Thursday, March 28, 2024

A New Golang-based (P2P) Botnet “Panchan” Actively Attacking Linux Servers

A new P2P botnet targeting Linux servers has been tracked recently by Akamai security researchers. The botnet network has been identified as ‘Panchan,’ which is active since March 2022 and is based on the Golang programming language.

A wormable behavior is implemented by Panchan through an SSH dictionary attack, which harvests SSH keys for lateral movement and uses them as keys to initiate SSH connections.

By building in concurrency via its built-in capabilities, the bot maximizes its spreading abilities and executes malware modules simultaneously.

This botnet primarily consists of activities that are related to cryptocurrency mining. Using the computer’s resources to mine cryptocurrencies is what the malicious code intends to do with the code.

During the course of Panchan’s processing, two miners have been known to be deployed and executed on the host, namely XMRig and nbhash. A unique feature of the network is the fact that the miners do not extract themselves to disk to maintain the network’s security.

Panchan’s features

Here below we have listed all the key features of Panchan:-

  • Infection vector – SSH worm
  • Peer-to-peer communication
  • Godmode
  • Fileless miner
  • Anti-kill
  • Anti-monitor
  • Persistence

Activity of Panchan

Earlier this year, the cybersecurity and cloud service company, Akamai on March 19, 2022, first spotted Panchan’s activity.

Based on the language used in the administrative panel that is embedded in the binary, which allows the user to edit the mining configuration, the Malware researchers attributed it to a likely Japanese threat actor at the time.

Researchers discovered that the malware implements a system called “godmode”, which is an admin panel that enables the threat actor to take control of the system remotely.

Operators are able to make modifications to the mining configuration using this panel, and the edits are then sent to all nodes of the botnet. To prevent unwanted tampering with the content of godmode, threat actors were monitored using private keys to access the content.

In addition to this private key, the bot contains a public key which is used to authenticate the connection to the private key. Here the threat actor probably originates from Japan, since the admin panel is written in Japanese.

During the research process, the security analysts discovered 209 peers, of which 40 are active at the moment. While the maximum number of compromised systems are discovered in the following regions:-

  • Asia (64)
  • Europe (52)
  • North America (45)
  • South America (11)
  • Africa (1)
  • Oceania (1)

Mitigation

Users who want to keep their networks protected proactively can opt for the mitigations listed below. As these mitigations are recommended by security analysts:-

  • Make sure your passwords are complex and secure.
  • Where possible, set up multi-factor authentication.
  • Make sure your network is segmented as much as possible.
  • Pay attention to how your VMs are using their resources.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles