Friday, June 21, 2024

Cryptocurrency-Mining Botnet Attack SSH Service Running IoT Devices

Newly discovered cryptocurrency mining bot targeting the Internet of Things (IoT) devices which contain SSH service and  IoT-related ports, including 22, 2222, and 502.

Cryptocurrency-mining malware consumes the system resources and utilizes them for mining cryptocurrencies without user permissions.

This crypto-mining attack will work for all the connected devices and servers that running under SSH service.

SSH service provides the secure connection for IoT (Internet of Things) refers to devices that are connected to the Internet.

Attackers using Various social Engineering tricks to compromise victims and  Monero and Ethereum coins to gain huge profits using another device.

The uncovered bot mainly searches for the device that running with open Remote Desktop Protocol (RDP) port and taking advantages of of-of vulnerable devices and run the script that download & install the malware.

Botnet Infection process on SSH Service

Initially, botnet host the malicious script using specific website and the script will download the files from hxxps://www[.]yiluzhuanqian[.]com/soft/Linux/yilu_2_[.]tgz and save it into the temp folder.

This is one of the widely using exploitation technique against Linux-based servers and this bot is able to load miners on Linux.

Script downloaded site appears to be financial scam site and the attacker using sophisticated techniques that helps switch to another domain to continue operations if the link is blocked at any cost.

So once the downloaded malicious script will be executed then it first checks the internet connectivity the connect to after that, it checks the OS that running on the target and it specifically targets the Linux based operating system.

The hugepage and memlock are also set up helps to enhance the more computational power to mining the cryptocurrency.

Once those are set up, the script downloads the miner, disguised as a download of a libhwloc4library and this miner using some persistance mechanism to keep running the miner even after rebooting the computer.

According to Trend Micro report, The file cmd.txt lists commands used to run the “mservice” binary with parameters, which then installs the actual miner, “YiluzhuanqianSer.” (Note that the miner is related to the potential scam site domain.Apart from this a conf.json file contains e web shell/backdoor and the aditional directories includes two binaries and even a cmd.txt file that contains commands used to run the miner.

This type of mining operation that targets connected devices for profit is not the first of its kind. Moreover, security incidents that make use of bots to target IoT devices have made headlines on several occasions Trend Micro said.

Also Read:

Bithump Hacked – Hackers Steal $31 Million Worth Cryptocurrency

16 Person Hacker Group Arrested for Mining Cryptocurrency at Internet Cafes

Android Cryptocurrency Mining Malware Infecting Amazon Fire TV & Other Amazon Devices


Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles