Cisco Talos Honeypot Analysis Reveals Rise in Attacks on Elasticsearch Clusters
Summary: Cisco Talos honeypots recorded a spike in attacks on unsecured Elasticsearch clusters running version 1.4.2 and lower, exploiting CVE-2014-3120 and CVE-2015-1427 to pass scripts to search queries and drop payloads. Talos assesses with moderate confidence that six distinct actors are involved, delivering cryptocurrency miners, a Bill Gates DDoS derivative, and a UPX-packed ELF executable carrying exploits for Drupal CVE-2018-7600, Oracle WebLogic CVE-2017-10271, and Spring Data Commons CVE-2018-1273.
What's compelling: The vulnerabilities exist only in Elasticsearch 1.4.2 and lower, so any cluster still on those versions is exposed to actors whose payloads also pivot to Drupal, WebLogic, and Spring Data Commons - and because these clusters hold very large datasets, Talos calls the potential impact of a breach severe.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2014-3120CVE-2015-1427CVE-2017-10271CVE-2018-1273CVE-2018-7600
- Related
- Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices Cyber Risks ·Drupalgeddon 2: Profiting from Mass Exploitation Cyber Risks ·Rocke: The Champion of Monero Miners Cyber Risks ·