This unusual Windows malware is controlled via a P2P network

guest · Jun 11, 2019

This unusual Windows malware is controlled via a P2P network
Researchers have detailed the newly uncovered malware, but it's still uncertain what the goal of the botnet campaign is
June 11, 2019
https://www.zdnet.com/article/this-unusual-windows-malware-is-controlled-via-a-p2p-network/

A new malware campaign aimed at Windows machines features a novel technique to control the resulting botnet, with the group behind it hiding their communications using a P2P network.
Dubbed IPStorm – short for InterPlanetary Storm – by its cyber criminal operators, the campaign was discovered in May. It's possible that the author has taken inspiration for the name from Storm – a P2P worm campaign which became notorious after it first emerged in 2007.

By using a legitimate p2p network, the malware can hide its network traffic among legitimate p2p network traffic.
The IPFS is an open source P2P file-sharing network which aims to act as a means of sharing and storing files, with users downloading and hosting content in a decentralised system.

Written in the Go programming language, it's still uncertain how IPStorm begins its initial infections, but the size of the malware package means the code is split into multiple parts. This indicates that the attackers are well versed in software development because this makes the malware simpler to manage and update.
Click to expand...

IPStorm also comes build with several antivirus evasion techniques, such as sleeping and memory allocations to remain undetected after it has found its way onto a Windows system and installed itself inside a folder from a pre-determined list,
In the analysis of the malware, researchers note that while IPStorm is only targeting Windows systems for now, metadata in the malware samples suggests the attackers are potentially in the process of compiling it to infect other operating systems.
Click to expand...

Anomali: The InterPlanetary Storm: New Malware in Wild Using InterPlanetary File System’s (IPFS) p2p network

guest · Oct 1, 2020

New Malware variant threatens smart devices in 84 different countries
October 1, 2020
https://www.pcr-online.biz/2020/10/...tens-smart-devices-in-84-different-countries/

A new variant of the InterPlanetary Storm malware has infected roughly 13,500 machines across 84 different countries and counting, says email security firm Barracuda Networks in their September Threat Spotlight research.

The malware, named InterPlanetary Storm, was initially uncovered in May 2019 as a malicious attack designed to target Windows machines. This new variant, which Barracuda researchers first detected in late August, is now also targeting IoT devices, such as TVs that run on Android operating systems, and Linux-based machines, such as routers with ill-configured SSH service.
Click to expand...

It spreads using SSH (Soft Shell) brute force and open ADB ports, and it serves malware files to other nodes in the network. The malware also enables reverse shell and can run bash shell.

Fleming Shi, CTO for Barracuda Networks, said: “This new variant of malware is extremely infectious and malicious, and it’s very likely that it will spread beyond the 84 countries which have already been impacted.
Click to expand...

Barracuda: Threat Spotlight: New InterPlanetary Storm variant targeting IoT devices

New variant of InterPlanetary Storm malware — This new malware variant gains access to machines by running a dictionary attack against SSH servers, similar to FritzFrog, another peer-to-peer (p2p) malware. It can also gain entry by accessing open ADB (Android Debug Bridge) servers. The malware detects the CPU architecture and running OS of its victims, and it can run on ARM-based machines, an architecture that is quite common with routers and other IoT devices.
Click to expand...

guest · Oct 16, 2020

Interplanetary Storm Botnet Shows Signs of Anonymization-Purpose Proxy-for-Hire Infrastructure
October 15, 2020
https://labs.bitdefender.com/2020/1...zation-purpose-proxy-for-hire-infrastructure/

While botnets have been used for anything from performing Distributed Denial-of-Service (DDoS) attacks to stealing data and even sending spam, Bitdefender researchers have found signs that the Interplanetary Storm botnet could be used for something else entirely.
This particular Golang-written botnet could be used as an anonymization proxy-network-as-a-service and potentially rented using a subscription-based model.

While the botnet has come under previous scrutiny from Bitdefender researchers, constant monitoring of the development lifecycle of Interplanetary Storm has revealed that threat actors are both proficient in using Golang and development best practices, and well-versed at concealment of management nodes.
Click to expand...

This research paper offers a glimpse into the inner workings of the Interplanetary Storm botnet, provides an exhaustive technical analysis of the Golang-written binaries along with an overview of the protocol internals and finally, some attribution information.

A complete technical analysis and the Indicators of Compromise associated with this attack are available in the whitepaper below.
Click to expand...

Key findings:

Botnet potentially rented as an anonymous proxy network

Built to use compromised devices as proxies

Botnet mapping reveals global presence

Rented using multi-tier subscription-based pricing model

More than 100 code revisions to date

Detailed analysis of the infrastructure behind the Interplanetary Storm botnet

Click to expand...

guest · Oct 16, 2020

mood said: ↑

Interplanetary Storm Botnet Shows Signs of Anonymization-Purpose Proxy-for-Hire Infrastructure October 15, 2020
Click to expand...

Thousands of infected IoT devices used in for-profit anonymity service
Interplanetary Storm uses P2P networking, mostly in devices running Android
October 16, 2020
https://arstechnica.com/information...devices-used-in-for-profit-anonymity-service/

Some 9,000 devices—mostly running Android, but also the Linux and Darwin operating Systems—have been corralled into the Interplanetary Storm, the name given to a botnet whose chief purpose is creating a for-profit proxy service, likely for anonymous Internet use.

The finding is based on several pieces of evidence collected by researchers from security provider Bitdefender. The core piece of evidence is a series of six specialized nodes that are part of the management infrastructure.
Click to expand...

Bitdefender estimated that there are about 9,000 unique devices, with the vast majority of them being Android devices. Only about 1 percent of the devices run Linux, and only one machine is believed to run Darwin.

Based on clues gathered from the operating system version and, when available, the hostname and user names, the security firm has identified specific models of routers, NAS devices, TV receivers, and multipurpose circuit boards and microcontrollers (e.g., Raspberry Pis) that likely make up the botnet.
Click to expand...

Many criminals use anonymous proxies to transmit illegal data, such as child pornography, threats, and swatting attacks. Thursday’s report is a good reminder why it’s important to always change default passwords when setting up Internet-of-things devices and—when possible—to also disable remote administrative access. The cost of not doing so may not only be lost bandwidth and increased power consumption, but also criminal content that might be traced back to your network.
Click to expand...

Log in or Sign up

This unusual Windows malware is controlled via a P2P network

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

This unusual Windows malware is controlled via a P2P network

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches