A new campaign observed in the wild installs cryptominers on misconfigured internet-facing Linux systems and internet of things (IoT) devices. The brute force attack on credentials deploys a backdoor that can deploy an assortment of tools, including a patched version of OpenSSH that allows threat actors to hijack Secure Socket Shell (SSH) credentials. The threat actors also use OpenSSH to move laterally within the network and to conceal malicious SSH connections.
In the attacks, the threat actors disable shell history before reaching out to a command and control (C2) server to download the malicious version of OpenSSH. This OpenSSH package is configured to install and launch the backdoor, a shell script (inst.sh) that installs additional payloads and post-exploit activities.
Impact
The threat actors hijack SSH credentials and steal device resources for mining operations, exposing sensitive information. According to Microsoft, in an attempt to disguise the malicious traffic, the attacks use an established criminal infrastructure that leverages an unnamed Southeast Asian financial institution’s subdomain for C2 communications. The efforts made to evade detection indicate the complexity and scope of this attack.
DXC perspective
The best defense strategy involves monitoring the network and endpoints for C2 traffic, abnormal user activity, new user account creation, and new or unusual process creation. As part of an ongoing program to maintain a secure infrastructure, we encourage you to implement Microsoft’s recommendations for protecting your devices and networks against this cryptomining threat:
- Harden internet-facing devices against attacks
- Secure device configurations: Strengthen default passwords, and block SSH from external access.
- Maintain device health with updates to the latest firmware and patches.
- Establish least-privileges access that restricts remote access to devices and uses a secure virtual private network (VPN).
- When possible, update OpenSSH to the latest version.
- Adopt a comprehensive IoT security solution such as Microsoft Defender to allow visibility and monitoring of all IoT and operational technology (OT) devices, threat detection and response, and integration with security information and event management (SIEM)/security orchestration, automation and response (SOAR) and extended detection and response (XDR) platforms such as Microsoft Sentinel and Microsoft 365 Defender.
- Deploy security solutions with cross-domain visibility and detection capabilities like Microsoft 365 Defender to provide integrated defense across endpoints, identities, email, applications and data.
Threat hunting tips
Microsoft has supplied an SSH Brute force detection template in a Syslog solution package to monitor for brute force attempts against exposed SSH endpoints.
The order of attack events is unclear, but Microsoft researchers indicate that the malicious OpenSSH tool downloads the script. Once compromised, the threat actors install two open-source rootkits retrieved from GitHub:
- Rootkit 1: Diamorphine
- Rootkit 2: Reptile
After install, logs are deleted to prevent detection.
For persistent SSH access to the device, the backdoor appends two public keys to the authorized keys configuration files of all users on the system.
IOCs
Indicator Type
asterzeu[@]yahoo[.]com Email address
dotsysadmin[@]protonmail[.]com Email address
185.161.208[.]234 C2
139.180.185[.]24 C2
199.247.30[.]230 C2
149.28.239[.]146 C2
209.250.234[.]77 C2
70.34.220[.]100 C2
irc[.]socialfreedom[.]party C2
singapore[.]sg[.]socialfreedom[.]party C2
amsterdam[.]nl[.]socialfreedom[.]party C2
frankfurt[.]de[.]socialfreedom[.]party C2
sidney[.]au[.]socialfreedom[.]party C2
losangeles[.]us[.]socialfreedom[.]party C2
mumbaitravelers[.]org C2
sh[.]madagent[.]tm C2
ssh[.]madagent[.]tm C2
dumpx[.]madagent[.]tm C2
reg[.]madagent[.]tm C2
sshm[.]madagent[.]tm C2
z[.]madagent[.]tm C2
ssho[.]madagent[.]tm C2
sshr[.]madagent[.]tm C2
sshu[.]madagent[.]tm C2
user[.]madagent[.]tm C2
madagent[.]cc C2
cler[.]madagent[.]cc C2
dumpx[.]madagent[.]cc C2
mh[.]madagent[.]cc C2
ns1[.]madagent[.]cc C2
ns2[.]madagent[.]cc C2
ns3[.]madagent[.]cc C2
ns4[.]madagent[.]cc C2
reg[.]madagent[.]cc C2
ssh[.]madagent[.]cc C2
sshm[.]madagent[.]cc C2
ssho[.]madagent[.]cc C2
sshr[.]madagent[.]cc C2
sshu[.]madagent[.]cc C2
user[.]madagent[.]cc C2
www[.]madagent[.]cc C2
rsh[.]sys-stat[.]download C2
sh[.]sys-stat[.]download C2
sh[.]rawdot[.]net C2
ssho[.]rawdot[.]net C2
donate[.]xmr[.]rawdot[.]net C2
pool[.]rawdot[.]net C2
2018[.]rawdot[.]net C2
blog[.]rawdot[.]net C2
clients[.]rawdot[.]net C2
ftp[.]rawdot[.]net C2
psql01[.]rawdot[.]net C2
www[.]rawdot[.]net C2
sh[.]0xbadc0de[.]stream C2
ss[.]0xbadc0de[.]stream C2
a26631dcc1aef92a92d2d37476fb1e9becae54541e0411224a441d3afc20b02a Script to launch ZiggyStarTux
6e9b692b401a57db306bd6c95409042aa6ed075088a40a6ceb74f96895116b62 ZiggyStarTux
5e11731e570fc79ad07da4f137e103e0ebfa45530fabd8fa9a9fece4e497bce0 ZiggyStarTux
22c2115becd1d0ff9dfe70d14a52ab0354e420f4bfe0df70ca0d55d3c557c6b3 ZiggyStarTux
d335c83c0dd5bc9a078e796016f9a9f845ff89ee434c63c7a2e7b360e8be3e95 ZiggyStarTux
336928c813f3c0ab9aaad5a9853ed96b3f82e7b2b6d96139a7ebb146337dd248 ZiggyStarTux
1f6a52ce5ee017f88bd5f9028e3741e69837437cc48444d31d50ef28f1ed03f4 ZiggyStarTux
b72f21077f9f4d85d555cc6c18677e285b61f980ca99d0495d52f0cbbe66517a Malicious OpenSSH
8e7c6cbbb17ffe5ea98986dd36c3e979bc348626637ff9bfd55cb08414f3494c Malicious OpenSSH
39b640f62c0046139c41bccd0f98f96165597d50c4823ed88154160c0cae6bd1 Malicious OpenSSH
b77f991a9e0533a7bb39480ba7e96c29a1c1c9e2e212497cfbf6221751a196a2 Malicious OpenSSH
1782930bc2d46da541c980c09b13811f504b743e485a2befb0df1e5865a95847 Malicious OpenSSH
7ea1db1581afb977ec6d4abadf98660526205f23c366f7ba6aa04061762b5a7e Malicious OpenSSH
4b23d2126a6aec79396630dc10bdf279d9dafc71358145ab0b726cdf0a90dedf Malicious OpenSSH
081ad11e67af3fd98cb34cae89a5d26699f132a7ada62b1409eb85eaa4431437 Malicious OpenSSH
8ff06c7f0c105301397d15b1be3f6fe3ba081bbe042136c5b0fa4478ab59650d Backdoor
28616594b320b492c04429ab2f569d22d56bd9a047903f214d8b0eacab9b9c14 Backdoor
e22148ae0cb1a5cc7743351909cd0ae99ba6a84e181dded1cfa9fa0ed9e4f0e2 Backdoor
6101fcda212f2ee2340e85eaac071ffa95507166ba253d555a69c9ab6c16b148 Backdoor
52fb0dcd929d57e32c8383873897963dd671b626d7e31dd98d2b092a9b57be43 Backdoor
78701d6cafb3e477a033d63b99d480c2d7647079133ecabdcb54cd7a520e46de Backdoor
2eb5a4766dd7b90674f16eea62ba4e9c33dac8023e1692ed67c917bca448d14f Backdoor
c775964fe1207b6a6f9faf818c63874b2bf5612581e3c3b2d9f6eeee969229d8 Backdoor
75385bb1548c567c4814ad5c13fde6bf64e47694c244e1c26e903abc4523c667 Backdoor
bc1e444ab92bb40e41e08846f3e485ffa17ab98563f2ed2129ef1b02c3d5a878 Backdoor
8cb1df542bc60eb187066c136ae413540b33dd28c856ee472dd073affb96a84b Backdoor
55448d04183a253c939a6463c8992cbc007be237c80de92ff31e3f6606ebd470 Backdoor
9967921339799ed6f510c8a567f8bd69129d75d113f5c63612ceef0d5c4bf019 Backdoor
0a565ebae65fb5fbb34801c2948d35a0b7b5762a9ce51bd55a43181f46bc9723 Backdoor
fdfed7c2bf55d0f2440f623e265ab8b8006987f94d23982688914feffb3c549e Backdoor
32aa3e5fd9b79dcfd9ebe590b6784527cb17217cdeb61a1791bd4a5f721f0099 vars.sh archive
30d456d6dbd492923972d5f3ceb72c0f7e80d1f6391d6f9c0f5e889b6f71be66 vars.sh archive
74f4b030529435a8872c3e10d3341a1988d4fdbba89d9afd876458980f6f7a49 vars.sh archive
3033bb18554ce62f2f96338af682efb647c98d126734bb20426da8ec49ec1cdd Decode utility used by the backdoor
58b9622960e1bb189a403da6cd73e6ec2cb446680a18092351e5a9fa1a205cbc ss.patch
0027edb4a3c33f3d0cb5cc6fc85b58a8f7c70b8e57a2d28bed53f11c5f649848 inst.sh
7ca66932d9015bf14b89b8650408e39a65c96f59f9273feaede28cabca8a3bbc hive-start.tgz
9564172445e66f0d3cb64c42f2298f14093c342b95b023bcb82408b6f2a66cd3 lssh.tgz
722b1970caa804154d85fb3dba88cf192bf3eedd2fea40c8c49c98130797649d File from lssh.tgz
85877eb8f60c903ccb256e776c3e077295cf10eccff8d8ce4400edc699e8021f File from lssh.tgz
635b3dfadeab6b3c2574b1689607b776518d42c2b9fdb895e25c04a8ae9dee92 File from lssh.tgz
3ba302f533fcf065fe3f80b4bbea4653e86a5a8c1c752e4798a64a6be3d06e5d File from lssh.tgz
b8a360e7094e27857c7daacf624f2d9916e002201caf8a88c5aa3bd37f7bc264 File from lssh.tgz