Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

This malware will still foul you up; it just doesn't want anyone messing with your servers while it's using you.

An attacker is breaking into Linux systems via a widely abused 2-year-old vulnerability in Apache ActiveMQ, installing malware and then patching the flaw.

Threat actors are exploiting a nearly two-year-old security flaw in Apache ActiveMQ to gain persistent access to cloud Linux systems and deploy malware called DripDropper. But in an unusual twist, the unknown attackers have been observed patching the exploited vulnerability after securing initial access to prevent further exploitation by other adversaries and evade detection, Red Canary said in

Attackers exploit CVE-2023-46604 in Apache ActiveMQ, deploy DripDropper malware, then patch flaw to secure persistence.

Read more

An attacker is breaking into Linux systems via a widely abused 2-year-old vulnerability in Apache ActiveMQ, installing malware and then patching the flaw.

A nearly two-year-old vulnerability in Apache ActiveMQ is being actively exploited by malicious actors to gain persistent access to Linux cloud systems and deploy a malware known as DripDropper. According to Red Canary, the attackers are employing a sophisticated tactic of patching the exploited vulnerability post-compromise to prevent other threat actors from gaining access and to evade detection. Apache ActiveMQ is a widely used open-source message broker that supports the Java Message Service (JMS) API. Vulnerabilities in such critical infrastructure components can have far-reaching implications, as they are often integral to enterprise messaging systems. The exploitation begins with the attackers leveraging the unpatched vulnerability in Apache ActiveMQ to gain initial access to the target systems. Once inside, they deploy DripDropper, a malware whose exact capabilities are not yet fully disclosed but is likely designed for persistence and potentially further payload delivery. What sets this campaign apart is the attackers' post-exploitation behavior. By patching the vulnerability they exploited, they ensure that no other malicious actors can use the same entry point, thereby maintaining exclusive control over the compromised systems. This tactic also helps them avoid detection, as the patched vulnerability might not trigger any alerts from security monitoring tools. The impact of this campaign could be significant, particularly if the targeted systems are part of critical infrastructure or handle sensitive data. The sophistication demonstrated by the attackers in patching the vulnerability post-exploitation indicates a high level of operational security (OPSEC) awareness. For organizations using Apache ActiveMQ, it is crucial to ensure that all systems are updated with the latest security patches. Additionally, monitoring for unusual activities such as unauthorized access or unexpected patching of vulnerabilities can help detect potential compromises. This incident underscores the importance of timely patch management and the need for continuous monitoring of enterprise systems. It also highlights the evolving tactics of threat actors, who are increasingly adopting measures to maintain exclusivity and avoid detection.

セキュリティ企業Red Canaryは、「ActiveMQ」の脆弱性を悪用し、クラウド上の「Linux」に侵入する攻撃者を確認した。注目すべきは、マルウェア「DripDropper」が侵入後にその脆弱性を自ら修正し、潜伏を図るという異例の手口である。

This malware will still foul you up; it just doesn't want anyone messing with your servers while it's using you.

This I have to admit is a new one. Security researchers detected an attacker exploiting Apache ActiveMQ, a popular open-source message broker, a security hole that is detailed in CVE-2023-46604, to gain persistent access on cloud Linux systems. The new part is that the attacker is apparently patching the vulnerability after securing initial access to secure their foothold and evade detection as per this: 

Après avoir pris le contrôle de l'appareil en exploitant une vulnérabilité, le logiciel malveillant corrige cette faille.

This malware will still foul you up; it just doesn't want anyone messing with your servers while it's using you. The post DripDropper Linux malware cleans up after itself – how it works appeared first on Linux Today.

This malware will still foul you up; it just doesn't want anyone messing with your servers while it's using you.

DripDropper is a Red Canary-named Linux malware variant that uses an encrypted PyInstaller ELF file to communicate with a Dropbox account.

An attacker is breaking into Linux systems via a widely abused 2-year-old vulnerability in Apache ActiveMQ, installing malware and then patching the flaw.

In an unprecedented display of cybercriminal sophistication, security researchers have uncovered a Linux malware campaign that turns conventional attack methodology on its head. The malware, dubbed "DripDropper," employs a counterintuitive strategy: exploiting vulnerabilities and then patching them to maintain exclusive access to compromised systems.

This malware will still foul you up; it just doesn't want anyone messing with your servers while it's using you.

Visit the link for more information