Lucene search

Industrial Control Systems Cyber Emergency Response TeamAA24-016A

HistoryJan 16, 2024 - 12:00 p.m.

Known Indicators of Compromise Associated with Androxgh0st Malware

2024-01-1612:00:00

Industrial Control Systems Cyber Emergency Response Team

www.cisa.gov

androxgh0st malware

indicators of compromise

patching vulnerabilities

internet-facing systems

exposed services

.env files

7.5 High

AI Score

Confidence

Low

0.975 High

EPSS

Percentile

100.0%

JSON

Actions to take today to mitigate malicious cyber activity:

Prioritize patching known exploited vulnerabilities in internet-facing systems.
Review and ensure only necessary servers and services are exposed to the internet.
Review platforms or services that have credentials listed in .env files for unauthorized access or use.

References

attack.mitre.org/versions/v13/tactics/TA0006/

attack.mitre.org/versions/v13/techniques/T1027/010/

attack.mitre.org/versions/v13/techniques/T1083/

attack.mitre.org/versions/v14/matrices/enterprise/

attack.mitre.org/versions/v14/tactics/TA0006/

attack.mitre.org/versions/v14/techniques/T1027/010/

attack.mitre.org/versions/v14/techniques/T1046/

attack.mitre.org/versions/v14/techniques/T1059/006/

attack.mitre.org/versions/v14/techniques/T1078/

attack.mitre.org/versions/v14/techniques/T1083/

attack.mitre.org/versions/v14/techniques/T1105/

attack.mitre.org/versions/v14/techniques/T1114/

attack.mitre.org/versions/v14/techniques/T1136/

attack.mitre.org/versions/v14/techniques/T1190/

attack.mitre.org/versions/v14/techniques/T1505/003/

attack.mitre.org/versions/v14/techniques/T1552/001/

attack.mitre.org/versions/v14/techniques/T1583/005/

attack.mitre.org/versions/v14/techniques/T1583/006/

attack.mitre.org/versions/v14/techniques/T1595/

attack.mitre.org/versions/v14/techniques/T1595/002/

fortiguard.fortinet.com/threat-signal-report/5066/androxgh0st-malware-actively-used-in-the-wild

github.com/cisagov/Decider/

nvd.nist.gov/vuln/detail/CVE-2017-9841

nvd.nist.gov/vuln/detail/CVE-2018-15133

nvd.nist.gov/vuln/detail/CVE-2021-41773

public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138

twitter.com/CISAgov

twitter.com/intent/tweet?text=Known%20Indicators%20of%20Compromise%20Associated%20with%20Androxgh0st%20Malware+https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a

www.cisa.gov/cross-sector-cybersecurity-performance-goals

www.cisa.gov/forms/report

www.cisa.gov/known-exploited-vulnerabilities-catalog

www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping

www.cisa.gov/securebydesign

www.dhs.gov

www.dhs.gov/foia

www.dhs.gov/performance-financial-reports

www.facebook.com/CISA

www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a&title=Known%20Indicators%20of%20Compromise%20Associated%20with%20Androxgh0st%20Malware

www.fbi.gov/contact-us/field-offices

www.fbi.gov/contact-us/field-offices/

www.ic3.gov/

www.instagram.com/cisagov

www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency

www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a

www.oig.dhs.gov/

www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a

www.usa.gov/

www.whitehouse.gov/

www.youtube.com/@cisagov

mailto:?subject=Known%20Indicators%20of%20Compromise%20Associated%20with%20Androxgh0st%20Malware&body=www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a