A fearsome new botnet is rapidly gaining momentum

An old, infamous trojan has been forked, with the new variant being used to attack Linux SSH servers, experts have warned.

However, unlike the original malware, whose purpose was quite clear, researchers are not yet sure what the operators are up to this time around.

Cybersecurity researchers from Fortinet detected IoT malware with unusual SSH-related strings, and after digging a bit deeper, discovered RapperBot, a variant of the dreaded Mirai trojan.

Access for sale?

RapperBot was first deployed in mid-June 2022, and is being used to brute-force into Linux SSH servers and gain persistence on the endpoints. 

RapperBot borrows quite a lot from Mirai, but it does have its own command and control (C2) protocol, as well as certain unique features.

But unlike Mirai, whose goal was to spread to as many devices as possible, and then use those devices to mount devastating Distributed Denial of Service (DDoS) attacks, RapperBot is spreading with more control, and has limited (sometimes even completely disabled) DDoS capabilities. 

The researchers’ first impression is that the malware might be used for lateral movement within a target network, and as the first stage in a multi-stage attack. It could be also used simply to gain access to the target devices, access which could later be sold on the black market. The researchers came to this conclusion, among other things, due to the fact that the trojan sits idly, once it compromises a device.

Whatever the endgame is, the trojan is quite active, the researchers further claim, saying that in the past month and a half, it used more than 3,500 unique IP addresses worldwide, to scan and brute-force Linux SSH servers. To launch a brute-force attack, the trojan first downloads a list of credentials from its C2, via host-unique TCP requests. If it succeeds, it reports the results back to the C2.

"Unlike the majority of Mirai variants, which natively brute force Telnet servers using default or weak passwords, RapperBot exclusively scans and attempts to brute force SSH servers configured to accept password authentication," Fortinet explains. "The bulk of the malware code contains an implementation of an SSH 2.0 client that can connect and brute force any SSH server that supports Diffie-Hellmann key exchange with 768-bit or 2048-bit keys and data encryption using AES128-CTR."

  • Keep your web services from being overwhelmed with a little help from these industry DDos protection legends

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/do2XwAY
Share:

No comments:

Post a Comment

Categories

Rove Reviews Youtube Channel

  1. Subscribe to our youtube channel
  2. Like our videos and share them too.
  3. Our youtube channel name Rove reviews.

WITNUX

This website is made by Witnux LLC. This website provides you with all the news feeds related to technology from large tech media industries like GSM Arena, NDTV, Gadgets 360, Firstpost and many other such ates altogether at technical depicts so that you need not go to several sites to view their post provide you advantantage of time.

From the developer
Tanzeel Sarwar

OUR OTHER NETWORKS

OUR YOUTUBE CHANNEL

ROVE REVIEWS PLEASE SUBSCRIBE

OUR FACEBOOK PAGE

The Rove Reviews

Support

Trying our best to provide you the best DONATE or SUPPORTour site Contact me with details how are you gonna help us