Windows, Apache Solr, and Redis servers were the main targets of malicious users last week. Computers that do not have security updates were their targets in order to install malware for cryptocurrency mining.
The 2 major campaigns that were launched were identified by the company Imperva targeting Windows and Redis servers and ISC SANS targeting Apache Solr.
The most active of the two was what Imperva calls RedisWannaMine. This one is still active and cybercriminals are scanning the internet for systems running outdated versions of Redis that are vulnerable to the CVE-2017-9805 vulnerability. Once they gain access, they then install the RedisWannaMine Malware which in turn installs a cryptocurrency miner. However, they don’t stop there, they use the same method of scanning for Windows servers with vulnerabilities in SMB ports. Here, the installation includes the well-known EternalBlue and the installation of a cryptominer. This is not the first time a coinminer campaign has targeted Redis servers. Earlier, in February, another campaign earned $1 million (in cryptocurrency) by infecting Redis and OrientDB servers with similar cryptomining software.
The second most active one targeted Apache Solr servers using the CVE-2017-12629 vulnerability. Here the end result is again the installation of a cryptocurrency miner, with the difference that there is no automated mechanism for spreading it to other network devices like in RedisWannaMine. The number of infected servers is 1,777 (first ten days of March).
Although Windows and Redis servers are easy to update with various patches and become more secure, they are often part of a more complex system which, if modified, can cause malfunctions in their overall infrastructure.
