A new sophisticated malware campaign dubbed “Zealot” leveraging NSA exploits targeting Windows and Linux systems to mine Monero on Internal Networks.
Security researchers from F5 Networks identified the malware campaign “Zealot” targeting internal networks Leveraging NSA Exploit EternalBlue and EternalSynergy.
Zealot campaign is highly obfuscated, sophisticated and it can deliver multistaged attacks, it exploits unpatched Apache Struts Vulnerability(CVE-2017-5638) and DotNetNuke (CVE-2017-9822).
Linux Exploit CVE-2017-5638
The attack starts by scanning the web and then by sending HTTP requests with famous Apache Struts exploit, Zealot equipped with exploits compatible with both Windows and Linux platforms.
If server found vulnerable and it will execute the JAVA script to detect the operating system type.Then in the background, it will run shell commands to downloads the bash scripts through many methods “TCP socket,” “curl” and “wget.”
These shell commands fetch “larva” bash script, and it checks whether machine already infected or not, and then it downloads the crypto-miner “mule“.
Windows Exploit CVE-2017-5638
For windows, it runs a PowerShell interpreter, and it will run base64 encoded code, and the decodes code reveals linking to another file, and it delivers obfuscated PowerShell script “scv.ps1,” and the deployer downloads the miner malware and executes it.
It looks for python 2.7, if not installed it will deploy python and then execute the module “probe.py” and obfuscates with “pyminifier” and it downloads zipped files for internal network propagation. For Technical details.
zealot.py — the main script executing the EternalBlue and EternalSynergy exploits
a0.py — EternalSynergy exploit with built-in shellcode for Windows 7
a1.py — EternalBlue exploits for Windows 7. Receives a shellcode as an argument.
a2.py — EternalBlue exploits for Windows 8. Receives a shellcode as an argument.
m.py — SMB protocol wrapper
data — folder including 2 shellcode files:
shellcode_win7 — used with a1.py
shellcode_win8 — used with a2.py
DotNetNuke CVE-2017-9822 – Zealot
Another request sent by the Zealot attacker is exploiting DotNetNuke, a content management system based on ASP.NET, by sending a serialized object via a vulnerable DNNPersonalization cookie (CVE-2017-9822).
Mule malware mines the most Anonymous cryptocurrency Monero and the specific miner address paid approximately USD 8,500.
The Zealot campaign, however, seems to be opening new attack vector doors, automatically delivering malware on internal networks via web application vulnerabilities. The level of sophistication we are currently observing in the Zealot campaign is leading us to believe that the attack was developed and is being run by threat actors several levels above ordinary bot herders.Concludes researchers.
