Malware attacks on Linux routers in Japan have been confirmed by JPCERT/CC

The Japanese Computer Emergency Response Team Coordination Center (JPCERT/CC) recently confirmed malware attacks on routers in Japan, targeting Linux routers with a new Golang RAT known as GobRAT. In this article, we will delve into the methods used by the attacker to exploit public router WEBUIs, the multifunctional Loader Script used to deploy GobRAT, how GobRAT executes on the machine, and its various functions, including the 22 commands used by GobRAT to communicate with its C2 server.

Methodology and Steps of the GobRAT Attack

The attacker exploits publicly accessible router WEBUIs, leveraging potential vulnerabilities to infect them with the GobRAT. The first step in the attacker’s process is targeting a publicly accessible router with an open WEBUI, exploiting vulnerabilities through script execution, and ultimately installing the GobRAT malware.

The multifunctional loader encompasses tasks such as script generation and downloading GobRAT. Additionally, it contains a hard-coded SSH public key for the assumed backdoor. The Loader Script disguises itself as the Apache daemon process (apached) to avoid being detected, making GobRAT downloading easier.

The Start Script is responsible for executing GobRAT and distinguishes itself by recording the startup time in a file called restart[.]log, while also running GobRAT under the guise of a legitimate process named apached. The script runs at regular intervals and ensures that GobRAT is up and running without interruption, while also keeping track of its execution and startup times.

The Status Monitoring Script is a daemon that checks the status of the Start Script every 20 seconds and ensures the continuous operation of the GobRAT payload. With this script, the attacker can guarantee uninterrupted operation of the GobRAT ransomware.

TLS Communication for Data Transfer

GobRAT utilizes TLS for data communication with the C2 server. The encryption mechanism provides confidentiality, integrity, and authenticity. This means that the attacker can easily transmit sensitive and confidential data over the network without any risk of interception or tampering by network attackers.

GobRAT utilizes 22 commands from the C2 server, which are grouped into communication functions such as frpc, socks5, and C2 reconfiguration. For instance, the frpc function allows the malware to bind to a specific port to receive data from the command-and-control center, facilitating communication between the C2 server and GobRAT malware.

In conclusion, GobRAT is a new RAT that is actively being used in Japan to target Linux routers. We have discussed the methodology and stages of the GobRAT attack, including the multifunctional Loader Script, Start Script, and Daemon Script. It is highly advisable to keep routers updated with the latest security patches and configurations to prevent cyber attacks of any kind.

Explore more

How Can MRP and MPS Optimize Your Supply Chain in D365?

Introduction Imagine a manufacturing operation where every order is fulfilled on time, inventory levels are perfectly balanced, and production schedules run like clockwork, all without excessive costs or last-minute scrambles. This scenario might seem like a distant dream for many businesses grappling with supply chain complexities. Yet, with the right tools in Microsoft Dynamics 365 Business Central, such efficiency is

Streamlining ERP Reporting in Dynamics 365 BC with FYIsoft

In the fast-paced realm of enterprise resource planning (ERP), financial reporting within Microsoft Dynamics 365 Business Central (BC) has reached a pivotal moment where innovation is no longer optional but essential. Finance professionals are grappling with intricate data sets spanning multiple business functions, often bogged down by outdated tools and cumbersome processes that fail to keep up with modern demands.

Top Digital Marketing Trends Shaping the Future of Brands

In an era where digital interactions dominate consumer behavior, brands face an unprecedented challenge: capturing attention in a crowded online space where billions of interactions occur daily. Imagine a scenario where a single misstep in strategy could mean losing relevance overnight, as competitors leverage cutting-edge tools to engage audiences in ways previously unimaginable. This reality underscores a critical need for

Microshifting Redefines the Traditional 9-to-5 Workday

Imagine a workday where logging in at 6 a.m. to tackle critical tasks, stepping away for a midday errand, and finishing a project after dinner feels not just possible, but encouraged. This isn’t a far-fetched dream; it’s the reality for a growing number of employees embracing a trend known as microshifting. With 65% of office workers craving more schedule flexibility

Boost Employee Engagement with Attention-Grabbing Tactics

Introduction to Employee Engagement Challenges and Solutions Imagine a workplace where half the team is disengaged, merely going through the motions, while productivity stagnates and innovative ideas remain unspoken. This scenario is all too common, with studies showing that a significant percentage of employees worldwide lack a genuine connection to their roles, directly impacting retention, creativity, and overall performance. Employee