Researchers at Sucuri and Eset say the attacks, which deliver the Blackhole malware kit to site visitors, leave no trace on servers Apache servers are being ambushed by a particularly pernicious malware program called Linux/Cdorked.A that’s infecting visitors to the sick machines with the Blackhole malware kit.Discovered by security researchers at Sucuri and Eset, they describe the malware a a sophisticated and stealthy backdoor meant to drive traffic to malicious websites.Eset explained in a blog post that the malware is one of the most sophisticated Apache backdoors it has seen so far. So far, hundreds of servers have been compromised, it said.The backdoor leaves no traces of compromised hosts on the hard drive other than a modified binary file, it continued. In addition, all of the information related to the backdoor is stored in shared memory and information on its command and control activity isn’t recorded in any Apache logs, making it difficult for defenders to identify it. [Also see: Blackhole creator releases stealthier exploity kit]“It resides all in memory so if you’re doing forensics or incident response, and you’re looking for signs on your hard drive that something bad has happened, you won’t find them,” Eset senior researcher Cameron Camp said in an interview. “It has the ability to redirect visitors to your website to terrible places where they will get infected through the Blackhole exploit kit, which is a nasty piece of malware,” he added.Since the malware resides in memory, if the server is rebooted, the malware will disappear. Reboots occur when Apache is upgraded or patched. The problem is, those patches aren’t always installed in a timely fashion.“Web servers are updated ad hoc,” Camp said. “There’s no set schedule.”“If a fix is released,” he continued, “some more vigilant folks will update right away, but it’s not uncommon to see an Apache server that hasn’t been patched for weeks or months.”It’s also still uncertain how the malware is reaching the server in the first place. So even the malware is flushed out of memory, it could be re-infected within a short period of time.“Unless you actively patch how they got into your server, they can get right back in,” Camp said. “That’s what’s so troubling right now — whether this is being spread by a Web exploit or by brute force attacks on the server,” he added.Making matters worse is that the attacks are being targeted at hosting servers. “They tend to be much more secure than an average website or server, and yet they’re still getting compromised,” said Mary Landesman, a senior security researcher with Cisco.“There’s a lot at stake for them to gain the necessary access and plant a backdoor,” she added, “because when that server gets compromised, every website hosted by that server becomes a vector for malware.”This malware departs from previous infections in a worrisome way, Landesman said. “With past infections, once you knew what to look for, it was fairly easy to find them,” she said. “With this evolution, it’s going to be much harder.” These kinds of attacks on hosting servers is a growing trend in the digital underground, replacing the old practice of mass registering domain names to be used for harmful activity, noted Paul Ferguson, vice president for threat intelligence at Internet Identity.“There’s been a dramatic decline in domains that were registered for sheer malicious purposes in favor of hacking servers and using them to perpetrate other crimes,” he told CSO.“Servers have become the low hanging fruit,” he said. Related content news Is China waging a cyber war with Taiwan? Nation-state hacking groups based in China have sharply ramped up cyberattacks against Taiwan this year, according to multiple reports. By Gagandeep Kaur Dec 01, 2023 4 mins Cyberattacks Government Government news Apple patches info-stealing, zero day bugs in iPads and Macs The vulnerabilities that can allow the leaking of sensitive information and enable arbitrary code execution have had exploitations in the wild. By Shweta Sharma Dec 01, 2023 3 mins Zero-day vulnerability feature The CSO guide to top security conferences Tracking postponements, cancellations, and conferences gone virtual — CSO Online’s calendar of upcoming security conferences makes it easy to find the events that matter the most to you. By CSO Staff Dec 01, 2023 6 mins Technology Industry IT Skills Events news Conti-linked ransomware takes in $107 million in ransoms: Report A ransomware campaign linked to the ostensibly defunct Conti malware group has targeted mostly US businesses, in a costly series of attacks. By Jon Gold Nov 30, 2023 4 mins Ransomware Malware Cybercrime Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe