{"id":576,"date":"2023-12-14T02:16:36","date_gmt":"2023-12-14T02:16:36","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=576"},"modified":"2023-12-14T02:16:36","modified_gmt":"2023-12-14T02:16:36","slug":"threat-profile-red-berryminer","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2023\/12\/14\/threat-profile-red-berryminer\/","title":{"rendered":"Threat Profile: Red BerryMiner"},"content":{"rendered":"

\"\"<\/p>\n

Red BerryMiner<\/strong><\/a><\/h2>\n

<\/a>Objective<\/h1>\n

This report analyses the modus operandi, TTPs, infrastructure, and tools used by a threat group named by SCILabs as Red BerryMiner<\/em>, which exploits vulnerabilities in servers of various organizations exposed on the Internet to infect them with the Mirai<\/em> malware families, ShellBot<\/em>, and predominantly the crypto-miner XMRig<\/em>.<\/a><\/p>\n

<\/a>Overview<\/h1>\n

The initial access vector of this adversary is primarily the exploitation of Internet-exposed server vulnerabilities, predominantly the vulnerability registered with the identifier CVE-2023-3722<\/strong><\/a>(CVSS:3.0 – 9.8<\/strong>), which affects the Avaya Aura Device web application Services.<\/p>\n

SCILabs identified in its own and public<\/a> investigations that Red<\/em> BerryMiner<\/em> exploits other vulnerabilities like the one registered with the identifiers CVE-2018-20062<\/strong><\/a>(CVSS:3.0 – 9.8<\/strong>) and CVE-2022-22965<\/strong><\/a>(CVSS:3.0 – 9.8<\/strong>) to install malware such as Mirai<\/em> and XMRig<\/em>.<\/p>\n

Based on the SCILabs telemetry study, we observed that Red<\/em> BerryMiner<\/em> directs its attacks to organizations in different countries (without targeting a specific sector) to use the compromised infrastructure for crypto-mining activities. According to our research, Red<\/em> BerryMiner<\/em> could operate as early as February 2023.<\/a><\/p>\n

<\/a><\/p>\n

<\/a>Region of operation<\/h1>\n

According to the evidence collected by SCILabs, the countries where activity related to Red BerryMiner<\/em> attacks has been observed are Mexico, the United States, Spain, Russia, and South Africa.<\/p>\n

\"\"<\/p>\n

Figure 1. Red BerryMiner operating region, identified so far by SCILabs.<\/strong><\/em><\/p>\n

SCILabs identified part of the Red BerryMiner<\/em> infrastructure used as a malware repository by this threat actor geolocated in some countries around the world, highlighting the Netherlands. Due to its IP address it belongs to the infrastructure of Alsycon B.V<\/a>. Therefore, it is hypothesized with a low level of confidence that the operators behind Red BerryMiner<\/em> are located mainly in that country.<\/p>\n

\"\"<\/p>\n

Figure 2. Red BerryMiner domains registration regions<\/strong><\/em><\/p>\n

\"\"<\/p>\n

Figure 3. Domain information download[.]asyncfox[.]xyz used by Red BerryMiner<\/em><\/strong><\/p>\n

The following figure shows a timeline with the most relevant Red BerryMiner<\/em> activity according to the events observed and analyzed by SCILabs since February 2023.<\/p>\n

\"\"<\/p>\n

Figure 4. Red BerryMiner campaigns timeline<\/strong><\/em><\/a><\/p>\n

<\/a>Who can it affect?<\/h1>\n

According to SCILabs telemetry, the leading affected organizations are those that use or have public services on the Internet with unmitigated vulnerabilities. The most exploited vulnerabilities by Red<\/em> BerryMiner<\/em> are the following:<\/p>\n\n\n\n\n\n\n
#<\/strong><\/td>\nTechnology<\/strong><\/td>\nVulnerability<\/strong><\/td>\nCriticality Level<\/strong><\/td>\nDescription<\/strong><\/td>\n<\/tr>\n
1<\/td>\n\u00a0Avaya Aura Device Services<\/strong><\/td>\n\n

CVE-2023-3722<\/strong><\/a><\/p>\n<\/td>\n

CVSS:3.0 – 9.8 CRITICAL<\/td>\nOperating system command injection vulnerability in the Avaya Aura Device Services web application could allow remote code execution as a user of the web server via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.<\/td>\n<\/tr>\n
2<\/td>\nThinkPHP<\/strong><\/td>\n\n

CVE-2018-20062<\/strong><\/a><\/p>\n<\/td>\n

CVSS:3.0 \u2013 9.8 CRITICAL<\/td>\nAllows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter.<\/td>\n<\/tr>\n
3<\/td>\nSpring Shell<\/strong><\/td>\nCVE-2022-22965<\/strong><\/a><\/td>\nCVSS:3.0 – 9.8 CRITICAL<\/td>\n\n

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e., the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 1. Exploited vulnerabilities by Red BerryMiner<\/strong><\/em><\/a><\/p>\n

<\/a><\/p>\n

<\/a><\/p>\n

<\/a>How can it affect an organization?<\/h1>\n

The main risk associated with this threat group is that they tend to exploit vulnerabilities in technology commonly used by all types of organizations to distribute the XMRig<\/em> crypto-miner and integrate the victim devices into the Mirai<\/em> Botnet network. This can cause severe consequences on an organization’s infrastructure. Furthermore, known for its DDoS attacks, Mirai<\/em> can cause massive disruptions to services and systems, damaging reputation and causing financial losses. On the other hand, XMRig<\/em> consumes resources from compromised systems to mine cryptocurrencies, leading to a slowdown in operations, increased energy costs, and potential additional security breaches.<\/a><\/p>\n

<\/a>Analysis<\/h1>\n

First campaign identified by SCILabs<\/strong><\/p>\n

During the first attack analyzed by SCILabs identified in July, which affected a government sector organization, the use of different droppers developed with PHP to download a shell script and the ShellBot<\/em> malware was identified. The downloaded shell script is named start.sh<\/strong> and it aims to deploy two additional scripts and the XMRig<\/em> crypto mining software. One of the scripts is responsible for terminating specific processes, and the other collects SSH keys, hosts, and users to perform lateral movement within the affected organization’s network.<\/p>\n

Droppers<\/u><\/strong><\/p>\n

sh <\/em><\/strong>script Droppers<\/strong><\/p>\n