01-25-2021 , 12:19 AM
A campaign of attacks on Linux systems using a new malware variant called 'FreakOut', discovered by experts at Check Point Research, threatens millions of Linux users. Although Linux-based systems are installed on less than 2% of all desktop devices, the platform is particularly popular with programmers and research institutions.
According to specialists, each of the infected devices can be used as a platform to launch further cyber attacks, such as using system resources to mine cryptocurrencies, spreading malicious files across the corporate network, or carrying out attacks on external targets, including DDoS attacks, thanks to the connection of computers Into a powerful IRC botnet (a collection of machines infected with malware that can be remotely controlled).
The FreakOut malware used in the attack takes advantage of relatively recently discovered vulnerabilities in programs such as:
• TerraMaster TOS (TerraMaster Operating System) - a known vendor of data storage devices (using CVE-2020-28188);
• Zend Framework - a popular collection of library packages, used to create web applications (using CVE-2021-3007);
• Liferay Portal - Free, open source enterprise portal with portal and website creation functions (use CVE-2020-7961).
The positive news is that the appropriate security patches are now available for all of the above. Platforms. Check Point experts advise users to urgently update their programs in order to patch dangerous gaps.
So far, Check Point researchers have been able to track 185 systems infected with malware. In addition, they detected over 380 additional attack attempts that were stopped by Check Point's solutions. Over 27% of the attack attempts occurred in the United States alone. Attacks also took place incl. In Great Britain, Italy, the Netherlands and Germany. The main target industries were finance and administration.
Source: Check Point
According to specialists, each of the infected devices can be used as a platform to launch further cyber attacks, such as using system resources to mine cryptocurrencies, spreading malicious files across the corporate network, or carrying out attacks on external targets, including DDoS attacks, thanks to the connection of computers Into a powerful IRC botnet (a collection of machines infected with malware that can be remotely controlled).
The FreakOut malware used in the attack takes advantage of relatively recently discovered vulnerabilities in programs such as:
• TerraMaster TOS (TerraMaster Operating System) - a known vendor of data storage devices (using CVE-2020-28188);
• Zend Framework - a popular collection of library packages, used to create web applications (using CVE-2021-3007);
• Liferay Portal - Free, open source enterprise portal with portal and website creation functions (use CVE-2020-7961).
The positive news is that the appropriate security patches are now available for all of the above. Platforms. Check Point experts advise users to urgently update their programs in order to patch dangerous gaps.
So far, Check Point researchers have been able to track 185 systems infected with malware. In addition, they detected over 380 additional attack attempts that were stopped by Check Point's solutions. Over 27% of the attack attempts occurred in the United States alone. Attacks also took place incl. In Great Britain, Italy, the Netherlands and Germany. The main target industries were finance and administration.
Source: Check Point