Latest Linux Security News & Information

security advisorymalwarebotnet

SocksEscort Linux Router Malware Botnet Takedown Operation Lightning

Authorities have dismantled SocksEscort, a service that sold access to a large proxy network built from compromised residential routers. Investigators say much of the infrastructure sat on infected SOHO networking devices, many running embedded Linux firmware. . Instead of running its own servers, the operation pushed customer traffic through hijacked home and small-business routers. Over time, that created a distributed botnet where thousands of compromised systems acted as proxy nodes, letting fraud operations and credential attacks blend into normal residential traffic instead of standing out as activity from known malicious infrastructure. It’s a pattern that shows up again and again with router malware. A device gets compromised, nobody notices, and eventually that bandwidth is part of someone else’s proxy network. The SocksEscort case becomes more interesting once you look at how the network actually operated. Inside the SocksEscort Proxy Network SocksEscort presented itself as a residential proxy service, but the infrastructure behind it looked very different from the commercial proxy platforms people normally think about. Instead of volunteers or paid nodes, the traffic moved through compromised routers sitting in homes and small offices. That distinction changes the entire model. Legitimate proxy networks rely on users knowingly sharing bandwidth. The SocksEscort network relied on devices that had been quietly taken over and turned into relay points. A lot of that control came from AVRecon malware, a Linux-targeting threat uncovered by researchers at Lumen Black Lotus Labs. The malware targeted a wide range of SOHO routers, including models from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel, which tend to run continuously and often sit untouched for years once they’re installed. Once a device was infected, the router effectively became part of the proxy network. AVRecon malware capabilities Linux router malware targeting SOHO networkingdevices device reconnaissance and system information collection command-and-control communication remote command execution proxy relay configuration for routing external traffic The result was a residential proxy network built almost entirely from compromised infrastructure. From the outside, it looked like a typical proxy service, but in reality, the network relied on thousands of infected routers acting as relay points for customer traffic. Once researchers started mapping the SocksEscort infrastructure, it became clear that the network had been running for years. The Scale of the SocksEscort Botnet Once researchers started mapping the SocksEscort infrastructure, it became clear that the network had been running for years. The service itself dates back more than a decade, gradually growing into a proxy network built from compromised residential devices. Investigators eventually tied more than 369,000 compromised IP addresses across 163 countries to the service. Researchers were also seeing around 20,000 devices communicating with the infrastructure each week, suggesting the botnet was constantly shifting as systems dropped off and new ones appeared. At that point, it stops looking like a niche proxy service. It starts looking like a long-running cybercrime infrastructure. The operation generated roughly $5.8 million (€5 million) in criminal revenue before the infrastructure was disrupted. The question I keep coming back to is why routers, especially Linux-based ones, keep showing up in operations like this. Why Linux Routers Keep Becoming Botnet Infrastructure Cases like SocksEscort tend to circle back to the same kind of device. Not servers. Not desktops. Home and small-office routers. Most of those systems run some form of embedded Linux, which makes sense once you think about how networking hardware is built. The operating system itself isn’t the problem. What matters is how long these devices stay online and how rarely they’re updated after they’reinstalled. A router might sit in a closet or under a desk for years without anyone logging into it. When attackers find a way in, that device can quietly become part of a botnet or proxy network and continue operating as if nothing changed. Where attackers usually get in Outdated firmware Default administrative credentials Exposed remote administration interfaces Unsupported hardware that no longer receives updates None of these weaknesses is particularly exotic. They’re the same entry points that have shown up in router botnet campaigns for years. Why infections often go unnoticed Routers operate continuously with little user interaction Proxy network activity generates minimal visible disruption Router security monitoring is uncommon in most environments •AVRecon has been observed flashing custom firmware images through the router’s update mechanism, allowing the malware to persist even after a reboot. That combination makes routers an unusually durable infrastructure once they’re compromised. A device can sit inside a botnet-backed proxy network for months, sometimes years, before anyone realizes it’s participating in the traffic. Which brings us back to the SocksEscort case and how authorities eventually disrupted that infrastructure. Why the SocksEscort Takedown Doesn’t Solve the Router Problem After years of operating in the background, the infrastructure behind SocksEscort eventually drew the attention of authorities . The joint investigation, known as Operation Lightning, focused on dismantling the service itself rather than attempting to track down every compromised router spread across residential networks. The response focused on dismantling the service itself rather than trying to track down every compromised router spread across residential networks. Authorities seized 34 domains and 23 servers across seven countries, dismantling the infrastructure used to operate the proxy service, and cryptocurrency connected to theoperation was frozen. In practical terms, that removed the platform that had been selling access to the proxy network. But taking down the service doesn’t automatically clean the devices that were already compromised. Many of the routers that once formed part of the SocksEscort network may still be online today, running the same firmware and configurations that allowed the compromise in the first place. What This Means for Linux Users and Administrators For most administrators, the takeaway from the SocksEscort case isn’t the malware itself. It’s the device lifecycle behind it. Routers and edge devices often stay in service far longer than the systems around them. They get installed, configured once, and then quietly run for years without firmware updates, configuration reviews, or security monitoring. That’s exactly the kind of environment operations like this depend on. If a router ends up inside a botnet or proxy network, the device may continue operating normally while routing traffic for someone else. In many cases, the first signal is an abuse notice from an ISP or unusual outbound traffic patterns that don’t match normal network activity. For administrators responsible for Linux-based networking devices, a few checks are worth making: Confirm routers are running the current firmware Replace hardware that no longer receives vendor updates Disable remote administration interfaces that are not required Change default or long-standing administrative credentials Review outbound traffic patterns from edge devices Isolate routers and IoT devices from internal networks where possible Administrators investigating suspicious router activity may also want to check for processes listening on port 48102 or the presence of a jid.pid file in /tmp, both indicators previously associated with AVRecon infections. None of these steps is complicated, but they’re often overlooked once a device is deployed, which is exactly the kind of gap operations like SocksEscorttend to rely on. That’s also why incidents like this keep resurfacing. The devices involved are rarely high-profile servers or hardened infrastructure. More often, they’re ordinary routers sitting at the edge of a network, quietly running the same firmware they had the day they were installed. . SocksEscort proxy network dismantled by authorities using compromised Linux routers shows ongoing threats from malware.. Linux Router Malicious Activity, SocksEscort Malware Disruption, Embedded Linux Security Issues, Cybercrime Infrastructure, SOHO Device Protection. . MaK Ulac

Mar 13, 2026 •

MaK Ulac Hacks/Cracks

exploitmalwareDDoS

XorDDoS Malware Overview: Threats to Linux, IoT, and Botnet Formation

When malware like XorDDoS resurfaces with expanded capabilities, it’s a wake-up call for us security professionals managing Linux-based systems. Initially discovered almost a decade ago, XorDDoS has evolved from a relatively basic threat into a more sophisticated attack. . Its key goal remains the same: compromise as many Linux systems as possible to create botnets capable of launching massive Distributed Denial of Service (DDoS) attacks. However, recent developments have revealed new targets and improved methods, forcing Linux admins to rethink their defenses. The latest version of XorDDoS is no longer limited to traditional Linux environments. It now actively targets Docker containers and Internet of Things (IoT) devices—two areas where security practices often lag. This shift in focus not only broadens its impact but also highlights the increasing sophistication of attackers, who are adapting to new technologies faster than many organizations can secure them. At the heart of XorDDoS’s operations lies one critical weakness in system configurations: insecure SSH setups. Understanding how this malware operates and how it exploits these vulnerabilities is the first step toward protecting your infrastructure. Let's take a closer look at this sophisticated malware's tactcis and techniques and discuss measures you can take to fortify your systems against it. XorDDoS Infection Vectors and Techniques XorDDoS exploits vulnerabilities by brute-forcing SSH credentials to gain access to systems. Attackers deploy automated tools designed to try thousands of username and password combinations until one works. Once inside, the malware installs itself and connects the compromised computer to an attacker-controlled botnet network, which it then uses to launch coordinated attacks, steal sensitive data, and proliferate further across networks. What distinguishes XorDDoS as particularly challenging is its persistence: this malware uses scripts to ensure it respawns after reboot attempts or removal,making it extremely difficult for admins to fully eradicate. Furthermore, its advanced obfuscation techniques and encrypted communication between command-and-control (C2) servers and compromised computers allow it to operate silently for extended periods. These features allow XorDDoS to operate undetected. Newer versions of XorDDoS now have expanded capabilities that enable them to take advantage of containerized environments, such as Docker. Improperly secured Docker instances with open APIs or inadequate access control provide fertile ground for propagating. IoT devices that lack robust security features altogether also serve as targets. These changes demonstrate how attackers have broadened their focus beyond more traditional entry points to form resilient botnets. The Risks of Leaving Systems Vulnerable Consequences of a XorDDoS infection extend far beyond any individual system or device that is compromised. Once infected, compromised machines become part of an expansive network that can disrupt services on a much larger scale. A botnet powered by XorDDoS could generate immense amounts of traffic that overwhelms web servers, causing outages for critical services. Attackers controlling these botnets could rent or use them to extort businesses, inflicting financially and reputationally damaging attacks that affect both their finances and reputations. After DDoS attacks have subsided, organizations must also worry about collateral damage from compromised Linux systems within their networks, which can serve as launch pads for attackers seeking to penetrate other systems and access sensitive information. Organizations running modern hybrid infrastructures that combine on-premises servers with cloud workloads or containers may find that one breach can cascade into a widespread operational disruption. XorDDoS' targeting of IoT devices and Docker containers significantly ratchets up the stakes. Given the interdependency of IoT ecosystems , vulnerabilities in seemingly harmless devices could openpaths into critical systems. Meanwhile, Docker containers' pivotal role in modern DevOps pipelines makes their breach all the more powerful, as it could threaten applications and services downstream. Strengthening Defenses Against XorDDoS Reinforcing SSH security is key to protecting against XorDDoS attacks that rely on brute force. Organizations still relying on username-password authentication are particularly at risk. Using key-based authentication significantly decreases this risk. Attackers cannot brute-force private keys without extensive computational resources, and disabling password-based login for SSH can stop many automated attacks at their source. Reducing SSH access altogether should also not be overlooked. By restricting login attempts to specific IP addresses or using firewalls to monitor suspicious SSH activity, admins can drastically resuce the attack surface and minimize attacks before they succeed. Tools like Fail2Ban offer additional layers of defense by temporarily banning IP addresses after repeated failed login attempts, which helps stop brute-force attacks before they take hold. Additionally, Docker containers require secure configuration practices in environments that use them. To protect environments using Docker, this means shutting down unnecessary access points, such as open APIs, and applying the principle of least privilege when assigning user permissions. Regular vulnerability scans and manual reviews of container images can help identify weak points before attackers do. The Importance of Monitoring and Incident Response Proactive monitoring is key to early detection and mitigation of XorDDoS infections. Though designed to avoid detection, subtle signs like unexplained spikes in outbound traffic, CPU usage fluctuations, or processes connecting to external IP addresses could indicate a compromise. Network monitoring tools that flag excessive or anomalous communication with external domains are especially valuable, given XorDDoS' dependence on C2servers for coordination. These tools are particularly helpful as the malware relies on them as coordination points for its activities. We admins should perform regular system integrity checks to detect changes caused by persistent malware, especially in critical directories like /etc/, where malware scripts may reside. Once an infection is identified, immediate containment and remediation measures should be undertaken as quickly as possible to limit further spread and remove malware remnants that remain after cleanup efforts are complete. Given XorDDoS' persistence capabilities, however, a complete system reinstallation may sometimes be required in severe cases to ensure all malware has been removed from a machine's booting environment. Our Final Thoughts on Staying Ahead of the XorDDoS Threat Although XorDDoS is only an example of evolving Linux-based malware, its resilience provides a timely reminder of the complexity of modern cyber threats. Attackers continue to find innovative ways to exploit security oversights. Their success often stems from outdated systems with poor configurations or unmonitored environments. For Linux administrators, protecting against these advanced threats requires taking an aggressive and proactive approach focused on prevention rather than reaction. Staying abreast of emerging threats means regularly reviewing system logs, configuration files and network activity. Employing an effective defense strategy, including robust SSH security, container security best practices , IoT policy enforcement, and incident monitoring, can significantly reduce your likelihood of falling prey to threats like XorDDoS. . XorDDoS targets Linux and IoT devices, forming extensive botnets for executing DDoS attacks. Investigate effective security measures to mitigate these threats.. XorDDoS, Linux Malware, Botnet Security, Container Security, IoT Threats. . Brittany Day

Apr 21, 2025 •

Brittany Day Hacks/Cracks

Banner 2 1028x280 1708121730 1 1771599631

security advisorymalwaredetection

Defending Linux Systems Against Outlaw Malware's Botnet Threat

As a Linux security administrator, staying ahead of the latest threats is crucial to maintaining the safety, integrity, and performance of your systems. Recently, Elastic Security identified a persistent piece of malware known as Outlaw that employs effective yet straightforward tactics . . Outlaw leverages brute-force attacks and cryptojacking to establish a resilient botnet, persistently exploiting weak SSH practices to propagate and mine cryptocurrencies. Understanding its execution chain, from initial deployment to propagation and maintaining control, is essential for defending against Outlaw attacks. In this article, I'll dive into Outlaw's key indicators of compromise and provide practical advice on boosting your defenses against this persistent menace, ensuring your systems remain secure and performant! Understanding Outlaw Malware Outlaw is not your run-of-the-mill sophisticated piece of malware ; it sways more towards simplicity in its approach. Despite using such non-advanced methods, its persistence makes it particularly troublesome. Outlaw primarily exploits weak SSH configurations to infiltrate systems via brute-force attacks. Once it gains access, it manipulates SSH keys and establishes persistence using scheduled cron jobs. The goal? To create a long-lasting botnet capable of generating cryptocurrency through mining operations. Recognizing and understanding the behavior of Outlaw malware is the first step toward securing your systems. The malware follows a consistent execution chain. It all starts with the deployment of a script, leading to the download and extraction of the malware package. Once the malware is unpacked, its journey within your system begins. Outlaw terminates any competing brute-force or mining operations, takes control by deploying a modified mining software (usually XMRIG), and sets up an IRC-based command and control (C2) system to maintain communication with its operators. Outlaw's Execution Chain Explained Outlaw Infection Chain Outlaw's execution chain is systematic and has a clear pattern, making it identifiable if closely monitored. Outlaw initiates its invasive journey through a script dubbed tddwrt7s.sh, which typically fetches a compressed package known as dota3.tar.gz. Once decompressed, this package unravels the malware's core components. Following the deployment phase, Outlaw neutralizes competing processes that might similarly use system resources, such as other crypto miners or brute-forcers. With the environment sanitized, Outlaw next sets its sights on executing the initall.sh script, responsible for launching its activities. This script ensures that a modified version of the XMRIG mining software begins its operation. Outlaw employs an IRC-based C2 system to maintain long-term control, a somewhat old-school but effective method for remote communication and command execution. By coupling brute-force modules with the retrieval of target lists from the SSH C2 server, Outlaw coordinates additional brute-force attacks and compromises more systems, continuously expanding its botnet. Indicators of Compromise Identifying Outlaw's presence in your system often boils down to recognizing key indicators of compromise. One of the initial signs you might notice is a general sluggishness in system performance. Crypto miners, like the modified XMRIG used by Outlaw, consume a significant amount of CPU and GPU resources, leading to noticeable slowdowns. Another red flag is unusual network traffic, particularly to and from IRC servers. Outlaw's C2 communication is based on IRC, so being vigilant about outbound connections to known IRC servers can assist in early detection. You might also observe unfamiliar processes or scripts running, such as tddwrt7s.sh or other cryptically named scripts. The presence of such scripts, especially if they periodically kickstart themselves through hidden cron jobs, should be thoroughly investigated. A complete review of user accounts and cron jobs can also be revealing. Outlaw oftencreates unauthorized users with elevated privileges or injects hidden cron jobs that enable it to relaunch its components should they be terminated. Understanding these nuances can significantly aid in the early detection and subsequent neutralization of this malware. Practical Advice to Mitigate and Prevent Outlaw Malware Attacks Securing your Linux systems against Outlaw requires a multifaceted approach. First and foremost, hardening SSH configurations is imperative. Implement strong, unique passwords and consider entirely disabling root login. SSH key authentication offers a more secure alternative and should be enforced wherever possible. Moving your SSH service to a non-standard port can also reduce the likelihood of brute-force attacks. Also, the importance of regular system audits cannot be overemphasized. Checking for new or unauthorized users, scrutinizing cron jobs, and continuously monitoring system logs are critical practices. Network monitoring tools , such as intrusion detection systems (IDS), can uncover unusual traffic patterns, particularly those that indicate communication with known C2 IPs or IRC servers. Keeping your system and software up to date is another vital defensive measure. Like many other malware variants, Outlaw exploits known vulnerabilities that unpatched systems harbor. Using automated update systems can help ensure your system is always protected against the latest threats. Additionally, file integrity monitoring tools like Tripwire are essential in detecting unauthorized changes to critical system files and directories. By maintaining a baseline of your system state and regularly comparing current states to this baseline, these tools can detect even minor unauthorized changes indicative of a malware infection. User education also plays a pivotal role in your defense strategy. Users must understand the risks of weak passwords and the potential consequences of social engineering attacks that could lead to compromised SSH credentials. Regulartraining sessions and clear security policies can go a long way in strengthening your security posture. Finally, developing and maintaining an incident response plan ensures that if the worst does happen, you are prepared to respond quickly and effectively. This plan should include steps for isolating infected systems, eradicating the malware, and recovering any impacted services. Regular drills and updates to the plan will keep your response capabilities sharp and up-to-date. Our Final Thoughts on Mitigating the Outlaw Linux Malware Threat The Outlaw malware exemplifies how simplicity can be coupled with persistence to create a formidable threat. By leveraging straightforward brute-force attacks and cryptojacking, Outlaw establishes a resilient botnet capable of significantly impacting system performance and compromising system integrity. Understanding its execution chain and being vigilant about indicators of compromise are essential steps in defending against this malware. By hardening SSH configurations, conducting regular system audits, and employing network and file integrity monitoring, you can create a robust defense system that significantly reduces the risk of an Outlaw infection. Coupling these technical measures with user education and a well-prepared incident response plan ensures that your systems remain secure, even in the face of threats like Outlaw. Stay informed , stay vigilant, and remember: proactive defense is always your best bet in the ongoing battle against Linux malware! . Rogue software employs aggressive methods alongside unauthorized cryptocurrency mining to establish a continual risk for Linux environments. Discover protective measures!. Linux Malware Detection, Outlaw Threat Mitigation, Secure SSH Practices. . Brittany Day

Apr 03, 2025 •

Brittany Day Hacks/Cracks

security advisorymalwaresecurity threats

Kinsing Malware Threat: Impact on Linux Security and Admin Strategies

The Kinsing hacker group, or H2Miner, has been orchestrating illicit cryptocurrency mining campaigns since 2019 and poses a persistent security threat. The group continuously evolves its toolkit by integrating newly disclosed vulnerabilities to expand its botnet. . The Kinsing malware has targeted various operating systems, focusing significantly on Linux servers. The group leverages exploits in popular open-source applications such as Apache ActiveMQ, Apache Log4j , and Oracle WebLogic Server, among others, to breach vulnerable systems. By disabling security services and removing existing miners, Kinsing enrolls infected systems in its botnet for crypto-mining activities. Let's examine the implications of this threat for Linux admins so you are better equipped to secure your systems against it. Analyzing This Threat: What Are the Security Implications for Linux Admins? The Kinsing hacker group's ability to adapt and exploit vulnerabilities to expand their botnet raises concerns for Linux admins and organizations. With most targeted applications being open-source, the impact on runtime applications, databases, and cloud infrastructure cannot be underestimated. The fact that 91% of the targeted applications are open-source should trigger heightened security within organizations using Linux and open-source software . Security practitioners must assess and proactively address vulnerabilities in these systems. The persistence and agility of the Kinsing group is particularly noteworthy. The group quickly integrates newly disclosed vulnerabilities into its arsenal, allowing them to stay one step ahead of security measures. This highlights the need for constant vigilance and proactive measures to prevent threats like Kinsing. Linux admins and infosec professionals should continuously monitor and patch vulnerabilities in their systems to mitigate the risk of exploitation. What Are the Longterm Consequences of Kinsing Malware? The long-term consequences of Kinsing's activities should concerninternet security enthusiasts and sysadmins. The group's ability to disable security tools, terminate security components, and deploy rootkits raises questions about the effectiveness of current defense mechanisms. This discovery highlights the broader trend of botnet malware families broadening their reach and exploiting poorly secured servers. This trend, exemplified by the P2PInfect malware, indicates a need for stronger security measures to protect against such threats. For practical advice on protecting against Linux malware, explore this LinuxSecurity must-read article. Our Final Thoughts on the Kinsing Hacker Group's Malicious Activities The Kinsing hacker group's continuous evolution and exploitation of vulnerabilities to expand their botnet pose a significant threat to organizations, especially those utilizing Linux and open-source software. Linux admins must remain vigilant, patch vulnerabilities promptly, and proactively harden their systems. The international nature of this threat underscores the need for technical audiences worldwide to understand the techniques employed by Kinsing. Addressing these activities' implications and long-term consequences is essential for security practitioners to safeguard their organizations' systems and data. . The Mariposa virus represents a major risk for Windows systems, underscoring the need for robust safeguards and preventative strategies.. Kinsing Malware,Crypto Botnet,Linux Threats,Open Source Security,System Hardening. . Dave Wreski

Jun 03, 2024 •

Dave Wreski Hacks/Cracks

security practicesmalwarecyber threat

Ebury Malware Analysis: Key Risks for 400K Linux Servers

As cybersecurity practitioners, we are no strangers to the constant threat of malicious actors and the importance of remaining vigilant to protect our systems. Security researchers have identified a massive botnet comprising over 400,000 compromised Linux servers, reinforcing the need to stay alert and implement robust security measures. Let's examine the significance of this discovery and what we can learn from it to protect against future attacks. . Why Is the Ebury Malware So Significant? What Can We Learn from This Threat? According to researchers, the botnet has been active since at least 2009, demonstrating the tenacity and persistence of the threat group behind the Ebury malware . The botnet has evolved significantly over the past decade, employing various techniques to propagate the malware and expand its reach. For example, the Ebury gang has leveraged access to hosting companies’ infrastructure to install Ebury on all hosted servers, intercepted and redirected SSH traffic inside data centers to capture credentials, and automatically steals crypto wallets when victims log in. Of particular concern is the botnet's use for illicit financial gain, such as stealing financial data from transactional websites and cryptojacking to mine cryptocurrency on infected systems. Research also reveals the latest update to the Ebury malware family, version 1.8, which includes new ways to hide information, a new domain generation algorithm (DGA), and better userland rootkits that Ebury uses to hide from system admins. Linux admins must recognize the implications of these findings and take proactive steps to prevent compromise from the evolving Ebury threat. Maintaining patched systems and robust credential policies is critical, along with monitoring for indicators of compromise and implementing security best practices such as firewall configurations and regular software updates . Perhaps most importantly, we must remain vigilant and continue educating ourselves and others about the evolvingthreat landscape, ensuring we stay up-to-date with the latest security trends and techniques. Our Final Thoughts on the Ebury Malware The recent discovery of a massive botnet comprised of over 400,000 compromised Linux servers highlights the ongoing need for strong cybersecurity measures and constant vigilance. It is essential to recognize the evolving threat landscape and take proactive steps to prevent compromise, stay informed about the latest security trends, and educate others about the importance of security best practices. Failure to take such measures could have severe long-term consequences that could put sensitive financial and other data at risk. . The Ebury malware poses a major risk to Linux security, exploiting its botnet capabilities and increasing Linux-targeted attacks, emphasizing the need for better defenses. Ebury Botnet, Linux Malware, Cyber Threats, Cryptojacking, Server Security. . Brittany Day

Jun 03, 2024 •

Brittany Day Hacks/Cracks

malwaresecurity measurebotnet

NoaBot: SSH Brute-Force Attack on Linux Servers - Cryptomining Risk

Over the last year, a new botnet slowly grew by brute-forcing SSH passwords and installing cryptomining malware onto Linux servers. The main client of the botnet is based on an old Mirai virus whose source code was available for many years. However, researchers have seen that the same group has also used the more recent P2PInfect malware, which exploits Redis instances. . According to security researchers, the botnet began in January 2023. However, it has grown significantly since then, reaching its peak last month. More than 800 unique IPs from around the globe that showed signs of NoaBot infection were recorded, with 10% of those being based in China. The researchers said that the malware uses a simple SSH credential dictionary attack to move laterally. Restricting internet SSH access greatly reduces the risk of infection. The use of strong passwords (not the default or randomly generated ones) also helps to secure your network since malware is able to guess passwords from a list. Modified Mirai Scanner Targets SSH Mirai is a self-propagating DDoS Botnet that first appeared in 2016. It was designed to infect embedded network devices using Telnet dictionary attacks and vulnerability exploits. The botnet was known for being the source of some of the biggest DDoS attacks on the internet. In recent years, the Mirai codebase, which includes a scanning module to propagate, an attack module, and persistence code used to hide botnet processes, has inspired many other Linux self-propagating botnets. Some focused on DDoS , while others were cryptomining. NoaBot was developed by NoaBot creators, who took Mirai's source code and made some significant changes. They replaced the Telnet scan with an SSH scan. It makes sense because embedded devices that still use Telnet for command-line debugging and administration are not good targets for cryptomining. This is due to the limited computing power of these devices. Linux servers, on the other hand, are good targets and more likely to beSSH-enabled. SSH dictionary attacks, where an attacker tests predefined usernames and passwords, are not new. They are easy to defend against if you follow best security practices, such as using SSH key-based authentication and disabling password authentication. The servers that were compromised by NoaBot would be considered low-hanging fruits from a security standpoint. It wouldn't surprise us if the servers had already been infected with malware. NoaBot SSH scan has a clear signature because the botnet client will send the message "hi" when an address accepts an SSH. This isn't a valid SSH Command, and there isn't a practical reason to send this. Therefore, it can be used as a firewall signature. NoaBot has also been modified by changing its compiler from GCC (to uClib) to significantly alter the binary code, allowing it to be detected differently than Mirai. It also added command-line arguments to enable various functionalities. The bot, for example, can include an attacker-controlled SSH key to ensure persistence, even if password authentication is disabled. It also acts as a backup by downloading and adding additional binaries, and it adds an entry in crontab to ensure that it starts up after reboot. This persistence mechanism's command-line flag is "noa," which inspired the name of the Botnet. Researchers found signatures for "noa" in antivirus engines, which indicates that it is a common prefix. Cryptominer Modification and P2PInfect Connection The cryptomining component of the NoaBot is XMRig. This is an open-source, widely used cryptocurrency miner that is popular among attackers. Akamai researchers claim that the NoaBot creators modified the XMRig program code to conceal and encrypt the configuration. This included the IP address of the mining pool, where the attackers collect their cryptocurrency. "We believe the threat actors have chosen to run their private pool rather than a public pool. This eliminates the need to specify the wallet (their pool and theirrules! Researchers said. The researchers said, "In our samples, we noticed that the miner's sites were no longer resolvable with Google's DNS. We can't prove our theory or collect more data because the domains are unresolved." There haven't been any recent incidents that drop the miner. It could be that the threat actor decided to leave for "greener pastures." Researchers are confident that the same authors also use a customized version. This self-replicating virus appeared in July, and it is written in Rust. The NoaBot code also included some P2PInfect samples that contained inside jokes and text. P2PInfect uses a Lua flaw to compromise Redis instances, which is an in-memory system. variants may also contain an SSH scan. This group of attackers is not sure why they switched from Mirai, which was a more customized creation, to P2PInfect. Or if they're using both at the same time. Researchers said that custom code was more difficult to reverse-engineer than repurposed codes because it has been modified. Second, since the threat actors are tech-savvy, they may try to develop malware out of boredom or curiosity. P2PInfect is a tool that targets Redis servers. It could be different tools being used for different purposes. How Can I Secure My Servers Against This Threat? To protect against this threat and enhance the security of your servers, SSH access should be restricted to trusted IP addresses, and key-based authentication is recommended as part of SSH hardening. Have additional questions about securing your Linux servers? Please reach out to us on X @lnxsec - we're here to help! Stay safe out there, fellow Linux users! . Digital threat WatchDog focuses on Linux servers through SSH brute-force intrusions, signaling analysts about the potential for illicit cryptomining activities.. NoaBot Threat, SSH Attack Prevention, Cryptomining Botnet, Linux Security Practices, Mirai Malware. . LinuxSecurity.com Team

Jan 10, 2024 •

LinuxSecurity.com Team Server Security

malwarecybercrimelaw enforcement

FBI Dismantles IPStorm Botnet Infrastructure: A Major Cyber Victory

The Federal Bureau of Investigation (FBI) dismantled the infrastructure behind the illegal botnet proxy service IPStorm. . The IPStorm botnet was first uncovered in May 2019 while targeting Windows systems, not experts from Intezer reported that the bot evolved to infect other platforms, including Android, Linux, and Mac devices. IPStorm botnet continues to infect systems across the world, its size passed from around 3,000 infected systems in May 2019 to more than 13,500 devices in October 2020. The name IPStorm is the abbreviation of InterPlanetary Storm that came from the InterPlanetary File System ( IPFS ), which is a peer-to-peer protocol used by the bot for communications with the intent to obscure the malicious traffic. . The neutralization of PhantomNet, a nefarious network targeting various systems, marks a significant achievement in the realm of digital security efforts.. IPStorm Botnet,Cybercrime,Law Enforcement,Cybersecurity Initiatives,Malware. . Brittany Day

Nov 17, 2023 •

Brittany Day Government

network securitycybercrimebotnet

US Dismantles IPStorm Botnet and Arrests Admin for Cybercrime

The US authorities have shut down a major botnet comprising tens of thousands of infected endpoints, which cyber-criminals hired to launch various attacks anonymously. . The IPStorm botnet and its infrastructure were dismantled earlier this year, according to the Department of Justice (DoJ). Its alleged administrator, Russian and Moldovan national Sergei Makinin, pleaded guilty back in September to three counts of fraud and related activity in connection with computers. Each count carries a maximum sentence of 10 years. The botnet operated from June 2019 to December 2022, turning compromised Windows, Linux, Mac and Android devices from around the world into proxies. These could then be rented out by cyber-criminals through two of Makinin’s websites: proxx.io and proxx.net. . The dismantling of the CloudTrace malware network underscores the persistent battle against digital crime by American law enforcement.. IPStorm Botnet, Cybercrime Enforcement, Infected Devices, Botnet Dismantle. . LinuxSecurity.com Team

Nov 15, 2023 •

LinuxSecurity.com Team Hacks/Cracks

Community Poll

More Polls

Stay Ahead With Linux Security News

Refine news

Get the latest News and Insights

Community Poll

Is continuous patching actually viable?

Trending News

Misuse of Cron Jobs for Long-Term Access in Linux Environments

MXDR Provider Selection for Linux Environments and Security Services

Risks of GitHub Repo Breach on Linux Supply Chain Security

After Years of Supply Chain Attacks, npm Is Finally Closing the Door on Auto-Scripts

Explore Latest Linux Security news

SocksEscort Linux Router Malware Botnet Takedown Operation Lightning

XorDDoS Malware Overview: Threats to Linux, IoT, and Botnet Formation

Defending Linux Systems Against Outlaw Malware's Botnet Threat

Kinsing Malware Threat: Impact on Linux Security and Admin Strategies

Ebury Malware Analysis: Key Risks for 400K Linux Servers

NoaBot: SSH Brute-Force Attack on Linux Servers - Cryptomining Risk

FBI Dismantles IPStorm Botnet Infrastructure: A Major Cyber Victory

US Dismantles IPStorm Botnet and Arrests Admin for Cybercrime

Get the latest News and Insights

Community Poll

Is continuous patching actually viable?

Trending News

Misuse of Cron Jobs for Long-Term Access in Linux Environments

MXDR Provider Selection for Linux Environments and Security Services

Risks of GitHub Repo Breach on Linux Supply Chain Security

After Years of Supply Chain Attacks, npm Is Finally Closing the Door on Auto-Scripts

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!

Stay Ahead With Linux Security News

Refine news

Topics

Category

Authors

Published Date

Get the latest News and Insights

Community Poll

Is continuous patching actually viable?

Trending News

Explore Latest Linux Security news

Get the latest News and Insights

Community Poll

Is continuous patching actually viable?

Trending News

Search Topics

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!