Androxgh0st Malware Botnet Steals AWS, Microsoft Credentials and More

The Federal Bureau of Investigation and Cybersecurity & Infrastructure Security Agency warned successful a associated advisory astir a threat histrion deploying a botnet that makes usage of the Androxgh0st malware. This malware is susceptible of collecting unreality credentials, specified arsenic those from AWS oregon Microsoft Azure and more, abusing the Simple Mail Transfer Protocol, and scanning for Amazon Simple Email Service parameters.

What is the Androxgh0st malware?

The Androxgh0st malware was exposed successful December 2022 by Lacework, a unreality information company. The malware is written successful Python and is chiefly utilized to bargain Laravel.env files, which incorporate secrets specified arsenic credentials for high-profile applications. For instance, organizations tin integrate applications and platforms specified arsenic AWS, Microsoft Office 365, SendGrid oregon Twilio to the Laravel framework, with each of the applications’ secrets being stored successful the .env file.

The botnet hunts for websites utilizing the Laravel web exertion model earlier determining if the domain’s basal level .env record is exposed and contains information for accessing further services. The information successful the .env record mightiness beryllium usernames, passwords, tokens oregon different credentials.

The cybersecurity institution Fortinet exposed telemetry connected Androxgh0st, which shows much than 40,000 devices infected by the botnet (Figure A).

Figure A

Number of devices infected by Androxgh0st. Image: Fortinet

The FBI/CISA advisory states: “Androxgh0st malware besides supports galore functions susceptible of abusing the Simple Mail Transfer Protocol (SMTP), specified arsenic scanning and exploiting exposed credentials and exertion programming interfaces (APIs), and web ammunition deployment.”

How tin Androxgh0st malware exploit aged vulnerabilities?

In addition, Androxgh0st tin entree the Laravel exertion key; if that cardinal is exposed and accessible, the attackers volition effort to usage it to encrypt PHP codification that is passed to the website arsenic a worth for the XSRF-TOKEN variable. This is an effort to exploit the CVE-2018-15133 vulnerability successful immoderate versions of the Laravel web exertion framework. A palmy effort allows the attacker to remotely upload files to the website. CISA added the CVE-2018-15133 Laravel deserialization of untrusted information vulnerability to its Known Exploited Vulnerabilities Catalog based connected this grounds of progressive exploitation.

The menace histrion deploying Androxgh0st has besides been observed exploiting CVE-2017-9841, a vulnerability successful the PHP Testing Framework PHPUnit that allows an attacker to execute distant codification connected the website.

CVE-2021-41773 is besides exploited by the menace actor. This vulnerability successful Apache HTTP Server allows an attacker to execute distant codification connected the website.

What is known astir Androxgh0st malware’s spamming purpose?

Lacework wrote successful precocious 2022 that “over the past year, astir a 3rd of compromised cardinal incidents observed by Lacework are believed to beryllium for the purposes of spamming oregon malicious email campaigns,” with the bulk of the enactment being generated by Androxgh0st.

The malware has aggregate features to alteration SMTP abuse, including scanning for Amazon’s Simple Email Service sending quotas, astir apt for aboriginal spamming usage.

How to support from this Androxgh0st malware threat

The associated advisory from CISA and the FBI recommends taking the pursuing actions:

• Keep each operating systems, bundle and firmware up to date. In particular, Apache servers indispensable beryllium up to date. As tin beryllium work successful this article, attackers are inactive capable to trigger an Apache Web server vulnerability that was patched successful 2021.
• Verify that the default configuration for each URIs is to contradict entree unless determination is simply a circumstantial request for it to beryllium accessible from the internet.
• Ensure Laravel applications are not configured to tally successful debug oregon investigating mode due to the fact that it mightiness let attackers to exploit weaknesses much easily.
• Remove each unreality credentials from .env files and revoke them. As stated by CISA and the FBI, “all unreality providers person safer ways to supply temporary, often rotated credentials to codification moving wrong a web server without storing them successful immoderate file.”
• Review immoderate platforms oregon services that usage .env files for unauthorized entree oregon use.
• Search for chartless oregon unrecognized PHP files, successful peculiar successful the basal folder of the web server and successful the /vendor/phpunit/phpunit/src/Util/PHP folder if PHPUnit is being utilized by the web server.
• Review outgoing GET requests to record hosting platforms (e.g., GitHub and Pastebin), peculiarly erstwhile the petition accesses a .php file.

In addition, it is advised to cheque for immoderate recently created idiosyncratic for immoderate of the affected services, due to the fact that Androxgh0st has been observed creating caller AWS instances utilized for further scanning activities.

Security solutions indispensable beryllium deployed connected each endpoints and servers from the enactment to observe immoderate suspicious activity. When possible, your IT section should deploy multifactor authentication connected each services wherever imaginable to debar being compromised by an attacker successful possession of valid credentials.

Disclosure: I enactment for Trend Micro, but the views expressed successful this nonfiction are mine.