The way Xbash behaves largely depends upon the infected platform and the services that it runs. This isn’t the way Linux based malware typically function. It can even scan for vulnerable servers associated with the intranet of an enterprise. “HTTP, VNC, MySQL, Memcached, MariaDB, FTP, Telnet, PostgreSQL, ElasticSearch, MongoDB, RDP, UPnP/SSDP, NTP, DNS, SNMP, LDAP, Rexec, Rlogic, Rsh, Rsync, Oracle database, CouchDB and phpMyAdmin.”īut it doesn’t search for weaknesses from randomly received IP addresses but fetches targeted IP addresses provided by its C&C server and also targets domains of public websites.

It starts the attack by identifying unpatched vulnerabilities, and devices having weak passwords, which are identified by scanning protocols and ports such as: Basically, the malware is designed to target and delete databases stored on Linux servers and the lost data cannot be recovered by the victims even if they pay the ransom because the malware lacks the capability of decrypting the data. They also explained that Xbash is utilizing its ransomware and botnet capabilities for targeting Linux servers, and using crypto-miner and self-propagating functionalities against Windows servers. They write that the malware, if implemented fully, can spread across the entire network of an organization instantaneously. Unit 42 division researchers Claud Xiao, Cong Zheng, and Xingyu Jin wrote in their blog post that it isn’t out of the ordinary to find multi-functional malware but they do admit that Xbash is somewhat too clever and unique. It can serve as ransomware, a botnet, worm, disk wiper and crypto-miner simultaneously.

This time, they are using Xbash, a self-propagating malware mash-up that is equipped with multiple features. Moreover, the APT threat actors from the Iron Group have been operating crypto transaction hijacking Trojans in the past. Palo Alto Networks’ Unit 42 researchers have come to the conclusion that the notorious Xbash malware that has been attacking Linux and Windows servers is being operated by the Iron Group which is an infamous hacker collective previously involved in a number of cyber crimes involving the use of ransomware and cryptominers.

Disk wiper