Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

2/5/2019
05:32 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Shellbot Crimeware Re-Emerges in Monero Mining Campaign

New attack uses a repurposed version of the Trojan that spreads using Internet Relay Chat.

Shellbot crimeware has been spotted in the wild as part of a growing campaign that appears to target infrastructure resources for cryptomining.

Tactics, techniques, and procedures observed in this campaign are similar to TTPs seen previousl with the Outlaw Group, a hacking organization whose operations were previously uncovered by Trend Micro. In Nov. 2018, researchers discussed a host portion of the botnet run by Outlaw, which they found using a tool called "haiduc" and a miner to obtain Monero cryptocurrency.

This latest campaign, detected by JASK Special Ops team (SpecOps) in late Nov. 2018, has these same qualities and was likely the same group. Analysts identified an SSH brute force campaign against Internet-facing Linux devices within the DMZ infrastructure of an education organization.

In the last weeks of November, firewall alerts notified the victim organization of SSH user authentication brute-force attempts, a sign of increased scanning against the target environment. After its machines were breached, network traffic showed payloads being installed and operated from infected devices, researchers explain in a report on the findings.

Payloads delivered to the target organization included Internet Relay Chat (IRC) C2 botware, cryptomining malware, and an SSH scan, brute force, and network propagation toolkit. SpecOps says host machines were hit with an opportunistic attack, likely sponsored by Outlaw, which has been responsible for Shellbot, cryptomining, and SSH brute-force campaigns.

Shellbot is a Trojan that creates a pathway between the attacker's command-and-control infrastructure and a victim's device.

The toolkit observed in use in this latest attack contains three primary components: the IRC botware for command-and-control, a revenue stream via Monero mining, and haiduc, the popular scan and brute force tool that helped researchers link this activity to Outlaw, says Rod Soto, JASK director of security research. The Perl-based IRC was identified as a new, lightly obfuscated version of Shellbot. Once executed, it creates a connection to a specific IRC channel.

In a tactic increasingly common with financially motivated cyberattacks, researchers note, the attackers created an easily liquidated revenue stream using a configurable Monero miner.

Game Server Hosting Connection

Based on the payloads, SpecOps uncovered a mining pool configuration related to the campaign, which points to a VPS provider in the Netherlands. Analysis showed the pool address is down, and passive DNS data for the VPS shows it hosts several domains that seem to be gaming servers – the host is a game server hoster. Experts say attackers may have built their own mining pool infrastructure on this provider instead of using publicly available ones.

"That's sort of bold," Soto points out. Typically, he says, groups would want to hide their activity in public pools. It's not the only sign this group is advanced: researchers noticed multiple languages in the code; specifically, Portuguese or Romanian. "It made me wonder if it's part of a multinational group, or if the person speaks multiple languages," Soto noted. Multi-stage payloads suggest reuse and repurpose of Shellbot code in different regions of the world.

SpecOps analysts believe the attackers behind this campaign, likely the Outlaw group, are motivated to target exposed Linux servers for broad propagation and abuse infrastructure for illegal cryptomining.

"I think the lesson from Outlaw and Shellbot is, you can do a lot with legacy tools and tradecraft," says Kevin Stear, lead threat analyst at JASK. IRC has been around for a while now, he says. Its use with Shellbot in this attack is a sign that attackers are changing strategies. Shellbot is good at hiding the noise of legitimate traffic, he points out.

"Crimeware is more and more operating as a business model," Stear explains. "Outlaw and Shellbot are just a great example of how sophisticated crimeware actors are going."

Typically, he says, SpecOps sees the infection surface tied to opportunistic bots, spamming vulnerable targets and converting them into revenue. "These are not unguarded infrastructure," he adds, and there is evidence of weaponized capabilities in intrusions.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Inside North Korea's Rapid Evolution to Cyber Superpower
Kelly Sheridan, Staff Editor, Dark Reading,  12/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25465
PUBLISHED: 2020-12-04
Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVE-2020-25461
PUBLISHED: 2020-12-04
Invalid Memory Access in the fxProxyGetter function in moddable/xs/sources/xsProxy.c in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVE-2020-25462
PUBLISHED: 2020-12-04
Heap buffer overflow in the fxCheckArrowFunction function at moddable/xs/sources/xsSyntaxical.c:3562 in Moddable SDK before OS200903.
CVE-2020-25463
PUBLISHED: 2020-12-04
Invalid Memory Access in fxUTF8Decode at moddable/xs/sources/xsCommon.c:916 in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVE-2020-25464
PUBLISHED: 2020-12-04
Heap buffer overflow at moddable/xs/sources/xsDebug.c in Moddable SDK before before 20200903. The top stack frame is only partially initialized because the stack overflowed while creating the frame. This leads to a crash in the code sending the stack frame to the debugger.