DreamBus resurfaces by exploiting the RocketMQ vulnerability CVE-2023-33246 to drop a modular bot that includes a Bash downloader (reketed), a DreamBus main module, and a Monero miner, with TOR-based and direct-download delivery methods. Juniper Threat Labs outlines attack stages from reconnaissance to persistence and lateral movement, highlighting TOR-based C2 and multi-vector propagation. #DreamBus #RocketMQ
Keypoints
- CVE-2023-33246 RocketMQ vulnerability allowed remote code execution, enabling DreamBus deployment.
-
- Reketed downloads the DreamBus main module from a TOR hidden service, then executes and deletes the script; the module is an ELF binary named with a 20-character filename derived from date/md5.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Exploitation of the RocketMQ vulnerability CVE-2023-33246 to gain initial access. Quote: “In May 2023, a vulnerability affecting RocketMQ servers (CVE-2023-33246), which allows remote code execution, was publicly disclosed.”
- [T1059.004] Bash – Use of a malicious bash script (reketed) to download and execute payloads. Quote: “starting on June 19th, we detected a series of attacks that involved downloading and executing a malicious bash script named, “reketed”.”
- [T1105] Ingress Tool Transfer – Downloading the DreamBus main module from remote sources after exploitation. Quote: “The primary function of the reketed bash shell script is to download the DreamBus main module from a TOR hidden service…”
- [T1027] Obfuscated/Compressed Files and Information – UPX-packed DreamBus main module with modified headers/footers to hinder unpacking. Quote: “The DreamBus main module is an ELF Linux binary that has been packed with UPX, but with modified headers and footers that make unpacking more challenging.”
- [T1053] Scheduled Task/Job – Persistence via timer service and cron job hourly to re-download/install payloads. Quote: “timer service” is implemented … hourly basis; “cron job” is created and configured to execute the downloader script … hourly frequency.
- [T1021.004] SSH – Lateral movement using IT automation tools (Ansible, Knife, Salt, PSSH) and infection of remote hosts. Quote: “DreamBus bot malware spread laterally. The malicious threat actors leverage widely recognized IT automation tools like ansible, knife, salt and pssh (parallel ssh).”
- [T1059.003] Command and Scripting Interpreter: PowerShell? (Not used here) – N/A
Indicators of Compromise
- [IP] 92.204.243.155 – Download Server
- [Domain] ru6r4inkaf4thlgflg4iqs5mhqwqubols5qagspvya4whp3dgbvmyhad.onion – .onion Download and Control Server
- [Hash] 1d0c3e35324273ffeb434f929f834b59dcc6cdd24e9204abd32cc0abefd9f047 – Bash script downloader
- [Hash] 601a2ff4a7244ed41dda1c1fc71b10d3cfefa34e2ef8ba71598f41f73c031443 – DreamBus Bot (main module)
- Additional hashes listed in the article include several DreamBus-related binaries used during the campaign (e.g., 153b0d0916bd3150c5d4ab3e14688140b34fdd34caac725533adef8f4ab621e2, e71caf456b73dade7c65662ab5cf55e02963ee3f2bfb47e5cffc1b36c0844b4d, 9f740c9042a7c3c03181d315d47986674c50c2fca956915318d7ca9d2a086b7f, 371319cd17a1ab2d3fb2c79685c3814dc24d67ced3e2f7663806e8960ff9334c, 21a9f094eb65256e0ea2adb5b43a85f5abfbfdf45f855daab3eb6749c6e69417, 0a8779a427aba59a66338d85e28f007c6109c23d6b0a6bd4b251bf0f543a029f).