Hello and welcome to the Wednesday, January 8th, 2025 edition of the Sandcent Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Ejing published a diary about the researchers of cryptocurrency mining matter targeting php

servers. At hackers are

exploiting vulnerabilities,

such as CVE

2024-4577.

That's the

misconfiguration in

PGPI CGI

installations.

Once they gain access, they deploy a dropper, VR0P.exe, that deploys additional payloads,

including PkT.exe, and PacketCript.exe.

These malware pieces are then being used to mine the packet crypt,

classic cryptocurrency, not a cryptocurrency I've heard about,

but they always come up with something new when it comes to cryptocurrencies.

This pH-PCI vulnerability is somewhat specific to Windows, which

is why you have these EXEs being uploaded here. A simplest way, of course, they detect

miners like this is typically CPU load spikes, patch management. Really important here.

This is not super recent vulnerability.

A vulnerability has been exploited for a while now.

And the vulnerability is also being exploited by other malicious tools and such. So when you're doing incident response in this particular case,

...