A new P2P botnet targeting Linux servers has been tracked recently by Akamai security researchers. The botnet network has been identified as ‘Panchan,’ which is active since March 2022 and is based on the Golang programming language.
A wormable behavior is implemented by Panchan through an SSH dictionary attack, which harvests SSH keys for lateral movement and uses them as keys to initiate SSH connections.
By building in concurrency via its built-in capabilities, the bot maximizes its spreading abilities and executes malware modules simultaneously.
This botnet primarily consists of activities that are related to cryptocurrency mining. Using the computer’s resources to mine cryptocurrencies is what the malicious code intends to do with the code.
During the course of Panchan’s processing, two miners have been known to be deployed and executed on the host, namely XMRig and nbhash. A unique feature of the network is the fact that the miners do not extract themselves to disk to maintain the network’s security.
Here below we have listed all the key features of Panchan:-
Earlier this year, the cybersecurity and cloud service company, Akamai on March 19, 2022, first spotted Panchan’s activity.
Based on the language used in the administrative panel that is embedded in the binary, which allows the user to edit the mining configuration, the Malware researchers attributed it to a likely Japanese threat actor at the time.
Researchers discovered that the malware implements a system called “godmode”, which is an admin panel that enables the threat actor to take control of the system remotely.
Operators are able to make modifications to the mining configuration using this panel, and the edits are then sent to all nodes of the botnet. To prevent unwanted tampering with the content of godmode, threat actors were monitored using private keys to access the content.
In addition to this private key, the bot contains a public key which is used to authenticate the connection to the private key. Here the threat actor probably originates from Japan, since the admin panel is written in Japanese.
During the research process, the security analysts discovered 209 peers, of which 40 are active at the moment. While the maximum number of compromised systems are discovered in the following regions:-
Users who want to keep their networks protected proactively can opt for the mitigations listed below. As these mitigations are recommended by security analysts:-
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
Some router models have identified a security vulnerability that allows attackers to bypass authentication. To exploit this vulnerability, an attacker…
Hackers often target CrushFTP servers as they contain sensitive data and are used for file sharing and storage. This makes…
DDoS attacks are a significant and growing risk that can overpower websites, crash servers, and block out authorized users with…
Hackers have leveraged an old Microsoft Office vulnerability, CVE-2017-8570, to deploy the notorious Cobalt Strike Beacon, targeting systems in Ukraine.…
In a historic move, Microsoft has made the source code for MS-DOS 4.0, one of the most influential operating systems…
A new attack campaign has been discovered to be employed by the FROZEN#SHADOW, which utilized SSLoad malware for its operations…