JBoss Vulnerability Could Lead to SamSam Ransomware
Researchers at Cisco Talos found a vulnerability in JBoss that can be exploited by SamSam ransomware. Cisco Talos said in a blog post, “As part of this investigation, we scanned for machines that were already compromised and potentially waiting for a ransomware payload. We found just over 2,100 backdoors installed across nearly 1600 IP addresses.” The research firm says they estimate over 3.2 million machines are at risk.
SamSam is distributed through compromised servers and then holds victim systems for ransom. Attackers are using the JexBoss open source tool to test and then exploit JBoss application servers. Once they gain access to the network, they start encrypting Windows systems using SamSam.
Cisco Talos suggests that if your server is vulnerable, the first piece of advice is to remove external access to the server. “Ideally, you would also re-image the system and install updated versions of the software,” the firm said in the blog post.
Related content
-
News for Admins
News for system administrators around the world. - A New Ransomware Targeting Linux-based NAS Devices
-
News for Admins
News for system administrators around the world.
- Adobe Releases an Emergency Flash Player Update
-
Freeing your data from ransomware
Cyber criminals don't need access to sensitive information to blackmail their victims. Simply encrypting everyday files can be enough to extort money from users, whose data is only unencrypted after they pay a ransom – and possibly not even then.