Last week, F5 threat researchers spotted a Monero (XMR) crypto-mining campaign that was taking advantage of a user configuration vulnerability in the rTorrent client, specifically misconfigured XML-RPC functionality. This misconfiguration vulnerability in rTorrent allows an unauthenticated user to execute methods in the rTorrent client using HTTP requests.

After deeper analysis of the attack logs, F5 threat researchers discovered another campaign targeting the same rTorrent configuration error, this time to disguise threat actors’ activities with user-agents that appear to be legitimate.

• The campaign (running in January) appears to have spoofed the Recording Industry Association of America (RIAA) and New York University (NYU) user-agents.
• F5 researchers do not believe either of these user-agents are legitimately from RIAA or NYU because of the origin of returning IP addresses and other attacks seen from those addresses as well.
• The sending server for the RIAA user-agent is a proxy server in the Netherlands set up with the hosting company Hostkey B.V. Activity from the same IP address includes scans of ports commonly used by Torrent software, and scans for Intel AMT ports.
• The sending servers for the NYU user-agent resolve to various hosting companies around the world from which malicious activity has been seen previously, including SSH brute force scans.

Why the RIAA?

Better known as the Recording Industry Association of America, the RIAA (among other things) helps members protect copyrighted works from piracy. It’s also widely known that BitTorrent is a file sharing protocol that is primarily used to illegally share software, movies, music, and other protected works—the very same materials RIAA exists to protect. In 2001, the RIAA tried to fight piracy of copyrighted works by filing lawsuits against offenders.¹ It even drafted an amendment to proposed legislation (the USA Act of 2001²) that would have allowed the RIAA to hack distributors’ computers to delete stolen content from their file systems and indemnified them from any responsibility for damage caused to distributors’ computers.³