Thursday, May 1, 2025
HomeBotnetMomentum Botnet Attacks Linux Devices and Recruit them as Botnet to Launch...

Momentum Botnet Attacks Linux Devices and Recruit them as Botnet to Launch DDoS Attacks Using 36 Different Methods

Published on

SIEM as a Service

Follow Us on Google News

Security researchers from Trend Micro observed a new malware activity targeting devices running the Linux platform, the malware samples found to be connected with Momentum Botnet.

The malware campaign targets to install a backdoor on the Linux platform that accepts commands from attackers server to conduct various types of DoS attacks against a given target.

Momentum Botnet Attack Campaign

The Momentum botnet targets the Linux platform running on various CPU architectures such as ARM, MIPS, Intel, Motorola 68020, and more. Mirai, Kaiten, and Bashlite are the backdoor variants distributed by the Momentum botnet.

- Advertisement - Google News

The botnet exploits various vulnerabilities on the targeted router devices and web services to deploy and execute PowerShell scripts.

Momentum Botnet
Botnet servers

Once the botnet infects the device it modified run commands config file “rc” and adds them to command and control (C&C) server through internet relay chat (IRC) channel.

Then the infected device gets connected with the distribution server, it uses various commands to launch 36 different methods using the compromised devices.

CommandDescription
ACKACK flooder
ADV-TCPTCP flooding – Improved SSYN Attack
BLACKNURSEAn ICMP packet flooder
DNSDNS amplification flooder
ECE attacking (Not in use)Type of SYN flood
ESSYNExecuteSpoofedSyn Flooder
FIN attacking (Not in use)FIN flood
FRAGACKACK Fragmentation Flood
FRAG-TCPSpoofed TCP Fragmentation Flooder
GREGRE flood
HOLD (Not in use)TCP connect flooder(frag)
HTTPHTTP Flooder
HTTPFLOODHTTP flooding
JUNKTCP flooder (frag)
LDAPLDAP amplification flooder
MEMCACHEMEMCACHE amplification flooder
NSACKType of ACK flood
NSSYNType of SYN flooder
OVHType of UDP flooding (DOMINATE)
PHATWONKMultiple attacks in one e.g. xmas, all flags set at once, usyn (urg syn), and any TCP flag combination.
RTCPA Random TCP Flooder Fragmented packet header
SACKType of TCP flood
SEW AttackType of SYN flood
SSYN2Type of SYN flood
STUDPSTD Flooder
STUDPSTD Flooder
SYNSYN flooder
SYNACKSYN-ACK flood
TCPNULLTCP-Nulled flooding – Flood with TCP packets with no flag set
UDPUDP flood
UDP-BYPASSA udp flooder (vulnMix)
UNKNOWNUDP Flooder
URG attacking
VOLT-UDPSpoofed UDP Flooder, Can Bypass most firewall
VSEValve Source Engine Amplification
XMASTCP Xmas flood

Researchers observed that with MEMCACHE, LDAP, DNS, and Valve Source Engine, the malware attack typically spoofs the source IP address to publicly accessible servers.

The botnet is also capable of “opening a proxy on a port on a specified IP, changing the nick of the client, disabling or enabling packeting from the client, and more.”

With LDAP DDoS reflection, Memcache attack the botnet spoofs the source IP address and with UDP-BYPASS attack targets the host by constructing and unloading a legitimate UDP payload on a specific port.

The Momentum botnet includes other capabilities such as Fast flux, Backdoor and Propagate to spread and compromise devices.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Managing Shadow IT Risks – CISO’s Practical Toolkit

Managing Shadow IT risks has become a critical challenge for Chief Information Security Officers...

Application Security in 2025 – CISO’s Priority Guide

Application security in 2025 has become a defining concern for every Chief Information Security...

Preparing for Quantum Cybersecurity Risks – CISO Insights

Quantum cybersecurity risks represent a paradigm shift in cybersecurity, demanding immediate attention from Chief...

Securing Digital Transformation – CISO’s Resource Hub

In today’s hyper-connected world, securing digital transformation is a technological upgrade and a fundamental...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

New WordPress Malware Disguised as Anti-Malware Plugin Takes Full Control of Websites

The Wordfence Threat Intelligence team has identified a new strain of WordPress malware that...

Konni APT Deploys Multi-Stage Malware in Targeted Organizational Attacks

A sophisticated multi-stage malware campaign, potentially orchestrated by the North Korean Konni Advanced Persistent...

Outlaw Cybergang Launches Global Attacks on Linux Environments with New Malware

The Outlaw cybergang, also known as “Dota,” has intensified its global assault on Linux...