Watchbog and the Importance of Patching
Summary: Cisco Talos describes Watchbog, a Linux-based malware that used Pastebin for command and control and was relatively simple to uncover despite base64 encoding of URLs and Pastebins. The installation script killed competing cryptocurrency miners, made three attempts to download a 'kerberods' dropper via wget or curl, and pulled a Monero wallet ID from Pastebin to install the XMR-Stak miner, while a Bash script used known_hosts and SSH keys for lateral movement and targeted CVE-2018-1000861 in Jenkins up to versions 2.138.1 or 2.145.
Bottom line: The attackers claimed to be finding vulnerabilities before 'real' hackers could, but Cisco IR found signs of hosts joining a separate botnet around the same time - and the lateral movement script needed only the known_hosts file and existing SSH keys to spread.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026