The company behind the popular vBulletin forum software may have patched a security hole discovered a few weeks ago, but that hasn’t prevented cybercriminals from going on a server hacking spree, according to researchers.

In a posting on its Security Response blog, experts at Symantec said server hacking attempts aimed at vBulletin users reached a high of 2,500 in a single day in hopes of exploiting a remote code execution vulnerability. Attackers are apparently downloading malicious shell scripts to steal system and network data on machines running 5.1.4 through 5.1.9 of vBulletin 5 Connect.

As SecurityWeek explained, these attempts are well worth cybercriminals’ efforts: The machines in question are often being used for high-traffic websites that can be either manipulated for distributed denial-of-service (DDoS) attacks or offered at a high price to the black market for other purposes. This could include sending out malware or stealing data from unsuspecting users.

The vBulletin security issue first came to light in early November, forcing the company to take its own site down for maintenance and issue an emergency patch. At the time, Ars Technica reported a data breach that exposed thousands of user IDs, which prompted a complete mandatory reset of all customer passwords.

An attacker using the name Coldzer0 claimed to have used the vulnerability to launch zero-day attacks against vBulletin users. As a result, Coldzer0’s posts on social media may have led others to pursue their own server hacking attempts. That said, vBulletin has not yet linked the zero-day attack to the vulnerability for which the patch was issued.

Ironically, vBulletin is a particularly popular forum tool for those in the security community, including the organizers of well-known industry gathering DEF CON. According to Silicon Angle, DEF CON had shut down its forums when the vulnerability first surfaced, and it’s unknown whether it is among those subjected to server hacking attempts.

In general, though, this is a classic situation in which attacks targeting places where many users gather is most likely to happen. Those that use the software and haven’t already applied the patch had better heed Symantec’s warnings as quickly as possible.

More from

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Now Social Engineering Attackers Have AI. Do You? 

4 min read - Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code. The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code just like everybody else. How does this powerful new category of tools affect the ability of criminals to launch cyberattacks, including social engineering attacks? When Every Social Engineering Attack Uses Perfect English ChatGPT is a public tool based on a…

4 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read