Ankura CTIX FLASH Update - May 31, 2022

RANSOMWARE/MALWARE ACTIVITY

Enemybot Botnet Observed Exploiting Critical Vulnerabilities to Expand Its Potential Targets

"Enemybot," an internet of things (IoT) botnet, has been observed expanding its potential target scope by exploiting critical vulnerabilities that allow it to spread to new types of devices. AT&T Alien Labs researchers detailed that the malware is now targeting IoT devices, web servers, Android devices, and content management system (CMS) servers via exploiting recently disclosed critical vulnerabilities in various software and systems. Some of the targeted services include VMware Workspace ONE, WordPress, Adobe ColdFusion, and PHP Scriptcase. Enemybot was first discovered in March 2022 by Securonix researchers and is suspected to be distributed by the Keksec threat group (also known as Kek Security or FreakOut). The original botnet code used by Enemybot is comprised of Mirai, Qbot, and Zbot, as well as custom developments made by the threat