Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

2/5/2019
05:32 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Shellbot Crimeware Re-Emerges in Monero Mining Campaign

New attack uses a repurposed version of the Trojan that spreads using Internet Relay Chat.

Shellbot crimeware has been spotted in the wild as part of a growing campaign that appears to target infrastructure resources for cryptomining.

Tactics, techniques, and procedures observed in this campaign are similar to TTPs seen previousl with the Outlaw Group, a hacking organization whose operations were previously uncovered by Trend Micro. In Nov. 2018, researchers discussed a host portion of the botnet run by Outlaw, which they found using a tool called "haiduc" and a miner to obtain Monero cryptocurrency.

This latest campaign, detected by JASK Special Ops team (SpecOps) in late Nov. 2018, has these same qualities and was likely the same group. Analysts identified an SSH brute force campaign against Internet-facing Linux devices within the DMZ infrastructure of an education organization.

In the last weeks of November, firewall alerts notified the victim organization of SSH user authentication brute-force attempts, a sign of increased scanning against the target environment. After its machines were breached, network traffic showed payloads being installed and operated from infected devices, researchers explain in a report on the findings.

Payloads delivered to the target organization included Internet Relay Chat (IRC) C2 botware, cryptomining malware, and an SSH scan, brute force, and network propagation toolkit. SpecOps says host machines were hit with an opportunistic attack, likely sponsored by Outlaw, which has been responsible for Shellbot, cryptomining, and SSH brute-force campaigns.

Shellbot is a Trojan that creates a pathway between the attacker's command-and-control infrastructure and a victim's device.

The toolkit observed in use in this latest attack contains three primary components: the IRC botware for command-and-control, a revenue stream via Monero mining, and haiduc, the popular scan and brute force tool that helped researchers link this activity to Outlaw, says Rod Soto, JASK director of security research. The Perl-based IRC was identified as a new, lightly obfuscated version of Shellbot. Once executed, it creates a connection to a specific IRC channel.

In a tactic increasingly common with financially motivated cyberattacks, researchers note, the attackers created an easily liquidated revenue stream using a configurable Monero miner.

Game Server Hosting Connection

Based on the payloads, SpecOps uncovered a mining pool configuration related to the campaign, which points to a VPS provider in the Netherlands. Analysis showed the pool address is down, and passive DNS data for the VPS shows it hosts several domains that seem to be gaming servers – the host is a game server hoster. Experts say attackers may have built their own mining pool infrastructure on this provider instead of using publicly available ones.

"That's sort of bold," Soto points out. Typically, he says, groups would want to hide their activity in public pools. It's not the only sign this group is advanced: researchers noticed multiple languages in the code; specifically, Portuguese or Romanian. "It made me wonder if it's part of a multinational group, or if the person speaks multiple languages," Soto noted. Multi-stage payloads suggest reuse and repurpose of Shellbot code in different regions of the world.

SpecOps analysts believe the attackers behind this campaign, likely the Outlaw group, are motivated to target exposed Linux servers for broad propagation and abuse infrastructure for illegal cryptomining.

"I think the lesson from Outlaw and Shellbot is, you can do a lot with legacy tools and tradecraft," says Kevin Stear, lead threat analyst at JASK. IRC has been around for a while now, he says. Its use with Shellbot in this attack is a sign that attackers are changing strategies. Shellbot is good at hiding the noise of legitimate traffic, he points out.

"Crimeware is more and more operating as a business model," Stear explains. "Outlaw and Shellbot are just a great example of how sophisticated crimeware actors are going."

Typically, he says, SpecOps sees the infection surface tied to opportunistic bots, spamming vulnerable targets and converting them into revenue. "These are not unguarded infrastructure," he adds, and there is evidence of weaponized capabilities in intrusions.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13693
PUBLISHED: 2020-05-29
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
CVE-2020-13173
PUBLISHED: 2020-05-28
Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 19.11.1 and earlier creates an insecure named pipe, which allows an attacker to intercept sensitive information or possibly elevate privileges via pre-installing...
CVE-2019-6342
PUBLISHED: 2020-05-28
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
CVE-2020-11082
PUBLISHED: 2020-05-28
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
CVE-2020-5357
PUBLISHED: 2020-05-28
Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time wi...