Saturday, July 20, 2024

Shell DDoS Malware Attacks Poorly Managed Linux SSH Servers

The ShellBot threat has turned out to be a new type of malware designed to target Linux SSH servers poorly managed as part of a new campaign.

As stated in a report published by AhnLab Security Emergency Response Center (ASEC), ShellBot, also called PerlBot, is a DDoS Bot malware developed using the Perl programming language, which normally communicates with the C&C server using the IRC protocol.

Despite being an old malware, ShellBot has been used steadily over the last few years and is still used today to attack Linux systems.

Attack Campaigns

A malware attack typically occurs through a web browser or email attachment in a desktop environment. It is also a common practice for threat actors to distribute malware disguised as legitimate software to convince users to install it on their devices.

In order to attack server environments, threat actors have also used different methods.

The prime targets of these attacks are those services that are poorly managed or are weak to exploit vulnerabilities because they are not patched to the latest version of their software.

There are several ways in which Windows operating systems can be targeted using the remote desktop protocol (RDP) and Microsoft SQL Server service as examples of attack vectors.

Credentials Used

Regarding attacks on Linux servers, Secure Shell (SSH) is one of the most commonly targeted services. When an old Linux server or embedded Linux OS is present in IoT environments, the Telnet service has been the target of dictionary attacks.

IRC protocol & ShellBot Analysis

The Internet Relay Chat (IRC) is a real-time Internet chat protocol that allows users to log on to certain channels and join in real-time discussions with other users who have logged on to the same channel.

An IRC bot can be defined as a piece of bot malware that uses the IRC protocol to communicate with a C&C server via the internet rather than via a regular serial port. 

Commands Used

Infected systems are infected with IRC bots that access an IRC server’s channel designated by threat actors, transmit stolen data, or receive a specific string from the attacker as a command, executing the malicious behavior associated with that string.

There has been a considerable amount of use of ShellBot by a number of threat actors in the past. Researchers have classified ShellBot into three types based on the commands, characteristics, and DDoS attacks used by the malware during installation.

The attack uses a list of known SSH credentials to initiate a dictionary attack, which compromises the server and deploys the payload, after which a remote server is contacted via Internet Relay Chat (IRC) protocol to communicate with the attacker.

On the other hand, PowerBots has a more backdoor-like capability since it can grant reverse shell access to compromised hosts and upload arbitrary files from them.

Nearly three months have passed since ShellBot was employed in attacks that aimed to infect Linux servers with cryptocurrency miners and distribute those miners using shell script compilers.

Building Your Malware Defense Strategy – Download Free E-Book

Related Read:


Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles