Shellshock Attacks Spotted In Wild [Updated Sept 26]

Zscaler ThreatLabZ reports active exploitation of the GNU Bash 'Shellshock' vulnerability (CVE-2014-6271) where attackers target Apache and Nginx servers (via mod_cgi) to download ELF backdoor binaries (named e.g. "apache" or "nginx") that contain hardcoded C2 information (e.g. 162.253.66.76:53) and provide DDoS, brute-force and backdoor capabilities; the advisory includes sample malicious headers, detection checks and patching guidance.