Security News > 2022 > May > EnemyBot Linux Botnet Now Exploits Web Server, Android and CMS Vulnerabilities
A nascent Linux-based botnet named Enemybot has expanded its capabilities to include recently disclosed security vulnerabilities in its arsenal to target web servers, Android devices, and content management systems.
"The malware is rapidly adopting one-day vulnerabilities as part of its exploitation capabilities," AT&T Alien Labs said in a technical write-up published last week.
"In case an Android device is connected through USB, or Android emulator running on the machine, EnemyBot will try to infect it by executing [a] shell command," the researchers said, pointing to a new "Adb infect" function.
ADB refers to Android Debug Bridge, a command-line utility used to communicate with an Android device.
Besides the Log4Shell vulnerabilities that came to light in December 2021, this includes recently patched flaws in Razer Sila routers, VMware Workspace ONE Access, and F5 BIG-IP as well as weaknesses in WordPress plugins like Video Synchro PDF. Other weaponized security shortcomings are below -.
CVE-2021-4039 - A command injection vulnerability in the web interface of the Zyxel.
News URL
https://thehackernews.com/2022/05/enemybot-linux-botnet-now-exploits-web.html
Related news
- Hackers exploit 14-year-old CMS editor on govt, edu sites for SEO poisoning (source)
- Hackers Exploit Misconfigured YARN, Docker, Confluence, Redis Servers for Crypto Mining (source)
- Hackers leverage 1-day vulnerabilities to deliver custom Linux malware (source)
- Hackers exploit Ray framework flaw to breach servers, hijack resources (source)
- Easy-to-use make-me-root exploit lands for recent Linux kernels. Get patching (source)
- DinodasRAT malware targets Linux servers in espionage campaign (source)
- New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks (source)
- New HTTP/2 DoS attack can crash web servers with a single connection (source)
- Researchers Uncover First Native Spectre v2 Exploit Against Linux Kernel (source)
- OpenAI's GPT-4 can exploit real vulnerabilities by reading security advisories (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-03-01 | CVE-2021-4039 | OS Command Injection vulnerability in Zyxel Nwa1100-Nh Firmware A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. | 10.0 |