Attacks/Breaches

9/17/2018
05:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Xbash Malware a Cocktail of Malicious Functions

The new malware tool targeting Windows and Linux systems combines cryptomining, ransomware, botnet, and self-propagation capabilities.

Adding to the rapidly growing list of multi-functional malware, a particularly nasty – and unique — data-destroying malware tool has been discovered that combines botnet, coin mining, ransomware, and self-propagation capabilities.

The malware, which researchers at Palo Alto Network's Unit 42 group has named Xbash, is targeting Linux and Windows servers and contains capabilities that when fully implemented can help it spread very quickly inside an organization's network.

Researchers from Palo Alto Network say their analysis shows the malware is being used to target Linux servers for their ransomware and botnet capabilities, and Windows servers for coin mining and self-propagation purposes.

Xbash's ransomware capabilities are designed to target and delete Linux-based databases. Worse, the malware appears to contain no functionality at all for helping victims recover lost data in the event they end up paying the demanded ransom.

So far, at least 48 victims have paid a total of $6,000 to the attackers, but there is no evidence that any of them were able to recover data that Xbash might have deleted, Palo Alto Networks said in an advisory Monday.

"Taken as a whole, we've not [before] seen this combination of ransomware, coinmining, worm capabilities, and targeting both Linux and Windows systems," says Ryan Olson, vice president of threat intelligence at Unit 42.

The malware appears to be the work of Iron Group, a threat actor associated with previous ransomware attacks and for spreading cryptocurrency mining tools mostly in Windows environments. With Xbash, the group appears to have broadened their targets to include Linux systems as well.

Unlike other recent Linux malware such as Gafgyt and Mirai, which scan for vulnerable devices using randomly generated IP addresses, Xbash scans for them also by domain name. The capability makes it harder for defenders to spot Xbash using honeypots, which are typically deployed with IP addresses only.

"Xbash uses a list of IP addresses and domains provided by its C2 to scan for specific open ports, weak credentials, or three known vulnerabilities in Hadoop, Redis and ActiveMQ — which it uses for self-propagation," Olson notes.

Two of the three vulnerabilities have no formal CVE number assigned to them. One of them is an unauthenticated command execution flaw in Hadoop YARN that was first disclosed in October 2016; the Redis flaw is from October 2015 and gives attackers a way to remotely execute files of their choice on a target machine. The third-flaw — n Active MQ — enables arbitrary file writes and has an assigned CVE number (CVE-2016-3088).

When it is exploiting a vulnerable Redis instance, Xbash is capable of determining whether it is running on a Windows system so the malware can then download and execute a coinminer it.

If the target that Xbash is scanning happens to be an IP address, it tries to scan multiple UDP and TCP ports. Among them are ports used by HTTP services, VMC, MySQL, Telnet, FTP, NTP, DNS and LDAP. If certain ports happen to be open—such as those used by VNC, MySQL and PostgreSQL—the malware uses a weak username and password dictionary—to brute force its way into the service.

 "Xbash uses weak passwords in its attacks against both Windows systems and Linux services," Olson says. "It uses both a built-in dictionary and also updates from its C2 server with an additional set of weak passwords."

When Xbash breaks into a service such as MySQL or MongoDB, it immediately deletes almost all the databases on the server and serves up a ransom message. "Because the malware deletes the databases based on brute forcing weak credentials for specific services, it could also happen on Windows with the same open ports/services and weak credentials," Olson warns.

Shades of WannaCry, NotPetya

The samples of Xbash that researchers at Palo Alto Networks analyzed show that the authors of Xbash are developing a new capability that will let the malware scan infected networks for other vulnerable servers. The capability has not yet been enabled, but if it is, Xbash will be able to spread quickly within an infected network like the WannaCray and Petya/NotPetya ransomware did.

For organizations, multi-functional and highly modular malware tools are quickly becoming a new threat. In recent weeks, several security vendors have issued warnings about malware tools capable of carrying out multiple malicious functions or of being modified after installation to do different things.

Proofpoint, for instance, recently warned about AdvisorsBot and Marap, two modular tools that allow criminals to add new functions to malware that has already been installed on a system. In an August advisory, Kaspersky Lab said it had observed a near doubling of multipurpose Remote Access Tools being distributed via botnets over the past 18 months or so, from 6.5% to 12.2%.

The trend highlights the need for a more high-level approach to defending against threats. "Organizations and defenders are better off focusing on prevention than specific threats," Olson notes. "A threat-based approach against Xbash would require multiple threats against multiple vectors, which is not scalable and is inherently advantageous to the attackers."

Related Content:

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11378
PUBLISHED: 2019-04-20
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2019-11372
PUBLISHED: 2019-04-20
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11373
PUBLISHED: 2019-04-20
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11374
PUBLISHED: 2019-04-20
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-11375
PUBLISHED: 2019-04-20
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.