Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/4/2017
01:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

New 'Bondnet' Botnet Mines Cryptocurrencies

The botnet has infected more than 15,000 machines at major institutions, including high-profile companies, universities, and city councils.

A newly detected botnet, made up of thousands of compromised servers, has infected more than 15,000 machines since it became active in December 2016. "Bondnet" is currently used to mine cryptocurrencies, primarily the open-source Monero.

It was discovered in January 2017 by the Guardicore Global Sensor Network (GGSN) at Guardicore Labs, which was unveiled April 24. The GGSN, a network of deception servers in data centers around the world, streams threat information to detect and analyze new attacks.

"The straight-forward goal is money," says Ofri Ziv, VP of research and head of GuardiCore Labs, describing Bondnet. Its attacker, operating under the alias Bond007.01, manages and controls the botnet remotely to earn the equivalent of one thousand dollars in Monero coins each day.

"In addition to this, given the attacker's technical infrastructure, he could easily pivot to deploying ransomware on thousands of servers immediately, or creating a high-bandwidth DDoS botnet," Ziv continues.

Renting the botnet is also not out of the question. He notes how Bondnet has reached some "interesting" organizations, large companies, universities, and government networks. "If he decides to pivot to selling access, we can imagine plenty of organizations that would be interested in a foothold inside these networks," Ziv explains.

The attacker uses a mix of old vulnerabilities and username/password combinations to attack mostly Windows Server machines, researchers found. New victims are found using a TCP port scanner called WinEggDrop, which gives an updated list of IPs with open ports. The attacker targets victims with a variety of public exploits and installs a Windows Management Interface (WMI) back door on each one. WMI enables communication with a C&C server, which enables the attacker to fully control the servers and take data, hold it for ransom, and use the server to launch more attacks.

Researchers discovered 2,000 machines report to the C&C server each day. About 500 new machines are added to the attacker's network on a daily basis, and about the same number is delisted.

"Businesses with infected servers are at a double risk," Ziv explains. "Foremost is that the attacker has created two pathways in which he can control the infected server (via the WMI RAT and the back door user), with which he can do practically anything."

The back door user is also easy to test remotely, he continues, noting that it lets other attackers search online for victimized servers and connect to them. Infected organizations are open to several types of attacks, from Bond007.01 and others, ranging "from ransomware demands to full-blown compromise."

Businesses looking to protect themselves should monitor all services, particularly Internet-facing ones, for resource usage spikes and unexpected network connections. Network-based monitoring systems can also alert organizations to known malware and suspicious activity.

Internet-facing services should be locked down, says Ziv. For example, MySQL servers are Bondnet's most common victims. Locking down MySQL to prevent running random SQL commands would have protected the infection vector for this attack.

"In addition, regular monitoring of all WMI activity and all user accounts is important," he continues. "Monitoring modifications such as changing user passwords would have quickly alerted the relevant security team, which could investigate the incident."

Related Content

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13842
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). A dangerous AT command was made available even though it is unused. The LG ID is LVE-SMP-200010 (June 2020).
CVE-2020-13843
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial of service because checking of the userdata partition is mishandled. The LG ID is LVE-SMP-200014 (June 2020).
CVE-2020-13839
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via a custom AT command handler buffer overflow. The LG ID is LVE-SMP-200007 (June 2020).
CVE-2020-13840
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via an MTK AT command handler buffer overflow. The LG ID is LVE-SMP-200008 (June 2020).
CVE-2020-13841
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets). An AT command handler allows attackers to bypass intended access restrictions. The LG ID is LVE-SMP-200009 (June 2020).