An attack campaign has been recently uncovered by AhnLab ASEC, where poorly controlled Linux SSH servers are targeted and infiltrated with the Tsunami DDoS Bot.
In addition to Tsunami, the threat actor installed several other types of malware, including:-
Most attacks on poorly managed Linux SSH servers involve DDoS bots or CoinMiners being installed.
Tsunami is a variant of Kaiten (aka Ziggy), a DDoS bot, and it is often distributed alongside Mirai and Gafgyt to attack vulnerable IoT devices.
Although they are all DDoS bots, Tsunami is unique because it functions as an IRC bot and communicates with the threat actor through IRC.
Tsunami’s source code is openly accessible, leading to widespread use by many threat actors.
It is primarily utilized for targeting IoT devices in attacks. Furthermore, it is regularly employed to target Linux servers without fail.
SSH service is commonly installed in Linux servers, making them vulnerable to attacks due to poor management.
It also enables remote login and system control for administrators, requiring them to log in with their registered user account.
Using basic login information (username and password) in a Linux system can let a malicious person get into the system by forcefully guessing or using a pre-made list of common passwords.
When poorly managed Linux SSH servers are targeted, attackers search for exposed servers by scanning specific ports.
They then try known account credentials to perform dictionary attacks and gain unauthorized access.
Here below we have mentioned the addresses that were attacked along with their IDs and passwords:-
Once logged in, the attacker runs a command to download and launch different types of malware. One of the installed malware is a Bash script called the “key” file, which acts as a downloader and installs more malware.
Apart from downloading malware, the “key” file also carries out several initial tasks to gain control over infected systems, such as setting up a secret SSH account as a backdoor, Researchers said.
Here below we have mentioned all the malware that is installed via the executed command and downloader Bash script:-
ShellBot is a DDoS bot that is Perl-based which utilizes the IRC protocol for communication, can set up a reverse shell, and supports:-
Tsunami stays active even after restarting by saving itself in “/etc/rc.local” and disguising itself with common system process names.
Here below we have mentioned all the remote control commands that Tsunami supports:-
In order to remove any traces of unauthorized access on compromised computers, MIG Logcleaner v2.0 and Shadow Log Cleaner are utilized, thus delaying the prompt detection of the infection by victims
In these attacks, the malware used by the threat actors is an “ELF” file and gives the threat actor elevated privileges.
Here below we have mentioned all the mitigations offered by the security analysts:-
Looking For an All-in-One Multi-OS Patch Management Platform – .
The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…
Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…
The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…
Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…
A security researcher discovered a vulnerability in Windows theme files in the previous year, which…
The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…