Exploitation of Older Versions of HTTP File Server by Cybercriminals

A significant security concern has emerged as cybercriminals actively exploit vulnerabilities in outdated versions of the HTTP File Server created by Rejetto. These malicious actors are leveraging these vulnerabilities to distribute Monero mining malware and other harmful software.

Reports from the cybersecurity firm AhnLab indicate that hackers have identified a means to target older editions of the HTTP File Server (HFS), originally designed for file sharing purposes. Exploiting a critical vulnerability present in HFS versions up to 2.3m, threat actors can execute remote commands without the need for authentication, granting them unauthorized system access.

The exploitation of these vulnerabilities goes beyond simple system compromise, as cybercriminals have been detected deploying a variety of malicious tools. This includes the distribution of Monero mining software like XMRig and remote access trojans such as XenoRAT and Gh0stRAT.

Rejetto, in response to the discovered exploits, has issued warnings, acknowledging the identified bug and advising users to avoid using versions 2.3m through 2.4 due to the inherent dangers associated with these outdated releases.

The preference for deploying XMRig by cybercriminals is attributed to Monero's advanced privacy features, which ensure transactions remain untraceable. XMRig's flexibility across different hardware configurations, coupled with its open-source nature allowing for easy modifications, enhances its appeal to malicious actors. Its ability to operate covertly in the background of a system reduces the risk of detection.

The ongoing exploitation of these older HTTP File Server versions highlights the importance of regular software updates and robust security measures to defend against evolving cyber threats effectively.