Nextcry Ransomware Targeting Unpatched Nextcloud Servers
185News that new strain of malware calling itself Nextcry has been targeting vulnerable Linux servers running Nextcloud.
It leverages a vulnerability in Nginx and PHP (specifically php-fpm, CVE-2019-11043) and then executes a Python script which then encrypts the first 1,000,000 bytes of files using AES Encryption.
Sources:
https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665
https://nvd.nist.gov/vuln/detail/CVE-2019-11043
https://www.bleepingcomputer.com/forums/t/707580/help-needed-decrypting-nextcry/
https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/43
https://forum.kasperskyclub.ru/index.php?showtopic=64121
https://linuxsecurity.com/features/features/nextcry-ransomware-targets-nextcloud-linux-servers-and-remains-undetected
Wallpaper by Charlie Henson: https://www.pling.com/p/1336103/
Like my channel? Please help support it:
Patreon: https://www.patreon.com/quidsup
Paypal: https://www.paypal.me/quidsup
Follow me on Social Media
Twitter: https://twitter.com/quidsup
MeWe: https://mewe.com/i/quidsup
Minds: https://minds.com/quidsup
#Nextcloud #Nextcry #Malware