A New Golang-based (P2P) Botnet “Panchan” Actively Attacking Linux Servers

A new P2P botnet targeting Linux servers has been tracked recently by Akamai security researchers. The botnet network has been identified as ‘Panchan,’ which is active since March 2022 and is based on the Golang programming language.

A wormable behavior is implemented by Panchan through an SSH dictionary attack, which harvests SSH keys for lateral movement and uses them as keys to initiate SSH connections.

By building in concurrency via its built-in capabilities, the bot maximizes its spreading abilities and executes malware modules simultaneously.

This botnet primarily consists of activities that are related to cryptocurrency mining. Using the computer’s resources to mine cryptocurrencies is what the malicious code intends to do with the code.

During the course of Panchan’s processing, two miners have been known to be deployed and executed on the host, namely XMRig and nbhash. A unique feature of the network is the fact that the miners do not extract themselves to disk to maintain the network’s security.

Panchan’s features

Here below we have listed all the key features of Panchan:-

• Infection vector – SSH worm
• Peer-to-peer communication
• Godmode
• Fileless miner
• Anti-kill
• Anti-monitor
• Persistence

Activity of Panchan

Earlier this year, the cybersecurity and cloud service company, Akamai on March 19, 2022, first spotted Panchan’s activity.

Based on the language used in the administrative panel that is embedded in the binary, which allows the user to edit the mining configuration, the Malware researchers attributed it to a likely Japanese threat actor at the time.

Researchers discovered that the malware implements a system called “godmode”, which is an admin panel that enables the threat actor to take control of the system remotely.

Operators are able to make modifications to the mining configuration using this panel, and the edits are then sent to all nodes of the botnet. To prevent unwanted tampering with the content of godmode, threat actors were monitored using private keys to access the content.

In addition to this private key, the bot contains a public key which is used to authenticate the connection to the private key. Here the threat actor probably originates from Japan, since the admin panel is written in Japanese.

During the research process, the security analysts discovered 209 peers, of which 40 are active at the moment. While the maximum number of compromised systems are discovered in the following regions:-

• Asia (64)
• Europe (52)
• North America (45)
• South America (11)
• Africa (1)
• Oceania (1)

Mitigation

Users who want to keep their networks protected proactively can opt for the mitigations listed below. As these mitigations are recommended by security analysts:-

• Make sure your passwords are complex and secure.
• Where possible, set up multi-factor authentication.
• Make sure your network is segmented as much as possible.
• Pay attention to how your VMs are using their resources.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.