Attacks/Breaches

5/4/2017
01:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

New 'Bondnet' Botnet Mines Cryptocurrencies

The botnet has infected more than 15,000 machines at major institutions, including high-profile companies, universities, and city councils.

A newly detected botnet, made up of thousands of compromised servers, has infected more than 15,000 machines since it became active in December 2016. "Bondnet" is currently used to mine cryptocurrencies, primarily the open-source Monero.

It was discovered in January 2017 by the Guardicore Global Sensor Network (GGSN) at Guardicore Labs, which was unveiled April 24. The GGSN, a network of deception servers in data centers around the world, streams threat information to detect and analyze new attacks.

"The straight-forward goal is money," says Ofri Ziv, VP of research and head of GuardiCore Labs, describing Bondnet. Its attacker, operating under the alias Bond007.01, manages and controls the botnet remotely to earn the equivalent of one thousand dollars in Monero coins each day.

"In addition to this, given the attacker's technical infrastructure, he could easily pivot to deploying ransomware on thousands of servers immediately, or creating a high-bandwidth DDoS botnet," Ziv continues.

Renting the botnet is also not out of the question. He notes how Bondnet has reached some "interesting" organizations, large companies, universities, and government networks. "If he decides to pivot to selling access, we can imagine plenty of organizations that would be interested in a foothold inside these networks," Ziv explains.

The attacker uses a mix of old vulnerabilities and username/password combinations to attack mostly Windows Server machines, researchers found. New victims are found using a TCP port scanner called WinEggDrop, which gives an updated list of IPs with open ports. The attacker targets victims with a variety of public exploits and installs a Windows Management Interface (WMI) back door on each one. WMI enables communication with a C&C server, which enables the attacker to fully control the servers and take data, hold it for ransom, and use the server to launch more attacks.

Researchers discovered 2,000 machines report to the C&C server each day. About 500 new machines are added to the attacker's network on a daily basis, and about the same number is delisted.

"Businesses with infected servers are at a double risk," Ziv explains. "Foremost is that the attacker has created two pathways in which he can control the infected server (via the WMI RAT and the back door user), with which he can do practically anything."

The back door user is also easy to test remotely, he continues, noting that it lets other attackers search online for victimized servers and connect to them. Infected organizations are open to several types of attacks, from Bond007.01 and others, ranging "from ransomware demands to full-blown compromise."

Businesses looking to protect themselves should monitor all services, particularly Internet-facing ones, for resource usage spikes and unexpected network connections. Network-based monitoring systems can also alert organizations to known malware and suspicious activity.

Internet-facing services should be locked down, says Ziv. For example, MySQL servers are Bondnet's most common victims. Locking down MySQL to prevent running random SQL commands would have protected the infection vector for this attack.

"In addition, regular monitoring of all WMI activity and all user accounts is important," he continues. "Monitoring modifications such as changing user passwords would have quickly alerted the relevant security team, which could investigate the incident."

Related Content

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.