PSAUX — Ransomware Profile

PSAUX is an opportunistic ransomware operation that hunts internet-exposed web servers, breaking in through unpatched vulnerabilities and misconfigurations; reporting places the start of the operation around June 2024. It came to wide attention in late October 2024, when the security research firm LeakIX identified mass exploitation of exposed CyberPanel servers and said the compromised hosts were being used to install PSAUX, with 21,761 vulnerable instances visible online at the time. The entry point was command injection in the CyberPanel hosting control panel: CVE-2024-51378, which MITRE scored 10.0, alongside CVE-2024-51567 in the upgrademysqlstatus handler, which lets an unauthenticated attacker bypass secMiddleware and run shell commands. On execution the payload generates a fresh AES key and initialisation vector, appends a .psaux extension to encrypted files, and drops ransom notes named index.html into every folder while copying one to /etc/motd. A weakness in that encryption routine let LeakIX build and release a free decryptor for victims. CISA subsequently added CVE-2024-51378 to its Known Exploited Vulnerabilities catalog.

Vendor research

November 1 Advisory: CyberPanel RCE Leveraged for Ransomware (CVE-2024-51378) Censys
Critical CyberPanel Vulnerability (CVE-2024-51378): How to Stay Protected SonicWall
CVE-2024-51567 Detail NIST NVD
Massive PSAUX ransomware attack targets 22,000 CyberPanel instances BleepingComputer

Read the full analysis on IntelFusions