Monero [XMR] Mining Malware in Action with Drupal Vulnerability Exploitation

Hackers are exploiting the Drupal vulnerability to attack the networks and activate Monero (XMR) mining malware. The same vulnerability that has been patched in April, is yet again exploited.

Hackers exploiting Drupal vulnerability again

Privacy-focused Monero is certainly favourable among the cybercriminals as yet again the criminals are trying to drop the Monero mining malware into the vulnerable systems by leveraging the Drupal vulnerability. A security flaw CVE-2018-7602 has been found in Drupal, a content management framework that has been exploited. The attackers are trying to run the affected systems into Monero mining bots. These attacks can lead to a number of threats apart from slowing the system performance and stealing the resources.

This is not the first time the Drupal vulnerability has been exploited, back in April, this year only it has been patched. A remote code execution, CVE-2018-7602 affects the 7 and 8 version of Drupal. In order to exploit this vulnerability, a shell script has been downloaded that recovers an  Executable and Linkable Format-based (ELF) downloader. This then adds a crontab entry that basically updates itself automatically.

Also, read: Monero (XMR), Siacoin (SC), NEM (XEM) & Aeternity (AE) Gets New Listing, Price Analysis

Save your systems

During the process, it retrieves and installs a Monero mining application in the affected machine. A modified version of XMRig, it is one of the most commonly used variants in Monero mining attacks. Apparently, the downloader even checks the target system to see if it the machine to be compromised or not. Once miner starts running, it even changes its name.

The attacks aren’t running amok, they take proper precautions by hiding behind the Tor network. Reportedly, the same IP address has initiated 810 attacks that have been blocked by Trend Micro. However, it’s not confirmed if all of these attacks are Monero related or not. Apparently, this IP address exploits Heartbleed (CVE-2014-0160), ShellShock (CVE-2014-6271) memory leak flaw in Apache (CVE-2004-0113), WEB GoAhead (CVE-2017-5674) and others.

By patching and updating the Drupal core, one can fix this vulnerability for which the guidelines are provided on the security bulletin of Drupal.

What do you think of the repeated attempts by cybercriminals to activate Monero mining malware? Share your thoughts with us!