It's called 'Capoae'

The new strain of malware which has been dubbed 'Capoae' has been spotted in the wild. It was written in Go and this strain targets Linux systems and WordPress installations. It was discovered by Larry Cashdollar. Larry is a senior security researcher at Akamai. Capoae is quickly becoming a favorite among threat actors because of its cross-platform capabilities. It also spreads via the exploitation of known bugs and weak admin login credentials.

Among others Capoae exploits CVE-2020-14882 which is a remote code execution bug in the Oracle WebLogic Server. CVE-2018-20062 is another RCE and this one was found in ThinkPHP.


Akamai had this to say about the new malware

"After the Capoae malware is executed, it has a pretty clever means of persistence. The malware first chooses a legitimate-looking system path from a small list of locations on a disk where you'd likely find system binaries. It then generates a random six-character filename and uses these two pieces to copy itself into the new location on the disk and deletes itself. Once this is done, it injects/updates a Crontab entry that will trigger the execution of this newly created binary."

Capoae will also attempt to brute-force attack WordPress installations to spread. It may also utilize CVE-2019-1003029 and CVE-2019-1003030. Both of those are additional RCE flaws that impact Jenkins and both have been used in attacks against Linux servers.

So far Capoae has been used to install cryptocurrency miners which is relatively harmless compared to some other payloads like ransomware. Even so there's nothing preventing the hackers currently using Capoae from injecting a more devastating payload. Even if they don't do that cryptocurrency miners are bad enough on their own.

The most notable outward sign of a Capoae infection is an unusual spike in system resource load or unrecognizable system processes in operation. Admins may also notice strange log entries or artifacts such as SSH keys and files.


My perspective

Although this is not the most dangerous malware strain, we've ever seen it's still one that bears worth keeping a watchful eye out for.

Hill Street Blues' Sgt. Esterhaus always advised:

"Hey, let's be careful out there!"


By Denis Wilson

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT Support

Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. You can also find me on LinkedIn, Facebook, and Twitter

I am also a published author and speaker on cloud computing, work@home, and cybersecurity. I work extensively with business and professional associations to provide free small business technology education programs.


Contact me if you would like me to speak for free to your association