Capoae Malware Targets Web Servers and WordPress
Cybercriminals are continuing to actively experiment with malware that uses the Golang programming language. This approach has multiple advantages, but there are two main ones that make it so attractive to cybercriminals. Because Golang is a fairly novel language, some security tools are not yet good enough to spot and terminate malicious code. In addition to this, Golang offers great cross-platform compatibility without asking for the prerequisites that JAVA, for example, demands. Other Golang malware families are the RustyBuer and Klingon RAT. The Capoae Malware is one of the latest Golang projects. This particular sample goes after Web servers, and it attempts to use several known vulnerabilities to obtain credentials and permissions.
The latest campaign of the Capoae Malware targets two primary vulnerabilities:
- CVE-2020-14882 – affecting outdated Oracle WebLogic Server versions and leading to Remote Code Execution (RCE.)
- CVE-2018-20062 – affects ThinkPHP and also enables attackers to execute remote code.
On top of these known exploits, the criminals behind the Capoae Malware are also using brute force to target servers with lax login credentials. One of the affected systems had the payload delivered through the use of a malicious plug-in that the attackers installed thanks to the stolen credentials. The faulty add-on, dubbed Download-monitor, affects WordPress installs.
Capoae Malware Features
The purpose of this threat is to deploy a payload, which brings a modified copy of the XMRig cryptocurrency miner. This particular software is the #1 favorite of cybercriminals who look to execute cryptojacking operations. It utilizes the infected server's resources to mine for the Monero cryptocurrency.
However, dropping the miner is not the end of the attack. The Capoae Malware also deploys web shells, which grant the attacker more control over the server. The criminals may utilize the infected Web servers and WordPress installations to scan the Internet for more potential victims.
Protecting yourself from the Capoae Malware requires the use of robust security features, as well as strong login credentials. Of course, applying the latest updates to all Internet-connected software is also mandatory to reduce the risk of attacks.
