The CrowdSec Network has detected an aggressive exploitation campaign involving around 400 machines. This campaign, classified by our detection system as "Nervous Burlywood Becard" (NBB), aggressively targeted Apache servers with a collection of old and new exploits. Between the 22nd and the 24th of September, this group of machines targeted over 700 members of the CrowdSec Network in a broad coordinated scan. As our Network covers a small portion of the web, we are confident that the true number of targets is significantly higher.
CrowdSec Findings
Focus on Apache CVEs: Key indicators for members of the NBB cluster are CVE-2022-42889 and CVE-2021-41773, both serious exploits for the Apache Web Server, and CVE-2022-42889, a vulnerable library that is part of Apache Commons.
Attacker relied on third-party hosting infrastructure: Though the campaign includes machines from 11 different Autonomous Systems, more than 70% of NBB members belong to HostRoyale Technologies, a mid-sized hosting provider.
A majority of NBB machines have been used in previous attacks: Using data from the month before the attack, CrowdSec was able to establish that more than half of the involved machines have been used in previous attacks. This highlights the importance of reliable Threat Intelligence in preventing attacks. A selection of machines used by the attacker is provided in our CTI.
