Cybercriminals Weaponizing Open-Source SSH-Snake Tool for Network Attacks

A recently open-sourced network mapping tool termed SSH-Snake has been repurposed by menace actors to perform destructive activities.

“SSH-Snake is a self-modifying worm that leverages SSH credentials found out on a compromised technique to start off spreading alone during the network,” Sysdig researcher Miguel Hernández mentioned.

“The worm mechanically lookups through recognised credential locations and shell historical past documents to identify its following move.”

SSH-Snake was 1st launched on GitHub in early January 2024, described by its developer as a “potent tool” to carry out computerized network traversal using SSH personal keys discovered on techniques.

In undertaking so, it produces a in depth map of a network and its dependencies, supporting decide the extent to which a network can be compromised using SSH and SSH non-public keys beginning from a distinct host. It also supports resolution of domains which have various IPv4 addresses.

“It is really fully self-replicating and self-propagating – and wholly fileless,” according to the project’s description. “In numerous means, SSH-Snake is actually a worm: It replicates by itself and spreads by itself from a single technique to a further as considerably as it can.”

Sysdig mentioned the shell script not only facilitates lateral movement, but also offers further stealth and flexibility than other regular SSH worms.

The cloud security organization explained it observed risk actors deploying SSH-Snake in real-world attacks to harvest qualifications, the IP addresses of the targets, and the bash command historical past subsequent the discovery of a command-and-management (C2) server hosting the info.

“The use of SSH keys is a encouraged follow that SSH-Snake tries to take advantage of in purchase to distribute,” Hernández mentioned. “It is smarter and a lot more responsible which will permit threat actors to get to farther into a network when they achieve a foothold.”

When arrived at for comment, Joshua Rogers, the developer of SSH-Snake, told The Hacker Information that the device provides legitimate technique owners a way to discover weaknesses in their infrastructure ahead of attackers do, urging corporations to use SSH-Snake to “discover the attack paths that exist — and fix them.”

“It would seem to be frequently thought that cyber terrorism ‘just happens’ all of a unexpected to devices, which exclusively needs a reactive method to security,” Rogers explained. “Instead, in my practical experience, methods need to be made and maintained with complete security measures.”

“If a cyber terrorist is in a position to operate SSH-Snake on your infrastructure and obtain hundreds of servers, emphasis really should be place on the people that are in cost of the infrastructure, with a aim of revitalizing the infrastructure this sort of that the compromise of a single host are not able to be replicated across thousands of other individuals.”

Rogers also termed interest to the “negligent operations” by companies that style and carry out insecure infrastructure, which can be simply taken about by a uncomplicated shell script.

“If programs ended up developed and taken care of in a sane way and method proprietors/organizations really cared about security, the fallout from such a script remaining executed would be minimized – as very well as if the steps taken by SSH-Snake have been manually performed by an attacker,” Rogers extra.

“As a substitute of reading through privacy procedures and executing info entry, security teams of companies apprehensive about this kind of script having above their overall infrastructure really should be carrying out overall re-architecture of their units by qualified security professionals – not these that created the architecture in the initially spot.”

The disclosure comes as Aqua uncovered a new botnet campaign named Lucifer that exploits misconfigurations and existing flaws in Apache Hadoop and Apache Druid to corral them into a network for mining cryptocurrency and staging dispersed denial-of-service (DDoS) attacks.

The hybrid cryptojacking malware was 1st documented by Palo Alto Networks Unit 42 in June 2020, contacting notice to its ability to exploit regarded security flaws to compromise Windows endpoints.

As quite a few as 3,000 unique attacks aimed at the Apache huge facts stack have been detected more than the previous thirty day period, the cloud security business stated. This also includes these that one out susceptible Apache Flink situations to deploy miners and rootkits.

“The attacker implements the attack by exploiting current misconfigurations and vulnerabilities in all those providers,” security researcher Nitzan Yaakov reported.

“Apache open up-source methods are greatly utilised by several people and contributors. Attackers may possibly perspective this in depth use as an chance to have inexhaustible resources for employing their attacks on them.”

Identified this report attention-grabbing? Follow us on Twitter  and LinkedIn to study a lot more exclusive written content we write-up.

Some areas of this report are sourced from:
thehackernews.com