Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating
How many servers were reported to be infected by the TellYouThePass ransomware strain as of Thursday, and how does this compare to the number detected on Monday?
As of Thursday, security firm Censys detected 1,000 servers infected by the TellYouThePass ransomware strain. This number is down from 1,800 detected on Monday.
How does the CVE-2024-4577 vulnerability specifically affect PHP when it is run in CGI mode?
The CVE-2024-4577 vulnerability specifically affects PHP when it is run in CGI mode by exploiting errors in the way PHP converts Unicode characters into ASCII. A feature built into Windows known as Best Fit allows attackers to use a technique called argument injection to pass user-supplied input as characters that can execute malicious commands in the main PHP application1. This vulnerability allows attackers to bypass the CVE-2012-1823 patch and achieve remote code execution on vulnerable servers.
What are the typical signs observed on servers infected by the TellYouThePass ransomware?
The typical signs observed on servers infected by the TellYouThePass ransomware include:
-
Encrypted files: The ransomware encrypts files on the infected server, making them inaccessible. Encrypted files are marked with the '.locked' extension.
-
Ransom note: A ransom note named 'READ_ME10.html' is left on the server, demanding approximately $6,500 in exchange for the decryption key.
-
Unusual network activity: The ransomware may communicate with its command-and-control servers over the network to receive instructions or transmit data6. Monitoring network traffic for any unusual or suspicious activity can help detect the infection.
-
System performance issues: Ransomware can consume a significant amount of system resources, leading to a noticeable decrease in server performance. If the server becomes slow or unresponsive, it could be a sign of ransomware infection.
-
Disabled security software: To avoid detection, ransomware often disables or bypasses security software installed on the server. If your antivirus or firewall has been turned off without your knowledge or consent, it could be an indication of a ransomware attack.
-
Changed file extensions: Some ransomware variants change the file extensions of encrypted files to make them unrecognizable. Keep an eye out for any unusual file extensions on your server.
-
Missing or altered files: Ransomware may delete or modify files on the server as part of its encryption process5. If you notice that files have gone missing or have been altered without your authorization, it could be a sign of ransomware activity.
-
Unexpected system reboots: In some cases, ransomware may force the server to reboot without warning. If the server does reboot randomly, especially repeatedly, contact your IT administrator right away.