Cybersecurity researchers have detected a massive wave of attempts to exploit critical vulnerabilities known as PHP2Shell, though hackers appear to be struggling to make the attacks work. Threat actors are targeting millions of systems in an effort to deploy Potassium, a sophisticated variant of the notorious Mirai botnet capable of launching devastating distributed denial of service attacks. Despite the scale of the campaign, experts at Sophos note that weaponizing these specific flaws has proven more difficult than attackers initially anticipated, leaving many victims untouched so far.
The offensive centers on two high severity vulnerabilities that could allow unauthenticated users to execute remote code via specially crafted web requests. If successful, the attackers intend to recruit infected Linux devices into their botnet to carry out volumetric flood attacks, specifically targeting networks in Ukraine. To maintain control over their growing army of compromised devices, the malware utilizes encrypted command and control channels and advanced resolution logic involving public DNS servers to avoid detection and disruption.
Technical analysis reveals that this latest iteration of the botnet is significantly more complex than its predecessors. Researchers from Nokia Deepfield and Arctic Wolf discovered that Potassium employs unique encryption methods for its configuration tables and supports dozens of different flood attack protocols including TCP and UDP. Some versions even include dormant capabilities to resolve infrastructure through the Ethereum Name Service, a move that would potentially make it much harder for security professionals to shut down the network by bypassing traditional domain registrars.
While the wide scale efforts have largely failed in the wild, firms like SOCRadar have uncovered specialized toolsets designed to automate the process. These tools include python scripts intended to bypass modern system defenses like Address Space Layout Randomization by leaking memory addresses through session cookies. Evidence suggests these operations are being driven by financially motivated actors who focus heavily on cryptocurrency and Web3 targets, combining their PHP exploits with systematic sweeps for leaked API keys and automated CAPTCHA solvers. For now, administrators are urged to update their PHP installations immediately to close these dangerous gaps.
