Hackers often target Linux SSH servers due to their widespread use in hosting critical services, and the following loopholes make them vulnerable, providing opportunities to hackers for unauthorized access and potential exploitation:-
Cybersecurity researchers at AhnLab Security Emergency Response Center (ASEC) recently identified that hackers actively attack the Linux SSH servers to deploy scanner malware.
Threat actors target poorly managed servers, seeking IP and SSH credentials for DDoS and CoinMiner malware. IP scanning identifies active SSH ports, followed by brute force attacks. More CoinMiners mean increased cryptocurrency mining.
DDoS attacks grow in power with more controlled bots, and to install more malware, actors need target information besides DDoS and CoinMiners, malware scans, and attacks vulnerable systems.
Meanwhile, SSH scanner malware DDoS bots and CoinMiners may be installed. Besides this, some actors install scanners, selling breached info on the dark web.
Here below, we have mentioned all the common malware that is installed in attacks against poorly managed Linux SSH servers:-
Threat actors deploy malware on Linux servers after logging in with stolen SSH credentials.
Threat actor scans for active SSH (port 22) systems using stolen credentials for malware installation.
The CPU core check command confirms the successful login. The actor downloads a compressed file with a port scanner and SSH attack tool. Notable commands include:-
Threat actor runs “go” script for port scanning, banner grabbing, and SSH dictionary attacks. “gob” and “rand” scripts allow IP class customization.
The results are saved in “bios.txt” and banners in “banner.log.” The “prg” tool extracts IPs with “SSH-2.0-OpenSSH” from “bios.txt” to use in dictionary attacks, and the successful logins are stored in “ssh_vuln.”
Besides this, the total CPU cores are checked using “grep -c ^processor /proc/cpuinfo.” After scanning and obtaining credentials, the actor repeats the process and installs the same tools.
To safeguard cybersecurity, researchers recommended the following mitigations:-
In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer overflow…
A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing attackers…
Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a cyberattack…
The ACRStealer malware, an infostealer disguised as illegal software such as cracks and keygens, has…
A security vulnerability in Nagios XI 2024R1.2.2, tracked as CVE-2024-54961, has been disclosed, allowing unauthenticated…
Ubiquiti Networks has issued an urgent security advisory (Bulletin 046) warning of multiple critical vulnerabilities…