‘Outlaw’ threat actor uses Shellbot variant to form new botnet

guest · Nov 2, 2018

‘Outlaw’ threat actor uses Shellbot variant to form new botnet
November 1, 2018
https://www.scmagazine.com/home/sec...tor-uses-shellbot-variant-to-form-new-botnet/

An unknown threat actor has been targeting organizations with botnet malware that communicates with its command-and-control server via the Internet Relay Chat application layer protocol.

Nicknamed Outlaw, the hacking group developed the botnet as a Perl language-based variant of Shellbot, according to a Nov. 1 blog post from Trend Micro, whose researchers uncovered the threat. Shellbot is a trojan horse malware that’s typically installed on computers via the Shellshock Unix Bash shell vulnerability that was found back in 2014.

In this case, however, the Perl Shellbot attackers are instead infecting victims via a command injection vulnerability that’s commonly found on IoT devices and Linux servers, but can also affect Windows environments and Android devices. They are also distributing the malware through previously brute-forced or compromised hosts, Trend Micro notes.
Click to expand...

guest · Nov 19, 2018

Outlaw Group Distributes Botnet for Cryptocurrency-Mining, Scanning, and Brute-Force
November 19, 2018
https://blog.trendmicro.com/trendla...yptocurrency-mining-scanning-and-brute-force/

This follow-up post covers a host part of the botnet operated by the group, which we found attempting to run a script on our IoT honeypot.

The script used in the first version of its bot has two functionalities: the miner and Haiduc-based dropper.
The second variant of the code, distributed by the bot, was mainly designed to brute force and further exploit the Microsoft Remote Desktop Protocol and cloud administration cPanel in order to escalate the privileges. [...]
Conclusion and solutions
First it seemed that the goal of the Outlaw group is to build an infrastructure capable of distributed denial of service (DDoS) against many known companies. Later, they have also facilitated brute forcing the SSH so they could grow the botnet further.

Then the cryptocurrency mining started, with the latest discovery described in this blog that RDP and cPanel brute-force are also in the scope of the group’s operation.
Click to expand...

guest · Feb 5, 2019

Outlaw Shellbot infects Linux servers to mine for Monero
Linux machines are being abused in Outlaw cryptojacking attacks
February 5, 2019
https://www.zdnet.com/article/outlaws-shellbot-infects-servers-for-monero-mining/

The Outlaw group is conducting an active campaign which is targeting Linux systems in cryptocurrency mining attacks.
The campaign uses a refined version of Shellbot, a Trojan which carves a tunnel between an infected system and a command-and-control (C2) server operated by threat actors.

The cybersecurity researchers note that Shellbot has the capacity to affect Windows environments and Android devices, too, but such infections are uncommon.
The threat actors target organizations through denial-of-service (DoS) and SSH brute-force techniques. If servers are compromised, their strength is added to the Outlaw botnet to carry on the campaign.

The toolkit belonging to Outlaw is now also making use of a Perl-based IRC bot which has been identified as a new version of Shellbot bolstered by Perl's pack routine for the purposes of obfuscation.
Click to expand...

guest · May 1, 2019

Shellbot malware evolves to spread and shuts down other cryptominers
May 1, 2019
https://techcrunch.com/2019/05/01/shellbot-malware-evolves/

New research out Wednesday by Boston-based security firm Threat Stack shared exclusively with TechCrunch reveals a new variant of the Shellbot malware is taking a leaf out of the other cryptocurrency mining by breaking into computers and using their resources to make money.

Shellbot, first written about by Jask in February, now uses an old but reliable SSH brute force technique to break into internet-connected Linux servers with weak passwords to infect a system and mine cryptocurrency.
But now Threat Stack says the malware has new capabilities allowing it to spread through a network and shut down other cryptominers on infected computers, allowing the malware to free up more processing power for its own cryptomining operation.

According to the MoneroHash campaign, the malware was making about $300 a day — or $8,000 in total. But the more servers infected, the greater the cryptomining returns will be.
Click to expand...

Threat Stack: The Continuing Evolution of the Shellbot Cryptomining Malware

guest · Jun 13, 2019

mood said: ↑

Outlaw Group Distributes Botnet for Cryptocurrency-Mining, Scanning, and Brute-Force
November 19, 2018
https://blog.trendmicro.com/trendla...yptocurrency-mining-scanning-and-brute-force/
Click to expand...

Outlaw hackers return with cryptocurrency mining botnet
June 13, 2019
https://www.zdnet.com/article/outlaw-hackers-return-with-cryptocurrency-mining-bot/

The Outlaw hacking group has reemerged and is once again on the radar of cybersecurity researchers following the detection of a botnet attacking systems to mine for cryptocurrency.
The botnet spreads a miner for Monero (XMR), Trend Micro said in a blog post on Thursday.

To begin the infection chain, Outlaw attempts to brute-force systems via SSH. A shell script is then deployed which downloads and executes the miner payload, as well as extract a TAR file which contains additional malicious scripts and backdoor.
In addition, there are scripts which are able to detect rival miners already installed on a target system and, if necessary, delete them to eradicate competing forces when CPU power is stolen during mining operations.

The presence of an APK, as of yet unused, suggests that Android may be the next operating system Outlaw will try to attack.
Click to expand...

guest · Feb 12, 2020

Outlaw hacking group kills existing cryptocurrency miners in enterprise server attacks
A recent update also revealed a pivot towards corporate systems with weak patch management practices
February 11, 2020
https://www.zdnet.com/article/outla...currency-miners-in-enterprise-server-attacks/

The Outlaw hacking group has remerged after months of quiet with an upgraded toolset designed for data theft and for plundering enterprise resources in the quest for cryptocurrency.
Outlaw, first spotted back in 2018, is a threat group that has been in testing and malware development stages over the past year.

The botnet is equipped with a Monero (XMR) miner and following a period of inactivity has now been bolstered with improvements, including the ability to find and eradicate existing cryptocurrency miners on infected systems.
Trend Micro observed an uptick in activity in December, in which attacks moved from the Chinese testing ground to the US and Europe, the cybersecurity firm said in a blog post on Monday.
Click to expand...

Currently, Outlaw is exploring CVE-2016-8655 and the Dirty COW exploit (CVE-2016-5195) as potential entryways for exploit kits, alongside PHP-based web shells used to try and crack servers with poor SSH and Telnet credentials.

"It appears that they're going after enterprises who have yet to patch their systems, as well as companies with Internet-facing systems with weak to no monitoring of traffic and activities," the researchers say.
Click to expand...

Trend Micro: Outlaw Updates Kit to Kill Older Miner Versions, Targets More Systems

The Shellbot script is added to run after the victim’s system reboots [...]
Shellbot is also used to control the botnet, with a command that is sent and run from the C&C to determine if there is a code execution in the shell, the hostname, and its architecture. All results and system information collected from the infected system are stored locally in the device for a period before Outlaw retrieves them via the C&C.
Conclusion
Since discovering the operations of this group in 2018, Outlaw continues to use scripts, codes, and commands that have been previously used and deployed.
Considering the amount of resources needed to deploy all the necessary patches for an enterprise (such as quality testing and operations alignment), which implies costly downtime for operations and the hesitation to update all systems immediately, Outlaw may find even more targets and victims for their updated botnets every time there is a patch released and waiting to be downloaded.
Click to expand...

Log in or Sign up

‘Outlaw’ threat actor uses Shellbot variant to form new botnet

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

‘Outlaw’ threat actor uses Shellbot variant to form new botnet

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches