The recently disclosed critical Spring4Shell vulnerability is being actively exploited by threat actors to execute the Mirai botnet malware, particularly in the Singapore region since the start of April 2022.
“The exploitation allows threat actors to download the Mirai sample to the ‘/tmp’ folder and execute them after permission change using ‘chmod,'” Trend Micro researchers Deep Patel, Nitesh Surana, Ashish Verma said in a report published Friday.
Tracked as CVE-2022-22965 (CVSS score: 9.8), the vulnerability could allow malicious actors to achieve remote code execution in Spring Core applications under non-default circumstances, granting the attackers full control over the compromised devices.
The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) earlier this week added the Spring4Shell vulnerability to its Known Exploited Vulnerabilities Catalog based on “evidence of active exploitation.”
This is far from the first time the botnet operators have quickly moved to add newly publicized flaws to their exploit toolset. In December 2021, multiple botnets including Mirai and Kinsing were uncovered leveraging the Log4Shell vulnerability to breach susceptible servers on the internet.
Mirai, meaning “future” in Japanese, is the name given to a Linux malware that has continued to target networked smart home devices such as IP cameras and routers and link them together into a network of infected devices known as a botnet.
The IoT botnet, using the herd of hijacked hardware, can be then used to commit further attacks, including large-scale phishing attacks, cryptocurrency mining, click fraud, and distributed denial-of-service (DDoS) attacks.
To make matters worse, the leak of Mirai’s source code in October 2016 has given birth to numerous variants such as Okiru, Satori, Masuta, and Reaper, making it an ever-mutating threat.
“The [Mirai] code is so influential that even some of the malware offshoots are starting to have their own code versions released and co-opted by other cyber criminals,” Intel 471 researchers said last month, pointing out the upload of the BotenaGo botnet’s source code on GitHub in January 2022.
Read more:https://bit.ly/3JHzTId
You can also read this: Researchers Expose Mars Stealer Malware Campaign Using Google Ads to Spread