Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

2/5/2019
05:32 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Shellbot Crimeware Re-Emerges in Monero Mining Campaign

New attack uses a repurposed version of the Trojan that spreads using Internet Relay Chat.

Shellbot crimeware has been spotted in the wild as part of a growing campaign that appears to target infrastructure resources for cryptomining.

Tactics, techniques, and procedures observed in this campaign are similar to TTPs seen previousl with the Outlaw Group, a hacking organization whose operations were previously uncovered by Trend Micro. In Nov. 2018, researchers discussed a host portion of the botnet run by Outlaw, which they found using a tool called "haiduc" and a miner to obtain Monero cryptocurrency.

This latest campaign, detected by JASK Special Ops team (SpecOps) in late Nov. 2018, has these same qualities and was likely the same group. Analysts identified an SSH brute force campaign against Internet-facing Linux devices within the DMZ infrastructure of an education organization.

In the last weeks of November, firewall alerts notified the victim organization of SSH user authentication brute-force attempts, a sign of increased scanning against the target environment. After its machines were breached, network traffic showed payloads being installed and operated from infected devices, researchers explain in a report on the findings.

Payloads delivered to the target organization included Internet Relay Chat (IRC) C2 botware, cryptomining malware, and an SSH scan, brute force, and network propagation toolkit. SpecOps says host machines were hit with an opportunistic attack, likely sponsored by Outlaw, which has been responsible for Shellbot, cryptomining, and SSH brute-force campaigns.

Shellbot is a Trojan that creates a pathway between the attacker's command-and-control infrastructure and a victim's device.

The toolkit observed in use in this latest attack contains three primary components: the IRC botware for command-and-control, a revenue stream via Monero mining, and haiduc, the popular scan and brute force tool that helped researchers link this activity to Outlaw, says Rod Soto, JASK director of security research. The Perl-based IRC was identified as a new, lightly obfuscated version of Shellbot. Once executed, it creates a connection to a specific IRC channel.

In a tactic increasingly common with financially motivated cyberattacks, researchers note, the attackers created an easily liquidated revenue stream using a configurable Monero miner.

Game Server Hosting Connection

Based on the payloads, SpecOps uncovered a mining pool configuration related to the campaign, which points to a VPS provider in the Netherlands. Analysis showed the pool address is down, and passive DNS data for the VPS shows it hosts several domains that seem to be gaming servers – the host is a game server hoster. Experts say attackers may have built their own mining pool infrastructure on this provider instead of using publicly available ones.

"That's sort of bold," Soto points out. Typically, he says, groups would want to hide their activity in public pools. It's not the only sign this group is advanced: researchers noticed multiple languages in the code; specifically, Portuguese or Romanian. "It made me wonder if it's part of a multinational group, or if the person speaks multiple languages," Soto noted. Multi-stage payloads suggest reuse and repurpose of Shellbot code in different regions of the world.

SpecOps analysts believe the attackers behind this campaign, likely the Outlaw group, are motivated to target exposed Linux servers for broad propagation and abuse infrastructure for illegal cryptomining.

"I think the lesson from Outlaw and Shellbot is, you can do a lot with legacy tools and tradecraft," says Kevin Stear, lead threat analyst at JASK. IRC has been around for a while now, he says. Its use with Shellbot in this attack is a sign that attackers are changing strategies. Shellbot is good at hiding the noise of legitimate traffic, he points out.

"Crimeware is more and more operating as a business model," Stear explains. "Outlaw and Shellbot are just a great example of how sophisticated crimeware actors are going."

Typically, he says, SpecOps sees the infection surface tied to opportunistic bots, spamming vulnerable targets and converting them into revenue. "These are not unguarded infrastructure," he adds, and there is evidence of weaponized capabilities in intrusions.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22850
PUBLISHED: 2021-01-19
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.
CVE-2021-22851
PUBLISHED: 2021-01-19
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.
CVE-2021-22852
PUBLISHED: 2021-01-19
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.
CVE-2021-3178
PUBLISHED: 2021-01-19
** DISPUTED ** fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to preven...
CVE-2021-3177
PUBLISHED: 2021-01-19
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf i...