EnemyBot Malware Targets Web Servers, CMS Tools and Android OS

A fast evolving IoT malware dubbed “EnemyBot” is concentrating on written content management methods (CMS), web servers and Android equipment. Threat actor team “Keksec” is considered at the rear of the distribution of the malware, according to researchers.

“Services these types of as VMware Workspace 1, Adobe ColdFusion, WordPress, PHP Scriptcase and additional are staying focused as effectively as IoT and Android units,” documented AT&T Alien labs in a latest submit. “The malware is rapidly adopting a single-day vulnerabilities as component of its exploitation abilities,” they extra.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

 According to AT&T’s analysis of the malware‘s code foundation, EnemyBot borrows generously from code used by other botnets these as Mirai, Qbot and Zbot. The Keksec team distributes the malware by concentrating on Linux equipment and IoT equipment, this danger group was fashioned back in 2016 and incorporates various botnet actors.

EnemyBot Working

The Alien lab investigation group study uncovered four major sections of the malware.

The initial segment is a python script ‘cc7.py’, utilised to down load all dependencies and compile the malware into distinctive OS architectures (x86, ARM, macOS, OpenBSD, PowerPC, MIPS). After compilation, a batch file “update.sh” is established and utilized to spread the malware to susceptible targets.

The next area is the principal botnet resource code, which features all the other operation of the malware excluding the principal element and incorporates resource codes of the a variety of botnets that can incorporate to conduct an attack.

The 3rd module is obfuscation segment “hide.c” and is compiled and executed manually to encode /decode the malware strings. A uncomplicated swap desk is used to hide strings and “each char is replaced with a corresponding char in the table” in accordance to scientists.

The past phase incorporates a command-and-management (CC) component to acquire critical steps and payloads from attackers.

AT&T researcher’s even more assessment disclosed a new scanner function to hunt susceptible IP addresses and an “adb_infect” operate that is applied to attack Android equipment.

ADB or Android Debug Bridge is a command-line device that lets you to connect with a product.

“In circumstance an Android product is linked via USB, or Android emulator managing on the device, EnemyBot will try out to infect it by executing shell command,” stated the researcher.

“Keksec’s EnemyBot appears to be just beginning to distribute, nevertheless because of to the authors’ immediate updates, this botnet has the likely to grow to be a significant threat for IoT devices and web servers,” the scientists included.

This Linux-centered botnet EnemyBot was to start with uncovered by Securonix in March 2022, and later in-depth assessment was finished by Fortinet.

Vulnerabilities Now Exploited by EnemyBot

The AT&T researchers release a listing of vulnerabilities that are presently exploited by the Enemybot, some of them are not assigned a CVE however.

The listing involves Log4shell vulnerability (CVE-2021-44228, CVE-2021-45046), F5 Huge IP devices (CVE-2022-1388), and some others. Some of the vulnerabilities ended up not assigned a CVE but this kind of as PHP Scriptcase and Adobe ColdFusion 11.

• Log4shell vulnerability – CVE-2021-44228, CVE-2021-45046
• F5 Big IP devices – CVE-2022-1388
• Spring Cloud Gateway – CVE-2022-22947
• TOTOLink A3000RU wi-fi router – CVE-2022-25075
• Kramer VIAWare – CVE-2021-35064

“This signifies that the Keksec group is effectively resourced and that the group has formulated the malware to acquire edge of vulnerabilities just before they are patched, as a result raising the velocity and scale at which it can unfold,” the researcher discussed.

Recommended Actions 

The Alien lab researcher implies procedures to protect from the exploitation. Users are suggested to use a adequately configured firewall and focus on cutting down Linux server and IOT devices’ exposure to the internet.

A different action suggested is to observe the network visitors, scan the outbound ports and search for the suspicious bandwidth use. Computer software ought to be current instantly and patched with the hottest security update.