A New Shellshock Worm on the Loose
Summary: Starting late in the afternoon on April 8, 2015, Volexity observed a sharp increase in Shellshock scanning over HTTP, driven by a worm-like script that exploits the User-Agent header and walks a list of cgi-bin paths. Successful hosts download a tarball (cc.tar) containing 32-bit and 64-bit scanning binaries, scan blocks of tens of thousands of IP addresses, and report vulnerable hosts back to 109.228.25.87 via .c.php?request=, adding themselves to the scanning network.
Key Takeaway: Every exploited host becomes a scanner for the next, and the attacker's check-in URL builds a standing list of vulnerable systems - so even after 109.228.25.87 was taken down and scanning slowed, that inventory of compromised hosts likely persists. Outbound traffic to 109.228.25.87 is the most solid indicator Volexity names.
Read the original at Volexity Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026