Skip to main content

Tuyul IRC Botnet

First observed in January 2020, Tuyul is a Perl-based Internet Relay Chat (IRC) botnet targeting a known vulnerability in the PHPUnit testing framework.

Threat ID:
CC-3389
Category:
Threat Severity:
Low
Threat Vector:
Published:
10 March 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

First observed in January 2020, Tuyul is a Perl-based Internet Relay Chat (IRC) botnet targeting a known vulnerability in the PHPUnit testing framework.

Threat details

Tuyul is delivered using a PHPUnit remote code execution exploit. If successful, it will then connect to one of a number of command and control servers, at which point the attackers will install an obfuscated PHP web shell or connect the system to an IRC botnet. At the time of publication, it is unclear what Tuyul is being used for.

For further information:

Remediation steps

Type Step

To prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Main indicators

IP Addresses

  • 103[.]3[.]189[.]32
  • 104[.]27[.]154[.]113
  • 104[.]27[.]182[.]106
  • 118[.]27[.]6[.]13
  • 138[.]68[.]152[.]125
  • 139[.]99[.]121[.]227
  • 140[.]82[.]56[.]119
  • 142[.]93[.]179[.]244
  • 142[.]93[.]185[.]6
  • 159[.]203[.]189[.]141
  • 178[.]128[.]35[.]202
  • 178[.]128[.]95[.]201
  • 20[.]37[.]96[.]167
  • 31[.]220[.]52[.]186
  • 40[.]112[.]129[.]217
  • 45[.]63[.]127[.]55
  • 45[.]77[.]97[.]0
  • 52[.]156[.]59[.]22
  • 63[.]250[.]33[.]43
  • 95[.]216[.]210[.]246

URLs

  • irc[.]localroot[.]xyz
  • localroot[.]xyz
  • zer0art[.]com

SHA1 File Hashes

  • 0204e028d242a0cbf1e1611908ff1895
  • 0323eb136c586b96cfade4407fa9abb7
  • 072f9f015fddcbdc1373633dcf8c7520
  • 111b543c6d110da5b3a070fdc44e4c7d
  • 333a1032f001c677f9925ef228830103
  • 3edcfecb434338580966e7fe8e0bf896
  • 5cfb092096be472eae67248a25ff57f6
  • 66027930586b3dbec1c1f84392b0dc13
  • 83d555ff340c7a8f3e7c40de496378ae
  • 847c8d52bc9c58c1e479fbb0d294cfec
  • 89398067c033a4d5c69ec56a95ea502f
  • 8edca42ab0ecc6358eac61a8cf53183f
  • 9398caaa1f4f583fcd3b6fa51622d3eb
  • 94186bb97a20b207507b4913ef3aa9a9
  • cbf995e0372230b345cd62178bec5635
  • e2a2b5f9d8798b0865c2f598e7662714

CVE Vulnerabilities

Status

CVE-2017-9841

Last edited: 29 June 2021 12:00 pm