Apache Malware Variant Discovered With Links to ‘Sweet Orange Exploit Kit’

Last month SecurityWeek reported about the discovery of a malicious module on Linux that was injecting malicious iFrames into websites. This week, researchers from ESET said they have discovered another Linux-based malware variant, one with links to the Sweet Orange exploit kit.

According to ESET, the malicious Apache module is being used to inject malicious content into web pages served by an infected LAMPP deployment. Although this latest Linux-based malware variant can serve practically any type of content, in the cases observed by ESET, it installs a variant of Zbot (Zeus), the infamous malware designed to steal information from online banking customers.

Based on ESET’s analysis, the iFrame injected by the malware (called Linux/Chapro.A by the company) points to a Sweet Orange exploit pack landing page.

“At the time of our analysis, the exploit pack was being hosted in Lithuania. The pack tries to exploit several vulnerabilities found in modern web browsers and plugins,” said Pierre-Marc Bureau, ESET security intelligence program manager.

“The attack described in the present analysis shows the increased complexity of malware attacks. This complicated case spreads across three different countries, targeting users from a fourth one, and making it very hard for law enforcement agencies to investigate and mitigate its effects.”

For now, the malware is only targeting users in Russia, but the concern is that this could change. Moreover, the iFrame injects are transparent on the compromised LAMPP deployment, and unless the server admin is looking for signs of compromise, it’s unlikely they’ll notice.

Additional details are available on ESET’s blog.