CyberPanel Ransomware Attack: Vulnerabilities forced thousands of instances to be taken offline
A massive PSAUX ransomware attack by Cybercriminals has disrupted CyberPanel instances after taking advantages of multiple vulnerabilities in CyberPanel.
Due to a massive PSUAX ransomware attack, thousands of CyberPanel instances are forced to be taken offline. Cybercriminals have taken advantage of multiple vulnerabilities in CyberPanel and installed PSUAX ransomware which forced thousands of CyberPanel instances offline. Attacks involved a pair of scripts, one for CyberPanel bug exploitation and the other for file encryption.
Why is PSAUX Ransomware harmful?
PSAUX ransomware targets Linux- based systems. It has advanced techniques to avoid detection which make it harmful for businesses and organizations which are using Linux systems for critical applications.
What were the CyberPanel vulnerabilities?
Alias DreyAnd, a cybersecurity researcher, has announced finding three major vulnerabilities in CyberPanel 2.3.6 and most likely to be 2.3.7 that allowed cybersecurity breachers for remote code execution, and arbitrary system commands execution.
Security researcher DreyAnd disclosed that CyberPanel 2.3.6 (and likely 2.3.7) suffers from three distinct security problems like defective authentication, command injection and security filter bypass that can result in an exploit allowing unauthenticated remote root access without authentication.
In a statement to Bleeping Computer, Cybersecurity researcher Alias DreyAnd has said that “he could only test the exploit on version 2.3.6 as he did not have access to the 2.3.7 version at the time. However, as 2.3.7 was released on September 19, before the bug was found, it was likely impacted as well. They also published a Proof – of – Control (PoC) on How to take over vulnerable server.
As per Bleeping Computer’s report, over 22,000 CyberPanel instances exposed online to a critical remote code execution (RCE) vulnerability were mass-targeted in a PSAUX ransomware attack that took almost all instances offline.
As per threat intelligence search engine LeakIX, most of these CyberPanel implementations were in the United States, followed by Germany, Singapore, Indonesia, India and France. These files i.e. PSAUX files had a loophole which enabled LeakIX to develop a decryptor.
The Businesses and Organizations that were affected by CyberPanel PSUAX Ransomware attack were immediately asked to install the latest version of the software from GitHub.
Related News:
Cloudflare’s Threat report Q3 2024: 6 million attacks across 330 cities
MIT’s protocol to shield cloud-based server data
Google Introduces AI to Support Global Startups with Cybersecurity Program
