Security News > 2022 > May > EnemyBot Linux Botnet Now Exploits Web Server, Android and CMS Vulnerabilities
A nascent Linux-based botnet named Enemybot has expanded its capabilities to include recently disclosed security vulnerabilities in its arsenal to target web servers, Android devices, and content management systems.
"The malware is rapidly adopting one-day vulnerabilities as part of its exploitation capabilities," AT&T Alien Labs said in a technical write-up published last week.
"In case an Android device is connected through USB, or Android emulator running on the machine, EnemyBot will try to infect it by executing [a] shell command," the researchers said, pointing to a new "Adb infect" function.
ADB refers to Android Debug Bridge, a command-line utility used to communicate with an Android device.
Besides the Log4Shell vulnerabilities that came to light in December 2021, this includes recently patched flaws in Razer Sila routers, VMware Workspace ONE Access, and F5 BIG-IP as well as weaknesses in WordPress plugins like Video Synchro PDF. Other weaponized security shortcomings are below -.
CVE-2021-4039 - A command injection vulnerability in the web interface of the Zyxel.
News URL
https://thehackernews.com/2022/05/enemybot-linux-botnet-now-exploits-web.html
Related news
- CUPS vulnerabilities affecting Linux, Unix systems can lead to RCE (source)
- Rackspace internal monitoring web servers hit by zero-day (source)
- New Perfctl Malware Targets Linux Servers for Cryptocurrency Mining and Proxyjacking (source)
- New scanner finds Linux, UNIX servers exposed to CUPS RCE attacks (source)
- Finland seizes servers of 'Sipultie' dark web drugs market (source)
- Exploit released for new Windows Server "WinReg" NTLM Relay attack (source)
- Ransomware hits web hosting servers via vulnerable CyberPanel instances (source)
- Botnet exploits GeoVision zero-day to install Mirai malware (source)
- 'Alarming' security bugs lay low in Linux's needrestart server utility for 10 years (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-03-01 | CVE-2021-4039 | OS Command Injection vulnerability in Zyxel Nwa1100-Nh Firmware A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. | 10.0 |