Cybercriminals are targeting Linux-based servers running Microsoft’s Azure public cloud environment that are vulnerable to flaws, after Microsoft didn’t automatically apply a patch on affected clients in its infrastructure.
According to cybersecurity firm Recorded Future, the attacks began the night of Sept. 16 after a proof-of-concept exploit was published earlier in the day on GitHub. About 10 malicious servers have been searching the internet for vulnerable systems, and while the search began slowing, it has now ramped up to more than 100 sites by morning, Recorded Future noted, citing information from threat intelligence vendor GreyNoise.
In addition, Cado Security researchers in a blog post also noted a tweet from cybersecurity researcher German Fernandez, who found that the infamous DDoS Mirai botnet – known for taking advantage of insecure Internet of Things (IoT) devices – also is exploiting OMIGOD. Mirai is putting a version of the botnet into a system and then closing the 5896 OMI SSL port, essentially stopping others from exploiting the same box.
According to Cado researchers, the Mirai worm tries to spread to other systems via various vulnerabilities, including OMIGOD.
“The race is on,” Stuart Winter-Tear, director of strategy at threat model solutions maker ThreatModeler, told eSecurity Planet. “As this is now confirmed as being actively scanned and exploited in an automated fashion via botnets, and we know there is the potential for root privilege remote code execution, any open OMI ports must be closed as soon as possible and Azure mitigation guidelines need to be implemented.”
Read on to learn more about how attackers are exploiting the OMIGOD Flaw in Azure, despite Microsoft fixes