Hackers Exploiting Drupal Vulnerability To Inject Cryptocurrency Miners

The Drupal vulnerability (CVE-2018-7600), dubbed Drupalgeddon2 that could allow attackers to completely conduct maintain over vulnerable websites has directly been exploited inwards the wild to deliver malware backdoors in addition to cryptocurrency miners.

Drupalgeddon2, a highly critical remote code execution vulnerability discovered 2 weeks agone inwards Drupal content administration organisation software, was late patched past times the fellowship without releasing its technical details.

However, exactly a twenty-four hr menses subsequently safety researchers at Check Point in addition to Dofinity published consummate details, a Drupalgeddon2 proof-of-concept (PoC) exploit code was made widely available, in addition to large-scale Internet scanning in addition to exploitation attempts followed.

At the time, no incident of targets beingness hacked was reported, but over the weekend, several safety firms noticed that attackers conduct maintain directly started exploiting the vulnerability to install cryptocurrency miner in addition to other malware on vulnerable websites.

The SANS Internet Storm Center spotted about attacks to deliver a cryptocurrency miner, a PHP backdoor, in addition to an IRC bot written inwards Perl.

The elementary PHP backdoor allows attackers to upload additional files (backdoors) to the targeted server.

H5N1 thread on SANS ISC Infosec forums too suggests that Drupalgeddon2 is beingness used to install the XMRig Monero miner on vulnerable websites. Besides the actual XMRig miner, the malicious script too downloads additional files, including a script to kill competing miners on the targeted system.

Researchers from safety draw solid Volexity conduct maintain too observed a broad diverseness of actions in addition to payloads attempted via the populace exploit for Drupalgeddon2 to deliver malicious scripts that install backdoors in addition to cryptocurrency miners on the vulnerable sites.

The researchers believed that 1 of the Monero miner campaigns, delivering XMRig, is associated alongside a criminal grouping that exploited the vulnerability (CVE-2017-10271) inwards Oracle WebLogic servers to deliver cryptocurrency miner malware shortly subsequently its PoC exploit code was made populace inwards belatedly 2017.

Volexity identified about of the group's wallets that had stored a full of 544.74 XMR (Monero coin), which is equivalent to virtually $105,567.

As nosotros reported inwards our previous article, Imperva stats showed that 90% of the Drupalgeddon2 attacks are only IP scanning inwards an endeavour to discovery vulnerable systems, 3% are backdoor infection attempts, in addition to 2% are attempting to run crypto miners on the targets.

For those unaware, Drupalgeddon2 allows an unauthenticated, remote assaulter to execute malicious code on default or mutual Drupal installations nether the privileges of the user, affecting all versions of Drupal from six to 8.

Therefore, site admins were highly recommended to piece the effect past times updating their CMS to Drupal 7.58 or Drupal 8.5.1 every bit presently every bit possible.

In its advisory, Drupal warned that "sites non patched past times Wednesday, 2018-04-11 may survive compromised" in addition to "simply updating Drupal volition non take away backdoors or gear upwards compromised sites."

Moreover,

"If you lot discovery that your site is already patched, but you lot didn’t create it, that tin survive a symptom that the site was compromised. Some attacks inwards the past times conduct maintain applied the piece every bit a agency to guarantee that entirely that assaulter is inwards command of the site."

Here's a guide Drupal squad advise to follow if your website has been hacked.