TF-MAL-py.androxgh0st

Description

ThreatFox malware family `py.androxgh0st`. Printable name: AndroxGh0st. Aliases: AndroxGhost,Androx.

Indicators of Compromise (0)

No indicators of compromise on this threat.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Hackers Use Androxgh0st Malware Botnet to Steal AWS and Microsoft ...
  web:dailysecurityreview.com

  The FBI and CISA recommend that network defenders implement the following mitigation measures to minimize the impact of Androxgh0st malware attacks and mitigate the risk of compromise: Keep all operating systems, software, and firmware up to date. Specifically, ensure that Apache servers are not running versions 2.4.49 or 2.4.50.

  2026-05-22 05:31 UTC
• Androxgh0st Malware Attack | Outbreak Alert | FortiGuard Labs
  web:fortiguard.fortinet.com

  AndroxGh0st malware is a python-based malware , which primarily targets user environment (.env) files. These files may contain credentials for various high-profile applications such as AWS, O365, SendGrid, and Twilio.

  2026-05-22 05:31 UTC
• AndroxGh0st (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  AndroxGh0st has multiple features to enable SMTP abuse including scanning, exploitation of exposed creds and APIs, and even deployment of webshells. For AWS specifically, the malware scans for and parses AWS keys but also has the ability to generate keys for brute force attacks.

  2026-05-22 05:31 UTC
• AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services
  web:thehackernews.com

  The threat actors behind the AndroxGh0st malware are now exploiting a broader set of security flaws impacting various internet-facing applications, while also deploying the Mozi botnet malware . "This botnet utilizes remote code execution and credential-stealing methods to maintain persistent access ...

  2026-05-22 05:31 UTC
• Androxgh0st Malware: Everything You Need to Know
  web:www.checkpoint.com

  Androxgh0st Malware : Everything You Need to Know Androxgh0st is a Python-based scripted malware that targets applications that use Laravel (like AWS, Twilio, Office 365, and SendGrid) by scanning and extracting information from .env files.

  2026-05-22 05:31 UTC
• Known Indicators of Compromise Associated with Androxgh0st Malware - CISA
  web:www.cisa.gov

  Androxgh0st malware TTPs commonly involves the use of scripts, conducting scanning [T1595 ] and searching for websites with specific vulnerabilities. In particular, threat actors deploying Androxgh0st have been observed exploiting CVE-2017-9841 to remotely run hypertext preprocessor (PHP) code on fallible websites via PHPUnit [T1190 ].

  2026-05-22 05:31 UTC
• Androxgh0st Continues Exploitation: Operators Compromise a US ...
  web:www.cloudsek.com

  CloudSEK uncovered that the Androxgh0st botnet compromised a University of California, San Diego subdomain to host its C2 logger. Active since 2023, the botnet exploits vulnerabilities in Apache Shiro, Spring4Shell, WordPress, IoT devices, and more for remote code execution and cryptomining. Webshells were also deployed for persistence.

  2026-05-22 05:31 UTC
• Known Indicators of Compromise Associated with Androxgh0st Malware ...
  web:www.cybersecurity-review.com

  The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory (CSA) to disseminate known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with threat actors deploying Androxgh0st malware . Multiple, ongoing investigations and trusted third party reporting yielded ...

  2026-05-22 05:31 UTC
• Androxgh0st Malware Attack - FortiGuard
  web:www.fortiguard.com

  AndroxGh0st malware is a python-based malware , which primarily targets user environment (.env) files. These files may contain credentials for various high-profile applications such as AWS, O365, SendGrid, and Twilio.

  2026-05-22 05:31 UTC
• PDF Known Indicators of Compromise Associated with Androxgh0st Malware
  web:www.ic3.gov

  Androxgh0st malware TTPs commonly involves the use of scripts, conducting scanning [T1595] and searching for websites with specific vulnerabilities. In particular, threat actors deploying Androxgh0st have been observed exploiting CVE-2017-9841 to remotely run hypertext preprocessor (PHP) code on fallible websites via PHPUnit [T1190].

  2026-05-22 05:31 UTC

Only Available for Registered Users. Sign in to view.