Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/4/2017
01:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

New 'Bondnet' Botnet Mines Cryptocurrencies

The botnet has infected more than 15,000 machines at major institutions, including high-profile companies, universities, and city councils.

A newly detected botnet, made up of thousands of compromised servers, has infected more than 15,000 machines since it became active in December 2016. "Bondnet" is currently used to mine cryptocurrencies, primarily the open-source Monero.

It was discovered in January 2017 by the Guardicore Global Sensor Network (GGSN) at Guardicore Labs, which was unveiled April 24. The GGSN, a network of deception servers in data centers around the world, streams threat information to detect and analyze new attacks.

"The straight-forward goal is money," says Ofri Ziv, VP of research and head of GuardiCore Labs, describing Bondnet. Its attacker, operating under the alias Bond007.01, manages and controls the botnet remotely to earn the equivalent of one thousand dollars in Monero coins each day.

"In addition to this, given the attacker's technical infrastructure, he could easily pivot to deploying ransomware on thousands of servers immediately, or creating a high-bandwidth DDoS botnet," Ziv continues.

Renting the botnet is also not out of the question. He notes how Bondnet has reached some "interesting" organizations, large companies, universities, and government networks. "If he decides to pivot to selling access, we can imagine plenty of organizations that would be interested in a foothold inside these networks," Ziv explains.

The attacker uses a mix of old vulnerabilities and username/password combinations to attack mostly Windows Server machines, researchers found. New victims are found using a TCP port scanner called WinEggDrop, which gives an updated list of IPs with open ports. The attacker targets victims with a variety of public exploits and installs a Windows Management Interface (WMI) back door on each one. WMI enables communication with a C&C server, which enables the attacker to fully control the servers and take data, hold it for ransom, and use the server to launch more attacks.

Researchers discovered 2,000 machines report to the C&C server each day. About 500 new machines are added to the attacker's network on a daily basis, and about the same number is delisted.

"Businesses with infected servers are at a double risk," Ziv explains. "Foremost is that the attacker has created two pathways in which he can control the infected server (via the WMI RAT and the back door user), with which he can do practically anything."

The back door user is also easy to test remotely, he continues, noting that it lets other attackers search online for victimized servers and connect to them. Infected organizations are open to several types of attacks, from Bond007.01 and others, ranging "from ransomware demands to full-blown compromise."

Businesses looking to protect themselves should monitor all services, particularly Internet-facing ones, for resource usage spikes and unexpected network connections. Network-based monitoring systems can also alert organizations to known malware and suspicious activity.

Internet-facing services should be locked down, says Ziv. For example, MySQL servers are Bondnet's most common victims. Locking down MySQL to prevent running random SQL commands would have protected the infection vector for this attack.

"In addition, regular monitoring of all WMI activity and all user accounts is important," he continues. "Monitoring modifications such as changing user passwords would have quickly alerted the relevant security team, which could investigate the incident."

Related Content

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18980
PUBLISHED: 2019-11-14
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The o...
CVE-2019-17391
PUBLISHED: 2019-11-14
An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and sec...
CVE-2019-18651
PUBLISHED: 2019-11-14
A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document to a user that the website trusts. The user needs to have ...
CVE-2019-18978
PUBLISHED: 2019-11-14
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
CVE-2019-14678
PUBLISHED: 2019-11-14
SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects t...