CIO News Hubb
Advertisement
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
CIO News Hubb
No Result
View All Result
Home Information Security

Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

admin by admin
July 17, 2022
in Information Security


VoIP phones using Digium’s software have been targeted to drop a web shell on their servers as part of an attack campaign designed to exfiltrate data by downloading and executing additional payloads.

“The malware installs multilayer obfuscated PHP backdoors to the web server’s file system, downloads new payloads for execution, and schedules recurring tasks to re-infect the host system,” Palo Alto Networks Unit 42 said in a Friday report.

The unusual activity is said to have commenced in mid-December 2021 and targets Asterisk, a widely used software implementation of a private branch exchange (PBX) that runs on the open-source Elastix Unified Communications Server.

Unit 42 said the intrusions share similarities with the INJ3CTOR3 campaign that Israeli cybersecurity firm Check Point disclosed in November 2020, alluding to the possibility that they could be a “resurgence” of the previous attacks.

Digium Phone Software

Coinciding with the sudden surge is the public disclosure in December 2021 of a now-patched remote code execution flaw in FreePBX, a web-based open source GUI that’s used to control and manage Asterisk. Tracked as CVE-2021-45461, the issue is rated 9.8 out of 10 for severity.

The attacks commence with retrieving an initial dropper shell script from a remote server, which, in turn, is orchestrated to install the PHP web shell in different locations in the file system as well as create two root user accounts to maintain remote access.

CyberSecurity

It further creates a scheduled task that runs every minute and fetches a remote copy of the shell script from the attacker-controlled domain for execution.

Besides taking measures to cover its tracks, the malware is also equipped to run arbitrary commands, ultimately allowing the hackers to take control of the system, steal information, while also maintaining a backdoor to the compromised hosts.

“The strategy of implanting web shells in vulnerable servers is not a new tactic for malicious actors,” the researchers said, adding it’s a “common approach malware authors take to launch exploits or run commands remotely.”





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
Previous Post

The Link Between AWM Proxy & the Glupteba Botnet – Krebs on Security

Next Post

Innovation ~ Future of CIO

Related Posts

Information Security

New IoT RapperBot Malware Targeting Linux Servers via SSH Brute-Forcing Attack

by admin
August 7, 2022
Information Security

Spring 2022 PCI 3DS report now available

by admin
August 7, 2022
Information Security

Tech giants pledge self-regulation in NZ pact

by admin
August 7, 2022
Information Security

Hackers Exploit Twitter Vulnerability to Exposes 5.4 Million Accounts

by admin
August 6, 2022
Information Security

Class Action Targets Experian Over Account Security – Krebs on Security

by admin
August 6, 2022
Next Post

Innovation ~ Future of CIO

Recommended

New IoT RapperBot Malware Targeting Linux Servers via SSH Brute-Forcing Attack

August 7, 2022

Spring 2022 PCI 3DS report now available

August 7, 2022

Tech giants pledge self-regulation in NZ pact

August 7, 2022

Will Oracle Save the Day with Its EHR database?

August 7, 2022

Illuminatecreativity

August 7, 2022

Hackers Exploit Twitter Vulnerability to Exposes 5.4 Million Accounts

August 6, 2022

© 2022 CIO News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy.

Navigate Site

  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

Newsletter Sign Up

No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

© 2022 JNews - Premium WordPress news & magazine theme by Jegtheme.