Eight Australian web hosting providers compromised in ‘​Manic Menagerie’ attack campaign

• Vulnerabilities within web applications and information stealing malware were leveraged to perform the attack.
• One vulnerability that was exploited in the attack was related to privilege escalation - CVE-2018-1038, also known as TotalMeltdown.

According to a recent report from the Australian Cyber Security Center (ACSC), eight Australian web hosting providers were compromised in a malware attack in 2018.

Vulnerabilities within web applications and information stealing malware were leveraged to perform the attack - which was dubbed as 'Manic Menagerie' by the ACSC.

Attack method

It was revealed that hackers abused the flaws with web applications to get root access to web servers. Upon gaining access, they installed a malware - that included both password stealing tools and the Gh0st remote access tool (RAT).

Further analysis revealed that the attackers used a web browser to manually interact with the targeted websites and find the vulnerabilities. Once identified, the attackers manually exploited these flaws to create a web shell on the server. This enabled them to gain control over the websites and perform future interactions remotely.

One vulnerability that was exploited in the attack was related to privilege escalation - CVE-2018-1038, also known as TotalMeltdown. The vulnerability was released publicly in late April 2018.

“The actor’s privilege escalation tools were all public proof of concepts (POC) and demonstrated an ability to quickly use new POC exploits,” the center said in a report.

About Gh0st RAT

Gh0st is a fully featured remote access tool (RAT). The malware’s capabilities include recording keystrokes, capturing recordings from webcam and microphone, stealing files from victims’ systems, downloading additional payloads and providing full remote control of a host.

As per the center, Gh0st was used for ‘remote access to victims’ systems’ and to ‘upload and download files without users’ knowledge or consent’.

"When executed, the Gh0st dropper creates a Windows executable with a .gif extension in a legitimate Windows directory then registers a new service to execute the dropped file on start-up," stated the report. "Every execution of the dropper results in a binary with a different hash being generated which causes hash-based detection to be ineffective."

Two of the eight compromised web hosting providers were used for mining Monero cryptocurrency. While none of the websites’ names have been disclosed by the ACSC, it is found that attackers had stolen a sum of AU$3868 (approximately 22.57 XMR).

The ACSC found that actors had modified some of these sites to boost SEO rankings and to redirect legitimate traffic to sites selling illegitimate products.

"The access was exclusively used to conduct criminal activity on the network and customer websites, using the reputation of these legitimate sites to add validity to their activities,” said the report.

In the wake of the malware attack campaign, the ACSC has advised web hosting providers to patch their web applications and CMSs, disable malicious plugins and reset user credentials.