Tuesday, October 15, 2024
HomeBotnetCryptocurrency-Mining Botnet Attack SSH Service Running IoT Devices

Cryptocurrency-Mining Botnet Attack SSH Service Running IoT Devices

Published on

Malware protection

Newly discovered cryptocurrency mining bot targeting the Internet of Things (IoT) devices which contain SSH service and  IoT-related ports, including 22, 2222, and 502.

Cryptocurrency-mining malware consumes the system resources and utilizes them for mining cryptocurrencies without user permissions.

This crypto-mining attack will work for all the connected devices and servers that running under SSH service.

- Advertisement - SIEM as a Service

SSH service provides the secure connection for IoT (Internet of Things) refers to devices that are connected to the Internet.

Attackers using Various social Engineering tricks to compromise victims and  Monero and Ethereum coins to gain huge profits using another device.

The uncovered bot mainly searches for the device that running with open Remote Desktop Protocol (RDP) port and taking advantages of of-of vulnerable devices and run the script that download & install the malware.

Botnet Infection process on SSH Service

Initially, botnet host the malicious script using specific website and the script will download the files from hxxps://www[.]yiluzhuanqian[.]com/soft/Linux/yilu_2_[.]tgz and save it into the temp folder.

This is one of the widely using exploitation technique against Linux-based servers and this bot is able to load miners on Linux.

Script downloaded site appears to be financial scam site and the attacker using sophisticated techniques that helps switch to another domain to continue operations if the link is blocked at any cost.

So once the downloaded malicious script will be executed then it first checks the internet connectivity the connect to Baindu.com after that, it checks the OS that running on the target and it specifically targets the Linux based operating system.

The hugepage and memlock are also set up helps to enhance the more computational power to mining the cryptocurrency.

Once those are set up, the script downloads the miner, disguised as a download of a libhwloc4library and this miner using some persistance mechanism to keep running the miner even after rebooting the computer.

According to Trend Micro report, The file cmd.txt lists commands used to run the “mservice” binary with parameters, which then installs the actual miner, “YiluzhuanqianSer.” (Note that the miner is related to the potential scam site domain.Apart from this a conf.json file contains e web shell/backdoor and the aditional directories includes two binaries and even a cmd.txt file that contains commands used to run the miner.

This type of mining operation that targets connected devices for profit is not the first of its kind. Moreover, security incidents that make use of bots to target IoT devices have made headlines on several occasions Trend Micro said.

Also Read:

Bithump Hacked – Hackers Steal $31 Million Worth Cryptocurrency

16 Person Hacker Group Arrested for Mining Cryptocurrency at Internet Cafes

Android Cryptocurrency Mining Malware Infecting Amazon Fire TV & Other Amazon Devices

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Splunk Enterprise Vulnerabilities let Attackers Execute Remote Code

Splunk has disclosed multiple vulnerabilities affecting its Enterprise product, which could allow attackers to...

OilRig Hackers Exploiting Microsoft Exchange Server To Steal Login Details

Earth Simnavaz, an Iranian state-sponsored cyber espionage group, has recently intensified its attacks on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Splunk Enterprise Vulnerabilities let Attackers Execute Remote Code

Splunk has disclosed multiple vulnerabilities affecting its Enterprise product, which could allow attackers to...