DjangoMalware
ransomwareFrom MISP Galaxy
Last reported today, by The Register (security)8 reports
ATT&CK techniques
6 of 34 · each with the sentence it comes from- T1001Data Obfuscation
“T1001 – Data Obfuscation”
- T1005Data from Local System
“T1005 – Data from Local System”
- T1014Rootkit
“XWorm now also includes a rootkit, a GPS location data harvester, and a webcam and microphone recording module—bringing it closer to a spyware strain than an infostealer.”
- T1041Exfiltration Over C2 Channel
“T1041 – Exfiltration Over C2 Channel”
- T1056Input Capture
“T1056 – Input Capture”
- T1056.001Keylogging
“T1056.001 – Input Capture: Keylogging”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds“…se include internet-wide asset discovery, botnet command-and-control, database dumping through Prisma, exploit modules aimed at VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments that allow remote code execution, GraphQL and generic command inject…”
-
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense“They covered internet-wide scanning for targets, exploits for Django, Jupyter, Laravel and other web frameworks, dumping of exposed databases and control of a botnet.”
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation“The exploits target Microsoft Visual Studio Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug deployments.”
-
Risky Bulletin: Spyware chip found in Ledger crypto-wallets“…, Chrome, ASUS, Zyxel, Arista Networks, Atlassian, Citrix, Splunk, WatchGuard, MikroTik, Axis, Gigabyte, GitHub, JetBrains, SmarterMail, Django, SonicWall, Veeam, OpenOffice, wolfSSH, MongoDB, Elastic, Fortra, HashiCorp, Moxa, and Proxmox released security updates earlier this mo…”
-
Google Makes CodeMender Available as Managed AI Security Agent“…ware languages including C, C++, Go, Java, Python, Ruby, Rust and TypeScript or JavaScript, alongside popular enterprise frameworks like Django, Flask, React, Spring Boot and Express.”
-
A method to assess 'forgivable' vs 'unforgivable' vulnerabilities“data type validators available natively in web application frameworks (such as Django Validators and Apache Commons Validators)”
-
Boolka Unveiled: From web attacks to modular malware“Further analysis showed that this website serves a modified version of Django admin page with injected script loaded from hxxps://beef.beonlineboo.com/hook.js.”
-
Roasting 0ktapus: The phishing campaign going after Okta identity credentials“The frontend of the phishing sites uses the Nuxt.js framework while the backend uses Django, running on port 8080.”
Indicators in its reports
named in the reports above- iglu[.]netin 1 report
- hxxps://news.blackduck[.]com/2015-07-29-Coverity-Scan-Open-Source-Report-Shows-Commercial-Code-Is-More-Compliant-to-Security-Standards-than-Open-Source-Codein 1 report
- news.blackduck[.]comin 1 report
- hxxps://www.acsac[.]org/2007/workshop/Howard.pdfin 1 report
- www.acsac[.]orgin 1 report
- hxxps://www.outsystems[.]com/blog/posts/attack-surface/in 1 report
- www.outsystems[.]comin 1 report
- 1ca4cbac895fc3bd12417b77fc6ed31din 1 report
- 45.182.189[.]109in 1 report
- hxxps://beef.beonlineboo[.]com/hook.jsin 1 report
- beef.beonlineboo[.]comin 1 report
- 1-update-soft[.]comin 1 report
- update-brower[.]comin 1 report
- hxxps://updatebrower[.]com/download/bmbackup.txt;bmbackup;C:Programin 1 report
- updatebrower[.]comin 1 report
- hxxps://updatebrower[.]com/download/bmhook.txt;bmhook;C:Programin 1 report
- hxxps://updatebrower[.]com/download/bmlog.txt;bmlog;C:Programin 1 report
- hxxps://updatebrower[.]com/download/bmreader.txt;bmreader;C:Programin 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.