Battling Cryptojacking, Botnets, and IABs [Guest Diary], (Thu, Jan 15th)
Source SANS ISC Handlers Diary
Description
[This is a Guest Diary by Matthew Presnal, an ISC intern as part of the SANS.edu BACS program]
Impact
For European organizations, this threat poses significant risks primarily to Linux servers and infrastructure exposed via SSH, which are common in enterprise environments, cloud services, and hosting providers. Successful exploitation can lead to unauthorized access, resource hijacking for cryptomining, inclusion in botnets used for DDoS attacks, and potential sale of access to other malicious actors. This can result in degraded system performance, increased operational costs, reputational damage, and potential regulatory scrutiny under GDPR if data confidentiality or integrity is compromised. The presence of Initial Access Brokers increases the threat's reach, as compromised systems may be leveraged in broader campaigns affecting multiple organizations. Additionally, the automation and scale of these attacks mean that even well-defended networks can be targeted, emphasizing the need for proactive detection and response. The threat also complicates incident response efforts due to the evolving nature of malware and attacker tactics, potentially leading to prolonged dwell times and increased remediation costs.
Defensive guidance
European organizations should implement the following specific measures: 1) Disable password-based SSH authentication entirely, enforcing key-based authentication combined with multi-factor authentication for all administrative and remote access. 2) Deploy TCP Wrappers or equivalent host-based access controls to restrict SSH access to known, trusted management networks, reducing exposure to brute-force attempts. 3) Implement file integrity monitoring on critical system files such as /etc/hosts.allow, /etc/hosts.deny, user .ssh directories, authorized_keys, and cron jobs to detect unauthorized changes indicative of persistence mechanisms. 4) Establish real-time monitoring and alerting for reconnaissance commands commonly used post-compromise (e.g., uname, lscpu, w, top, crontab -l) to identify early adversarial activity. 5) Detect and investigate destructive commands like recursive deletion of .ssh directories or use of chattr, which attackers use to disable recovery or detection. 6) Centralize logging of authentication attempts, process executions, and network connections with at least 90 days retention to support forensic analysis and threat hunting. 7) Conduct regular audits of user accounts, group memberships, and privilege assignments to minimize attack surface. 8) Maintain rigorous patch management for operating systems and exposed services to reduce vulnerabilities exploited by automated tools. 9) Regularly test and update incident response plans to ensure rapid containment and isolation of compromised systems. 10) Invest in threat hunting and cyber threat intelligence capabilities to anticipate attacker tactics and disrupt IAB operations. These targeted actions go beyond generic advice by focusing on early detection of attacker behaviors and hardening specific attack vectors used in this threat.
Summary
The analyzed threat centers on a prevalent attack methodology used by cybercriminal groups specializing in cryptojacking, botnets, and Initial Access Brokerage (IAB). The attack chain begins with SSH password spraying to gain unauthorized access to Linux-based systems. Once access is achieved, attackers perform extensive system enumeration, collecting kernel details, CPU and GPU information, uptime, binary versions, and logged-in users. This reconnaissance phase is critical for assessing the system's suitability for botnet inclusion or cryptojacking operations. Following enumeration, attackers execute commands to remove or alter SSH configurations, establishing persistence via backdoors. Malware deployment follows, with samples identified as Trojans and cryptocurrency miners, including Go binaries that suggest evolving attacker toolsets beyond previously known Perl-based backdoors. The threat actor infrastructure includes IPs from diverse geographies, with some activity traced to Chinese ASN ranges and others linked to known groups like 'Outlaw'. The attackers leverage automation and scripting to scale operations, often selling access or offering DDoS-for-hire services. Defensive strategies emphasize early detection of reconnaissance commands (e.g., uname, lscpu, w, top), monitoring for destructive commands (recursive deletion of .ssh directories), and enforcing strong authentication mechanisms such as SSH key-based authentication and multi-factor authentication. Additional measures include TCP Wrappers for network access control, file integrity monitoring on critical files, centralized logging with extended retention, routine patching, and active threat hunting informed by cyber threat intelligence. The attack pattern underscores the importance of breaking the kill chain early to prevent persistence and malware deployment, thereby mitigating resource drain and potential lateral movement within networks.