8.4.x prior to version 8.4.6
- Versions 8.5.x prior to version 8.5.1

Threat details

The worm spreads by attempting to exploit four web application vulnerabilities or by brute forcing Secure Shell (SSH) and Redis database services on the target system using a hardcoded set of credentials. Once the worm is established on the system it downloads and executes three scripts.

The first script contains a set of installation instructions, the second and third scripts contain the code and configuration for the cryptocurrency miner. When the first script executes, it attempts to carry out a series of activities:

The script attempts to disable security features including SELinux.
A scheduled job is created that downloads and runs the installation script every fifteen minutes in order to maintain persistence.
All processes with a CPU usage greater than 30% are killed.
The script attempts to connect to all known SSH hosts in the directory and execute the payload.
The cryptocurrency miner is installed and run as a service.

For further information

Remediation steps

Type	Step
	To prevent and detect an infection, ensure that: Users and administrators are encouraged to review the following vendor security advisories and apply the necessary updates. Atlassian security advisory CONFSERVER-57974 Drupal security advisory SA-CORE-2018-002 All operating systems, anti-virus and other security products are kept up-to-date. Regular anti-virus and security scans are performed on your organisation’s estate. All day-to-day computer activities such as email and internet are performed using non-administrative accounts. Strong password policies are in place. Network, proxy and firewall logs should be monitored for suspicious activity. User accounts accessed from affected devices should be reset on a clean computer. Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Type

Step

To prevent and detect an infection, ensure that:

Users and administrators are encouraged to review the following vendor security advisories and apply the necessary updates.
- Atlassian security advisory CONFSERVER-57974
- Drupal security advisory SA-CORE-2018-002
All operating systems, anti-virus and other security products are kept up-to-date.
Regular anti-virus and security scans are performed on your organisation’s estate.
All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
Strong password policies are in place.
Network, proxy and firewall logs should be monitored for suspicious activity.
User accounts accessed from affected devices should be reset on a clean computer.
Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

CVE Vulnerabilities

Status

CVE-2019-9082

Status

CVE-2019-3396

Status

CVE-2018-7600

Last edited: 14 February 2020 2:44 pm