Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

2/5/2019
05:32 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Shellbot Crimeware Re-Emerges in Monero Mining Campaign

New attack uses a repurposed version of the Trojan that spreads using Internet Relay Chat.

Shellbot crimeware has been spotted in the wild as part of a growing campaign that appears to target infrastructure resources for cryptomining.

Tactics, techniques, and procedures observed in this campaign are similar to TTPs seen previousl with the Outlaw Group, a hacking organization whose operations were previously uncovered by Trend Micro. In Nov. 2018, researchers discussed a host portion of the botnet run by Outlaw, which they found using a tool called "haiduc" and a miner to obtain Monero cryptocurrency.

This latest campaign, detected by JASK Special Ops team (SpecOps) in late Nov. 2018, has these same qualities and was likely the same group. Analysts identified an SSH brute force campaign against Internet-facing Linux devices within the DMZ infrastructure of an education organization.

In the last weeks of November, firewall alerts notified the victim organization of SSH user authentication brute-force attempts, a sign of increased scanning against the target environment. After its machines were breached, network traffic showed payloads being installed and operated from infected devices, researchers explain in a report on the findings.

Payloads delivered to the target organization included Internet Relay Chat (IRC) C2 botware, cryptomining malware, and an SSH scan, brute force, and network propagation toolkit. SpecOps says host machines were hit with an opportunistic attack, likely sponsored by Outlaw, which has been responsible for Shellbot, cryptomining, and SSH brute-force campaigns.

Shellbot is a Trojan that creates a pathway between the attacker's command-and-control infrastructure and a victim's device.

The toolkit observed in use in this latest attack contains three primary components: the IRC botware for command-and-control, a revenue stream via Monero mining, and haiduc, the popular scan and brute force tool that helped researchers link this activity to Outlaw, says Rod Soto, JASK director of security research. The Perl-based IRC was identified as a new, lightly obfuscated version of Shellbot. Once executed, it creates a connection to a specific IRC channel.

In a tactic increasingly common with financially motivated cyberattacks, researchers note, the attackers created an easily liquidated revenue stream using a configurable Monero miner.

Game Server Hosting Connection

Based on the payloads, SpecOps uncovered a mining pool configuration related to the campaign, which points to a VPS provider in the Netherlands. Analysis showed the pool address is down, and passive DNS data for the VPS shows it hosts several domains that seem to be gaming servers – the host is a game server hoster. Experts say attackers may have built their own mining pool infrastructure on this provider instead of using publicly available ones.

"That's sort of bold," Soto points out. Typically, he says, groups would want to hide their activity in public pools. It's not the only sign this group is advanced: researchers noticed multiple languages in the code; specifically, Portuguese or Romanian. "It made me wonder if it's part of a multinational group, or if the person speaks multiple languages," Soto noted. Multi-stage payloads suggest reuse and repurpose of Shellbot code in different regions of the world.

SpecOps analysts believe the attackers behind this campaign, likely the Outlaw group, are motivated to target exposed Linux servers for broad propagation and abuse infrastructure for illegal cryptomining.

"I think the lesson from Outlaw and Shellbot is, you can do a lot with legacy tools and tradecraft," says Kevin Stear, lead threat analyst at JASK. IRC has been around for a while now, he says. Its use with Shellbot in this attack is a sign that attackers are changing strategies. Shellbot is good at hiding the noise of legitimate traffic, he points out.

"Crimeware is more and more operating as a business model," Stear explains. "Outlaw and Shellbot are just a great example of how sophisticated crimeware actors are going."

Typically, he says, SpecOps sees the infection surface tied to opportunistic bots, spamming vulnerable targets and converting them into revenue. "These are not unguarded infrastructure," he adds, and there is evidence of weaponized capabilities in intrusions.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.
CVE-2019-6650
PUBLISHED: 2019-09-20
F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings.
CVE-2014-10396
PUBLISHED: 2019-09-20
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.