Linux SSH Attacks Spread XMRig Miners and Additional Malware
Summary
AhnLab analyzed attacks on poorly managed Linux servers that use SSH-scanning malware to spread XMRig miners, ShellBot, and other tools. The malware establishes persistence and disguises mining activity; the campaign appears active since at least 2023.
Key points
- Attackers target Linux servers through SSH scanning and successful logins, using Go-written downloaders and propagation malware to install additional payloads.
- The “run” downloader changes the current user’s password, downloads an archive, and launches an XMRig miner and the “meta” propagation malware.
- “Meta” scans supplied address ranges using provided credentials, installs the miner on successfully accessed servers, and reports results to a remote site.
- The miner creates a systemd service and uses watchdog and cron mechanisms to maintain execution across reboots.
- Malware disguises processes as legitimate Linux services and uses command aliases and output manipulation to conceal activity from administrators.
- The attackers also distributed ShellBot, a Perl-based IRC bot with DDoS and system-control capabilities, and MIG Logcleaner.
- AhnLab recommends strong, regularly changed passwords, timely vulnerability patching, and access controls such as firewalls for publicly accessible servers.
Article Details
- Attack Vectors
- SSH scanning and login attempts against poorly managed Linux servers; after successful access, commands install downloaders and propagation malware.
- Propagation malware scans specified address ranges for SSH services and uses supplied credentials to install additional malware.
- The malware downloads and executes payloads, including XMRig CoinMiner variants, ShellBot, MIG Logcleaner, and XHide.
- Defensive Notes
- Use difficult-to-guess passwords and change them periodically to reduce brute-force and dictionary attacks.
- Apply the latest vulnerability patches and use firewalls or other security products to control access to publicly accessible servers.
- Keep V3 updated to the latest version.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | download[.]xrpl[.]city | Malware-download host used to retrieve the run downloader and additional payloads. |
| DOMAIN | irc[.]lat | ShellBot C&C server address listed in its configuration. |
| DOMAIN | irc[.]undernet[.]org | ShellBot C&C server address listed in its configuration. |
| DOMAIN | sad[.]lat | XMRig mining pool address used by the malware. |
| DOMAIN | time[.]justnames[.]in | Mining pool address stored in the Discord XMRig variant's configuration. |
| DOMAIN | youpost[.]in | Destination to which the propagation malware sends attack results by HTTP POST. |
| IPV4 | 143[.]20[.]185[.]252 | IP address listed in the article's threat indicators. |
| IPV4 | 146[.]19[.]213[.]82 | Mining pool address used by the XMRig CoinMiner. |
| IPV4 | 172[.]245[.]81[.]188 | Mining pool address used by the XMRig CoinMiner. |
| IPV4 | 185[.]242[.]3[.]57 | IP address listed in the article's threat indicators. |
| IPV4 | 192[.]3[.]9[.]34 | Mining pool address used by the XMRig CoinMiner. |
| IPV4 | 23[.]94[.]137[.]96 | Mining pool address used by the XMRig CoinMiner. |
| MD5 | 0d01bd11d1d3e7676613aacb109de55f | MD5 hash listed in the article's malware indicators. |
| MD5 | 0fde38c0cfa5e5bf8e6ac2a6be0232b7 | MD5 hash listed in the article's malware indicators. |
| MD5 | 161d62e4b7ab39f677e7a6828039ef79 | MD5 hash listed in the article's malware indicators. |
| MD5 | 2fcad1ae4a29ddb3862f3674065e7433 | MD5 hash listed in the article's malware indicators. |
| MD5 | 3565360c4102e152852976effc9aab85 | MD5 hash listed in the article's malware indicators. |
| URL | hxxp[:]//download[.]xrpl[.]city/[.]b0t | Malware-distribution URL used to distribute ShellBot. |
| URL | hxxp[:]//download[.]xrpl[.]city/auto/auto[.]jpg | Malware-distribution URL hosting a compressed file containing scripts, XHide, and XMRig. |
| URL | hxxp[:]//download[.]xrpl[.]city/auto/mig | URL listed as malware-distribution infrastructure; the article associates MIG Logcleaner with distribution from the same address. |
| URL | hxxp[:]//download[.]xrpl[.]city/run | Downloader URL used to install malware on targeted Linux servers. |
| URL | hxxp[:]//download[.]xrpl[.]city/test/pack[.]jpg | Payload URL used by the downloader to retrieve a compressed malware package. |
MITRE ATT&CK
T1021.004 · SSHThe malware uses SSH connections and supplied credentials to access other servers and install payloads.T1036 · MasqueradingXHide changes argv[0] so XMRig runs under a disguised process name; other malware also disguises processes as legitimate system processes.T1046 · Network Service DiscoveryThe propagation malware scans address ranges for SSH ports.T1053.003 · CronThe malware adds a reboot-triggered command to cron to relaunch a copied miner.T1071.003 · Mail ProtocolsShellBot communicates with its C&C servers using IRC.T1105 · Ingress Tool TransferThe malware downloads its downloader, compressed packages, and other payloads from distribution servers.T1110.001 · Password GuessingThe article describes SSH brute-force and dictionary attacks against Linux servers.T1496 · Resource HijackingThe malware uses compromised servers' resources to mine Monero for the threat actor.T1543.002 · Systemd ServiceThe CoinMiner creates a Systemd service at /etc/systemd/system/oracle-service.Service.
Malware
MIG LogCleanerIn these attack cases, malware such as ShellBot, MIG LogCleaner, and XHide were used.PerlBotShellBot was also distributed from malware distribution servers under the name “.B0t.” ShellBot, also known as PerlBot, is a DDoS bot developed in Perl.ShellBotIn these attack cases, malware such as ShellBot, MIG LogCleaner, and XHide were used.XHideIn these attack cases, malware such as ShellBot, MIG LogCleaner, and XHide were used.XMRigRecently, ASEC identified cases where malware with propagation capabilities was used to install the XMRig CoinMiner.