Botnet Operators Abusing Legit GitHub, Pastebin Resources

guest · Nov 6, 2020

Reverse shell botnet Gitpaste-12 spreads via GitHub and Pastebin
November 6, 2020
https://www.bleepingcomputer.com/ne...-gitpaste-12-spreads-via-github-and-pastebin/

A newly discovered worm and botnet named Gitpaste-12 lives on GitHub and also uses Pastebin to host malicious code.

The advanced malware comes equipped with reverse shell and crypto-mining capabilities and exploits over 12 known vulnerabilities, therefore the moniker.
Spreads via GitHub, attacks in 12 different ways
Gitpaste-12 was first detected by Juniper Threat Labs lurking on GitHub around October 15th.

However, commits reveal the malware has lived on GitHub since Jul 9th, 2020 until its shut down after Oct 27th, 2020.
11 of these vulnerabilities are as follows, with the 12th one stemming from a Telnet brute force application used to spread Gitpaste-12: [...]
Click to expand...

Gitpaste-12 has a low detection rate
Considering the recency of its discovery, some files associated with the Gitpaste-12 botnet have quite a low detection rate.

At the time of writing, BleepingComputer observed the hide.so payload which aids Gitpaste-12 in evading detection was itself undetectable by over 93% antivirus engines.
Similarly, the crypto miner configuration file and the shell script has not yet been flagged by any antivirus engine listed on VirusTotal, as observed by BleepingComputer: [...]
Click to expand...

"There is evidence of test code for possible future modules, indicating ongoing development for this malware. For now, however, targets are Linux based x86 servers, as well as Linux ARM and MIPS based IoT devices," stated the report released by Juniper Threat Labs.
The researchers noted some compromised systems had TCP ports 30004 and 30005 open for receiving commands via reverse shells.
Click to expand...

Juniper Threat Labs: Gitpaste-12: a new worming botnet with reverse shell capability spreading via GitHub and Pastebin

The first phase of the attack is the initial system compromise (note the details of compromises used by this worm will be discussed later in this piece). This worm has 12 known attack modules and more under development. The worm will attempt to use known exploits to compromise systems and may also attempt to brute force passwords.

Immediately after compromising a system, the malware sets up a cron job it downloads from Pastebin, which in turn calls the same script and executes it again each minute. This is presumably one mechanism by which updates to the cron jobs can be pushed to the botnet.
The malware begins by preparing the environment. This means stripping the system of its defenses, including firewall rules, selinux, apparmor, as well as common attack prevention and monitoring software. [...]
Click to expand...

guest · Dec 15, 2020

Gitpaste-12 Worm Widens Set of Exploits in New Attacks
December 15, 2020
https://threatpost.com/gitpaste-12-worm-widens-exploits/162290/

The Gitpaste-12 worm has returned in new attacks targeting web applications, IP cameras and routers, this time with an expanded set of exploits for initially compromising devices.

First discovered in a round of late-October attacks that targeted Linux-based servers and internet-of-things (IoT) devices, the botnet utilizes GitHub and Pastebin for housing malicious component code, has at least 12 different attack modules and includes a cryptominer that targets the Monero cryptocurrency.
Click to expand...

Now, researchers have uncovered a new slew of attacks by the malware, starting on Nov. 10, which used a different GitHub repository to target web applications, IP cameras, routers and more.

“The wave of attacks used payloads from yet another GitHub repository, which contained a Linux cryptominer (‘ls’), a list of passwords for brute-force attempts (‘pass’) and a statically linked Python 3.9 interpreter of unknown provenance,” said researchers with Juniper Threat Labs in a Tuesday analysis.
Click to expand...

The first phase of the worm’s initial system compromise still leverages previously-disclosed vulnerabilities. However, a new sample discovered in Gitpaste-12’s initial attack repository shows that the worm has expanded the breadth of those attack vectors.
Gitpaste-12 now also attempts to compromise open Android Debug Bridge connections and existing malware backdoors, said researchers.
Click to expand...

Juniper Threat Labs: Everything but the kitchen sink: more attacks from the Gitpaste-12 worm

In this blog, we’ll dig deeper into some newly-found samples from the initial attack repository.
Click to expand...

Log in or Sign up

Botnet Operators Abusing Legit GitHub, Pastebin Resources

guest Guest

guest Guest

Log in or Sign up

Botnet Operators Abusing Legit GitHub, Pastebin Resources

guest Guest

guest Guest

Useful Searches