Security News > 2022 > May > EnemyBot Linux Botnet Now Exploits Web Server, Android and CMS Vulnerabilities
A nascent Linux-based botnet named Enemybot has expanded its capabilities to include recently disclosed security vulnerabilities in its arsenal to target web servers, Android devices, and content management systems.
"The malware is rapidly adopting one-day vulnerabilities as part of its exploitation capabilities," AT&T Alien Labs said in a technical write-up published last week.
"In case an Android device is connected through USB, or Android emulator running on the machine, EnemyBot will try to infect it by executing [a] shell command," the researchers said, pointing to a new "Adb infect" function.
ADB refers to Android Debug Bridge, a command-line utility used to communicate with an Android device.
Besides the Log4Shell vulnerabilities that came to light in December 2021, this includes recently patched flaws in Razer Sila routers, VMware Workspace ONE Access, and F5 BIG-IP as well as weaknesses in WordPress plugins like Video Synchro PDF. Other weaponized security shortcomings are below -.
CVE-2021-4039 - A command injection vulnerability in the web interface of the Zyxel.
News URL
https://thehackernews.com/2022/05/enemybot-linux-botnet-now-exploits-web.html
Related news
- Ransomware hits web hosting servers via vulnerable CyberPanel instances (source)
- Botnet exploits GeoVision zero-day to install Mirai malware (source)
- Matrix Botnet Exploits IoT Devices in Widespread DDoS Botnet Campaign (source)
- Hackers exploit ProjectSend flaw to backdoor exposed servers (source)
- BootKitty UEFI malware exploits LogoFAIL to infect Linux systems (source)
- Russia-Linked Turla Exploits Pakistani Hackers' Servers to Target Afghan and Indian Entities (source)
- BadBox malware botnet infects 192,000 Android devices despite disruption (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-03-01 | CVE-2021-4039 | OS Command Injection vulnerability in Zyxel Nwa1100-Nh Firmware A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. | 9.8 |