Stantinko Botnet Now Targeting Linux Servers to Hide Behind Proxies

An adware and coin-miner botnet concentrating on Russia, Ukraine, Belarus, and Kazakhstan at least considering that 2012 has now set its sights on Linux servers to fly less than the radar.

In accordance to a new evaluation published by Intezer now and shared with The Hacker Information, the trojan masquerades as HTTPd, a usually employed method on Linux servers, and is a new model of the malware belonging to a threat actor tracked as Stantinko.

Back again in 2017, ESET researchers comprehensive a significant adware botnet that performs by tricking customers seeking for pirated software package into downloading destructive executables disguised as torrents to install rogue browser extensions that carry out ad injection and click on fraud.

The covert campaign, which controls a extensive army of 50 % a million bots, has considering that received a significant enhance in the form of a crypto-mining module with an purpose to income from desktops less than their control.

Whilst Stantinko has been usually a Windows malware, the expansion in their toolset to goal Linux failed to go unnoticed, with ESET observing a Linux trojan proxy deployed through malicious binaries on compromised servers.

Intezer’s most up-to-date investigate provides refreshing perception into this Linux proxy, particularly a newer edition (v2.17) of the very same malware (v1.2) referred to as “httpd,” with 1 sample of the malware uploaded to VirusTotal on November 7 from Russia.

On execution, “httpd” validates a configuration file located in “etcetera/pd.d/proxy.conf” which is sent alongside with the malware, adhering to it up by producing a socket and a listener to accept connections from what the researchers think are other infected devices.

An HTTP Post ask for from an contaminated consumer paves the way for the proxy to go on the request to an attacker-controlled server, which then responds with an ideal payload which is forwarded by the proxy again to the shopper.

In the party a non-contaminated shopper sends an HTTP Get request to the compromised server, an HTTP 301 redirect to a preconfigured URL specified in the configuration file is sent again.

Stating that the new edition of the malware only capabilities as a proxy, Intezer researchers explained the new variant shares numerous perform names with the previous model and that some hardcoded paths bear similarities to previous Stantinko campaigns.

“Stantinko is the hottest malware concentrating on Linux servers to fly less than the radar, along with threats this kind of as ​Doki​, ​IPStorm​ and ​RansomEXX​,” the company explained. “We feel this malware is section of a broader campaign that will take advantage of compromised Linux servers.”

Located this report fascinating? Comply with THN on Facebook, Twitter  and LinkedIn to read through more distinctive articles we put up.
Some sections of this write-up are sourced from:
thehackernews.com