Ankura CTIX FLASH Update - March 8, 2024

Ransomware/Malware Activity

New Golang Malware Targets Hadoop, Docker, Confluence, and Redis

Security researchers have recently discovered several new Golang payloads developed to identify and exploit hosts running Hadoop YARN, Docker, Confluence, and/or Redis. To kick-off the malware campaign, hackers use Golang tools to scan the victim network for open ports associated with the targeted services (ports 2375, 8088, 8090, 6379). Each Golang binary contains code to exploit the identified service – for instance, the Confluence-targeting binary is built to grab an exploit for a known Atlassian vulnerability (CVE-2022-26134). Once the service is exploited, attackers install a cryptocurrency miner and establish a reverse shell to maintain persistence. The researchers point out that the new binaries were not sanitized by the threat actors, making them very easy to reverse engineer. Other payloads analyzed in this campaign attempt to delete initial access artifacts such