Adversaries Ride RocketMQ Bug to DreamBus Bot Resurgence
Last seen in 2021, DreamBus Monero crypto bot is back and finding new life on vulnerable RocketMQ servers.
![Monero concept image Monero concept image](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt18dc0f60de479848/64f17e071dce68f4608f1152/monero_MR3D_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Since the disclosure in May that RocketMQ servers had a remote code execution (RCE) bug, multiple threat actors have been making the most of the opportunity, even dusting off a previously dormant crypto bot called DreamBus for the occasion.
Threat researchers with Juniper report they have observed several threat actors launching attacks against the RocketMQ server vulnerability, tracked under CVE-2023-33246, to breach systems and drop the DreamBus malicious Monero miner bots.
The Juniper team warned that while DreamBus is currently limited to delivering crypto bots, it could easily be adapted to deliver an array of other malware strains in the future.
"As DreamBus malicious threat actors resurface, their primary objective remains the installation of a Monero cryptocurrency miner," the Juniper team explained. "However, the presence of a modular bot like the DreamBus malware equipped with the ability to execute bash scripts provides these cybercriminals the potential to diversify their attack repertoire, including the installation of various other forms of malware."
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024