Malware attacks on Linux routers in Japan have been confirmed by JPCERT/CC

The Japanese Computer Emergency Response Team Coordination Center (JPCERT/CC) recently confirmed malware attacks on routers in Japan, targeting Linux routers with a new Golang RAT known as GobRAT. In this article, we will delve into the methods used by the attacker to exploit public router WEBUIs, the multifunctional Loader Script used to deploy GobRAT, how GobRAT executes on the machine, and its various functions, including the 22 commands used by GobRAT to communicate with its C2 server.

Methodology and Steps of the GobRAT Attack

The attacker exploits publicly accessible router WEBUIs, leveraging potential vulnerabilities to infect them with the GobRAT. The first step in the attacker’s process is targeting a publicly accessible router with an open WEBUI, exploiting vulnerabilities through script execution, and ultimately installing the GobRAT malware.

The multifunctional loader encompasses tasks such as script generation and downloading GobRAT. Additionally, it contains a hard-coded SSH public key for the assumed backdoor. The Loader Script disguises itself as the Apache daemon process (apached) to avoid being detected, making GobRAT downloading easier.

The Start Script is responsible for executing GobRAT and distinguishes itself by recording the startup time in a file called restart[.]log, while also running GobRAT under the guise of a legitimate process named apached. The script runs at regular intervals and ensures that GobRAT is up and running without interruption, while also keeping track of its execution and startup times.

The Status Monitoring Script is a daemon that checks the status of the Start Script every 20 seconds and ensures the continuous operation of the GobRAT payload. With this script, the attacker can guarantee uninterrupted operation of the GobRAT ransomware.

TLS Communication for Data Transfer

GobRAT utilizes TLS for data communication with the C2 server. The encryption mechanism provides confidentiality, integrity, and authenticity. This means that the attacker can easily transmit sensitive and confidential data over the network without any risk of interception or tampering by network attackers.

GobRAT utilizes 22 commands from the C2 server, which are grouped into communication functions such as frpc, socks5, and C2 reconfiguration. For instance, the frpc function allows the malware to bind to a specific port to receive data from the command-and-control center, facilitating communication between the C2 server and GobRAT malware.

In conclusion, GobRAT is a new RAT that is actively being used in Japan to target Linux routers. We have discussed the methodology and stages of the GobRAT attack, including the multifunctional Loader Script, Start Script, and Daemon Script. It is highly advisable to keep routers updated with the latest security patches and configurations to prevent cyber attacks of any kind.

Explore more

Can Federal Lands Power the Future of AI Infrastructure?

I’m thrilled to sit down with Dominic Jainy, an esteemed IT professional whose deep knowledge of artificial intelligence, machine learning, and blockchain offers a unique perspective on the intersection of technology and federal policy. Today, we’re diving into the US Department of Energy’s ambitious plan to develop a data center at the Savannah River Site in South Carolina. Our conversation

Can Your Mouse Secretly Eavesdrop on Conversations?

In an age where technology permeates every aspect of daily life, the notion that a seemingly harmless device like a computer mouse could pose a privacy threat is startling, raising urgent questions about the security of modern hardware. Picture a high-end optical mouse, designed for precision in gaming or design work, sitting quietly on a desk. What if this device,

Building the Case for EDI in Dynamics 365 Efficiency

In today’s fast-paced business environment, organizations leveraging Microsoft Dynamics 365 Finance & Supply Chain Management (F&SCM) are increasingly faced with the challenge of optimizing their operations to stay competitive, especially when manual processes slow down critical workflows like order processing and invoicing, which can severely impact efficiency. The inefficiencies stemming from outdated methods not only drain resources but also risk

Structured Data Boosts AI Snippets and Search Visibility

In the fast-paced digital arena where search engines are increasingly powered by artificial intelligence, standing out amidst the vast online content is a formidable challenge for any website. AI-driven systems like ChatGPT, Perplexity, and Google AI Mode are redefining how information is retrieved and presented to users, moving beyond traditional keyword searches to dynamic, conversational summaries. At the heart of

How Is Oracle Boosting Cloud Power with AMD and Nvidia?

In an era where artificial intelligence is reshaping industries at an unprecedented pace, the demand for robust cloud infrastructure has never been more critical, and Oracle is stepping up to meet this challenge head-on with strategic alliances that promise to redefine its position in the market. As enterprises increasingly rely on AI-driven solutions for everything from data analytics to generative