VMware bug with 9.8 severity rating exploited to install witch’s brew of malware - Ars Technica

GOT PATCHES? —

If you haven't patched CVE-2022-22954 yet, present would beryllium an fantabulous clip to bash so.

Dan Goodin - Oct 21, 2022 10:31 p.m. UTC

Hackers person been exploiting a now-patched vulnerability successful VMware Workspace ONE Access successful campaigns to instal assorted ransomware and cryptocurrency miners, a researcher astatine information steadfast Fortinet said connected Thursday.

CVE-2022-22954 is simply a distant codification execution vulnerability successful VMware Workspace ONE Access that carries a severity standing of 9.8 retired of a imaginable 10. VMware disclosed and patched the vulnerability connected April 6. Within 48 hours, hackers reverse-engineered the update and developed a moving exploit that they past utilized to compromise servers that had yet to instal the fix. VMware Workspace ONE entree ​​helps administrators configure a suite of apps employees request successful their enactment environments.

In August, researchers astatine Fortiguard Labs saw a abrupt spike successful exploit attempts and a large displacement successful tactics. Whereas earlier the hackers installed payloads that harvested passwords and collected different data, the caller surge brought thing else—specifically, ransomware known arsenic RAR1ransom, a cryptocurrency miner known arsenic GuardMiner, and Mirai, bundle that corrals Linux devices into a monolithic botnet for usage successful distributed denial-of-service attacks.

FortiGuard

“Although the captious vulnerability CVE-2022-22954 is already patched successful April, determination are inactive aggregate malware campaigns trying to exploit it,” Fortiguard Labs researcher Cara Lin wrote. Attackers, she added, were utilizing it to inject a payload and execute distant codification execution connected servers moving the product.

The Mirai illustration Lin saw getting installed was downloaded from http[:]//107[.]189[.]8[.]21/pedalcheta/cutie[.]x86_64 and relied connected a bid and power server astatine “cnc[.]goodpackets[.]cc. Besides delivering junk postulation utilized successful DDoSes, the illustration besides attempted to infect different devices by guessing the administrative password they used. After decoding strings successful the code, Lin recovered the pursuing database of credentials the malware used: