Abcbot — A New Evolving Wormable Botnet Malware Targeting Linux

guest · Nov 12, 2021

Abcbot — A New Evolving Wormable Botnet Malware Targeting Linux
November 11, 2021
https://thehackernews.com/2021/11/abcbot-new-evolving-wormable-botnet.html

Researchers from Qihoo 360's Netlab security team have released details of a new evolving botnet called "Abcbot" that has been observed in the wild with worm-like propagation features to infect Linux systems and launch distributed denial-of-service (DDoS) attacks against targets.

While the earliest version of the botnet dates back to July 2021, new variants observed as recently as October 30 have been equipped with additional updates to strike Linux web servers with weak passwords and are susceptible to N-day vulnerabilities, including a custom implementation of DDoS functionality, indicating that the malware is under continuous development.
Click to expand...

Netlab's findings also build on a report from Trend Micro early last month, which publicized attacks targeting Huawei Cloud with cryptocurrency-mining and cryptojacking malware.

Now according to the Chinese internet security company, these shell scripts are being used to spread Abcbot. A total of six versions of the botnet have been observed to date.

"The update process in these six months is not so much a continuous upgrade of features as a trade-off between different technologies," the researchers concluded. "Abcbot is slowly moving from infancy to maturity. We do not consider this stage to be the final form, there are obviously many areas of improvement or features to be developed at this stage."
Click to expand...

guest · Dec 21, 2021

New Abcbot botnet goes after Chinese cloud providers
December 21, 2021

Security researchers have spotted a new malware botnet that, over the past few months, has specifically targeted the infrastructure of Chinese cloud hosting providers.

Named Abcbot, the botnet has targeted servers hosted by companies like Alibaba Cloud, Baidu, Tencemt, and Huawei Cloud, Cado Security said in a report today, echoing previous findings from Trend Micro and Qihoo 360 Netlab.

“My theory is that the newer CSPs such as Huawei Cloud, Tencent and Baidu are not as mature as something like AWS, which includes automatic alerting when a cloud instance is deployed in an insecure fashion,” Matt Muir of Cado Security told The Record in an email this week.
Click to expand...

Abcbot’s attacks typically target Linux servers hosted by these companies that are secured with weak passwords or are running unpatched applications.

Once an initial entry point is found, Abcbot deploys a Linux bash script that disables SELinux security protections, creates a backdoor for the attacker, and then scans the infected hosts for signs of other malware botnets.
Muir said that Abcbot samples analyzed by Cado researchers only contained functionality to corral infected systems as part of Abcbot’s botnet.
Click to expand...

Taking into consideration the steps Abcbot took to kill crypto-mining processes it did not spawn itself; it may be that its final purpose is to generate cryptocurrency profits for the attackers after all.

Right now, the size of the Abcbot botnet is still unknown to Cado and other researchers.

“Given that the malware targets specific CSPs, this suggests that propagation is fairly limited,” Muir said.
Click to expand...

Cado Security: The Continued Evolution of Abcbot

A new version of a malicious shell script targeting insecure cloud instances running under Cloud Service Providers such as Tencent, Baidu and Alibaba Cloud has recently been discovered. The shell script prepares the target host for additional compromise over SSH, kills off processes from competing threat actors and persists itself, before downloading an additional ELF executable used to connect to a botnet as part of a campaign dubbed by 360Netlab as “Abcbot”.
Click to expand...

guest · Jan 10, 2022

Abcbot DDoS Botnet Linked to Older Cryptojacking Campaign
January 10, 2022

Xanthe was designed to hijack a computer’s resources to mine for cryptocurrency (it uses XMRig for this), while Abcbot packs distributed denial-of-service (DDoS) capabilities, which shows that the threat actor shifted objectives to activities traditionally associated with botnets.

Abcbot was initially observed in July 2021, when it mainly contained scanning capabilities, with the DDoS functionality added in October, through the implementation of the open source ATK rootkit.
After taking a closer look at the botnet’s code and infrastructure, Cado’s security researchers discovered a close connection with Xanthe, and concluded that the same threat actor is responsible for both malware families.
Click to expand...

Both malware families, Cado says, create on the infected systems four malicious users that have the exact same names, and both search for and remove users likely associated with competing malware (some of the removed users were used by the threat actors in previous campaigns).

“If the same threat actor is behind both campaigns, it signals a shift away from the objective of mining cryptocurrency on compromised hosts onto activities more traditionally associated with botnets – such as DDoS attacks. We suspect this won’t be the last malware campaign we analyze from this actor,” Cado Security concludes.
Click to expand...

Cado Security: Abcbot - An Evolution of Xanthe

Abcbot, the emerging botnet that we recently analyzed and reported on, has a longer history than we first thought. Our continued analysis on this malware family reveals a clear link with the Xanthe-based cryptojacking campaign discovered by Cisco’s Talos security research team in late 2020. Researchers at Talos discovered malware resembling a cryptocurrency mining bot when they were alerted to an intrusion on one of their Docker honeypots.
Click to expand...

Log in or Sign up

Abcbot — A New Evolving Wormable Botnet Malware Targeting Linux

guest Guest

guest Guest

guest Guest

Log in or Sign up

Abcbot — A New Evolving Wormable Botnet Malware Targeting Linux

guest Guest

guest Guest

guest Guest

Useful Searches