Hackers assault HFS servers to drop malware and Monero miners

Hackers are focusing on older variations of the HTTP File Server (HFS) from Rejetto to drop malware and cryptocurrency mining software program.

Menace researchers at safety firm AhnLab consider that the menace actors are exploiting CVE-2024-23692, a critical-severity safety subject that permits executing arbitrary instructions with out the necessity to authenticate.

The vulnerability impacts variations of the software program as much as and together with 2.3m. In a message on their web site, Rejetto warns customers that variations 2.3m by 2.4 are “harmful and shouldn’t be used anymore” due to a bug that lets attackers “management your laptop,” and a repair has but to be discovered.

Noticed assaults

AhnLab SEcurity Intelligence Middle (ASEC) noticed assaults on model 2.3m of HFS, which continues to be highly regarded amongst particular person customers, small groups, instructional establishments, and builders that need to take a look at file sharing over a community.

Due to the focused software program model, the researchers consider that attackers are exploiting CVE-2024-23692, a vulnerability found by safety researcher Arseniy Sharoglazov final August and disclosed publicly in a technical report in Could this yr.

CVE-2024-23692 is a template injection vulnerability that permits unauthenticated distant attackers to ship a specifically crafted HTTP request to execute arbitrary instructions on the affected system.

Quickly after the disclosure, a Metasploit module and proof of idea exploits turned accessible. In keeping with ASEC, that is across the time exploitation within the wild began.

The researchers say that throughout the assaults the hackers accumulate details about the system, set up backdoors and varied different forms of malware.

Attackers execute instructions like “whoami” and “arp” to assemble details about the system and the present person, uncover linked gadgets, and usually plan subsequent actions.

In lots of circumstances, the attackers terminate the HFS course of after they add a brand new person to the directors’ group, to stop different menace actors from utilizing it.

Within the subsequent phases of the assaults, ASEC noticed the set up of the XMRig instrument for mining Monero cryptocurrency. The researchers be aware that XMRig was deployed in not less than 4 distinct assaults, one performed of them attributed to the LemonDuck menace group.

Different payloads delivered to the compromised laptop embrace:

• XenoRAT – Deployed alongside XMRig for distant entry and management.
• Gh0stRAT – Used for distant management and information exfiltration from breached techniques.
• PlugX – A backdoor principally related to Chinese language-speaking menace actors that’s used for persistent entry.
• GoThief – An info stealer that makes use of Amazon AWS to steal information. It captures screenshots, collects info on desktop information, and sends information to an exterior command and management (C2) server.

AhnLab researchers be aware that they hold detecting assaults on model 2.3m of HFS. As a result of the server must be uncovered on-line for the file sharing to be attainable, hackers will like proceed searching for weak variations to assault.

The beneficial variant of the product is 0.52.x, which, regardless of being a decrease model, is at the moment the newest HFS launch from the developer. It’s web-based, requires minimal configuration, comes with help for HTTPS, dynamic DNS, and authentication for the executive panel.

The corporate gives a set of indicators of compromise within the report, which embrace hashes for the malware put in on breached techniques, IP addresses for attacker command and management servers, and the obtain URLs for the malware used within the assaults.