Kaiji, a new Linux malware targets IoT devices in the wild

guest · May 5, 2020

Kaiji, a new Linux malware targets IoT devices in the wild
DDoS bot dubbed Kaiji that is targeting IoT devices via SSH brute-force attacks
May 5, 2020
https://securityaffairs.co/wordpress/102753/malware/kaiji-linux-iot-malware.html

Last week, the popular security researcher MalwareMustDie and the experts at Intezer Labs spotted a new piece of malware dubbed Kaiji, that is targeting IoT devices via SSH brute-force attacks.

The malicious code was designed to target Linux-based servers and Internet of Things (IoT) devices and use them as part of a DDoS botnet.
The Kaiji malware is different from other IoT ELF malware, it is written from scratch in the Go programming language, and its detection rate at the time of discovery was only 1.

“In late April we identified a new botnet campaign with definitive Chinese origins,targeting servers and IoT devices via SSH brute forcing. While most attackers derive their implants from popular and well-tested sources such as open source (e.g., Mirai) or blackmarket toolsets (e.g., BillGates), this botnet utilizes its own custom implant, which MalwareMustDie named Kaiji based on one of the function names.” reads the analysis published by Intezer.
Click to expand...

The Kaiji botnet doesn’t leverage exploits to spread, instead, it carries out brute-force attacks against the root of IoT devices and Linux servers that have left their SSH port exposed online.

The malware is quite simple, it implements multiple DDoS attacks, it includes a module to conduct SSH brute-force attacks and steal SSH keys used to spreads to other devices to infect hosts that the server has connected to in the past.
The Kaiji botnet is clearly a work-in-progress, the source code includes “demo” strings and the rootkit module would often call itself too many times and exhaust the device’s memory, resulting in the crash of the devices.
Click to expand...

Intezer: Kaiji: New Chinese Linux malware turning to Golang

Conclusion
It is rare to see a botnet written from scratch, considering the tools readily available to attackers in blackmarket forums and open source projects. In this post we have uncovered a new DDoS operation in its early stages that was written from scratch. This is another confirmation of an interesting trajectory noted by vendors such as Palo Alto that malware developers are turning to modern languages such as Golang for their operations.
Click to expand...

Log in or Sign up

Kaiji, a new Linux malware targets IoT devices in the wild

guest Guest

Log in or Sign up

Kaiji, a new Linux malware targets IoT devices in the wild

guest Guest

Useful Searches