ANDROXGHOST MALWARE BOTNET STEALS AWS, MICROSOFT CREDENTIALS

Summary from the TLDR InfoSec newsletter

CISA and FBI warn that threat actors using Androxghost malware are building a botnet focused on cloud credential theft and using the stolen information to deliver additional malicious payloads. The botnet scans for servers vulnerable to specific RCE vulnerabilities and then scans the servers for .env files with cloud credentials. The credentials can then be used to spin up infrastructure to expand the botnet or to send out spam masquerading as the compromised companies.