An updated Python-based virus that targets Windows and Linux systems can now obtain access to VMware vCenter servers that are accessible to the Internet and are not patched against a remote code execution vulnerability.

The malware, known as FreakOut by CheckPoint researchers in January (also known as Necro and N3Cr0m0rPh), is an obscured Python script built with a polymorphic engine and a user-mode rootkit that conceals dangerous files placed on infected systems.

FreakOut spreads by taking advantage of a variety of OS and app flaws and brute-forcing passwords over SSH, adding the infected devices to an IRC botnet that is under the control of its creators.

Infected systems can be backdoored, network traffic can be sniffed and exfiltrated, and XMRig miners can be used to mine Monero cryptocurrency thanks to the malware’s main feature.

updated malware with fresh exploits
FreakOut’s developers have been hard at work enhancing the malware’s spreading capabilities since early May, when the botnet’s activity has abruptly spiked, Cisco Talos researchers said in a report released today.

Vanja Svajcer, a security researcher at Cisco Talos, said that although the bot was first identified this year, recent activity “shows numerous changes to the bot, ranging from different command and control (C2) communications and the addition of new exploits for spreading, most notably vulnerabilities in VMWare vSphere, SCO OpenServer, Vesta Control Panel and SMB-based exploits that were not present in the earlier iterations of the code.”

FreakOut bots look for new systems to attack by generating network ranges at random or by responding to commands from their masters delivered via IRC via the command-and-control server.

The bot will attempt to log in using one of the built-in exploits or a hardcoded set of SSH credentials for each IP address in the scan list.

The most recent FreakOut versions include more than twice as many built-in exploits, whereas earlier versions could only exploit vulnerable versions of Liferay, Laravel, WebLogic, TerraMaster, and Zend Framework (Laminas Project) web apps.

The following newly added malware variant exploits were discovered by Cisco Talos in May:

VestaCP — ‘v sftp licence’ Command Injection in VestaCP 0.9.8
‘cgi-bin/kerbynet’ in ZeroShell 3.9.0 Injection of remote root commands
The ‘outputform’ Command Injection Genexis in SCO Openserver 5.0.7 VULNERABILITY IN PLATINUM 4410 2.1 P4410-V2-1.28 FOR REMOTE COMMAND EXECUTION
Remote Command Execution vulnerability in OTRS 6.0.1
Remote Command Execution vulnerability in VMware vCenter
An unknown app’s Nrdh.php remote code execution vulnerability
Python versions of the EternalBlue and EternalRomance attacks (CVE-2017-0144 and CVE-2017-0147, respectively)
Numerous VMware servers are vulnerable to assaults.
The vCenter plugin for vRealize Operations (vROps) contains the VMware vCenter vulnerability (CVE-2021-21972), which is particularly intriguing because it affects all default vCenter Server installations.

Shodan and BinaryEdge have revealed that thousands of unpatched vCenter servers are currently reachable over the Internet.

After security researchers released a proof-of-concept (PoC) exploit code, attackers had previously bulk scanned for vulnerable Internet-exposed vCenter servers.

In February, CVE-2021-21972 exploits were also added to the toolkit of Russian Foreign Intelligence Service (SVR) state hackers, who are now actively using them in ongoing activities.

Ransomware attacks aimed at enterprise networks have also in the past taken advantage of VMware vulnerabilities. FreakOut operators have also been observed releasing a unique ransomware strain, indicating that they are actively experimenting with new harmful payloads, Cisco Talos reported.

Several ransomware groups, including RansomExx, Babuk Locker, and Darkside, have in the past encrypted virtual hard drives used as centralised enterprise storage space using VMware ESXi pre-auth RCE attacks.

“The Necro Python bot depicts an actor who updates the bot with the most recent remote command execution exploits for various online apps. This raises the likelihood of it spreading and contaminating systems, “said Svajcer.

Users must frequently update all apps, not only operating systems, with the most recent security patches.