Article Details
Scrape Timestamp (UTC): 2023-10-12 11:31:28.620
Source: https://thehackernews.com/2023/10/shellbot-uses-hex-ips-to-evade.html
Original Article Text
Click to Toggle View
ShellBot Uses Hex IPs to Evade Detection in Attacks on Linux SSH Servers. The threat actors behind ShellBot are leveraging IP addresses transformed into its hexadecimal notation to infiltrate poorly managed Linux SSH servers and deploy the DDoS malware. "The overall flow remains the same, but the download URL used by the threat actor to install ShellBot has changed from a regular IP address to a hexadecimal value," the AhnLab Security Emergency response Center (ASEC) said in a new report published today. ShellBot, also known by the name PerlBot, is known to breach servers that have weak SSH credentials by means of a dictionary attack, with the malware used as a conduit to stage DDoS attacks and deliver cryptocurrency miners. Developed in Perl, the malware uses the IRC protocol to communicate with a command-and-control (C2) server. The latest set of observed attacks involving ShellBot has been found to install the malware using hexadecimal IP addresses – hxxp://0x2763da4e/ which corresponds to 39.99.218[.]78 – in what's seen as an attempt to evade URL-based detection signatures. "Due to the usage of curl for the download and its ability to support hexadecimal just like web browsers, ShellBot can be downloaded successfully on a Linux system environment and executed through Perl," ASEC said. The development is a sign that ShellBot continues to witness steady usage to launch attacks against Linux systems. With ShellBot capable of being used to install additional malware or launch different types of attacks from the compromised server, it's recommended that users switch to strong passwords and periodically change them to resist brute-force and dictionary attacks. The disclosure also comes as ASEC revealed that attackers are weaponizing abnormal certificates with unusually long strings for Subject Name and Issuer Name fields in a bid to distribute information stealer malware such as Lumma Stealer and a variant of RedLine Stealer known as RecordBreaker. "These types of malware are distributed via malicious pages that are easily accessible through search engines (SEO poisoning), posing a threat to a wide range of unspecified users," ASEC said. "These malicious pages primarily use keywords related to illegal programs such as serials, keygens, and cracks."
Daily Brief Summary
Threat actors are leveraging IP addresses that have been transformed into hexadecimal notation to infiltrate poorly managed Linux SSH servers in order to deploy the DDoS malware, ShellBot.
The malware, also known as PerlBot, is used to breach servers with weak SSH credentials by means of dictionary attacks, enabling the staging of DDoS attacks and the delivery of cryptocurrency miners.
Recent attacks involving ShellBot have been seen to install the malware using hexadecimal IP addresses in an attempt to evade URL-based detection signatures.
ShellBot uses the IRC protocol to communicate with a command-and-control server and continues to be used in steady attacks against Linux systems.
It's recommended for users to switch to and regularly update strong passwords to prevent brute-force and dictionary attacks.
ASEC also revealed that attackers are weaponizing abnormal certificates with unusually long strings for Subject Name and Issuer Name fields to distribute malware such as Lumma Stealer and a variant of RedLine Stealer.
These types of malware are primarily distributed via malicious pages that are easily accessible through search engines, posing a threat to a wide range of users.