FBI, CISA warn of AndroxGh0st botnet for victim identification and exploitation

FBI, CISA warn of AndroxGh0st botnet for victim identification and exploitation

Pierluigi Paganini
January 17, 2024

U.S. CISA and the FBI warned of AndroxGh0st malware used to create a botnet for victim identification and exploitation in target networks.

US CISA and the Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory (CSA) to warn of AndroxGh0st malware. The malware is spreading to create a botnet for victim identification and exploitation in target networks.

The US agencies are sharing known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with threat actors deploying the Androxgh0st malware.

“Androxgh0st malware establishes a botnet for victim identification and exploitation in vulnerable networks, and targets files that contain confidential information, such as credentials, for various high profile applications.” reads the advisory. “Threat actors deploying Androxgh0st malware have been observed exploiting specific vulnerabilities which could lead to remote code execution”

The Python-based malware AndroxGh0st was first spotted in December 2022 by the cybersecurity firm Lacework.

“AndroxGh0st is a “SMTP cracker” which is primarily intended to scan for and parse Laravel application secrets from exposed .env files. Note: Laravel is an open source PHP framework and the Laravel .env file is often targeted for its various configuration data including AWS, SendGrid and Twilio.” reported Lacework.

The malware supports multiple features, including scanning, exploitation of exposed credentials and APIs, and even deployment of webshells. The malware allows operators to scan for and parse AWS keys, but it has also the ability to generate keys for brute-force attacks.

According to the joint Cybersecurity Advisory (CSA), threat actors behind the Androxgh0st malware exploit the following vulnerabilities to achieve remote code execution on target systems:

Known Indicators of Compromise Associated with this malware are available here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts