Androxgh0st: The Botnet That Hunts Your Leaked .env Files

Androxgh0st is a Python-based, cloud-focused malware used to build a botnet that scans for and abuses exposed web-application secrets — primarily Laravel .env files — to harvest credentials for high-value services such as AWS, Twilio, SendGrid and Office 365. It is opportunistic and credential-theft-driven: it scans the internet for misconfigured web servers, exploits a small set of well-known CVEs, steals API keys and tokens, and uses them for follow-on abuse. On 16 January 2024 the FBI and CISA issued a joint advisory (AA24-016A) warning that operators were using it to establish a botnet. MITRE ATT&CK tracks it as S1092.

Overview

Androxgh0st activity was first documented around 2022 and scaled into large-scale .env scanning through 2023. It is assessed as financially motivated, with no confirmed named-group attribution. After the 2024 advisory, third-party reporting (CloudSEK) said the botnet incorporated exploits previously associated with the Mozi IoT botnet to target routers and IoT — code and exploit reuse, not proof of shared operators.

Exploited Vulnerabilities

Per the CISA and FBI advisory, Androxgh0st exploits a small set of known, CISA-KEV-listed flaws:

• CVE-2017-9841 — PHPUnit remote code execution via an exposed eval-stdin.php. T1190
• CVE-2018-15133 — Laravel deserialization RCE when the APP_KEY leaks.
• CVE-2021-41773 — Apache HTTP Server path traversal to RCE. T1083

How It Works

• Internet-wide scanning for vulnerable endpoints and exposed .env and config files. T1595.002 T1552.001
• Credential and secret extraction, then abuse of discovered keys — for example AWS API calls to check send quota and create IAM users, and SMTP and email-API abuse for spam. T1078 T1114
• Web-shell deployment on compromised servers and reuse of compromised hosts to continue scanning. T1505.003 T1059.006

MITRE ATT&CK Mapping (S1092)

Detection & Mitigation

• Ensure .env and config files are not web-reachable; restrict /vendor exposure and confirm PHPUnit is not internet-accessible.
• Rotate and revoke any credential that ever sat in an exposed .env; prefer short-lived provider credentials over stored static secrets, and audit affected services for misuse.
• Patch CVE-2017-9841, CVE-2018-15133 (rotate APP_KEY, disable debug in production) and CVE-2021-41773; add WAF rules for requests to /.env and the PHPUnit path, and watch for anomalous AWS API activity.