Malware attacks on Linux routers in Japan have been confirmed by JPCERT/CC

The Japanese Computer Emergency Response Team Coordination Center (JPCERT/CC) recently confirmed malware attacks on routers in Japan, targeting Linux routers with a new Golang RAT known as GobRAT. In this article, we will delve into the methods used by the attacker to exploit public router WEBUIs, the multifunctional Loader Script used to deploy GobRAT, how GobRAT executes on the machine, and its various functions, including the 22 commands used by GobRAT to communicate with its C2 server.

Methodology and Steps of the GobRAT Attack

The attacker exploits publicly accessible router WEBUIs, leveraging potential vulnerabilities to infect them with the GobRAT. The first step in the attacker’s process is targeting a publicly accessible router with an open WEBUI, exploiting vulnerabilities through script execution, and ultimately installing the GobRAT malware.

The multifunctional loader encompasses tasks such as script generation and downloading GobRAT. Additionally, it contains a hard-coded SSH public key for the assumed backdoor. The Loader Script disguises itself as the Apache daemon process (apached) to avoid being detected, making GobRAT downloading easier.

The Start Script is responsible for executing GobRAT and distinguishes itself by recording the startup time in a file called restart[.]log, while also running GobRAT under the guise of a legitimate process named apached. The script runs at regular intervals and ensures that GobRAT is up and running without interruption, while also keeping track of its execution and startup times.

The Status Monitoring Script is a daemon that checks the status of the Start Script every 20 seconds and ensures the continuous operation of the GobRAT payload. With this script, the attacker can guarantee uninterrupted operation of the GobRAT ransomware.

TLS Communication for Data Transfer

GobRAT utilizes TLS for data communication with the C2 server. The encryption mechanism provides confidentiality, integrity, and authenticity. This means that the attacker can easily transmit sensitive and confidential data over the network without any risk of interception or tampering by network attackers.

GobRAT utilizes 22 commands from the C2 server, which are grouped into communication functions such as frpc, socks5, and C2 reconfiguration. For instance, the frpc function allows the malware to bind to a specific port to receive data from the command-and-control center, facilitating communication between the C2 server and GobRAT malware.

In conclusion, GobRAT is a new RAT that is actively being used in Japan to target Linux routers. We have discussed the methodology and stages of the GobRAT attack, including the multifunctional Loader Script, Start Script, and Daemon Script. It is highly advisable to keep routers updated with the latest security patches and configurations to prevent cyber attacks of any kind.

Explore more

Why Should Leaders Invest in Employee Career Growth?

In today’s fast-paced business landscape, a staggering statistic reveals the stakes of neglecting employee development: turnover costs the median S&P 500 company $480 million annually due to talent loss, underscoring a critical challenge for leaders. This immense financial burden highlights the urgent need to retain skilled individuals and maintain a competitive edge through strategic initiatives. Employee career growth, often overlooked

Making Time for Questions to Boost Workplace Curiosity

Introduction to Fostering Inquiry at Work Imagine a bustling office where deadlines loom large, meetings are packed with agendas, and every minute counts—yet no one dares to ask a clarifying question for fear of derailing the schedule. This scenario is all too common in modern workplaces, where the pressure to perform often overshadows the need for curiosity. Fostering an environment

Embedded Finance: From SaaS Promise to SME Practice

Imagine a small business owner managing daily operations through a single software platform, seamlessly handling not just inventory or customer relations but also payments, loans, and business accounts without ever stepping into a bank. This is the transformative vision of embedded finance, a trend that integrates financial services directly into vertical Software-as-a-Service (SaaS) platforms, turning them into indispensable tools for

DevOps Tools: Gateways to Major Cyberattacks Exposed

In the rapidly evolving digital ecosystem, DevOps tools have emerged as indispensable assets for organizations aiming to streamline software development and IT operations with unmatched efficiency, making them critical to modern business success. Platforms like GitHub, Jira, and Confluence enable seamless collaboration, allowing teams to manage code, track projects, and document workflows at an accelerated pace. However, this very integration

Trend Analysis: Agentic DevOps in Digital Transformation

In an era where digital transformation remains a critical yet elusive goal for countless enterprises, the frustration of stalled progress is palpable— over 70% of initiatives fail to meet expectations, costing billions annually in wasted resources and missed opportunities. This staggering reality underscores a persistent struggle to modernize IT infrastructure amid soaring costs and sluggish timelines. As companies grapple with