NewsPublished 30 Apr 2026

Danger of Libredtail [Guest Diary], (Wed, Apr 29th)

Source SANS ISC Handlers Diary

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2024-4577

Description

[This is a Guest Diary by James Roberts, an ISC intern as part of the SANS.edu BACS program]

Impact

Successful exploitation allows remote attackers to execute arbitrary PHP code on vulnerable servers, leading to installation of the redtail cryptomining malware. This results in unauthorized resource consumption, potential system compromise, and persistence of malicious code. The malware also attempts to disable competing cryptominers, potentially affecting system stability and security. SSH brute force attempts may lead to unauthorized access if weak credentials are used. The overall impact is medium severity due to cryptomining and system compromise risks.

Defensive guidance

However, upgrading PHP to a current, supported version can mitigate the vulnerability exploited by CVE-2024-4577. Network defenses should block the libredtail-http user agent on WAFs, reverse proxies, IPS, or host firewalls. Blocking HTTP requests containing suspicious patterns such as variations of "/sh" scripts and base64-encoded payloads can reduce exposure. Implementing SSH key-based authentication and disabling password logins can prevent unauthorized SSH access attempts. Monitoring network traffic for unusual activity related to these indicators is recommended.

Summary

The libredtail-http attacks exploit CVE-2024-4577, a PHP vulnerability that allows arbitrary PHP code execution through malformed HTTP POST requests that manipulate PHP options (allow_url_include and auto_prepend_file). The attackers use base64-encoded payloads to deliver scripts that connect to known malicious IPs hosting scripts (e.g., apache.selfrep and cve_2024_4577.selfrep) to install the redtail cryptominer. The malware supports multiple architectures and attempts to maintain persistence and disable other cryptominers. The attacks also include SSH login attempts using default credentials and SYN scans. The activity was observed on a honeypot simulating a Debian system, with attacker IPs from Germany, Great Britain, and India. Mitigation involves patching PHP, blocking the libredtail-http user agent, and filtering suspicious HTTP requests.

References

isc.sans.edu/diary/rss/32936 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Apr 2026, 00:22 UTC

References

Community reviews

Related threats