Blackunix RAMZ v1.4 PHP Bot

The PHP bot has been active since 2015. The original authors appear to be based in Indonesia under the monikers ‘bogel’ and ‘RamZikiE’. An attacker will infect a web server with the bot and send a request to the script. The script then generates a random username and nickname to join the hardcoded IRC server. The bot will join an assigned channel; the admin can contact the bot from there to send various commands. 

Exploitation 

Stages 

1. An attacker uploads the RAMZ PHP bot to a victim web server. 
   
   
2. The attacker requests the RAMZ PHP bot via HTTP.
   
   
3. The attacker joins the IRC server and channel that is hardcoded in the bot. The bot will also have joined the channel awaiting further commands. 
   
   
4. The attacker sends commands to the bot which interacts with the victim server.

Prerequisites 

The attacker must be able to inject the malicious code onto the web server through another vulnerability or exploit. 

Alert Logic Coverage 

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.  

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.  

Recommendations for Mitigation 

The attacker must have exploited some other entry vector to allow the malicious files to become resident on the victim machine.