IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Hackers use WebSVN to deploy new Mirai malware

Attackers used the notorious malware to perform distributed denial of service attacks

Hackers are exploiting a  vulnerability affecting WebSVN, an open source web application for browsing source code, to deploy variants of the Mirai DDoS malware.

According to security researchers at Palo Alto Networks’ Unit 42, while the critical command injection vulnerability was discovered and patched in May this year, they’ve observed hackers exploiting unpatched versions of the application.

The flaw, CVE-2021-32305, affects version 2.6.0 of the software. A proof-of-concept was released in June and within a week attackers exploited the vulnerability to deploy variants of the Mirai DDoS malware.

The flaw happens when a hacker uses a command injection to download a shell script that infects the system with malware.

“When abusing these types of web vulnerabilities, some important details about the target environment may be unknown to the attacker. These details include the operating system and processor architecture that the web server is running. The shell script used in the next step of the attack shows how the attacker can overcome this issue,” said researchers.

Hackers also used malicious Linux binaries provided for 12 different architectures. But instead of detecting which one is correct for the target environment, an attack will take a brute-force approach. Researchers said the script simply downloads and attempts to execute the binaries for every possible architecture, disregarding any incompatibility errors. 

“Although WebSVN is a cross-platform PHP application capable of running on many operating systems, only Linux binaries are used in this attack,” researchers said.

Related Resource

Challenging the rules of security

Protecting data and simplifying IT management with Chrome OS

Whitepaper front coverFree download

When analyzed, researchers said hackers use the malware to perform distributed denial of service (DDoS) attacks, and it shares some of its code with the Mirai botnet family.

Hackers reduced the size of the executable files by compressing them with a modified version of the popular open source packer, UPX. 

“Because the packer is modified, it is less likely for reverse engineering tools to succeed in automatically unpacking the executable files, requiring more manual effort for analysis,” they said.

After the malware is executed, it continuously tries to connect to its command and control (C2) server on port 666. Once it establishes a connection, it communicates using a custom text-based TCP protocol. 

Researchers said the main purpose of this malware family is to perform DDoS attacks, and the effectiveness of an attack depends on the network protocols and techniques used.

“In the analyzed sample, there are eight types of attacks, each designed to be effective against a different type of target,” said researchers.

Researchers said attackers will continue to exploit the latest vulnerabilities to “expand their army of infected devices and increase the strength of their DDoS attacks.” WebSVN users have been urged to upgrade to the latest software version.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
RATDispenser evades nine in ten anti-virus engines
Security

RATDispenser evades nine in ten anti-virus engines

24 Nov 2021
Hackers use Linux backdoor on compromised e-commerce sites with software skimmer
malware

Hackers use Linux backdoor on compromised e-commerce sites with software skimmer

19 Nov 2021
Iranian hackers ramp up attacks against IT services sector
hacking

Iranian hackers ramp up attacks against IT services sector

19 Nov 2021

Most Popular

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
The UK's best cities for tech workers in 2022
Business strategy

The UK's best cities for tech workers in 2022

24 Jun 2022
Carnival hit with $5 million fine over cyber security violations
cyber security

Carnival hit with $5 million fine over cyber security violations

27 Jun 2022