Security News > 2023 > October > ShellBot Uses Hex IPs to Evade Detection in Attacks on Linux SSH Servers
2023-10-12 11:27
The threat actors behind ShellBot are leveraging IP addresses transformed into its hexadecimal notation to infiltrate poorly managed Linux SSH servers and deploy the DDoS malware. "The overall flow remains the same, but the download URL used by the threat actor to install ShellBot has changed from a regular IP address to a hexadecimal value," the AhnLab Security Emergency response Center (ASEC)
News URL
https://thehackernews.com/2023/10/shellbot-uses-hex-ips-to-evade.html
Related news
- New scanner finds Linux, UNIX servers exposed to CUPS RCE attacks (source)
- New Perfctl Malware Targets Linux Servers for Cryptocurrency Mining and Proxyjacking (source)
- Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks (source)
- Exploit released for new Windows Server "WinReg" NTLM Relay attack (source)
- Windows infected with backdoored Linux VMs in new phishing attacks (source)
- Critical RCE bug in VMware vCenter Server now exploited in attacks (source)
- New 'Helldown' Ransomware Variant Expands Attacks to VMware and Linux Systems (source)
- 'Alarming' security bugs lay low in Linux's needrestart server utility for 10 years (source)