CVE

CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It

Exploitation IoCs 11

Domain codeberg[.]org

Domain opencompiled[.]org

Domain www[.]opencompiled[.]org

Filename patch-mc-0x129.sh

GitHub Repo hpc20235/yawpp

GitHub Repo k0rn66/xmrdropper

GitHub Repo opencompiled-oss/kernel-patch

IP 37[.]120[.]193[.]124

IP 94[.]156[.]177[.]14

Package 0xengine/meow

Package 0xengine/xmlrpc

MITRE ATT&CK TTPs 8

T1005

Data from Local System

Collection

T1027

Obfuscated Files or Information

Defense Evasion

T1059

Command and Scripting Interpreter

Execution

T1071

Application Layer Protocol

Command And Control

T1082

System Information Discovery

Discovery

T1083

File and Directory Discovery

Discovery

T1195

Supply Chain Compromise

Source Articles

Getting a taste of your own medicine: Threat actor MUT-1244 targets offensive actors, leaking hundreds of thousands of credentials | Datadog Security Labs

Threat actor MUT-1244 targets offensive security actors, including pentesters and researchers, using phishing campaigns and trojanized GitHub repositories to deliver a second-stage payload. The payload exfiltrates sensitive data such as SSH keys, AWS credentials, and environment variables. Over 390,000 WordPress credentials were harvested after compromising threat actors who used a trojanized credential checker tool named 'yawpp'. The actor leverages multiple initial access methods, including malicious npm packages and phishing emails, to distribute the same backdoor.

Datadog Security Labs