Forest Global Training Partners

Cyber Risks · Cisco Talos

Forgot About Default Accounts? No Worries, GoScanSSH Didn’t

Summary: Cisco Talos analyzed GoScanSSH, malware that brute-forces SSH on Linux-based devices using a wordlist of usernames including admin, guest, oracle, pi, root, test, ubnt, ubuntu and user, and reports successful logins back to command-and-control servers hosted on Tor and reached through the Tor2Web proxy service. Talos traced resolution attempts on the C2 domains back to June 19, 2017, indicating the campaign had been running at least nine months, with the most-resolved domain seen 8,579 times.

Bottom line: The malware checks reverse DNS and drops any target resolving to .mil, .gov or similar government and military domains, so the devices it keeps and infects are the ordinary ones - and a single default or weak SSH credential on a Linux host is enough to enroll it in a campaign that had already been running for at least nine months.

Read the original at Cisco Talos ↗

Topics
Malware
Related