Muhstik Botnet Exploiting Apache RocketMQ Flaw to Expand DDoS Attacks

[ixsky]

Muhstik Botnet Exploiting Apache RocketMQ Flaw to Expand DDoS Attacks

Muhstik botnet exploits a critical Apache RocketMQ flaw (CVE-2023-33246) for remote code execution, targeting Linux servers and IoT devices for DDoS attacks and cryptocurrency mining.
    Infection involves executing a shell script from a remote IP, downloading the Muhstik malware binary ("pty3"), and ensuring persistence by copying to multiple directories and editing system files.

Source: Muhstik Botnet Exploiting Apache RocketMQ Flaw to Expand DDoS Attacks