Analysis
Making use of the Python-based hacking tool Legion, threat actors may penetrate internet services to be further exploited, according to Telegram promotional activities. The programme comes with modules to list vulnerable SMTP servers, carry out remote code execution attacks, take advantage of unpatched versions of Apache, and brute-force logins for cPanel and WebHost Manager. The virus is comparable to the AndroxGh0st malware family, which cloud security services firm Lacework originally identified in December 2022. It is crucial to remember that using hacking tools is against the law, is illegal, and may have negative effects on people, organisations, and society as a whole. It's essential to follow the law and employ moral and legal procedures to hone your skills and gain expertise in areas like cybersecurity.
Prevention
- Education and information
- Dependable security measures
- Updating software often
- Using multiple factors of authentication and strong passwords
- Flagging suspicious behaviour
- Using moral and legal principles to develop cybersecurity skill sets
Detection
Legion-based attack detection might be difficult because the technology is meant to hide assaults using methods like obfuscation and encryption. But some detecting techniques are as follows:
- Monitoring network traffic: Monitoring network traffic could help in finding unusual or suspicious behaviour that might indicate to an attack.
- Installing intrusion detection and prevention systems: Installing such systems can assist in spotting and to prevent attempts like remote code execution and brute-force attacks.
- Monitoring for odd login behaviour: Monitoring for unusual login behaviour, such as many unsuccessful login attempts or logins from various places, can aid in the detection of attacks that seek to get user credentials.
- Regular vulnerability scanning: Regular vulnerability scanning can assist identify and fix flaws that an attacker could exploit.
- Implementing file integrity monitoring can assist in identifying alterations or changes to vital system files, which may be signs of an assault.
- A layered defense approach is crucial for cybersecurity. Stay up-to-date and follow best practices for security and risk management. Detection methods can help identify potential attacks but are not foolproof.
Indicators of Compromise (IOCs)
- Unusual network traffic, such as an increase in traffic to or from suspicious IP addresses.
- Unusual login activity, such as failed login attempts or multiple logins from different locations.
- Presence of suspicious files or processes, such as unknown processes running in the background or unrecognized files on the system.
- Unusual system behavior, such as slow performance or crashes.
- Presence of unauthorized users or accounts, such as new accounts with elevated privileges.
- Presence of suspicious domains or URLs, such as domains or URLs associated with phishing or malware campaigns.
- Unusual DNS requests, such as requests for known malicious domains or requests from suspicious IP addresses.
It is important to note that IOCs may vary depending on the specific attack.
References
The hacker news
