Type
|
Botnet |
Target
|
Content Management System (CMS) |
KashmirBlack botnet has been active since November 2019 and is linked to an Indonesian hacker group known as PhantomGhost. Earlier the botnet's primary purpose was to infect websites and use their servers for cryptocurrency mining, redirecting legitimate traffic to spam pages and defacing websites. But in May of 2020 KashmirBlack underwent a couple of changes. The botnet now handles hundreds of bots, each communicating with the C2 server, performing brute force attacks, installing backdoors, and continuously expanding the size of the botnet.
KashmirBlack hunts for sites that use outdated software and then uses the exploits for known vulnerabilities, to compromise the site and its underlying server. Currently, botnet is targeting content management system (CMS) platforms.
The botnet infects machines by exploiting a PHPUnit remote code execution vulnerability (CVE-2017-9841) in CMS platforms. Network of the botnet is spread across 30 countries, controlled by a single C2 server, with over 60 surrogate servers. The botnet utilizes several vulnerabilities to hide itself in compromised machines and maintain its operations. In addition to this, the botnet uses software development frameworks like DevOps and Agile to add new devices in it. Most businesses are affected because of the recent spike in the number of users leveraging CMS platforms to support remote work.[/vc_wp_text][vc_wp_text]
Impact
- Botnet can be used to perform distributed denial of service (DDoS) attacks.
- Account credentials can be leaked leading to account takeovers.
- Provides the attacker access to a device and its connection to a network.
[/vc_wp_text][vc_wp_text]
IOC
Spam bot - malicious and compromised files
- /index.php
- /priv_sym/conf.php
- /priv_sympy/sym.py
- /tmp/pear/download/imagick-3.4.4.tgz
- /wp-content/plugins/three-column-screen-layout/db.php
- /wp-content/plugins/wordfence/url/cach/classes/model/wp-pingg.php
- /wp-content/sqlapi.php
- /wp-content/themes/danfe/db.php
- /wp-content/themes/danfe/indx.php
- /wp-content/themes/danfe/ramage_Libytheidae.php
- /wp-content/themes/danfe/tbl_status.php
- /wp-content/themes/danfe/wp_class_datlib.php
- /wp-content/themes/danfe/wp-data.php
- /wp-load.php
- Files with prefix ‘original1.’
Known KashmirBlack IPs
- 101.50.3.132
- 160.153.192.222
- 198.1.98.189
- 35.240.254.161
- 103.11.75.15
- 161.189.159.172
- 198.37.123.60
- 35.242.128.177
- 103.116.16.67
- 161.189.202.40
- 198.57.247.202
- 35.244.124.106
- 103.145.226.104
- 162.144.18.118
- 198.58.99.254
- 35.244.72.212
- 103.147.154.41
- 162.144.68.170
- 199.101.100.123
- 35.247.132.6
- 103.21.58.29
- 162.214.71.13
- 199.101.100.124
- 35.247.160.99
- 103.229.72.13
- 162.241.143.7
- 199.188.200.224
- 35.247.185.96
- 103.229.72.89
- 162.241.156.242
- 199.79.62.126
- 37.187.163.201
[/vc_wp_text][vc_wp_text]
Mitigation
- Make sure CMS core files and modules are updated.
- Use strong passwords.
- Deploy web application firewall (WAF).
- Access should be denied or limited for sensitive files and paths such as wp-config.php, install.php, and eval-stdin.php.
- Keep your system updated and use antivirus software.
