In recent times, hackers have been relentlessly targeting Linux Secure Shell (SSH) servers, aiming to compromise vulnerable systems by installing tools for port scanning and dictionary attacks. This article delves into the research conducted by AhnLab Security Emergency Response Center, providing an in-depth analysis of attack campaigns and the various malware encountered. Additionally, we explore the tactics employed by threat actors during the attack process.
Analysis of Attack Campaigns
The AhnLab researchers meticulously analyzed attack campaigns, specifically focusing on hackers’ usage of IP scanning techniques to locate servers with activated SSH services or port 22. This method allows the attackers to identify potential targets and exploit their vulnerabilities.
Malware and Attack Options
In their quest for malicious activities, hackers have an array of tools at their disposal. Commonly found malware includes DDoS bots, CoinMiners, and other malicious software capable of performing scanning and brute force or dictionary attacks on infected systems. By installing this malware on compromised servers, threat actors gain control and further their objectives.
Common Malware Installed in Attacks
AhnLab researchers have identified several prevalent types of malware used in attacks on poorly managed Linux SSH servers. Some notable examples include ShellBot, Tsunami, ChinaZ DDoS Bot, and XMRig CoinMiner. By exploiting vulnerabilities in server management, hackers use these tools to gain unauthorized access and carry out their malicious activities.
Initial Login Attempts
Prior to the installation of malware, threat actors diligently attempt to log into Linux servers with activated SSH services using various combinations of identification (ID) and password credentials. This serves as their first and crucial step towards gaining control over the compromised system.
Variations in Attack Strategies
Interestingly, the researchers noticed a shift in strategy, where threat actors opted to install additional scanners instead of traditional malware. This technique increases their chances of identifying more vulnerable systems for potential exploitation.
Steps After Successful Login
Once a threat actor gains access to a compromised server, they proceed methodically. Their first objective is to determine the number of CPU cores on the compromised machine. This information allows them to make informed decisions regarding resource allocation and future actions.
Downloading Compressed File
To proceed with the attack, the hacker obtains account credentials from the compromised server. These valuable credentials grant the attacker the ability to log in again, using the compromised account, and initiate subsequent actions. The next step involves downloading a compressed file containing essential tools for the attack.
Contents of the Compressed File
The compressed file obtained by the threat actor contains two critical components: a powerful port scanner and an SSH dictionary attack tool. These tools provide the hacker with the means to identify vulnerable ports on target systems and launch a brute force or dictionary attack to gain unauthorized access.
Execution of the Attack
To execute the attack, threat actors employ a Bash script named “go” with the argument “212.” This script acts as a command center, orchestrating the execution of the port scanner, banner grabber, and the SSH dictionary attack tool. These tools combined enable the hacker to systematically exploit vulnerabilities in the target system.
The persistent targeting of Linux Secure Shell servers by hackers demands heightened vigilance from system administrators and advanced cybersecurity measures. Understanding the attack strategies employed by threat actors, such as the installation of port scanners and dictionary attack tools, allows organizations to adopt effective defensive measures and protect their infrastructure from unauthorized access and potential compromise. By remaining proactive, organizations can minimize the risks posed by these evolving attack techniques and ensure the security of their SSH servers.