Express
Mining Trojan 4SHMiner Controls Roughly 15k Cloud Servers For Mining
Summary: On November 18, the Cloud Workload Protection (CWP for short) under the tech giant Tencent, captured that the mining Trojan 4SHMiner used Apache Shiro deserialization vulnerability CVE-2016-4437 to attack cloud servers. After the 4SHMiner mining group successfully invaded, it executed the command to download 4.sh and the mining Trojan XMRig, thus to achieve persistent operation ...
On November 18, the Cloud Workload Protection (CWP for short) under the tech giant Tencent, captured that the mining Trojan 4SHMiner used Apache Shiro deserialization vulnerability CVE-2016-4437 to attack cloud servers. After the 4SHMiner mining group successfully invaded, it executed the command to download 4.sh and the mining Trojan XMRig, thus to achieve persistent operation through Linux service, systemctl service, system configuration file $HOME/.profile, crontab timing tasks, etc.
Security experts at Tencent Security recommend that companies ought to check whether their servers have deployed Apache Shiro with a version 1.2.5 or newer.
Tracy Chen
Tags: Mining
Link: Mining Trojan 4SHMiner Controls Roughly 15k Cloud Servers For Mining [Copy]
