Hackers infect Linux SSH servers with Tsunami Botnet Malware

Summary: [emaillocker id="1283"]

 A mysterious actor is engaging in brute-force attacks on Linux SSH servers with the intention of deploying various types of malwares. This includes the Tsunami DDoS bot, ShellBot, tools for cleaning logs, tools for privilege escalation, and an “XMRig” coin miner designed for mining Monero. A recent discovery by researchers unveiled a campaign in which Linux servers were compromised to orchestrate DDoS attacks and engage in the mining of Monero cryptocurrency. The attackers conducted scans across the Internet to identify publicly exposed Linux SSH servers, subsequently employing brute-force techniques to guess username-password combinations and gain unauthorized access to the targeted servers.

Upon successfully establishing themselves as admin users on the compromised endpoints, the attackers proceeded to execute a series of commands through a Bash script, fetching and deploying a variety of malware onto the affected systems. Observations revealed that the intruders took additional measures by generating a fresh set of public and private SSH keys for the compromised server. This allowed them to maintain access to the system even if the user password was altered or modified. The malware that was downloaded onto the compromised hosts encompassed a range of malicious software, including DDoS botnets, log cleaning utilities, cryptocurrency miners, and tools designed to facilitate privilege escalation.

ShellBot, the initial malware of interest, is a Perl-based DDoS bot that relies on the IRC protocol for communication. This bot exhibits a wide range of capabilities, including port scanning, UDP, TCP, and HTTP flood attacks. Additionally, it is capable of establishing a reverse shell, providing the attacker with remote access to the compromised system. Another DDoS botnet malware encountered in these attacks is Tsunami. Similar to ShellBot, Tsunami also employs the IRC protocol for communication. To ensure persistence even after system reboots, Tsunami deploys a technique by writing itself onto the "rc.local" file. Moreover, it disguises itself by adopting common system process names, effectively concealing its presence and making it more challenging to detect. In addition to carrying out SYN, ACK, UDP, and random flood DDoS attacks, Tsunami boasts a comprehensive repertoire of remote-control commands. These commands encompass various functionalities such as executing shell commands, establishing reverse shells, gathering system information, updating its own components, and downloading supplementary payloads from external sources.

Next on the list are the MIG Logcleaner v2.0 and Shadow Log Cleaner. These tools serve the purpose of eradicating traces of intrusion on compromised computers, effectively reducing the likelihood of victims swiftly detecting the infection. These tools provide operators with specific command arguments that empower them to delete logs, manipulate existing logs, or introduce new logs into the system as per their requirements. The privilege escalation malware employed in these attacks takes the form of an ELF file. By leveraging this malware, the attackers can elevate their privileges to that of a root user, granting them extensive control over the compromised system. As a final step, the threat actors initiate the activation of an “XMRig” coin miner. This miner hijacks the computational resources of the compromised server, redirecting them towards the mining of Monero cryptocurrency on a designated mining pool.

SSH is widely utilized by network administrators for remote management of Linux devices. It facilitates various essential tasks including executing commands, modifying configurations, updating software, and troubleshooting issues. Unfortunately, if proper security measures are not in place, poorly secured servers are susceptible to brute force attacks. To safeguard against these attacks, Linux users should prioritize strong account passwords as a fundamental security measure. In addition, it is crucial to disable root login via SSH to bolster security measures. Furthermore, restricting the range of permitted IP addresses that can access the server adds an extra layer of protection.

Threat Profile:

References:

The following reports contain further technical details:

https://www.bleepingcomputer.com/news/security/hackers-infect-linux-ssh-servers-with-tsunami-botnet-malware/