Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/4/2017
01:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

New 'Bondnet' Botnet Mines Cryptocurrencies

The botnet has infected more than 15,000 machines at major institutions, including high-profile companies, universities, and city councils.

A newly detected botnet, made up of thousands of compromised servers, has infected more than 15,000 machines since it became active in December 2016. "Bondnet" is currently used to mine cryptocurrencies, primarily the open-source Monero.

It was discovered in January 2017 by the Guardicore Global Sensor Network (GGSN) at Guardicore Labs, which was unveiled April 24. The GGSN, a network of deception servers in data centers around the world, streams threat information to detect and analyze new attacks.

"The straight-forward goal is money," says Ofri Ziv, VP of research and head of GuardiCore Labs, describing Bondnet. Its attacker, operating under the alias Bond007.01, manages and controls the botnet remotely to earn the equivalent of one thousand dollars in Monero coins each day.

"In addition to this, given the attacker's technical infrastructure, he could easily pivot to deploying ransomware on thousands of servers immediately, or creating a high-bandwidth DDoS botnet," Ziv continues.

Renting the botnet is also not out of the question. He notes how Bondnet has reached some "interesting" organizations, large companies, universities, and government networks. "If he decides to pivot to selling access, we can imagine plenty of organizations that would be interested in a foothold inside these networks," Ziv explains.

The attacker uses a mix of old vulnerabilities and username/password combinations to attack mostly Windows Server machines, researchers found. New victims are found using a TCP port scanner called WinEggDrop, which gives an updated list of IPs with open ports. The attacker targets victims with a variety of public exploits and installs a Windows Management Interface (WMI) back door on each one. WMI enables communication with a C&C server, which enables the attacker to fully control the servers and take data, hold it for ransom, and use the server to launch more attacks.

Researchers discovered 2,000 machines report to the C&C server each day. About 500 new machines are added to the attacker's network on a daily basis, and about the same number is delisted.

"Businesses with infected servers are at a double risk," Ziv explains. "Foremost is that the attacker has created two pathways in which he can control the infected server (via the WMI RAT and the back door user), with which he can do practically anything."

The back door user is also easy to test remotely, he continues, noting that it lets other attackers search online for victimized servers and connect to them. Infected organizations are open to several types of attacks, from Bond007.01 and others, ranging "from ransomware demands to full-blown compromise."

Businesses looking to protect themselves should monitor all services, particularly Internet-facing ones, for resource usage spikes and unexpected network connections. Network-based monitoring systems can also alert organizations to known malware and suspicious activity.

Internet-facing services should be locked down, says Ziv. For example, MySQL servers are Bondnet's most common victims. Locking down MySQL to prevent running random SQL commands would have protected the infection vector for this attack.

"In addition, regular monitoring of all WMI activity and all user accounts is important," he continues. "Monitoring modifications such as changing user passwords would have quickly alerted the relevant security team, which could investigate the incident."

Related Content

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16649
PUBLISHED: 2019-09-21
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the...
CVE-2019-16650
PUBLISHED: 2019-09-21
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the se...
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.