Wiz Details Evolving Diicot Malware Campaign Targeting Linux Systems

Dec 17, 2024 · Original article ↗

Summary

Wiz researchers attribute an evolving Linux malware campaign to Diicot. The malware brute-forces weak SSH credentials, spreads in cloud environments, and establishes persistence; researchers suspect it mines cryptocurrency on non-cloud systems.

Key points

Wiz researchers attribute the campaign to the Romanian-speaking Diicot group, also known as Mexals, and report finding malware in several cloud environments.
The malware scans for OpenSSH systems and uses lists of weak username-password combinations to gain access and spread to additional hosts.
The main Go-based Update payload checks Linux distribution and version: researchers observed cloud-aware spreading, while cryptomining on non-cloud systems is suspected.
Modified UPX headers and corrupted checksums hinder standard unpacking tools; a separate payload provides a reverse shell for remote command execution.
The malware uses crontab jobs for persistence and sends successful brute-force results—including victim IP addresses, usernames, and passwords—to its command-and-control infrastructure.
Researchers found no mining activity in the customer environment they investigated. They estimate that wallets linked to the campaign earned over $16,000 from Monero mining; additional Zephyr earnings are suspected but difficult to trace.

Article Details

Attack Vectors: The campaign targets Linux systems running OpenSSH, using SSH brute force against weak credentials to gain access and scan for additional SSH hosts.
The Update payload adapts its behavior to detected Linux distributions and versions, prioritizing propagation in cloud environments and potentially deploying a cryptominer in non-cloud environments.
Payloads use modified UPX headers and corrupted checksums to hinder unpacking and detection.
The malware uses a reverse shell for remote command execution, modifies crontab entries for persistence, and reports errors and successful brute-force attempts to C2 infrastructure.
Defensive Notes: Secure SSH with strong credentials and prevent root SSH logins; misconfigured SSH and weak credentials can enable compromise.
Monitor for SSH brute-force activity, reverse-shell connections, crontab modifications, and cryptomining behavior.
Use malware detection capable of identifying evolving threats and modified UPX-packed files; standard UPX recovery tools may not unpack these samples.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`digital[.]digitaldatainsights[.]org`	Attacker-controlled payload server used to host campaign scripts and payloads.
DOMAIN	`pauza[.]digitaldatainsights[.]org`	Attacker-controlled reverse-shell C2 domain; reported as inactive at publication.
DOMAIN	`test[.]digitaldatainsights[.]org`	C2 and mining-pool domain associated with the campaign.
DOMAIN	`web[.]digitaldatainsights[.]org`	Domain associated with an old campaign payload server.
IPV4	`139[.]99[.]123[.]196`	Mining-pool endpoint listed with the campaign's mining configuration.
IPV4	`147[.]189[.]132[.]45`	Mining-pool endpoint listed with the campaign's mining configuration.
IPV4	`185[.]112[.]249[.]20`	Old payload server identified in the campaign's infrastructure table.
IPV4	`46[.]102[.]174[.]115`	Mining-pool endpoint listed with the campaign's mining configuration.
IPV4	`80[.]76[.]51[.]5`	Attacker-controlled main payload server; also served the identified cryptomining payload.
IPV4	`87[.]120[.]114[.]219`	Hardcoded fallback reverse-shell C2 address.
IPV4	`87[.]120[.]116[.]242`	Mining-pool endpoint listed with the campaign's mining configuration.
IPV4	`87[.]120[.]116[.]35`	C2 server receiving malware reports and also listed as a mining-pool endpoint.
IPV4	`91[.]92[.]250[.]6`	Additional old payload server assessed by the researchers as belonging to the same group.
SHA1	`07f200ad0b5a03433a184b442dcd7a688e1ff7a7`	SHA1 of the .diicot payload uploaded to the attack server.
SHA1	`1d56f998bc4f7b649f882a2d730d5e9b1b2e621f`	SHA1 of the retea payload uploaded to the attack server.
SHA1	`2ec6af460feabfe9ed37c1955ff266cff63f31ff`	SHA1 of the cache reverse-shell payload embedded in Update.
SHA1	`7940c6e29ab9cf6abe5e570f73eed93265962e1a`	SHA1 of the .bisis network scanner embedded in Update.
SHA1	`7ece24f3b426169d720ab8353e07f0feb6dbc854`	SHA1 of black4, a script uploaded to the attack server.
SHA1	`970b45be172ffb9d3192a8d2d015b1c91b216107`	SHA1 of the network payload uploaded to the attack server.
SHA1	`a2101ec53fb0934b23f83c582d3a0bed9f66fd13`	SHA1 of the Update primary payload, also embedded in abc123.
SHA1	`a8a5d0223519590bb48e0b52102786623ec45511`	SHA1 of the .b payload embedded in Update.
SHA1	`e0e3456a0b3c06a33cbb4db1f7d1335b777cf107`	SHA1 of a later abc123 payload uploaded to the attack server.
SHA1	`f657f695faf2cfd9f6f2188d154f7767da248b9e`	SHA1 of the .c payload embedded in Update.
SHA1	`f82b2df5e01abab70085a12388b3ec83c5e33ba1`	SHA1 of an abc123 cryptomining payload uploaded to the attack server.
URL	`hxxp[:]//80[.]76[.]51[.]5/.NzJjOTY`	Specific path on the attacker-controlled payload server containing the identified cryptomining payload.
URL	`hxxp[:]//87[.]120[.]116[.]35:1418/save-data?err=L3Jvb3Qvc2tlbWEvYnJ1dGUtc3ByZWFkZXIuZ286MjE4OiBFIGRlIGxhIGNyb250YWIgdWlkMA==`	C2 reporting URL used by the malware to send error reports.