KmsdBot, a new evasive bot for cryptomining activity and DDoS attacks

guest · Nov 17, 2022

By Pierluigi Paganini - November 14, 2022

Akamai Security Research discovered a new evasive Golang-based malware, tracked as KmsdBot, that infects systems via an SSH connection that uses weak login credentials.

The malware was employed in cryptocurrency mining campaigns and to launch denial-of-service (DDoS) attacks. KmsdBot supports multiple architectures, including as Winx86, Arm64, and mips64, x86_64, and does not stay persistent to avoid detection.
Click to expand...

The malicious code was used in attacks targeting multiple sectors including the gaming industry, technology industry, and luxury car manufacturers. The first DDoS attack observed by Akamai targeted a gaming company named FiveM, which allows gamers to host custom private servers for Grand Theft Auto Online. The malware employed specific targeted attacks along with generic Layer 4 and Layer 7 attacks.

“we found an interesting log entry: A cryptominer with distributed denial-of-service (DDoS) functionality tailored to the gaming industry. It’s not often we see these types of botnets actively attacking and spreading, especially ones written in Golang.” reads the post published by Akamai. “The targets range from gaming companies to luxury car brands to security companies — this malware is almost erratic with regard to its targets.”
Click to expand...

Akamai: KmsdBot: The Attack and Mine Malware

November 10, 2022
Executive Summary

Akamai Security Research has observed a new malware that infected our honeypot, which we have dubbed KmsdBot.

The botnet infects systems via an SSH connection that uses weak login credentials.

It is written in Golang, an increasingly common language for attackers because of the difficulty of reverse engineering.

Click to expand...

The malware attacks using UDP, TCP, HTTP POST, and GET, along with a command and control infrastructure (C2), which communicates over TCP.

The malware does not stay persistent on the infected system as a way of evading detection.

The malware has varied targets including the gaming industry, technology industry, and luxury car manufacturers.

The botnet also has the ability to mine cryptocurrencies.

The malware supports multiple architectures, such as Winx86, Arm64, and mips64, x86_64.

Click to expand...

Log in or Sign up

KmsdBot, a new evasive bot for cryptomining activity and DDoS attacks

guest Guest

Log in or Sign up

KmsdBot, a new evasive bot for cryptomining activity and DDoS attacks

guest Guest

Useful Searches