Hackers Targeting Linux Secure Shell Servers: Analysis Reveals Advanced Attack Strategies

In recent times, hackers have been relentlessly targeting Linux Secure Shell (SSH) servers, aiming to compromise vulnerable systems by installing tools for port scanning and dictionary attacks. This article delves into the research conducted by AhnLab Security Emergency Response Center, providing an in-depth analysis of attack campaigns and the various malware encountered. Additionally, we explore the tactics employed by threat actors during the attack process.

Analysis of Attack Campaigns

The AhnLab researchers meticulously analyzed attack campaigns, specifically focusing on hackers’ usage of IP scanning techniques to locate servers with activated SSH services or port 22. This method allows the attackers to identify potential targets and exploit their vulnerabilities.

Malware and Attack Options

In their quest for malicious activities, hackers have an array of tools at their disposal. Commonly found malware includes DDoS bots, CoinMiners, and other malicious software capable of performing scanning and brute force or dictionary attacks on infected systems. By installing this malware on compromised servers, threat actors gain control and further their objectives.

Common Malware Installed in Attacks

AhnLab researchers have identified several prevalent types of malware used in attacks on poorly managed Linux SSH servers. Some notable examples include ShellBot, Tsunami, ChinaZ DDoS Bot, and XMRig CoinMiner. By exploiting vulnerabilities in server management, hackers use these tools to gain unauthorized access and carry out their malicious activities.

Initial Login Attempts

Prior to the installation of malware, threat actors diligently attempt to log into Linux servers with activated SSH services using various combinations of identification (ID) and password credentials. This serves as their first and crucial step towards gaining control over the compromised system.

Variations in Attack Strategies

Interestingly, the researchers noticed a shift in strategy, where threat actors opted to install additional scanners instead of traditional malware. This technique increases their chances of identifying more vulnerable systems for potential exploitation.

Steps After Successful Login

Once a threat actor gains access to a compromised server, they proceed methodically. Their first objective is to determine the number of CPU cores on the compromised machine. This information allows them to make informed decisions regarding resource allocation and future actions.

Downloading Compressed File

To proceed with the attack, the hacker obtains account credentials from the compromised server. These valuable credentials grant the attacker the ability to log in again, using the compromised account, and initiate subsequent actions. The next step involves downloading a compressed file containing essential tools for the attack.

Contents of the Compressed File

The compressed file obtained by the threat actor contains two critical components: a powerful port scanner and an SSH dictionary attack tool. These tools provide the hacker with the means to identify vulnerable ports on target systems and launch a brute force or dictionary attack to gain unauthorized access.

Execution of the Attack

To execute the attack, threat actors employ a Bash script named “go” with the argument “212.” This script acts as a command center, orchestrating the execution of the port scanner, banner grabber, and the SSH dictionary attack tool. These tools combined enable the hacker to systematically exploit vulnerabilities in the target system.

The persistent targeting of Linux Secure Shell servers by hackers demands heightened vigilance from system administrators and advanced cybersecurity measures. Understanding the attack strategies employed by threat actors, such as the installation of port scanners and dictionary attack tools, allows organizations to adopt effective defensive measures and protect their infrastructure from unauthorized access and potential compromise. By remaining proactive, organizations can minimize the risks posed by these evolving attack techniques and ensure the security of their SSH servers.

Explore more

BSP Boosts Efficiency with AI-Powered Reconciliation System

In an era where precision and efficiency are vital in the banking sector, BSP has taken a significant stride by partnering with SmartStream Technologies to deploy an AI-powered reconciliation automation system. This strategic implementation serves as a cornerstone in BSP’s digital transformation journey, targeting optimized operational workflows, reducing human errors, and fostering overall customer satisfaction. The AI-driven system primarily automates

Is Gen Z Leading AI Adoption in Today’s Workplace?

As artificial intelligence continues to redefine modern workspaces, understanding its adoption across generations becomes increasingly crucial. A recent survey sheds light on how Generation Z employees are reshaping perceptions and practices related to AI tools in the workplace. Evidently, a significant portion of Gen Z feels that leaders undervalue AI’s transformative potential. Throughout varied work environments, there’s a belief that

Can AI Trust Pledge Shape Future of Ethical Innovation?

Is artificial intelligence advancing faster than society’s ability to regulate it? Amid rapid technological evolution, AI use around the globe has surged by over 60% within recent months alone, pushing crucial ethical boundaries. But can an AI Trustworthy Pledge foster ethical decisions that align with technology’s pace? Why This Pledge Matters Unchecked AI development presents substantial challenges, with risks to

Data Integration Technology – Review

In a rapidly progressing technological landscape where organizations handle ever-increasing data volumes, integrating this data effectively becomes crucial. Enterprises strive for a unified and efficient data ecosystem to facilitate smoother operations and informed decision-making. This review focuses on the technology driving data integration across businesses, exploring its key features, trends, applications, and future outlook. Overview of Data Integration Technology Data

Navigating SEO Changes in the Age of Large Language Models

As the digital landscape continues to evolve, the intersection of Large Language Models (LLMs) and Search Engine Optimization (SEO) is becoming increasingly significant. Businesses and SEO professionals face new challenges as LLMs begin to redefine how online content is managed and discovered. These models, which leverage vast amounts of data to generate context-rich responses, are transforming traditional search engines. They