Skip to main content

Eight Australian web hosting providers compromised in ‘​Manic Menagerie’ attack campaign

 
 
  • Vulnerabilities within web applications and information stealing malware were leveraged to perform the attack.
  • One vulnerability that was exploited in the attack was related to privilege escalation - CVE-2018-1038, also known as TotalMeltdown.
According to a recent report from the Australian Cyber Security Center (ACSC), eight Australian web hosting providers were compromised in a malware attack in 2018.
Attack method
It was revealed that hackers abused the flaws with web applications to get root access to web servers. Upon gaining access, they installed a malware - that included both password stealing tools and the Gh0st remote access tool (RAT).
Further analysis revealed that the attackers used a web browser to manually interact with the targeted websites and find the vulnerabilities. Once identified, the attackers manually exploited these flaws to create a web shell on the server. This enabled them to gain control over the websites and perform future interactions remotely.
“The actor’s privilege escalation tools were all public proof of concepts (POC) and demonstrated an ability to quickly use new POC exploits,” the center said in a report.
About Gh0st RAT
Gh0st is a fully featured remote access tool (RAT). The malware’s capabilities include recording keystrokes, capturing recordings from webcam and microphone, stealing files from victims’ systems, downloading additional payloads and providing full remote control of a host.
"When executed, the Gh0st dropper creates a Windows executable with a .gif extension in a legitimate Windows directory then registers a new service to execute the dropped file on start-up," stated the report. "Every execution of the dropper results in a binary with a different hash being generated which causes hash-based detection to be ineffective."
Two of the eight compromised web hosting providers were used for mining Monero cryptocurrency. While none of the websites’ names have been disclosed by the ACSC, it is found that attackers had stolen a sum of AU$3868 (approximately 22.57 XMR).
The ACSC found that actors had modified some of these sites to boost SEO rankings and to redirect legitimate traffic to sites selling illegitimate products.
In the wake of the malware attack campaign, the ACSC has advised web hosting providers to patch their web applications and CMSs, disable malicious plugins and reset user credentials.

Global Locations

  • Block A, A-25, Second Floor, Sector 3
    Noida, Uttar Pradesh
    +91-120 429 1672+91 931 991 8771

Comments

Popular posts from this blog

Digital Marketing Services in noida

Red Securium Company Provide Digital Marketing Service In Noida Strengthen your brand positioning, awareness, revenue objectives and market share with our custom-built digital marketing services to suit their business needs. Get easily accessible to your target audience on mobiles and social networking sites across different platforms. Our cross-functional digital marketing experts offer end-to-end digital marketing solutions that are in step with your business's goals and policies. Our targeted digital marketing campaigns are custom-structured for helping you in strengthening your brand positioning, awareness, revenue objectives and market share. Digital Marketing Services  Digital Marketing Service  Social Network Marketing Service Seo Services Marketing  PPC Marketing Service  Social Media Marketing Sales Generation Services  Mobile Marketing Service  Content Marketing Service Event Marketing Service  Vide...

How To Access Notorious Dark Web Anonymously (10 Step Guide)

Are you trying to find out  how to access the dark web  and what is it? Well, look no further, we have gone and done the research so we could show you step by step the best and safest way how to access the dark net. We cover everything, from setting up Tor, how to choose a VPN , what not to do, finding the best sites to access, and extra steps to remain anonymous. It is extremely easy to access the dark web and even easier to be detected on it if you don’t take precautions. If you are new to the darknet, this guide will help you on your way. According to researchers, only 4% of the internet is visible to the general public. Meaning that the remaining 96% of the internet is made up of “The Deep Web”. Dark Web or Dark Net  is a subset of the  Deep Web  where there are sites that sell drugs, hacking software, counterfeit money and more. We explain this further down the article if you are not up to speed. If you are looking to access hidden marketpl...

Tr0ll 1.0 – Vulnhub CTF Challenge Walkthrough

  Tr0ll 1.0 is an intentionally vulnerable machine, which is more of a   CTF  like type than real world scenario. Nevertheless, this machine has its own difficulties and you can learn some new stuff from it. So, let’s start. Enumeration Phase Let’s first run  netdiscover  to find the IP of our machine. netdiscover -r 192.168.1.1/24 After that, we run our typical  nmap  scan to see the open ports in the machine. nmap -A -sS -Pn -vv [target] Great we see many interesting stuff here. First of all, there is an open  FTP  port and we can connect to it with  anonymous access .  Also there is an open  http  port, we will run a nikto scan for it. The  ssh  port will be valuable later. From the nikto scan we got an interesting  /secret/  folder. When we get inside, we can understand why the machine got this name. Nothing interesting here, as you can see. we got trolled Let’s connect ...