Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Apache Malware Variant Discovered With Links to ‘Sweet Orange Exploit Kit’

Last month SecurityWeek reported about the discovery of a malicious module on Linux that was injecting malicious iFrames into websites. This week, researchers from ESET said they have discovered another Linux-based malware variant, one with links to the Sweet Orange exploit kit.

Last month SecurityWeek reported about the discovery of a malicious module on Linux that was injecting malicious iFrames into websites. This week, researchers from ESET said they have discovered another Linux-based malware variant, one with links to the Sweet Orange exploit kit.

According to ESET, the malicious Apache module is being used to inject malicious content into web pages served by an infected LAMPP deployment. Although this latest Linux-based malware variant can serve practically any type of content, in the cases observed by ESET, it installs a variant of Zbot (Zeus), the infamous malware designed to steal information from online banking customers.

Based on ESET’s analysis, the iFrame injected by the malware (called Linux/Chapro.A by the company) points to a Sweet Orange exploit pack landing page.

“At the time of our analysis, the exploit pack was being hosted in Lithuania. The pack tries to exploit several vulnerabilities found in modern web browsers and plugins,” said Pierre-Marc Bureau, ESET security intelligence program manager.

“The attack described in the present analysis shows the increased complexity of malware attacks. This complicated case spreads across three different countries, targeting users from a fourth one, and making it very hard for law enforcement agencies to investigate and mitigate its effects.”

For now, the malware is only targeting users in Russia, but the concern is that this could change. Moreover, the iFrame injects are transparent on the compromised LAMPP deployment, and unless the server admin is looking for signs of compromise, it’s unlikely they’ll notice.

Additional details are available on ESET’s blog.

Written By

Click to comment

Expert Insights

Related Content

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cybercrime

CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.

Cyberwarfare

Russia-linked cyberespionage group APT29 has been observed using embassy-themed lures and the GraphicalNeutrino malware in recent attacks.

Malware & Threats

Security researchers are warning of a new wave of malicious NPM and PyPI packages designed to steal user information and download additional payloads.

Cybercrime

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Malware & Threats

Cybercrime in 2017 was a tumultuous year "full of twists and turns", with new (but old) infection methods, a major return to social engineering,...