cyber.hendryadrian.com
Threat Research · cloudsek.com

Androxgh0st Uses UC San Diego-Linked Subdomain to Host C2 Logger, CloudSEK Reports

· Original article ↗

Summary

CloudSEK details Androxgh0st’s expanded exploitation of web and IoT vulnerabilities, finding C2 logger panels on a UC San Diego-linked subdomain, malicious webshells, and evidence of attempted data theft and cryptomining.

Key points

  • CloudSEK found Androxgh0st command-and-control logger panels on a subdomain linked to the University of California, San Diego; the article does not establish that the university itself was compromised.
  • The botnet targets web platforms and IoT devices using techniques including JNDI injection, command injection, OGNL injection, and Spring4Shell.
  • CloudSEK reports roughly a 50% increase in the initial access vectors used since its previous report.
  • Logger entries show attempts to read account information and exploit known vulnerabilities; JSON-RPC requests suggest compromised systems may also be used for cryptomining.
  • Four PHP webshells or droppers enable code execution, file uploads, and payload deployment, supporting persistent access.
  • The report provides IOCs and YARA rules, and recommends patching affected software, restricting outbound RMI/LDAP/JNDI, and checking logs and filesystems for webshells.

Article Details

Attack Vectors
  • Exploitation of Apache Shiro and FasterXML jackson-databind through JNDI injection, with RMI URLs directing vulnerable servers to attacker-controlled infrastructure.
  • Unix command injection, including a logged attempt to run `;cat /etc/passwd`.
  • Exploitation of the WordPress Popup Maker plugin vulnerability CVE-2019-17574 to attempt to disclose system information.
  • Command injection against the WLANScanSSID functionality in Lantronix PremierWave devices, including injected curl commands in the SSID parameter.
  • Apache Struts OGNL injection, with a payload intended to execute a command.
  • Spring4Shell exploitation attempts involving manipulation of Spring class-loader properties and a remote configuration file.
  • Remote code execution attempts targeting fastjson-v1.2.47.
  • Webshells and a code dropper used for remote code execution, file uploads, and planting additional PHP scripts.
  • Cryptomining activity indicated by JSON-RPC requests for mining work.
Defensive Notes
  • Patch systems affected by the listed vulnerabilities, including those in Shiro, Spring Framework, Fastjson, and Jackson.
  • Restrict outbound RMI, LDAP, and JNDI access at the firewall.
  • Monitor and harden CMS plugins, particularly Popup Maker on WordPress.
  • Audit file systems for unexpected PHP files and scan for obfuscated webshells or droppers.
  • Use a WAF or runtime application self-protection for web applications.
  • Review server logs for suspicious POST parameters, injected shell commands, OGNL expressions, and JNDI/RMI activity.
  • Monitor for beaconing to the listed .oast domains and similar domains.

Indicators of compromise

TypeIndicatorContext
DOMAINch14vjilcoecm8580ft0bhwxm3yjaacyo[.]oast[.]liveListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINch14vjilcoecm8580ft0g6xsmrkewgwro[.]oast[.]liveListed as an indicator associated with Androxgh0st activity.
DOMAINch14vjilcoecm8580ft0owzy7e9c7hu36[.]oast[.]liveListed as an indicator associated with Androxgh0st activity.
DOMAINchcmp35oujaubpa7e86g1wz9dypg9oc67[.]oast[.]siteListed as an indicator associated with Androxgh0st activity.
DOMAINchcmp35oujaubpa7e86g7mnzmqr9qadow[.]oast[.]siteListed as an indicator associated with Androxgh0st activity.
DOMAINchcmp35oujaubpa7e86gke4ba4r5iwxwz[.]oast[.]siteListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINchcmp35oujaubpa7e86gkmmxw6tzhz5s6[.]oast[.]siteListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINchi2p4r4bcdfd791dh50af56ny6e5p6e3[.]oast[.]funListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINchi2p4r4bcdfd791dh50c6dpgu4h9rdhc[.]oast[.]funListed as an indicator associated with Androxgh0st activity.
DOMAINchi2p4r4bcdfd791dh50e76q1is16rh83[.]oast[.]funListed as an indicator associated with Androxgh0st activity.
DOMAINchi2p4r4bcdfd791dh50tp6ptaa1syixo[.]oast[.]funListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINchke3769l5m6jbj8hq90cjcau8b594eu[.]oast[.]funListed in the article's IOC section with the exploit-related indicators.
DOMAINchke3769l5m6jbj8hq90d4dhb4nx4zagt[.]oast[.]funListed in the article's IOC section with the exploit-related indicators.
DOMAINchke3769l5m6jbj8hq90dzxqghnrfe6x6[.]oast[.]funListed under indicators for Fastjson-v1.2.47 remote code execution.
DOMAINchke3769l5m6jbj8hq90fu71kckky5x63[.]oast[.]funListed in the article's IOC section with the exploit-related indicators.
DOMAINchke3769l5m6jbj8hq90grzqgusyh11ep[.]oast[.]funListed under indicators for Fastjson-v1.2.47 remote code execution.
DOMAINchke3769l5m6jbj8hq90kumuzndndpokb[.]oast[.]funListed under indicators for Fastjson-v1.2.47 remote code execution.
DOMAINchke3769l5m6jbj8hq90mrpez639ppnhj[.]oast[.]funListed under indicators for Fastjson-v1.2.47 remote code execution.
DOMAINchke3769l5m6jbj8hq90q5hqbd8rq5gkk[.]oast[.]funListed under indicators for Fastjson-v1.2.47 remote code execution.
DOMAINchke3769l5m6jbj8hq90tyrybjrzu9d1x[.]oast[.]funListed in the article's IOC section with the exploit-related indicators.
DOMAINchke3769l5m6jbj8hq90up1kyouqdf7hx[.]oast[.]funListed in the article's IOC section with the exploit-related indicators.
DOMAINchke3769l5m6jbj8hq90wc79578iwhft1[.]oast[.]funListed in the article's IOC section with the exploit-related indicators.
DOMAINchke3769l5m6jbj8hq90y47n3ayz4uryc[.]oast[.]funListed under indicators for Fastjson-v1.2.47 remote code execution.
DOMAINcj7409i4t88ukb0publgakedcbwnz7nzy[.]oast[.]liveListed as an indicator associated with Androxgh0st activity.
DOMAINcj7409i4t88ukb0publgep4f3ii11ogdk[.]oast[.]liveListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINcj7409i4t88ukb0publgjtkyt534mnrby[.]oast[.]liveListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINcj7409i4t88ukb0publgtphu9h34f9bpn[.]oast[.]liveListed as an indicator associated with Androxgh0st activity.
DOMAINcv032vemsb87jtt2p11g5h8xztka6kruj[.]oast[.]meListed as an indicator associated with Androxgh0st activity.
DOMAINcv032vemsb87jtt2p11g5y63nwb1ekujx[.]oast[.]meListed under indicators for Spring4Shell.
DOMAINcv032vemsb87jtt2p11g9n8d9kmxqhq6q[.]oast[.]meListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINcv032vemsb87jtt2p11ger6hddhzm5j4p[.]oast[.]meListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINcv032vemsb87jtt2p11getfd9zd4tpqqs[.]oast[.]meListed as an indicator associated with Androxgh0st activity.
DOMAINcv032vemsb87jtt2p11gnn3nghfxgd3bt[.]oast[.]meListed in the article's IOC section with the exploit-related indicators.
DOMAINcv032vemsb87jtt2p11gwf68p1xw7rgtk[.]oast[.]meListed under indicators for Spring4Shell.
DOMAINcv032vemsb87jtt2p11gybdoc66nuxxxh[.]oast[.]meListed under indicators for Fastjson-v1.2.47 remote code execution.
DOMAINcv032vemsb87jtt2p11gz8mdcbnsokgf6[.]oast[.]meListed under indicators for Fastjson-v1.2.47 remote code execution.
DOMAINcv032vemsb87jtt2p11gzhoc81cijqymg[.]oast[.]meListed under indicators for Fastjson-v1.2.47 remote code execution.
DOMAINcv032vemsb87jtt2p11gzs4xhcki44oof[.]oast[.]meListed in the article's IOC section with the exploit-related indicators.
DOMAINd0i0taritt4c9dh9hln06thpknw9dcqhu[.]oast[.]todayListed as an indicator associated with Androxgh0st activity.
DOMAINd0i0taritt4c9dh9hln0h7xsu7h88cxfr[.]oast[.]todayListed as an indicator associated with Androxgh0st activity.
DOMAINd0i0taritt4c9dh9hln0rhrdyu5ds8frk[.]oast[.]todayListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINd0i0taritt4c9dh9hln0w8mzbmxi5bu96[.]oast[.]todayListed under indicators for Lantronix WLANScanSSID command injection.
DOMAINi-sh[.]detectors-testing[.]comListed in the article's IOC section with the exploit-related indicators.
IPV4185[.]172[.]128[.]93IP address listed in the IOC section under Apache Shiro and FasterXML jackson-databind.
MD55a12416857547341493b436299e9b886MD5 hash identified as the baocun.php webshell.
MD59e1fb14b747b5bdaf817845007a47752MD5 hash identified as the abuok.php webshell.
MD5d6efe92ca18570f940a720e51af77f72MD5 hash identified as the myabu.php webshell.
MD5f65749ddf93e890b48b3bde77b1302aaMD5 hash identified as the scwj.php webshell.

MITRE ATT&CK

T1059.004 · Unix ShellLogged command-injection attempts include executing `;cat /etc/passwd` on Unix-like systems.T1190 · Exploit Public-Facing ApplicationAndroxgh0st attempts to exploit web application and device vulnerabilities, including Shiro, Spring Framework, and Lantronix WLANScanSSID.T1496 · Resource HijackingJSON-RPC requests for mining work are reported as evidence suggesting deployment of cryptocurrency-mining software on compromised servers.T1505.003 · Web ShellThe article describes PHP webshells planted on compromised infrastructure for persistent access and further payload deployment.

CVE

CVE-2017-5638A complex Object-Graph Navigation Language (OGNL) payload is present, a hallmark of attacks against the Apache Struts2 framework (e.g., CVE-2017-5638) that can result in RCE.CVE-2019-17574CVE-2019-17574: Sensitive Information DisclosureCVE-2020-10650CVE-2020-10650: JNDI Injection, Remote Code ExecutionCVE-2020-9547CVE-2020-9547: JNDI Injection, Remote Code ExecutionCVE-2020-9548CVE-2020-9548: JNDI Injection, Remote Code ExecutionCVE-2021-21881CVE-2021-21881: WLANScanSSID Command Injection - Remotely Control IoT Device(s)CVE-2022-22965Spring4Shell CVE-2022-22965 - Remote Code ExecutionCVE-2024-4577CVE-2024-4577

Threat Actors

Androxgh0stBotnet identified by CloudSEK as exploiting vulnerabilities, compromising infrastructure, and deploying webshells and cryptomining software.

Malware

Androxgh0stCloudSEK’s recent investigation reveals that the Androxgh0st botnet has evolved significantly since its early activity in 2023, leveraging a wide range of Initial Access Vectors (IAVs). Misconfigured/vulnerable servers

Vendors

Lantronixbotnet exploits popular platforms (e.g., Apache Shiro, Spring framework, WordPress) and IoT devices (Lantronix), enabling remote code execution, sensitive data theft, and cryptomining. Evidence from the C2 logs

Products

Apache Shirowere found hosting command-and-control (C2)logger panels. The botnet exploits popular platforms (e.g., Apache Shiro, Spring framework, WordPress) and IoT devices (Lantronix), enabling remote code execution, sensitiveApache StrutsApache StrutsFasterXML jackson-databindFasterXML jackson-databind 2.x before 2.9.10.4fastjson-v1.2.47fastjson-v1.2.47Lantronix PremierWaveLantronix PremierWavePopup MakerWordPress Plugin “Popup Maker”Spring Frameworkcommand-and-control (C2)logger panels. The botnet exploits popular platforms (e.g., Apache Shiro, Spring framework, WordPress) and IoT devices (Lantronix), enabling remote code execution, sensitive data theft, andWordPress(C2)logger panels. The botnet exploits popular platforms (e.g., Apache Shiro, Spring framework, WordPress) and IoT devices (Lantronix), enabling remote code execution, sensitive data theft, and cryptomining.

Tools

YARATo detect malicious uploads or runtime use of shells, place YARA scans on:

Countries

JamaicaUnited Stateslogger on the website of a Jamaican events aggregator platform. This time, it's a university in the United States.

Industries

Education

Related Articles