HiddenWasp

[drugit]

Just wondering if you guys are aware of HiddenWasp and if theres anything you can do to protect against it or at least detect it?

Apparently there is a couple of IP this attack comes from which Ive permanently blocked but that will probably change soon:

103.206.122.245
103.206.123.13

Let me know what you know.

Thanks
G

[skhristich]

Hello, Glenn
If you require any further information, let me know.
To help you with this question we need a little bit more information, please create a ticket here https://cloudlinux.zendesk.com/hc/en-us/requests/new and technical experts will help you asap.
If you have any other questions, feel free to ask here.
Thank you for contacting us.

[glenn]

Hi Sergey, I dont need help. I just became aware of HiddenWasp and its not affecting my systems as far as I know.

I was just wondering what CL knows about HiddenWasp.

[skhristich]

Hello, Glenn! We are working on this issue.
Get back to you later today with a response.
Thanks in advance!

[skhristich]

Glenn,
For now, all files in HiddenWasps malware set are blacklisted, and in the next 24 hours hashlist updates will be delivered to clients.
To force the blackhash updates you can use the following command:
`# imunify360-agent update sigs --force`
Also, we ve made a signature for our AV scanner. It will be live in the nearest time.
As a side note: we havent detected any part of this botnet on the servers secured by Imunify for the moment.
Thanks in advance!

[glenn]

Thanks Sergey. Appreciate the update. Glad to see that you guys are on it!

[skhristich]

Hello, Glenn! Thank you.
Please let us know if you have any questions.
Thanks in advance!