Hackers Attack Linux SSH Servers with Tsunami DDoS Malware

An attack campaign has been recently uncovered by AhnLab ASEC, where poorly controlled Linux SSH servers are targeted and infiltrated with the Tsunami DDoS Bot.

In addition to Tsunami, the threat actor installed several other types of malware, including:-

• ShellBot
• XMRig CoinMiner
• Log Cleaner

Most attacks on poorly managed Linux SSH servers involve DDoS bots or CoinMiners being installed.

Tsunami DDoS Malware

Tsunami is a variant of Kaiten (aka Ziggy), a DDoS bot, and it is often distributed alongside Mirai and Gafgyt to attack vulnerable IoT devices.

Although they are all DDoS bots, Tsunami is unique because it functions as an IRC bot and communicates with the threat actor through IRC.

Tsunami’s source code is openly accessible, leading to widespread use by many threat actors.

It is primarily utilized for targeting IoT devices in attacks. Furthermore, it is regularly employed to target Linux servers without fail.

Attack Against Linux SSH Servers

SSH service is commonly installed in Linux servers, making them vulnerable to attacks due to poor management.

It also enables remote login and system control for administrators, requiring them to log in with their registered user account.

Using basic login information (username and password) in a Linux system can let a malicious person get into the system by forcefully guessing or using a pre-made list of common passwords.

When poorly managed Linux SSH servers are targeted, attackers search for exposed servers by scanning specific ports.

They then try known account credentials to perform dictionary attacks and gain unauthorized access.

Here below we have mentioned the addresses that were attacked along with their IDs and passwords:-

Once logged in, the attacker runs a command to download and launch different types of malware. One of the installed malware is a Bash script called the “key” file, which acts as a downloader and installs more malware.

Apart from downloading malware, the “key” file also carries out several initial tasks to gain control over infected systems, such as setting up a secret SSH account as a backdoor, Researchers said.

Here below we have mentioned all the malware that is installed via the executed command and downloader Bash script:-

• Downloader Bash (Download URL: ddoser[.]org/key)
• ShellBot DDoS Bot (Download URL: ddoser[.]org/logo)
• ShellBot DDoS Bot (Download URL: ddoser[.]org/siwen/bot)
• Tsunami DDoS Bot (Download URL: ddoser[.]org/siwen/a)
• MIG Logcleaner v2.0 (Download URL: ddoser[.]org/siwen/cls)
• 0x333shadow Log Cleaner (Download URL: ddoser[.]org/siwen/clean)
• Privilege escalation malware (Download URL: ddoser[.]org/siwen/ping6)
• XMRig CoinMiner (compressed file) (Download URL: ddoser[.]org/top)

ShellBot is a DDoS bot that is Perl-based which utilizes the IRC protocol for communication, can set up a reverse shell, and supports:-

• Port scanning
• UDP flood attacks
• TCP flood attacks
• HTTP flood attacks

Tsunami stays active even after restarting by saving itself in “/etc/rc.local” and disguising itself with common system process names.

Here below we have mentioned all the remote control commands that Tsunami supports:-

• Shell command execution
• Reverse shells
• Collecting system information
• Updating itself
• Downloading additional payloads from an external source

In order to remove any traces of unauthorized access on compromised computers, MIG Logcleaner v2.0 and Shadow Log Cleaner are utilized, thus delaying the prompt detection of the infection by victims

In these attacks, the malware used by the threat actors is an “ELF” file and gives the threat actor elevated privileges.

Mitigations

Here below we have mentioned all the mitigations offered by the security analysts:-

• Linux users should use strong passwords or SSH keys to protect against attacks.
• Make sure to disable root login via SSH.
• Take the necessary steps to restrict access to the server by allowing only a specific range of IP addresses.
• Ensure that you alter the default SSH port to a less common number to evade automated bots and infection scripts.

Looking For an All-in-One Multi-OS Patch Management Platform – .