Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Blocking Dedicated Attacking Hosts Is Not Enough: In-Depth Analysis of a Worldwide Linux XorDDoS Campaign

Summary: Unit 42 Palo Alto Networks traced a new XorDDoS campaign that began in earnest on July 28, 2023, and delivered 30 unique malware variants on Aug. 12, using the same C2 domains as a 2022 campaign but migrated to 13 IP addresses on two legitimate public hosting providers. The Trojan infects Linux devices, probes for directory traversal to read /etc/passwd, gains access via SSH brute-force, and turns victims into zombies for DDoS attacks, with DNS requests for the C2 domains peaking at 961,438 on Aug. 20.

Bottom line: Because the C2 IPs also serve legitimate domains, blocking the known malicious hostnames leaves the attacker's underlying infrastructure reachable - and Unit 42's signatures still identified over 1,000 XorDDoS C2 sessions in August 2023 alone.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related