Security News > 2022 > January > Abcbot Botnet Linked to Operators of Xanthe Cryptomining malware

New research into the infrastructure behind an emerging DDoS botnet named Abcbot has uncovered links with a cryptocurrency-mining botnet attack that came to light in December 2020.

Attacks involving Abcbot, first disclosed by Qihoo 360's Netlab security team in November 2021, are triggered via a malicious shell script that targets insecure cloud instances operated by cloud service providers such as Huawei, Tencent, Baidu, and Alibaba Cloud to download malware that co-opts the machine to a botnet, but not before terminating processes from competing threat actors and establishing persistence.

In an interesting twist, continued analysis of the botnet by mapping all known Indicators of Compromise, including IP addresses, URLs, and samples, has revealed Abcbot's code and feature-level similarities to that of a cryptocurrency mining operation dubbed Xanthe that exploited incorrectly-configured Docker implementations to propagate the infection.

"The same threat actor is responsible for both Xanthe and Abcbot and is shifting its objective from mining cryptocurrency on compromised hosts to activities more traditionally associated with botnets, such as DDoS attacks," Cado Security's Matt Muir said in a report shared with The Hacker News.

The semantic overlaps between the two malware families range from how the source code is formatted to the names given to the routines, with some functions not only sporting identical names and implementation but also having the word "Go" appended to the end of the function names.

The deep-dive examination of the malware artifacts revealed the botnet's capability to create as many as four users of their own by using generic, inconspicuous names like "Autoupdater," "Logger," "Sysall," and "System" to avoid detection, and adding them to the sudoers file to give the rogue users administrative powers over the infected system.

News URL

https://thehackernews.com/2022/01/abcbot-botnet-linked-to-operators-of.html