VMware 9.8 priority rating bug exploited to install malware witch’s brew

Hackers are exploiting a now-patched vulnerability in VMware Workspace ONE Access in campaigns to install various ransomware and cryptocurrency miners, a researcher at security firm Fortinet said Thursday.

CVE-2022-22954 is a remote code execution vulnerability in VMware Workspace ONE Access with a priority rating of 9.8 out of a possible 10. VMware disclosed and patched the vulnerability on April 6. Within 48 hours, hackers reverse engineered the update and developed a working exploit that they then used to compromise servers that had yet to install the fix. VMware Workspace ONE access helps administrators configure a suite of apps that employees need in their work environment.

In August, researchers at Fortiguard Labs saw a sudden spike in exploit attempts and a major shift in tactics. While before the hackers installed payloads that collected passwords and collected other data, the new wave brought with it something else, most notably ransomware known as RAR1ransom, a cryptocurrency miner known as GuardMiner, and Mirai, software that assembles Linux devices into a massive botnet for use in distributed denial-of-service attacks.

“Although the critical vulnerability CVE-2022-22954 was patched as early as April, there are still multiple malware campaigns attempting to exploit it,” wrote Fortiguard Labs researcher Cara Lin. Attackers, she added, used it to inject a payload and run code remotely on servers running the product.

The Mirai example that Lin saw installing was downloaded from http[:]//107[.]189[.]8[.]21/pedalcheta/cutie[.]x86_64 and trusted a command and control server on “cnc”[.]good packages[.]cc. In addition to delivering junk traffic used in DDoSes, the monster also tried to infect other devices by guessing the administrator password they were using. After decoding strings in the code, Lin found the following list of credentials that the malware used: