Security News > 2022 > March > DirtyMoe Botnet Gains New Exploits in Wormable Module to Spread Rapidly

"The worming module targets older well-known vulnerabilities, e.g., EternalBlue and Hot Potato Windows privilege escalation," Avast researcher Martin Chlumecký said in a report published Wednesday.

"One worm module can generate and attack hundreds of thousands of private and public IP addresses per day; many victims are at risk since many machines still use unpatched systems or weak passwords."

Also employed as part of the attack sequence is a DirtyMoe service that triggers the launch of two additional processes, namely the Core and the Executioner, which is used to load the modules for Monero mining and to spread the malware in a worm-like manner.

The worming modules attack victim machines by using several vulnerabilities to install the malware, with each module targeting a specific flaw based on information gathered post reconnaissance -.

"The main goal of the worming module is to achieve RCE under administrator privileges and install a new DirtyMoe instance," Chlumecký explained, adding one of the component's core functions is to generate a list of IP addresses to attack based on the geological location of the module.

Another in-development worming module was found to contain exploits targeting PHP, Java Deserialization, and Oracle Weblogic Servers, implying that the attackers are looking to broaden the scope of the infections.

News URL

https://thehackernews.com/2022/03/dirtymoe-botnet-gains-new-exploits-in.html