Friday, March 29, 2024

Cryptocurrency-Mining Botnet Attack SSH Service Running IoT Devices

Newly discovered cryptocurrency mining bot targeting the Internet of Things (IoT) devices which contain SSH service and  IoT-related ports, including 22, 2222, and 502.

Cryptocurrency-mining malware consumes the system resources and utilizes them for mining cryptocurrencies without user permissions.

This crypto-mining attack will work for all the connected devices and servers that running under SSH service.

SSH service provides the secure connection for IoT (Internet of Things) refers to devices that are connected to the Internet.

Attackers using Various social Engineering tricks to compromise victims and  Monero and Ethereum coins to gain huge profits using another device.

The uncovered bot mainly searches for the device that running with open Remote Desktop Protocol (RDP) port and taking advantages of of-of vulnerable devices and run the script that download & install the malware.

Botnet Infection process on SSH Service

Initially, botnet host the malicious script using specific website and the script will download the files from hxxps://www[.]yiluzhuanqian[.]com/soft/Linux/yilu_2_[.]tgz and save it into the temp folder.

This is one of the widely using exploitation technique against Linux-based servers and this bot is able to load miners on Linux.

Script downloaded site appears to be financial scam site and the attacker using sophisticated techniques that helps switch to another domain to continue operations if the link is blocked at any cost.

So once the downloaded malicious script will be executed then it first checks the internet connectivity the connect to Baindu.com after that, it checks the OS that running on the target and it specifically targets the Linux based operating system.

The hugepage and memlock are also set up helps to enhance the more computational power to mining the cryptocurrency.

Once those are set up, the script downloads the miner, disguised as a download of a libhwloc4library and this miner using some persistance mechanism to keep running the miner even after rebooting the computer.

According to Trend Micro report, The file cmd.txt lists commands used to run the “mservice” binary with parameters, which then installs the actual miner, “YiluzhuanqianSer.” (Note that the miner is related to the potential scam site domain.Apart from this a conf.json file contains e web shell/backdoor and the aditional directories includes two binaries and even a cmd.txt file that contains commands used to run the miner.

This type of mining operation that targets connected devices for profit is not the first of its kind. Moreover, security incidents that make use of bots to target IoT devices have made headlines on several occasions Trend Micro said.

Also Read:

Bithump Hacked – Hackers Steal $31 Million Worth Cryptocurrency

16 Person Hacker Group Arrested for Mining Cryptocurrency at Internet Cafes

Android Cryptocurrency Mining Malware Infecting Amazon Fire TV & Other Amazon Devices

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles