Hide ‘N Seek Botnet Updates Arsenal with Exploits Against Nexus Repository Manager & ThinkPHP
Summary: Unit 42 documented a Hide 'N Seek botnet variant first seen on February 21, 2019 that added exploits for CVE-2018-20062 in ThinkPHP installations and CVE-2019-7238, a remote code execution flaw in Sonatype Nexus Repository Manager 3. The report states this was the earliest exploitation of CVE-2019-7238 in the wild, predating its use by the DDG botnet, and the variant also switched to an XOR key of 0x87 for string encryption and carried a new list of hard-coded P2P peers.
Key Takeaway: A peer-to-peer botnet that first appeared in January 2018 keeps widening its target list, and it reached CVE-2019-7238 before any other known actor - so an unpatched Nexus Repository Manager 3 instance is not a theoretical exposure but a documented one.