Stealthy Malware Has Infected Thousands of Linux Systems for Years

1 month ago 34

Other discussions include: Reddit, Stack Overflow (Spanish), forobeta (Spanish), brainycp (Russian), natnetwork (Indonesian), Proxmox (Deutsch), Camel2243 (Chinese), svrforum (Korean), exabytes, virtualmin, serverfault and galore others.

After exploiting a vulnerability oregon misconfiguration, the exploit codification downloads the main payload from a server, which, successful astir cases, has been hacked by the attacker and converted into a transmission for distributing the malware anonymously. An onslaught that targeted the researchers’ honeypot named the payload httpd. Once executed, the record copies itself from representation to a caller determination successful the /temp directory, runs it, and past terminates the archetypal process and deletes the downloaded binary.

Once moved to the /tmp directory, the record executes nether a antithetic name, which mimics the sanction of a known Linux process. The record hosted connected the honeypot was named sh. From there, the record establishes a section command-and-control process and attempts to summation basal strategy rights by exploiting CVE-2021-4043, a privilege-escalation vulnerability that was patched successful 2021 successful Gpac, a wide utilized unfastened root multimedia framework.

The malware goes connected to transcript itself from representation to a fistful of different disk locations, erstwhile again utilizing names that look arsenic regular strategy files. The malware past drops a rootkit, a big of fashionable Linux utilities that person been modified to service arsenic rootkits, and the miner. In immoderate cases, the malware besides installs bundle for “proxy-jacking,” the word for surreptitiously routing postulation done the infected instrumentality truthful the existent root of the information isn’t revealed.

The researchers continued:

As portion of its command-and-control operation, the malware opens a Unix socket, creates 2 directories nether the /tmp directory, and stores information determination that influences its operation. This information includes big events, locations of the copies of itself, process names, connection logs, tokens, and further log information. Additionally, the malware uses situation variables to store information that further affects its execution and behavior.

All the binaries are packed, stripped, and encrypted, indicating important efforts to bypass defence mechanisms and hinder reverse engineering attempts. The malware besides uses precocious evasion techniques, specified arsenic suspending its enactment erstwhile it detects a caller idiosyncratic successful the btmp oregon utmp files and terminating immoderate competing malware to support power implicit the infected system.

By extrapolating information specified arsenic the fig of Linux servers connected to the net crossed assorted services and applications, arsenic tracked by services specified arsenic Shodan and Censys, the researchers estimation that the fig of machines infected by Perfctl is measured successful the thousands. They accidental that the excavation of susceptible machines—meaning those that person yet to instal the spot for CVE-2023-33426 oregon incorporate a susceptible misconfiguration—is successful the millions. The researchers person yet to measurement the magnitude of cryptocurrency the malicious miners person generated.

People who privation to find if their instrumentality has been targeted oregon infected by Perfctl should look for indicators of compromise included successful Thursday’s post. They should besides beryllium connected the lookout for antithetic spikes successful CPU usage oregon abrupt strategy slowdowns, peculiarly if they hap during idle times. Thursday’s study besides provides steps for preventing infections successful the archetypal place.

This communicative primitively appeared on Ars Technica.

Read Entire Article