Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner

Summary: The Apache Foundation released a bulletin on August 22, 2018 for CVE-2018-11776, a critical Apache Struts flaw allowing remote code execution through improper validation of namespace input data; a proof-of-concept exploit followed on August 23 and a Python script on August 24. Volexity observed scanning and attempted exploitation from IP addresses 95.161.225.94 and 167.114.171.27, with at least one threat actor attempting mass exploitation to install the CNRig cryptocurrency miner, which downloads Intel, ARM, and MIPS binaries and mines via us-east.cryptonight-hub.miningpoolhub.com on port 20580 under the account c646.miner.
What's compelling: The same unpatched Struts flaw that let this actor push a miner was the entry point for the Equifax breach, and Volexity reports multiple APT groups using Struts vulnerabilities to gain network access - so a cryptominer on the box may not be the only thing that got in.

Read the original at Volexity Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-11776
Related: CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Threat Brief: Information on Critical Apache Struts Vulnerability CVE-2018-11776 Cyber Risks ·
Detecting Apache Struts 2 Namespace RCE | Qualys Cyber Risks ·