Many of these files accompany deployed applications and contain sensitive information such as credentials or access tokens but should not be readable by external users. Unfortunately, such misconfigurations are common. For example, security researchers recently reported that attackers collected .env files from around 110,000 domains, leading to the exposure of more than 90,000 unique environment variables with 7,000 corresponding to cloud services.

Multi-stage malware deployment

After they gain access to a system, attackers will attempt to execute a shell script called rconf to perform several checks, set environment variables, and download the main payload. For example, it checks whether the /tmp directory exists, is writable, and has execution permissions. If it doesn’t it attempts to mount it. It also checks whether the system’s architecture is x86_64, as it will not run on ARM or other types of CPUs.

The script then downloads a file called avatar.php, saves it to the /tmp directory with the name httpd — a name typically used by the Apache web server process — and then executes it. Interestingly, the request to download avatar.php from the attackers’ servers needs to have a specific User-Agent to receive the malicious payload. Otherwise, the server will provide a benign php file.