The Japanese Computer Emergency Response Team Coordination Center (JPCERT/CC) recently confirmed malware attacks on routers in Japan, targeting Linux routers with a new Golang RAT known as GobRAT. In this article, we will delve into the methods used by the attacker to exploit public router WEBUIs, the multifunctional Loader Script used to deploy GobRAT, how GobRAT executes on the machine, and its various functions, including the 22 commands used by GobRAT to communicate with its C2 server.
Methodology and Steps of the GobRAT Attack
The attacker exploits publicly accessible router WEBUIs, leveraging potential vulnerabilities to infect them with the GobRAT. The first step in the attacker’s process is targeting a publicly accessible router with an open WEBUI, exploiting vulnerabilities through script execution, and ultimately installing the GobRAT malware.
The multifunctional loader encompasses tasks such as script generation and downloading GobRAT. Additionally, it contains a hard-coded SSH public key for the assumed backdoor. The Loader Script disguises itself as the Apache daemon process (apached) to avoid being detected, making GobRAT downloading easier.
The Start Script is responsible for executing GobRAT and distinguishes itself by recording the startup time in a file called restart[.]log, while also running GobRAT under the guise of a legitimate process named apached. The script runs at regular intervals and ensures that GobRAT is up and running without interruption, while also keeping track of its execution and startup times.
The Status Monitoring Script is a daemon that checks the status of the Start Script every 20 seconds and ensures the continuous operation of the GobRAT payload. With this script, the attacker can guarantee uninterrupted operation of the GobRAT ransomware.
TLS Communication for Data Transfer
GobRAT utilizes TLS for data communication with the C2 server. The encryption mechanism provides confidentiality, integrity, and authenticity. This means that the attacker can easily transmit sensitive and confidential data over the network without any risk of interception or tampering by network attackers.
GobRAT utilizes 22 commands from the C2 server, which are grouped into communication functions such as frpc, socks5, and C2 reconfiguration. For instance, the frpc function allows the malware to bind to a specific port to receive data from the command-and-control center, facilitating communication between the C2 server and GobRAT malware.
In conclusion, GobRAT is a new RAT that is actively being used in Japan to target Linux routers. We have discussed the methodology and stages of the GobRAT attack, including the multifunctional Loader Script, Start Script, and Daemon Script. It is highly advisable to keep routers updated with the latest security patches and configurations to prevent cyber attacks of any kind.