Tencent yu see: there are groups using remote command execution vulnerability to attack Windows server, earn Monroe

近日，腾讯安全御见威胁情报中心监测到团伙利用 Apache Struts 2 远程命令执行漏洞（CVE-2017-5638）攻击 windows 服务器，从团伙使用的文件列表来看，主要通过爆破或漏洞利用进行攻击，且针对 windows 服务器，已控制服务器 270 台左右，被下发挖矿木马的服务器有 44 台，该团伙挖取门罗（ XMR ）已赚得 3.5 万元。

针对该黑产团伙的特点， 腾讯安全御见建议企业用户参考以下方法解除风险：

1. It is recommended to modify the default port of remote desktop, or limit the IP address allowed to be accessed;

2. Upgrade Apache Struts 2 to the latest version to fix security vulnerabilities. Affected versions of Struts 2.3.5 -- Struts 2.3.31, Struts 2.5 -- Struts 2.5.10;

3, modify the sqlserver password, do not use weak password, weak password is very easy to be blasting invasion. SQL server is compromised may also lead to serious information leakage risk;

4. Recommend enterprises to use tencent t-sec advanced threat detection system (imperial) to detect various suspicious attacks by unknown hackers. T-sec advanced threat detection system (tencent yujie) is a unique threat intelligence and malicious detection model system developed based on the security capability of tencent anti-virus laboratory and tencent's massive data in the cloud and terminal.

Original address:https://mp.weixin.qq.com/s/81jZS7uBfW8VsNy48O982g

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia