## Apache HTTP Server Exploited for Cryptocurrency Mining
Cybersecurity researchers have uncovered a sophisticated campaign exploiting a critical vulnerability in Apache HTTP Server to distribute the Linuxsys cryptocurrency miner. The attack leverages CVE-2021-41773, a high-severity path traversal flaw (CVSS score: 7.5) in Apache HTTP Server version 2.4.49 that enables remote code execution.
### Attack Method and Distribution
The campaign, traced to an Indonesian IP address, uses a clever distribution strategy by compromising legitimate websites to host malware. This approach allows attackers to evade detection since victims connect to trusted sites with valid SSL certificates.
The infection process works as follows:
– Initial exploitation delivers a shell script from “repositorylinux[.]org”
– The script downloads the Linuxsys miner from five compromised legitimate websites
– An additional “cron.sh” script ensures the miner automatically restarts after system reboots
– Windows executables were also discovered, indicating cross-platform targeting
### Long-Running Campaign
This isn’t an isolated incident. The same threat actors have previously exploited multiple vulnerabilities since 2021, including:
– CVE-2024-36401: OSGeo GeoServer GeoTools (CVSS: 9.8)
– CVE-2023-22527: Atlassian Confluence template injection
– CVE-2023-34960: Chamilo LMS command injection
– CVE-2023-38646: Metabase command injection
– CVE-2024-0012 and CVE-2024-9474: Palo Alto Networks firewall vulnerabilities
The attackers demonstrate sophisticated evasion techniques, avoiding low-interaction honeypots and requiring high interaction to observe their activities.
## GhostContainer Backdoor Targets Exchange Servers
In a separate campaign, security firm Kaspersky has identified attacks against government entities in Asia using a sophisticated backdoor called GhostContainer. The attacks likely exploit CVE-2020-0688, a patched remote code execution vulnerability in Microsoft Exchange Server (CVSS score: 8.8).
### Advanced Capabilities
GhostContainer is a multi-functional backdoor that can:
– Execute shellcode and arbitrary commands
– Download, read, or delete files
– Load additional .NET modules dynamically
– Operate web proxy and tunneling functions
– Hide control commands within normal Exchange web requests
The backdoor’s design is particularly stealthy—it doesn’t establish traditional command-and-control connections. Instead, attackers connect externally and embed commands within legitimate Exchange traffic.
### Sophisticated Threat Actors
The campaign appears to be the work of highly skilled attackers with deep Microsoft Exchange knowledge. They’ve successfully transformed publicly available code into advanced espionage tools, targeting high-value organizations including technology companies across Asia.
Both campaigns highlight the ongoing threat posed by unpatched vulnerabilities and the increasing sophistication of cybercriminal operations targeting critical infrastructure and enterprise systems.