Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”
Summary: Cisco Talos reports that an actor it calls Panda has run illicit cryptocurrency mining campaigns since summer 2018, using Masscan to find vulnerable servers and exploiting flaws including Apache Struts 2 CVE-2017-5638 and, by June 2019, WebLogic CVE-2019-2725. Talos estimates Panda amassed about 1,215 XMR worth roughly $100,000, and that a config file on list[.]idc3389[.]top had been downloaded more than 300,000 times by October 2018.
Why it matters: Panda exploits known vulnerabilities shortly after public proof-of-concept code appears, and Talos notes that any infection vector used to plant a miner could equally deliver other malware - so an unpatched host is not just a compute drain but an open door.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-5638
- Related
- CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021