Known Indicators of Compromise Associated with Androxgh0st Malware

Text acquired from the source

Cybersecurity Advisory Known Indicators of Compromise Associated with Androxgh0st Malware Release Date January 16, 2024 Alert Code AA24-016A Related topics: Cyber Threats and Response , Malware, Phishing, and Ransomware Actions to take today to mitigate malicious cyber activity: Prioritize patching known exploited vulnerabilities in internet-facing systems. Review and ensure only necessary servers and services are exposed to the internet. Review platforms or services that have credentials listed in .env files for unauthorized access or use. SUMMARY The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory (CSA) to disseminate known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with threat actors deploying Androxgh0st malware. Multiple, ongoing investigations and trusted third party reporting yielded the IOCs and TTPs, and provided information on Androxgh0st malware’s ability to establish a botnet that can further identify and compromise vulnerable networks. The FBI and CISA encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of cybersecurity incidents caused by Androxgh0st infections. Download the PDF version of this report: AA24-016A Known Indicators of Compromise Associated with Androxgh0st Malware (PDF, 576.40 KB ) AA24-016A Known Indicators of Compromise Associated with Androxgh0st Malware - Spanish (PDF, 353.45 KB ) For a downloadable copy of IOCs, see: AA24-016A STIX XML (XML, 45.81 KB ) AA24-016A STIX JSON (JSON, 39.87 KB ) TECHNICAL DETAILS Note: This advisory uses the MITRE ATT&CK ® for Enterprise framework, version 14. See the MITRE ATT&CK Tact