Necro Python bot adds new exploits and Tezos mining to its bag of tricks
Summary: Cisco Talos documented the Necro Python bot, a self-replicating, polymorphic bot that spreads via SSH brute-forcing, SMB exploits including Python versions of EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147), and a Vesta Control Panel command injection, while using IRC for command-and-control. Its main payloads are DDoS attacks, network traffic sniffing and exfiltration through a SOCKS5 proxy, and XMRig Monero mining, with JavaScript miner code injected into .htm, .html, .php and .js files on Linux systems and Tezos (XTZ) mining commands observed in honeypots starting May 9.
What you should know: The actor behind Necro is actively folding newly published remote code execution exploits into the bot, and Talos observed one attempt to distribute bigRANSOM.exe alongside the miners - a sign the same infrastructure could pivot from cryptomining to ransomware against any server still running unpatched web applications.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2017-0144CVE-2017-0147
- Related
- CVE-2017-0147: Microsoft Windows SMBv1 Information Disclosure Vulnerability Known Exploited Vulnerabilities · May 24, 2022CVE-2017-0144: Microsoft SMBv1 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022