News

Hackers attack Jira and Exim servers to install Watchbog Linux Trojan

Cybercriminals attack vulnerable Jira and Exim servers in order to infect them with the new version of Linux-Trojan Watchbog and Monero cryptocurrency mining.

Watchbog is a malicious software for infecting Linux-based servers by operating vulnerable software, such as Jenkins, Nexus Repository Manager 3, ThinkPHP or Linux Supervisord.

According to a researcher from Intezer Labs, the latest version of the malware exploits the newly discovered template injection vulnerability (template injection) in Jira (CVE-2019-11581), which allows executing remote code.

Tweet of researcher Intezer Labs

The malware also exploits a RCE vulnerability in Exim (CVE-2019-10149), which allows attackers to execute commands with root permissions.

According to the Shodan search, there are currently more than 1,610,000 vulnerable Exim servers on the network, as well as over 54,000 vulnerable Atlassian JIRA servers.

“The fact that the Jira CVE-2019-11581 template injection vulnerability these attackers are targeting has been publicly disclosed just 12 days ago stands as proof to the speed at which threat actors are starting to abuse new security flaws”, — conclude Bleepingcomputer journalists.

Having exploited the vulnerabilities, Watchbog uploads a crypto-miner to extract Monero currency and takes steps to maintain its presence on the system. In particular, it adds itself to several crontab files to reinfect the system if the user deletes one of these files.

Extracted currency is sent to:

47k2wdnyyBoMT6N9ho5Y7uQg1J6gPsTboKP6JXfB5msf3jUUvTfEceK5U7KLnWir5VZPKgUVxpkXnJLmijau3VZ8D2zsyL7

During the campaign, attackers managed to get 53 XMR (approximately $4503).

One of the distinguishing features of this campaign is that the malware leaves a message to its victims, according to which the motive of the intruders is “Internet security”.

Watchbog fighting to keep the Internet safe

What makes it highly dangerous is that this variant is not detected by any of the scanning engines on VirusTotal.

But, according to the Watchbog operators, the malware is intended only for mining cryptocurrency, and they have no intention to modify the data stored on the servers or demand a ransom.

Polina Lisovskaya

I works as a marketing manager for years now and loves searching for interesting topics for you

Recent Posts

Remove Kabatibly.co.in Pop-up Ads

About Kabatibly.co.in Kabatibly.co.in pop-ups can not introduce out of nowhere. If you have clicked some…

9 hours ago

Remove Reditarcet.co.in Pop-up Ads

About Reditarcet.co.in Reditarcet.co.in pop-ups can not introduce out of the blue. If you have clicked…

9 hours ago

Remove Everestpeak.top Pop-up Ads

About Everestpeak.top Everestpeak.top pop-ups can not open out of the blue. If you have actually…

13 hours ago

Remove Firm-jawed.yachts Pop-up Ads

About Firm-jawed.yachts Firm-jawed.yachts pop-ups can not launch out of nowhere. If you have clicked some…

13 hours ago

Remove Anapurnatop.top Pop-up Ads

About Anapurnatop.top Anapurnatop.top pop-ups can not expose out of nowhere. If you have clicked on…

13 hours ago

Remove Boomira.com Pop-up Ads

About Boomira.com Boomira.com pop-ups can not open out of nowhere. If you have clicked on…

14 hours ago