Mumblehard Still Spams

According to researchers at the security firm ESET, the Mumblehard malware system continues to plague Joomla and WordPress content management systems around the world. The report summary states that Mumblehard consists of two components:

• a generic backdoor that "requests commands from its Command and Control server"
• a spam daemon launched through commands received by the backdoor

The company claims it has identified 8500 unique IP addresses during a 7-month period related to Mumblehard attacks. The summary alleges that Mumblehard is distributed via “pirated copies of a Linux and BSD program known as DirectMailer, software sold on the Yellsoft website for $240.”

ESET says it has discovered other links with Yellsoft, “Among other things, we found that IP addresses hard-coded in the malware are closely tied to those of Yellsoft.” The best remedy will sound familiar: make sure your systems are patched and up-to-date.