Muhstik Botnet Targeting Redis Servers Using Recently Disclosed Vulnerability

Muhstik, a botnet infamous for propagating via web application
exploits, has been observed targeting Redis servers using a
recently disclosed vulnerability in the database system.

The vulnerability relates to CVE-2022-0543^[1], a Lua sandbox escape flaw^[2]
in the open-source, in-memory, key-value data store that could be
abused to achieve remote code execution on the underlying machine.
The vulnerability is rated 10 out of 10 for severity.

“Due to a packaging issue, a remote attacker with the ability to
execute arbitrary Lua scripts could possibly escape the Lua sandbox
and execute arbitrary code on the host,” Ubuntu noted in an
advisory released last month.

According to telemetry data^[3]
gathered by Juniper Threat Labs, the attacks leveraging the new
flaw are said to have commenced on March 11, 2022, leading to the
retrieval of a malicious shell script (“russia.sh”) from a remote
server, which is then utilized to fetch and execute the botnet
binaries from another server.

First documented^[4]
by Chinese security firm Netlab 360, Muhstik is known to be
active^[5]
since March 2018 and is monetized for carrying out coin mining
activities and staging distributed denial-of-service (DDoS)
attacks.

Capable of self-propagating on Linux and IoT devices like GPON
home router, DD-WRT router, and Tomato routers^[6], Muhstik has been
spotted weaponizing a number of flaws over the years –

• CVE-2017-10271^[7] (CVSS score: 7.5) – An
  input validation vulnerability in the Oracle WebLogic Server
  component of Oracle Fusion Middleware
• CVE-2018-7600^[8] (CVSS score: 9.8) –
  Drupal remote code execution vulnerability
• CVE-2019-2725^[9] (CVSS score: 9.8) –
  Oracle WebLogic Server remote code execution vulnerability
• CVE-2021-26084^[10] (CVSS score: 9.8) – An
  OGNL (Object-Graph Navigation Language) injection flaw in Atlassian
  Confluence, and
• CVE-2021-44228^[11] (CVSS score: 10.0) –
  Apache Log4j remote code execution vulnerability (aka
  Log4Shell)

“This bot connects to an IRC server to receive commands which
include the following: download files, shell commands, flood
attacks, [and] SSH brute force,” Juniper Threat Labs researchers
said in a report published last week.

In light of active exploitation of the critical security flaw,
users are highly recommended to move quickly to patch their Redis
services to the latest version.