Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows

Summary: Unit 42 researchers identified a new malware family called Xbash that targets Linux and Windows servers, tied to the Iron Group threat actor, combining botnet, ransomware and coinmining capabilities with worm-like self-propagation via weak passwords and unpatched vulnerabilities in Hadoop, Redis and ActiveMQ. The malware deletes MySQL, PostgreSQL and MongoDB databases and leaves ransom notes demanding 0.02 BTC, but Unit 42 found no code that backs up or restores the deleted data, and observed 48 incoming transactions totaling about 0.964 bitcoins across three hard-coded wallets since May 2018.

Key Takeaway: Xbash is data-destructive malware posing as ransomware - the 48 payments to its wallets bought victims nothing, because no restore capability exists in the code. A dormant LanScan module that enumerates and port-scans the victim's own subnet is already written but not yet wired in, and if enabled it could spread inside enterprise networks the way WannaCry and NotPetya did.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related