Monday, March 4, 2024

Shell DDoS Malware Attacks Poorly Managed Linux SSH Servers

The ShellBot threat has turned out to be a new type of malware designed to target Linux SSH servers poorly managed as part of a new campaign.

As stated in a report published by AhnLab Security Emergency Response Center (ASEC), ShellBot, also called PerlBot, is a DDoS Bot malware developed using the Perl programming language, which normally communicates with the C&C server using the IRC protocol.

Despite being an old malware, ShellBot has been used steadily over the last few years and is still used today to attack Linux systems.

Attack Campaigns

A malware attack typically occurs through a web browser or email attachment in a desktop environment. It is also a common practice for threat actors to distribute malware disguised as legitimate software to convince users to install it on their devices.

In order to attack server environments, threat actors have also used different methods.

The prime targets of these attacks are those services that are poorly managed or are weak to exploit vulnerabilities because they are not patched to the latest version of their software.

There are several ways in which Windows operating systems can be targeted using the remote desktop protocol (RDP) and Microsoft SQL Server service as examples of attack vectors.

Credentials Used

Regarding attacks on Linux servers, Secure Shell (SSH) is one of the most commonly targeted services. When an old Linux server or embedded Linux OS is present in IoT environments, the Telnet service has been the target of dictionary attacks.

IRC protocol & ShellBot Analysis

The Internet Relay Chat (IRC) is a real-time Internet chat protocol that allows users to log on to certain channels and join in real-time discussions with other users who have logged on to the same channel.

An IRC bot can be defined as a piece of bot malware that uses the IRC protocol to communicate with a C&C server via the internet rather than via a regular serial port. 

Commands Used

Infected systems are infected with IRC bots that access an IRC server’s channel designated by threat actors, transmit stolen data, or receive a specific string from the attacker as a command, executing the malicious behavior associated with that string.

There has been a considerable amount of use of ShellBot by a number of threat actors in the past. Researchers have classified ShellBot into three types based on the commands, characteristics, and DDoS attacks used by the malware during installation.

The attack uses a list of known SSH credentials to initiate a dictionary attack, which compromises the server and deploys the payload, after which a remote server is contacted via Internet Relay Chat (IRC) protocol to communicate with the attacker.

On the other hand, PowerBots has a more backdoor-like capability since it can grant reverse shell access to compromised hosts and upload arbitrary files from them.

Nearly three months have passed since ShellBot was employed in attacks that aimed to infect Linux servers with cryptocurrency miners and distribute those miners using shell script compilers.

Building Your Malware Defense Strategy – Download Free E-Book

Related Read:


Latest articles

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles