Akamai Diversity

Akamai Security Intelligence
& Threat Research

Recently by Larry Cashdollar

Larry Cashdollar

Larry Cashdollar

November 18, 2019 9:00 AM

Update to x86 XMR Crypto Mining Blog Post

Back in August, I wrote an article about XMR crypto mining software targeting x86/I686 systems. This is a follow-up to that original malware analysis. Previously, I discussed an attacker who, using known default login credentials, targets enterprise systems to mine the XMR cryptocurrency.

Larry Cashdollar

Larry Cashdollar

October 21, 2019 8:00 AM

A Cryptomining SSH Worm

Recently, I noticed an interesting cryptomining script in my honeypot. It had all the usual checks for CPU and architecture type before downloading a binary. It even had the usual kill any processes that might be other cryptominers. However, what caught my eye was a one-line shell script that searched through .ssh/known_hosts and .ssh/id_pub.pub keys, in an attempt to infect other systems that might share SSH keys with the infected

Larry Cashdollar

Larry Cashdollar

October 7, 2019 8:00 AM

Drupalgeddon2 still used in attack campaigns

While examining Akamai's network attack logs, I noticed an attack campaign leveraging Drupalgeddon2. Drupalgeddon2 is an unauthenticated remote code execution vulnerability (CVE-2018-7600) in the Drupal CMS platform that was patched in March 2018.

Larry Cashdollar

Larry Cashdollar

August 30, 2019 5:30 PM

XMR Cryptomining Targeting x86/i686 Systems

I have been playing close attention to Internet of Things (IoT) malware targeting systems with Telnet enabled, while also collecting samples targeting systems with SSH enabled on port 22. I've collected over 650 samples landing in my honeypot within the last week. The earliest sample showed up on July 24th at 20:06. The honeypot allows logins using known default login credentials for root.

Larry Cashdollar

Larry Cashdollar

July 29, 2019 7:00 AM

Criminals using targeted Remote File Inclusion attac ...

In June 2019, logs on my personal website recorded markers that were clearly Remote File Inclusion (RFI) vulnerability attempts. The investigation into the attempts uncovered a campaign of targeted RFI attacks that currently are being leveraged to deploy phishing kits. The latest kit focuses on a large and well-known bank in the EU.

Larry Cashdollar

Larry Cashdollar

June 26, 2019 2:14 PM

SIRT Advisory: Silexbot bricking systems with known ...

On June 25th, I discovered a new bot named Silexbot on my honeypot. The bot itself is a blunt tool used to destroy IoT devices. Its author, someone who claims to be a 14-year-old boy from Europe, has made his intentions clear with some very distinct text embedded in the code.

Larry Cashdollar

Larry Cashdollar

June 13, 2019 11:17 AM

Latest ECHOBOT: 26 Infection Vectors

Introduction Since the release of the Mirai source code in October of 2016, there have been hundreds of variants. While publishing my own research, I noticed that Palo Alto Networks was also examining similar samples, and published their findings. Earlier this month, not too long after Palo Alto Networks published their report, I discovered a newer version of Echobot that uses 26 different exploits for its infection vectors. In some

Larry Cashdollar

Larry Cashdollar

June 5, 2019 8:00 AM

Identifying Vulnerabilities in Phishing Kits

While recently examining hundreds of phishing kits for ongoing research, Akamai discovered something interesting - several of the kits included basic vulnerabilities due to flimsy construction or reliance on outdated open source code. Considering the impact phishing kits have on the Internet and web hosting as a whole, the phrase "kicking someone when they're down" certainly come to mind.

Larry Cashdollar

Larry Cashdollar

April 1, 2019 10:09 AM

SIRT Advisory: Multiple Vulnerabilities in Magento

Summary Magento users should patch their systems to the fixed versions 2.3.1, 2.2.8 and 2.1.17 immediately due to multiple severe vulnerabilities disclosed in Magento on March 26, 2019.